由浅入深玩转华为WLAN—21 漫游系列(8)不同AC之间三层漫游


三层漫游数据包的过程(隧道转发模式下)

由浅入深玩转华为WLAN—21 漫游系列(8)不同AC之间三层漫游

漫游前数据包的走向
1、STA发送数据报文给HAP
2、HAP通过CAPWAP隧道把报文发送给HAC
3、HAC收到以后把业务报文送给上层设备处理转发


漫游后数据包的走向
1、STA发送数据报文给FAP
2、FAP通过CAPWAP隧道把报文发送给FAC
3、FAC通过AC间的隧道把报文发送给HAC
4、HAC把报文送往上层设备处理转发

可以看到其实数据包最终还是由原来的AC处理,而FAC只是做了个代理通过AC之间的隧道来把数据包交给AC。

三层漫游数据包的过程(直接转发模式下)

由浅入深玩转华为WLAN—21 漫游系列(8)不同AC之间三层漫游

在AC间三层漫游的直接转发比较麻烦,而且处理过程比隧道转发还要多。

漫游前的数据转发
1、STA发送数据包报文给HAP
2、HAP收到以后把数据包交给HAC(如果是旁挂模式,则直接交给对应VLAN的网关设备处理来路由到需要去的目的地)
3、HAC收到以后把数据报文交给上层设备处理转发


漫游后的数据转发
1、STA把数据包转发给FAP
2、FAP收到报文后,交给HAC处理(如果旁挂模式,必须将该业务的数据包由FAC处理,否则漫游后的数据包不通)
3、FAC收到后,把数据包从AC间的隧道发送给HAC
4、HAC收到后,把报文转发给HAP
5、HAP在将数据报文按正常的方式转发

可以看到三层漫游的直接转发非常麻烦,通常情况下,我们理解直接转发的处理过程肯定比隧道转发要简便,但是在三层AC间漫游的过程中,确变得比较复杂,所以在三层AC间漫游的情况下,建议用隧道方式相比更加简单些。

家乡代理的作用

其实可以看到在三层直接转发的模式下相比来说非常繁琐,而家乡代理的作用就是减轻HAP的负担,它可以指定HAC直接转发数据包,省去了FAC把数据包通过隧道发给HAC的时候,在发给HAP做转发的过程。

拓扑介绍

由浅入深玩转华为WLAN—21 漫游系列(8)不同AC之间三层漫游

这里是官方给出的拓扑,这里主要重点在于两边的业务VLAN都是同一个,但是AC_1提供的在192.168.101.0/24网段,而AC_2的网段则提供在192.168.102.0/24网段,VLAN ID相同,但网段不一样,这个其实也是属于三层漫游的。

实际拓扑建议

由浅入深玩转华为WLAN—21 漫游系列(8)不同AC之间三层漫游

实际工作中,建议肯定需要更多的冗余性,核心之间可以通过多条链路做捆绑,然后起VRRP给下面的用户提供网关,而且也可以避免AC单连交换机的时候,该交换机出现故障,导致AC无法提供业务。

说明:这里还是以官方给的拓扑做介绍,ENSP目前无法支持AC间漫游,所以这里无法演示。

Switch_1配置

[SW1] vlan batch 100 101
[SW1] interface gigabitethernet 0/0/1
[SW1-GigabitEthernet0/0/1] port link-type trunk
[SW1-GigabitEthernet0/0/1] port trunk pvid vlan 100
[SW1-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
[SW1-GigabitEthernet0/0/1] quit
[SW1] interface gigabitethernet 0/0/2
[SW1-GigabitEthernet0/0/2] port link-type trunk
[SW1-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101
[SW1-GigabitEthernet0/0/2] quit

Switch_2配置

[SW2] vlan batch 100 101
[SW2] interface gigabitethernet 0/0/1
[SW2-GigabitEthernet0/0/1] port link-type trunk
[SW2-GigabitEthernet0/0/1] port trunk pvid vlan 100
[SW2-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
[SW2-GigabitEthernet0/0/1] quit
[SW2] interface gigabitethernet 0/0/2
[SW2-GigabitEthernet0/0/2] port link-type trunk
[SW2-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101
[SW2-GigabitEthernet0/0/2] quit

AC-1的配置(只包含AP上线以及WLAN业务配置)

[AC_1] dhcp enable
[AC_1] vlan batch 100 101
[AC_1] interface gigabitethernet 0/0/1
[AC_1-GigabitEthernet0/0/1] port link-type trunk
[AC_1-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
[AC_1-GigabitEthernet0/0/1] quit


[AC_1] interface gigabitethernet 0/0/2
[AC_1-GigabitEthernet0/0/2] port link-type trunk
[AC_1-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101
[AC_1-GigabitEthernet0/0/2] quit

[AC_1] interface vlanif 100
[AC_1-vlanif100] ip address 192.168.100.1 255.255.255.0
[AC_1-vlanif100] dhcp select interface
[AC_1-vlanif100] dhcp server excluded-ip-address 192.168.100.2
[AC_1-vlanif100] quit

[AC_1] interface vlanif 101
[AC_1-vlanif101] ip address 192.168.101.1 255.255.255.0
[AC_1-vlanif101] dhcp select interface
[AC_1-vlanif101] quit

[AC_1] interface wlan-ess 1
[AC_1-Wlan-Ess1] port hybrid pvid vlan 101
[AC_1-Wlan-Ess1] port hybrid untagged vlan 101

[AC_1] wlan
[AC_1-wlan-view] wlan ac source interface vlanif 100
[AC_1-wlan-view] ap id 1 type-id 19 mac 60de-4476-e360
[AC_1-wlan-view] wmm-profile name wmm id 1
[AC_1-wlan-wmm-prof-wmm] quit
[AC_1-wlan-view] radio-profile name radio id 1
[AC_1-wlan-radio-prof-radio] wmm-profile name wmm
[AC_1-wlan-radio-prof-radio] quit
[AC_1-wlan-view] security-profile name security id 1
[AC_1-wlan-sec-prof-security] quit
[AC_1-wlan-view] traffic-profile name traffic id 1
[AC_1-wlan-traffic-prof-traffic] quit
[AC_1-wlan-view] service-set name huawei1 id 1
[AC_1-wlan-service-set-huawei1] ssid huawei1
[AC_1-wlan-service-set-huawei1] wlan-ess 1
[AC_1-wlan-service-set-huawei1] security-profile name security
[AC_1-wlan-service-set-huawei1] traffic-profile name traffic
[AC_1-wlan-service-set-huawei1] service-vlan 101
[AC_1-wlan-service-set-huawei1] vlan-mobility-group 101 (必须)
[AC_1-wlan-service-set-huawei1] forward-mode tunnel
[AC_1-wlan-service-set-huawei1] quit

AC-2的配置(只包含AP上线以及WLAN业务配置)

[AC_2] dhcp enable
[AC_2] vlan batch 100 101
[AC_2] interface gigabitethernet 0/0/1
[AC_2-GigabitEthernet0/0/1] port link-type trunk
[AC_2-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 101
[AC_2-GigabitEthernet0/0/1] quit


[AC_2] interface gigabitethernet 0/0/2
[AC_2-GigabitEthernet0/0/2] port link-type trunk
[AC_2-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 101
[AC_2-GigabitEthernet0/0/2] quit

[AC_2] interface vlanif 100
[AC_2-vlanif100] ip address 192.168.100.2 255.255.255.0
[AC_2] interface vlanif 101
[AC_2-vlanif101] ip address 192.168.102.1 255.255.255.0
[AC_2-vlanif101] dhcp select interface

[AC_2] interface wlan-ess 1
[AC_2-Wlan-Ess1] port hybrid pvid vlan 101
[AC_2-Wlan-Ess1] port hybrid untagged vlan 101

[AC_2] wlan
[AC_2-wlan-view] wlan ac source interface vlanif 100
[AC_2-wlan-view] ap id 1 type-id 19 mac 60de-4476-e360
[AC_2-wlan-view] wmm-profile name wmm id 1
[AC_2-wlan-wmm-prof-wmm] quit
[AC_2-wlan-view] radio-profile name radio id 1
[AC_2-wlan-radio-prof-radio] wmm-profile name wmm
[AC_2-wlan-radio-prof-radio] quit
[AC_2-wlan-view] security-profile name security id 1
[AC_2-wlan-sec-prof-security] quit
[AC_2-wlan-view] traffic-profile name traffic id 1
[AC_2-wlan-traffic-prof-traffic] quit
[AC_2-wlan-view] service-set name huawei1 id 1
[AC_2-wlan-service-set-huawei1] ssid huawei1
[AC_2-wlan-service-set-huawei1] wlan-ess 1
[AC_2-wlan-service-set-huawei1] security-profile name security
[AC_2-wlan-service-set-huawei1] traffic-profile name traffic
[AC_2-wlan-service-set-huawei1] service-vlan 101
[AC_2-wlan-service-set-huawei1]forward-mode tunnel
[AC_2-wlan-service-set-huawei1] vlan-mobility-group 102 (必须,而且区分与AC_1)
[AC_2-wlan-service-set-huawei1] quit

漫游功能相关配置

[AC_1] master-controller enable
[AC_1] master controller
[AC_1-master-controller] ac id 1 ip 192.168.100.1
[AC_1-master-controller] ac id 2 ip 192.168.100.2
[AC_1-master-controller] mobility-group name mobility
[AC_1-mc-mg-mobility] member ac id 1
[AC_1-mc-mg-mobility] member ac id 2
说明:AC_1的配置,它作为master controller,然后在controller里面定义了漫游组,属于同一个漫游组的AC之间是可以漫游的。


[AC_2-wlan-view] master-controller ip 192.168.100.1
而AC_2的配置比较简单,只需要指定controller在哪即可,漫游组信息由master告诉其他AC成员。

下发业务给AP

[AC_1] wlan
[AC_1-wlan-view] ap 1 radio 0
[AC_1-wlan-radio-1/0] radio-profile name radio
[AC_1-wlan-radio-1/0] service-set name huawei1
[AC_1-wlan-radio-1/0] quit
[AC_1-wlan-view] commit ap 1
Warning: Committing configuration may cause service interruption,continue?[Y/N]y


[AC_2] wlan
[AC_2-wlan-view] ap 1 radio 0
[AC_2-wlan-radio-1/0] radio-profile name radio
[AC_2-wlan-radio-1/0] service-set name huawei1
[AC_2-wlan-radio-1/0] quit
[AC_2-wlan-view] commit ap 1
Warning: Committing configuration may cause service interruption,continue?[Y/N]y

测试

这里把一个客户端连接到AP_1上后,可以通过命令查看
[AC_1-wlan-view] display station assoc-info all
——————————————————————————
STA MAC AP ID RADIO ID SS ID SSID
——————————————————————————
0025-86aa-0d1c 1 0 1 huawei1
——————————————————————————
Total stations: 1
目前该客户端关联上来了,当把客户端从AP_1移动到AP_2的范围内

[AC_2-wlan-view] display station assoc-info all
——————————————————————————
STA MAC AP ID RADIO ID SS ID SSID
——————————————————————————
0025-86aa-0d1c 1 0 1 huawei1
——————————————————————————
Total stations: 1

这时候AP_2上面已经有关于客户端的信息了。

[AC_2-wlan-view] display station roam-track sta 0025-86aa-0d1c
Access SSID:huawei1 Rx/Tx:Rx-Rate/Tx-Rate Mbps
——————————————————————————
L2/L3 AC IP
AP/Radio BSSID TIME In Rx/Tx RSSI Out Rx/Tx RSSI
——————————————————————————
— 192.168.100.1
1/0 60de-4476-e360 2014/01/03 11:46:12 61/61 -51 46/13 -48
L3 192.168.100.2
1/0 dcd2-fc04-b500 2014/01/03 11:48:17 61/61 -58 -/- –
——————————————————————————
Number of roam track: 1

当然这个模型只是讲解了下三层AC间漫游如何配置,实际环境中并不推荐这样的拓扑,推荐使用下面这样的拓扑结构。
由浅入深玩转华为WLAN—21 漫游系列(8)不同AC之间三层漫游

本文首发于公众号:网络之路博客

上一篇:VRRP协议原理与配置


下一篇:API与ESB 、ServiceMesh、微服务究竟关系如何?