配置VRRP热备份示例（直接转发）
组网图形
图1 配置VRRP热备份组网图（直接转发）
- 业务需求
- 组网需求
- 数据规划
- 配置思路
- 配置注意事项
- 操作步骤
- 配置文件
业务需求
某企业构建了无线局域网，为用户提供WLAN上网服务。现在企业希望采用VRRP热备份的方式提高无线用户的数据传输的可靠性。
组网需求
- AC组网方式：旁挂二层组网。
- DHCP部署方式：AC作为DHCP服务器为AP分配IP地址、交换机集群作为DHCP服务器为STA分配IP地址。
- 业务数据转发方式：直接转发。
- 交换机集群：核心层两台交换机SwitchB和SwitchC采用集群卡集群方式进行组网，其中SwitchB为主交换机，SwitchC为备交换机。
数据规划
配置项 | 数据 |
|---|---|
AC1的源接口 | VLANIF100：10.23.100.1/24 |
AC2的源接口 | VLANIF100：10.23.100.2/24 |
管理VRRP备份组的虚拟IP地址 | 10.23.100.3/24 |
VAP模板 | 名称：wlan-net转发模式：直接转发业务VLAN：VLAN101引用模板：安全模板wlan-net、SSID模板wlan-net |
AP组 | 名称：ap-group1引用模板：VAP模板wlan-net、域管理模板default |
域管理模板 | 名称：default国家码：中国 |
SSID模板 | 名称：wlan-netSSID名称：wlan-net |
安全模板 | 名称：wlan-net安全策略：WPA-WPA2 PSK AES密码：a1234567 |
DHCP服务器 | AC作为DHCP服务器为AP分配地址，交换机集群作为DHCP服务器为STA分配地址 |
AP的网关 | VLANIF100：10.23.100.3/24 |
AP的IP地址池 | 10.23.100.4～10.23.100.254/24 |
STA网关 | VLANIF101：10.23.101.1/24 |
STA的IP地址池 | 10.23.101.2～10.23.101.254/24 |
AC1的主备通道IP地址和端口号 | IP地址：VLANIF102，10.23.102.1/24端口号：10241 |
AC2的主备通道IP地址和端口号 | IP地址：VLANIF102，10.23.102.2/24端口号：10241 |
- 名称：wlan-net
- 转发模式：直接转发
- 业务VLAN：VLAN101
- 引用模板：安全模板wlan-net、SSID模板wlan-net
AP组
- 名称：ap-group1
- 引用模板：VAP模板wlan-net、域管理模板default
域管理模板
- 名称：default
- 国家码：中国
SSID模板
- 名称：wlan-net
- SSID名称：wlan-net
安全模板
- 名称：wlan-net
- 安全策略：WPA-WPA2 PSK AES
- 密码：a1234567
DHCP服务器AC作为DHCP服务器为AP分配地址，交换机集群作为DHCP服务器为STA分配地址AP的网关VLANIF100：10.23.100.3/24AP的IP地址池10.23.100.4～10.23.100.254/24STA网关VLANIF101：10.23.101.1/24STA的IP地址池10.23.101.2～10.23.101.254/24AC1的主备通道IP地址和端口号IP地址：VLANIF102，10.23.102.1/24 端口号：10241AC2的主备通道IP地址和端口号IP地址：VLANIF102，10.23.102.2/24 端口号：10241
配置思路
采用如下的思路配置VRRP热备份：
- 在SwitchB、SwitchC上配置集群卡集群功能，提高核心层可靠性，并使SwitchB成为主交换机。
- 配置AP、AC和其他网络设备之间实现网络互通。
- 配置WLAN基本业务，保证用户能够通过WLAN网络接入Internet。
- 在AC1和AC2上配置VRRP备份组。其中，AC1上配置较高优先级，作为主用设备承担流量转发；AC2上配置较低优先级，作为备用设备。
- 配置双机热备份功能，将AC1上的业务信息通过备份链路批量备份和实时备份到AC2上，保证在主设备故障时业务能够不中断地顺利切换到备份设备。
配置时，用户还需关注有线网络的实际组网是否有环路存在。如果存在环路，需要为相关网元配置MSTP功能。
配置注意事项
- 纯组播报文由于协议要求在无线空口没有ACK机制保障，且无线空口链路不稳定，为了纯组播报文能够稳定发送，通常会以低速报文形式发送。如果网络侧有大量异常组播流量涌入，则会造成无线空口拥堵。为了减小大量低速组播报文对无线网络造成的冲击，建议配置组播报文抑制功能。配置前请确认是否有组播业务，如果有，请谨慎配置限速值。
- 业务数据转发方式采用直接转发时，建议在直连AP的交换机接口上配置组播报文抑制。
- 业务数据转发方式采用隧道转发时，建议在AC的流量模板下配置组播报文抑制。
- 建议在与AP直连的设备接口上配置端口隔离，如果不配置端口隔离，尤其是业务数据转发方式采用直接转发时，可能会在VLAN内形成大量不必要的广播报文，导致网络阻塞，影响用户体验。
- 隧道转发模式下，管理VLAN和业务VLAN不能配置为同一VLAN，且AP和AC之间只能放通管理VLAN，不能放通业务VLAN。
- VRRP热备份组网中，部署在主备AC上的DHCP地址池配置要保持一致。例如主备AC上不参与自动分配的IP地址范围必须保持一致。
操作步骤
代码语言：javascript复制配置集群卡集群功能
# 配置SwitchB的集群连接方式为集群卡集群，集群ID为1，集群优先级为100。
<HUAWEI> system-view
[HUAWEI] sysname SwitchB
[SwitchB] set css mode css-card
[SwitchB] set css id 1
[SwitchB] set css priority 100
# 配置SwitchC的集群连接方式为集群卡集群，集群ID为2，集群优先级为10。
<HUAWEI> system-view
[HUAWEI] sysname SwitchC
[SwitchC] set css mode css-card
[SwitchC] set css id 2
[SwitchC] set css priority 10
# 查看SwitchB上的集群配置信息。
[SwitchB] display css status saved
Current Id Saved Id CSS Enable CSS Mode Priority Master force
------------------------------------------------------------------------------
1 1 Off CSS card 100 Off
# 查看SwitchC上的集群配置信息。
[SwitchC] display css status saved
Current Id Saved Id CSS Enable CSS Mode Priority Master force
------------------------------------------------------------------------------
1 2 Off CSS card 10 Off
# 使能SwitchB的集群功能并重新启动SwitchB。
[SwitchB] css enable
Warning: The CSS configuration will take effect only after the system is rebooted. T
he next CSS mode is CSS card. Reboot now? [Y/N]:y
# 使能SwitchC的集群功能并重新启动SwitchC。
[SwitchC] css enable
Warning: The CSS configuration will take effect only after the system is rebooted. T
he next CSS mode is CSS card. Reboot now? [Y/N]:y
# 通过任意主控板上的Console口本地登录集群，使用命令行查看集群组建是否成功。
<SwitchB> display device
Chassis 1 (Master Switch)
S12708's Device status:
Slot Sub Type Online Power Register Status Role
-------------------------------------------------------------------------------
1 - ET1D2SFUD000 Present PowerOn Registered Normal NA
1 EH1D2VS08000 Present PowerOn Registered Normal NA
5 - ET1D2G48SEC0 Present PowerOn Registered Normal NA
7 - ET1D2X16SSC0 Present PowerOn Registered Normal NA
9 - ET1D2MPUA000 Present PowerOn Registered Normal Slave
10 - ET1D2MPUA000 Present PowerOn Registered Normal Master
12 - ET1D2SFUD000 Present PowerOn Registered Normal NA
1 EH1D2VS08000 Present PowerOn Registered Normal NA
13 - ET1D2SFUD000 Present PowerOn Registered Normal NA
1 EH1D2VS08000 Present PowerOn Registered Normal NA
14 - ET1D2SFUD000 Present PowerOn Registered Normal NA
1 EH1D2VS08000 Present PowerOn Registered Normal NA
PWR1 - - Present PowerOn Registered Normal NA
PWR2 - - Present PowerOn Registered Normal NA
CMU2 - EH1D200CMU00 Present PowerOn Registered Normal Master
FAN1 - - Present PowerOn Registered Normal NA
FAN2 - - Present PowerOn Registered Normal NA
FAN3 - - Present PowerOn Registered Normal NA
FAN4 - - Present PowerOn Registered Normal NA
Chassis 2 (Standby Switch)
S12708's Device status:
Slot Sub Type Online Power Register Status Role
-------------------------------------------------------------------------------
1 - ET1D2SFUD000 Present PowerOn Registered Normal NA
1 EH1D2VS08000 Present PowerOn Registered Normal NA
3 - ET1D2G48SEC0 Present PowerOn Registered Normal NA
4 - ET1D2X16SSC0 Present PowerOn Registered Normal NA
9 - ET1D2MPUA000 Present PowerOn Registered Normal Slave
10 - ET1D2MPUA000 Present PowerOn Registered Normal Master
12 - ET1D2SFUD000 Present PowerOn Registered Normal NA
1 EH1D2VS08000 Present PowerOn Registered Normal NA
13 - ET1D2SFUD000 Present PowerOn Registered Normal NA
1 EH1D2VS08000 Present PowerOn Registered Normal NA
14 - ET1D2SFUD000 Present PowerOn Registered Normal NA
1 EH1D2VS08000 Present PowerOn Registered Normal NA
PWR1 - - Present PowerOn Registered Normal NA
PWR2 - - Present PowerOn Registered Normal NA
CMU1 - EH1D200CMU00 Present PowerOn Registered Normal Master
FAN1 - - Present PowerOn Registered Normal NA
FAN2 - - Present PowerOn Registered Normal NA
FAN3 - - Present PowerOn Registered Normal NA
FAN4 - - Present PowerOn Registered Normal NA
<SwitchB> display css status
CSS Enable switch On
Chassis Id CSS Enable CSS Status CSS Mode Priority Master Force
------------------------------------------------------------------------------
1 On Master CSS card 100 Off
2 On Standby CSS card 10 Off
以上显示信息中，能够查看到两台成员交换机的单板状态及集群状态，表示集群建立完成。
# 查看集群链路状态是否正常。
<SwitchB> display css channel
Chassis 1 || Chassis 2
--------------------------------------------------------------------------------
Num [Port] [Speed] || [Speed] [Port]
1 1/1/0/1 10G 10G 2/1/0/1
2 1/1/0/2 10G 10G 2/1/0/2
3 1/1/0/3 10G 10G 2/1/0/3
4 1/1/0/4 10G 10G 2/1/0/4
5 1/1/0/5 10G 10G 2/1/0/5
6 1/1/0/6 10G 10G 2/1/0/6
7 1/1/0/7 10G 10G 2/1/0/7
8 1/1/0/8 10G 10G 2/1/0/8
9 1/12/0/1 10G 10G 2/12/0/1
10 1/12/0/2 10G 10G 2/12/0/2
11 1/12/0/3 10G 10G 2/12/0/3
12 1/12/0/4 10G 10G 2/12/0/4
13 1/12/0/5 10G 10G 2/12/0/5
14 1/12/0/6 10G 10G 2/12/0/6
15 1/12/0/7 10G 10G 2/12/0/7
16 1/12/0/8 10G 10G 2/12/0/8
17 1/13/0/1 10G 10G 2/13/0/1
18 1/13/0/2 10G 10G 2/13/0/2
19 1/13/0/3 10G 10G 2/13/0/3
20 1/13/0/4 10G 10G 2/13/0/4
21 1/13/0/5 10G 10G 2/13/0/5
22 1/13/0/6 10G 10G 2/13/0/6
23 1/13/0/7 10G 10G 2/13/0/7
24 1/13/0/8 10G 10G 2/13/0/8
25 1/14/0/1 10G 10G 2/14/0/1
26 1/14/0/2 10G 10G 2/14/0/2
27 1/14/0/3 10G 10G 2/14/0/3
28 1/14/0/4 10G 10G 2/14/0/4
29 1/14/0/5 10G 10G 2/14/0/5
30 1/14/0/6 10G 10G 2/14/0/6
31 1/14/0/7 10G 10G 2/14/0/7
32 1/14/0/8 10G 10G 2/14/0/8
--------------------------------------------------------------------------------
以上显示信息中，所有集群连接的链路都显示正常，至此可以说明集群组建完全成功。配置SwitchA、SwitchB、SwitchC、AC1和AC2，使AP与AC之间能够传输CAPWAP报文
当用户的数据转发方式为直接转发，建议在SwitchA连接AP的接口GE0/0/1上配置端口隔离，如果不配置端口隔离，可能会在VLAN内存在不必要的广播报文，或者导致不同AP间的WLAN用户二层互通。
# 配置SwitchA连接AP的接口GE0/0/1的PVID为VLAN100（管理VLAN）并加入VLAN100和VLAN101（业务VLAN），SwitchA连接SwitchB的接口GE0/0/2和SwitchA连接SwitchC的接口GE0/0/3加入Eth-Trunk10。
<HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan batch 100 101
[SwitchA] interface gigabitethernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] port link-type trunk
[SwitchA-GigabitEthernet0/0/1] port trunk pvid vlan 100
[SwitchA-GigabitEthernet0/0/1] undo port trunk allow-pass vlan 1
[SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
[SwitchA-GigabitEthernet0/0/1] port-isolate enable
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface eth-trunk 10
[SwitchA-Eth-Trunk10] port link-type trunk
[SwitchA-Eth-Trunk10] undo port trunk allow-pass vlan 1
[SwitchA-Eth-Trunk10] port trunk allow-pass vlan 100 101
[SwitchA-Eth-Trunk10] quit
[SwitchA] interface gigabitethernet 0/0/2
[SwitchA-GigabitEthernet0/0/2] undo port link-type
[SwitchA-GigabitEthernet0/0/2] eth-trunk 10
[SwitchA-GigabitEthernet0/0/2] quit
[SwitchA] interface gigabitethernet 0/0/3
[SwitchA-GigabitEthernet0/0/3] undo port link-type
[SwitchA-GigabitEthernet0/0/3] eth-trunk 10
[SwitchA-GigabitEthernet0/0/3] quit
# 配置SwitchB的接口GE1/1/0/2和SwitchC的接口GE2/1/0/2加入Eth-Trunk10，SwitchB的接口E1/1/0/1和SwitchC的接口GE2/1/0/1加入VLAN100。
[SwitchB] sysname CSS
[CSS] vlan batch 100 101
[CSS] interface gigabitethernet 1/1/0/1
[CSS-GigabitEthernet1/1/0/1] port link-type trunk
[CSS-GigabitEthernet1/1/0/1] undo port trunk allow-pass vlan 1
[CSS-GigabitEthernet1/1/0/1] port trunk allow-pass vlan 100
[CSS-GigabitEthernet1/1/0/1] quit
[CSS] interface gigabitethernet 2/1/0/1
[CSS-GigabitEthernet2/1/0/1] port link-type trunk
[CSS-GigabitEthernet2/1/0/1] undo port trunk allow-pass vlan 1
[CSS-GigabitEthernet2/1/0/1] port trunk allow-pass vlan 100
[CSS-GigabitEthernet2/1/0/1] quit
[CSS] interface eth-trunk 10
[CSS-Eth-Trunk10] port link-type trunk
[CSS-Eth-Trunk10] undo port trunk allow-pass vlan 1
[CSS-Eth-Trunk10] port trunk allow-pass vlan 100 101
[CSS-Eth-Trunk10] quit
[CSS] interface gigabitethernet 1/1/0/2
[CSS-GigabitEthernet1/1/0/2] undo port link-type
[CSS-GigabitEthernet1/1/0/2] eth-trunk 10
[CSS-GigabitEthernet1/1/0/2] quit
[CSS] interface gigabitethernet 2/1/0/2
[CSS-GigabitEthernet2/1/0/2] undo port link-type
[CSS-GigabitEthernet2/1/0/2] eth-trunk 10
[CSS-GigabitEthernet2/1/0/2] quit
# 配置AC1连接SwitchB的接口GE0/0/1加入VLAN100，并配置VLANIF100。
<HUAWEI> system-view
[HUAWEI] sysname AC1
[AC1] vlan batch 100 101
[AC1] interface gigabitethernet 0/0/1
[AC1-GigabitEthernet0/0/1] port link-type trunk
[AC1-GigabitEthernet0/0/1] undo port trunk allow-pass vlan 1
[AC1-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
[AC1-GigabitEthernet0/0/1] quit
[AC1] interface vlanif 100
[AC1-Vlanif100] ip address 10.23.100.1 24
[AC1-Vlanif100] quit
# 配置AC2连接SwitchC的接口GE0/0/1加入VLAN100，并配置VLANIF100。
<HUAWEI> system-view
[HUAWEI] sysname AC2
[AC2] vlan batch 100 101
[AC2] interface gigabitethernet 0/0/1
[AC2-GigabitEthernet0/0/1] port link-type trunk
[AC2-GigabitEthernet0/0/1] undo port trunk allow-pass vlan 1
[AC2-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
[AC2-GigabitEthernet0/0/1] quit
[AC2] interface vlanif 100
[AC2-Vlanif100] ip address 10.23.100.2 24
[AC2-Vlanif100] quit配置AC1和AC2互通
# 配置AC1连接AC2的接口GE0/0/2加入VLAN102。
[AC1] vlan batch 102
[AC1] interface gigabitethernet 0/0/2
[AC1-GigabitEthernet0/0/2] port link-type trunk
[AC1-GigabitEthernet0/0/2] undo port trunk allow-pass vlan 1
[AC1-GigabitEthernet0/0/2] port trunk allow-pass vlan 102
[AC1-GigabitEthernet0/0/2] quit
[AC1] interface vlanif 102
[AC1-Vlanif102] ip address 10.23.102.1 24
[AC1-Vlanif102] quit
# 配置AC2连接AC1的接口GE0/0/2加入VLAN102。
[AC2] vlan batch 102
[AC2] interface gigabitethernet 0/0/2
[AC2-GigabitEthernet0/0/2] port link-type trunk
[AC2-GigabitEthernet0/0/2] undo port trunk allow-pass vlan 1
[AC2-GigabitEthernet0/0/2] port trunk allow-pass vlan 102
[AC2-GigabitEthernet0/0/2] quit
[AC2] interface vlanif 102
[AC2-Vlanif102] ip address 10.23.102.2 24
[AC2-Vlanif102] quit配置DHCP服务器
DNS服务器地址请根据实际需要配置。常用配置方法如下：
接口地址池场景，需要在VLANIF接口视图下执行命令dhcp server dns-list ip-address &<1-8>。
全局地址池场景，需要在IP地址池视图下执行命令dns-list ip-address &<1-8>。
# 配置AC1作为DHCP服务器为AP分配IP地址。 10.23.100.1已分配给主AC，10.23.100.2已分配给备AC，10.23.100.3已分配给VRRP虚地址，需要在主备AC的接口地址池中配置为不参与自动分配的IP地址。
[AC1] dhcp enable
[AC1] dhcp server database enable
[AC1] dhcp server database recover
[AC1] interface vlanif 100
[AC1-Vlanif100] dhcp select interface
[AC1-Vlanif100] dhcp server excluded-ip-address 10.23.100.1 10.23.100.3
[AC1-Vlanif100] quit
# AC2的配置与AC1相同。
# 配置CSS作为DHCP服务器为STA分配IP地址。
[CSS] dhcp enable
[CSS] interface vlanif 101
[CSS-Vlanif101] ip address 10.23.101.1 24
[CSS-Vlanif101] dhcp select interface
[CSS-Vlanif101] quit
在AC1上配置VRRP方式的双机热备份
# 配置VRRP备份组的状态恢复延迟时间为60秒。
[AC1] vrrp recover-delay 60
# 在AC1上创建管理VRRP备份组，配置AC1在该备份组中的优先级为120，并配置抢占时间为1800秒。
[AC1] interface vlanif 100
[AC1-Vlanif100] vrrp vrid 1 virtual-ip 10.23.100.3
[AC1-Vlanif100] vrrp vrid 1 priority 120
[AC1-Vlanif100] vrrp vrid 1 preempt-mode timer delay 1800
[AC1-Vlanif100] admin-vrrp vrid 1
[AC1-Vlanif100] quit
# 在AC1上创建HSB主备服务0，并配置其主备通道IP地址和端口号，配置HSB主备服务报文的重传次数和发送间隔。
[AC1] hsb-service 0
[AC1-hsb-service-0] service-ip-port local-ip 10.23.102.1 peer-ip 10.23.102.2 local-data-port 10241 peer-data-port 10241
[AC1-hsb-service-0] service-keep-alive detect retransmit 3 interval 6
[AC1-hsb-service-0] quit
# 在AC1上创建HSB备份组0，并配置其绑定HSB主备服务0和管理VRRP备份组。
[AC1] hsb-group 0
[AC1-hsb-group-0] bind-service 0
[AC1-hsb-group-0] track vrrp vrid 1 interface vlanif 100
[AC1-hsb-group-0] quit
# 配置NAC业务绑定HSB备份组。
[AC1] hsb-service-type access-user hsb-group 0
# 配置WLAN业务绑定HSB备份组。
[AC1] hsb-service-type ap hsb-group 0
# 配置DHCP业务绑定HSB备份组。
[AC1] hsb-service-type dhcp hsb-group 0
# 使能双机热备功能。
[AC1] hsb-group 0
[AC1-hsb-group-0] hsb enable
[AC1-hsb-group-0] quit
在AC2上配置VRRP方式的双机热备份
# 配置VRRP备份组的状态恢复延迟时间为60秒。
[AC2] vrrp recover-delay 60
# 在AC2上创建管理VRRP备份组。
[AC2] interface vlanif 100
[AC2-Vlanif100] vrrp vrid 1 virtual-ip 10.23.100.3
[AC2-Vlanif100] admin-vrrp vrid 1
[AC2-Vlanif100] quit
# 在AC2上创建HSB主备服务0，并配置其主备通道IP地址和端口号，配置HSB主备服务报文的重传次数和发送间隔。
[AC2] hsb-service 0
[AC2-hsb-service-0] service-ip-port local-ip 10.23.102.2 peer-ip 10.23.102.1 local-data-port 10241 peer-data-port 10241
[AC2-hsb-service-0] service-keep-alive detect retransmit 3 interval 6
[AC2-hsb-service-0] quit
# 在AC2上创建HSB备份组0，并配置其绑定HSB主备服务0和管理VRRP备份组。
[AC2] hsb-group 0
[AC2-hsb-group-0] bind-service 0
[AC2-hsb-group-0] track vrrp vrid 1 interface vlanif 100
[AC2-hsb-group-0] quit
# 配置NAC业务绑定HSB备份组。
[AC2] hsb-service-type access-user hsb-group 0
# 配置WLAN业务绑定HSB备份组。
[AC2] hsb-service-type ap hsb-group 0
# 配置DHCP业务绑定HSB备份组。
[AC2] hsb-service-type dhcp hsb-group 0
配置AC1的WLAN业务，AC2的配置与之类似。注意AP在主AC上状态为normal时，在AC2上的状态为standby
配置AC1的系统参数。
[AC1] wlan
[AC1-wlan-view] ap-group name ap-group1
[AC1-wlan-ap-group-ap-group1] quit
[AC1-wlan-view] regulatory-domain-profile name default
[AC1-wlan-regulate-domain-default] country-code cn
[AC1-wlan-regulate-domain-default] quit
[AC1-wlan-view] ap-group name ap-group1
[AC1-wlan-ap-group-ap-group1] regulatory-domain-profile default
Warning: Modifying the country code will clear channel, power and antenna gain configurations of the radio and reset the AP. Continue?[Y/N]:y
[AC1-wlan-ap-group-ap-group1] quit
[AC1-wlan-view] quit
[AC1] capwap source ip-address 10.23.100.3
在AC1上离线导入AP。
[AC1] wlan
[AC1-wlan-view] ap auth-mode mac-auth
[AC1-wlan-view] ap-id 0 ap-mac 00e0-fc76-e360
[AC1-wlan-ap-0] ap-name area_1
[AC1-wlan-ap-0] ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y
[AC1-wlan-ap-0] quit
[AC1-wlan-view] display ap all
Total AP information:
nor : normal [1]
Extra information: P : insufficient power supply
--------------------------------------------------------------------------------------------------
ID MAC Name Group IP Type State STA Uptime ExtraInfo
--------------------------------------------------------------------------------------------------
0 00e0-fc76-e360 area_1 ap-group1 10.23.100.254 AP5030DN nor 0 10S -
--------------------------------------------------------------------------------------------------
Total: 1
配置AC1的WLAN业务参数。
# 创建名为“wlan-net”的安全模板，并配置安全策略。
举例中以配置WPA-WPA2 PSK AES的安全策略为例，密码为“a1234567”，实际配置中请根据实际情况，配置符合实际要求的安全策略。
[AC1-wlan-view] security-profile name wlan-net
[AC1-wlan-sec-prof-wlan-net] security wpa-wpa2 psk pass-phrase a1234567 aes
[AC1-wlan-sec-prof-wlan-net] quit
# 创建名为“wlan-net”的SSID模板，并配置SSID名称为“wlan-net”。
[AC1-wlan-view] ssid-profile name wlan-net
[AC1-wlan-ssid-prof-wlan-net] ssid wlan-net
[AC1-wlan-ssid-prof-wlan-net] quit
# 创建名为“wlan-net”的VAP模板，配置业务数据转发模式、业务VLAN，并且引用安全模板和SSID模板。
[AC1-wlan-view] vap-profile name wlan-net
[AC1-wlan-vap-prof-wlan-net] forward-mode direct-forward
[AC1-wlan-vap-prof-wlan-net] service-vlan vlan-id 101
[AC1-wlan-vap-prof-wlan-net] security-profile wlan-net
[AC1-wlan-vap-prof-wlan-net] ssid-profile wlan-net
[AC1-wlan-vap-prof-wlan-net] quit
# 配置AP组引用VAP模板，AP上射频0和射频1都使用VAP模板“wlan-net”的配置。
[AC1-wlan-view] ap-group name ap-group1
[AC1-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 0
[AC1-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 1
[AC1-wlan-ap-group-ap-group1] quit
[AC1-wlan-view] quit
在AC2上开启双机热备功能
# 开启双机热备功能。
[AC2] hsb-group 0
[AC2-hsb-group-0] hsb enable
[AC2-hsb-group-0] quit
检查配置结果
# 完成上述配置以后，在AC1和AC2上分别执行display vrrp命令，可以看到AC1的State字段的显示为Master，AC2的State字段的显示为Backup。
[AC1] display vrrp
Vlanif100 | Virtual Router 1
State : Master
Virtual IP : 10.23.100.3
Master IP : 10.23.100.1
PriorityRun : 120
PriorityConfig : 120
MasterPriority : 120
Preempt : YES Delay Time : 1800 s
TimerRun : 2 s
TimerConfig : 2 s
Auth type : NONE
Virtual MAC : 0000-5e00-0101
Check TTL : YES
Config type : admin-vrrp
Backup-forward : disabled
Create time : 2005-07-31 01:25:55 UTC 08:00
Last change time : 2005-07-31 02:48:22 UTC 08:00
[AC2] display vrrp
Vlanif100 | Virtual Router 1
State : Backup
Virtual IP : 10.23.100.3
Master IP : 10.23.100.1
PriorityRun : 100
PriorityConfig : 100
MasterPriority : 120
Preempt : YES Delay Time : 0 s
TimerRun : 2 s
TimerConfig : 2 s
Auth type : NONE
Virtual MAC : 0000-5e00-0101
Check TTL : YES
Config type : admin-vrrp
Backup-forward : disabled
Create time : 2005-07-31 02:11:07 UTC 08:00
Last change time : 2005-07-31 03:40:45 UTC 08:00
# 在AC1和AC2上执行display hsb-service 0命令，查看主备服务的建立情况。可以看到Service State字段的显示为Connected，说明主备服务通道已经成功建立。
[AC1] display hsb-service 0
Hot Standby Service Information:
----------------------------------------------------------
Local IP Address : 10.23.102.1
Peer IP Address : 10.23.102.2
Source Port : 10241
Destination Port : 10241
Keep Alive Times : 2
Keep Alive Interval : 1
Service State : Connected
Service Batch Modules :
Shared-key : -
----------------------------------------------------------
[AC2] display hsb-service 0
Hot Standby Service Information:
----------------------------------------------------------
Local IP Address : 10.23.102.2
Peer IP Address : 10.23.102.1
Source Port : 10241
Destination Port : 10241
Keep Alive Times : 2
Keep Alive Interval : 1
Service State : Connected
Service Batch Modules :
Shared-key : -
----------------------------------------------------------
# 在AC1和AC2上执行display hsb-group 0命令，查看HSB备份组的运行情况。
[AC1] display hsb-group 0
Hot Standby Group Information:
----------------------------------------------------------
HSB-group ID : 0
Vrrp Group ID : 1
Vrrp Interface : Vlanif100
Service Index : 0
Group Vrrp Status : Master
Group Status : Active
Group Backup Process : Realtime
Peer Group Device Name : AC2
Peer Group Software Version : V200R019C10
Group Backup Modules : Access-user
DHCP
AP
----------------------------------------------------------
[AC2] display hsb-group 0
Hot Standby Group Information:
----------------------------------------------------------
HSB-group ID : 0
Vrrp Group ID : 1
Vrrp Interface : Vlanif100
Service Index : 0
Group Vrrp Status : Backup
Group Status : Inactive
Group Backup Process : Realtime
Peer Group Device Name : AC1
Peer Group Software Version : V200R019C10
Group Backup Modules : Access-user
DHCP
AP
----------------------------------------------------------
# AP下的无线接入用户可以搜索到SSID标识为“wlan-net”的WLAN网络并正常上线。
# 通过重启主AC的方式，模拟主AC故障的场景，验证备份配置。重启AC1，当AP与AC1的链路中断后，AC2切换为主AC，保证业务的稳定。
重启AC前，请执行命令save保存AC上的配置文件，以免重启后配置丢失。
# AC1重启期间，STA上业务不中断。AP切换到AC2上线，在AC2上执行命令display ap all可以查看AP的状态由standby变为normal。
# AC1重启恢复正常，触发主备回切后，AP会自动重新到AC1正常上线。
配置文件
SwitchA的配置文件
#
sysname SwitchA
#
vlan batch 100 to 101
#
interface Eth-Trunk10
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk pvid vlan 100
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 100 to 101
port-isolate enable group 1
#
interface GigabitEthernet0/0/2
eth-trunk 10
#
interface GigabitEthernet0/0/3
eth-trunk 10
#
return
集群系统的配置文件
#
sysname CSS
#
vlan batch 100 to 101
#
dhcp enable
#
interface Vlanif101
ip address 10.23.101.1 255.255.255.0
dhcp select interface
#
interface Eth-Trunk10
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet1/1/0/1
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 100
#
interface GigabitEthernet1/1/0/2
eth-trunk 10
#
interface GigabitEthernet2/1/0/1
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 100
#
interface GigabitEthernet2/1/0/2
eth-trunk 10
#
return
AC1我正在参与2024腾讯技术创作特训营第五期有奖征文，快来和我瓜分大奖！
