BACKGROUND
This guide shows how to configure a Huawei device with the Access Points running firmware Fit AP_Model_V200R006C10SPC800
Please note that the images contained in this article may contain outdated configuration data. Therefore, please check the data contained in the article "Configuration Parameters" at the bottom of the page, as they are certainly up to date.
PREREQUISITES
The configuration procedure has been performed and tested on Huawei Access Controller AC6005-8-PWR running firmware VRP (R) software, Version 5.130 (AC6005 V200R006C10) and Access Point AP5030DN running firmware FitAP5X30XN_V200R006C10SPC800.
Before integrating the Access Controller with IPERA Starling, it is necessary that it is connected to the Internet and reachable on the network and has open the UDP port 2000.
This guide will refer to the Access Controller AC6005 and the network architecture in the picture below.
In this case:
Network 1 includes the Access Controller
Network 2 includes the Access Points, any switch or any client
For all other network topologies, please contact Huawei support or read the Huawei documentation available their site: http://support.huawei.com/.
ACCESSING THE DEVICE
By default, the Access Controller has the following IP address: 169.254.1.1. You can manage and configure the AC by Telnet or by opening a web browser, visiting the following URL: http://169.254.1.1 and logging in as the admin user with a default password admin@huawei.com. This guide will drive the configuration based on CLI.
Network 1 (AC)
Ethernet interfaces and VLANs
Configure a Service VLAN and the CapWap source IP address (in this example is the IP address configured in Vlan150) on the GigabitEthernet interface attached to your default gateway (GigabitEthernet0/0/1).
Configure a management VLAN. (Management of APs - Vlan30).
Configure the CapWap source to your public IP address of the AC 6005.
Configure a tagged VLAN. (Service for the STAs - Vlan200)
In Telnet session, we start to configure the VLAN interface GigabitEthernet 0/0/1 as following:
<AC-6005>system-view
Enter system view, return user view with Ctrl+Z.
Change the system name to the public IP address of the AC 6005. This is a mandatory step and the name of the controller needs to be its public IP address. If AC controller uses private IP address, then you need to provide public IP address after NATting.
[AC-6005]sysname 151.0.208.150
# VLAN / Capwap source (public IP address of the AC 6005)
[151.0.208.150]interface vlanif 150
[151.0.208.150-Vlanif150]description public-ip-AC
[151.0.208.150-Vlanif150]ip address 151.0.208.150 29
[151.0.208.150-Vlanif150]quit
# Service VLAN with the address pool of the STAs (Client devices will connect to AP)
[151.0.208.150]interface vlanif 200
[151.0.208.150-Vlanif200]description service-VLAN
[151.0.208.150-Vlanif200]ip address 192.168.50.1 24
[151.0.208.150-Vlanif200]quit
# Management VLAN (IP pool for APs)
[151.0.208.150]interface vlanif 30
[151.0.208.150-Vlanif30]description Management-VLAN
[151.0.208.150-Vlanif30]ip address 192.168.30.1 24
[151.0.208.150-Vlanif30]quit
# Associate the VLAN created to interface GigabitEthernet 0/0/1
[151.0.208.150]interface GigabitEthernet0/0/1
[151.0.208.150-GigabitEthernet0/0/1]port hybrid pvid vlan 150
[151.0.208.150-GigabitEthernet0/0/1]port hybrid tagged vlan 200
[151.0.208.150-GigabitEthernet0/0/1]port hybrid untagged vlan 30 150
[151.0.208.150-GigabitEthernet0/0/1]quit
[151.0.208.150]vlan batch 30, 150, 200
# Capwap source is the public IP address of the AC
[151.0.208.150]capwap source ip-address 151.0.208.150
# Add the default gateway of the AC. In this case 151.0.208.145
[151.0.208.150]ip route-static 0.0.0.0 0.0.0.0 151.0.208.145
[151.0.208.150]quit
<151.0.208.150>save
# Verify the portal version of the AC
[151.0.208.150]undo web-auth-server version
The Portal version on the AC should be set to Ver 1. If the AC is running on different version then you can execute the following command.
CONFIGURING ACL AND FREE-RULES (WALLED GARDEN)
Security consideration: To permit the connections between the Portal Server and the Access Controller, it's necessary the AC is reachable from the Internet and have open the UDP port 2000 (check your firewall configuration guide).
# Free domains
[151.0.208.150]passthrough-domain name *.iperawifi.com id 1
# Example to configure free domains for facebook login
[151.0.208.150]passthrough-domain name *.facebook.com id 2
[151.0.208.150]passthrough-domain name *.facebook.net id 3
[151.0.208.150]passthrough-domain name *.akamaihd.net id 4
[151.0.208.150]passthrough-domain name *.fcbn.net id 5
# ACL
[151.0.208.150]acl number 6000
[151.0.208.150]rule 4 permit ip destination 8.8.8.8 0
[151.0.208.150]rule 5 permit udp source 0.0.0.0 0 destination-port eq dns
[151.0.208.150]rule 39 permit tcp destination passthrough-domain *.IPERA Starling.com
[151.0.208.150]rule 40 permit tcp destination passthrough-domain *.facebook.com
[151.0.208.150]rule 41 permit tcp destination passthrough-domain *.facebook.net
[151.0.208.150]rule 42 permit tcp destination passthrough-domain *.fbcdn.net
# RADIUS server
[151.0.208.150]rule 6 permit ip destination 35.156.39.198 0
[151.0.208.150]rule 7 permit ip destination 35.156.23.166 0
# Create a free rule template
[151.0.208.150]free-rule-template name free1
[151.0.208.150-free-rule-free1]free-rule acl 6000
It is mandatory to add the following domains to ACL
- engage.iperawifi.com
- static.iperawifi.com
If you wish to support social network logins, you need to add rules for domains below for each network you plan to support
|
|
login.microsoftonline.com | accounts.google.com | |
| aadcdn.msauth.net | www.google.com | ||
| login.live.com | fonts.gstatic.com | ||
| akamaihd.net | play.google.com | ||
| aadcdn.msftauth.net | ssl.gstatic.com | ||
| www.facebook.com | accounts.youtube.com | ||
| www.facebook.net | accounts.google.com | ||
| static.xx.fbcdn.net | TikTok (**) | *.tiktok.com | |
| api.twitter.com | firebaseinstallations.googleapis.com | ||
| abs-0.twimg.com | storage.googleapis.com | ||
| pbs.twimg.com | *.ibytedtos.com | ||
|
|
www.linkedin.com | *.tiktokv.com | |
| static.licdn.com | open-api.tiktok.com | ||
| media.licdn.com | www.tiktok.com | ||
| ponf.linkedin.com | *.ttwstatic.com | ||
| platform.linkedin.com | *.tiktokcdn.com | ||
| Apple | www.apple.com | ||
| appleid.apple.com | |||
| appleid.cdn-apple.com | |||
| is4-ssl.mzstatic.com | |||
(*) Please refer to the below URL if you wish to use Microsoft login method
https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/review-admin-consent-requests
(**) Google, Facebook, Twitter, and Apple should be also added for TikTok
CONFIGURING RADIUS SERVER TEMPLATE
[151.0.208.150]radius-server template radius
# IPERA Starling RADIUS server IPs: 35.156.39.198 & 35.156.23.166
authentication port: 1812, accounting port:1813
[151.0.208.150-radius]radius-server shared-key
IPERA Support team will provide the shared-key
[151.0.208.150-radius]radius-server authentication 35.156.39.198 1812
[151.0.208.150-radius]radius-server accounting 35.156.39.198 1813
Repeat the same for 35.156.23.166 also
[151.0.208.150-radius]radius-server user-name domain-included
[151.0.208.150-radius]quit
[151.0.208.150]aaa
[151.0.208.150-aaa]authentication-scheme radius
[151.0.208.150-aaa-authen-radius]authentication-mode radius
[151.0.208.150-aaa-authen-radius]quit
[151.0.208.150-aaa]authorization-scheme radius
[151.0.208.150-aaa-author-radius]authorization-mode if-authenticated
[151.0.208.150-aaa-author-radius]quit
[151.0.208.150-aaa]accounting-scheme radius
[151.0.208.150-aaa-accounting-radius]accounting-mode radius
[151.0.208.150-aaa-accounting-radius]accounting realtime 900
[151.0.208.150-aaa-accounting-radius]quit
[151.0.208.150-aaa]domain d1
[151.0.208.150-aaa-domain-d1]authentication-scheme radius
[151.0.208.150-aaa-domain-d1]authorization-scheme radius
[151.0.208.150-aaa-domain-d1]accounting-scheme radius
[151.0.208.150-aaa-domain-d1]radius-server radius
CONFIGURING URL TEMPLATE AND AUTHENTICATION PROFILE
[151.0.208.150]url-template name u1
[151.0.208.150-url-template-u1]url https://engage.iperawifi.com/onboarding
# Uam parameters
[151.0.208.150-url-template-u1]url-parameter user-ipaddress wlanuserip ac-ip wlanacip ac-mac wlanacmac ap-ip wlanapip ap-mac ap-mac redirect-url switch_url ssid ssid sysname wlanacname user-mac user-mac
[151.0.208.150-url-template-u1]quit
[151.0.208.150]web-auth-server web
[151.0.208.150-web-auth-server-web]server-ip 35.156.56.30 (IPERA Starling splash portal IP)
[151.0.208.150-web-auth-server-web]port 50100 (default port communication between AC-Portal)
[151.0.208.150-web-auth-server-web]url-template u1
[151.0.208.150-web-auth-server-web]source-ip 151.0.208.150
[151.0.208.150-web-auth-server-web]quit
[151.0.208.150]portal-access-profile name portal
[151.0.208.150-portal-access-profile-portal]web-auth-server web direct
[151.0.208.150-portal-access-profile-portal]quit
[151.0.208.150]authentication-profile name portal
[151.0.208.150-authentication-profile-portal]portal-access-profile portal
[151.0.208.150-authentication-profile-portal]free-rule-template free1
[151.0.208.150-authentication-profile-portal]access-domain d1
[151.0.208.150-authentication-profile-portal]authentication roam-accounting
[151.0.208.150-authentication-profile-portal]update-session-mode
[151.0.208.150-authentication-profile-portal]authentication-scheme radius
[151.0.208.150-authentication-profile-portal]accounting-scheme radius
[151.0.208.150-authentication-profile-portal]authorization-scheme radius
[151.0.208.150-authentication-profile-portal]radius-server radius
CONFIGURING WLAN, SSID PROFILE, AND VAP PROFILE
# Create SSID Profile
[151.0.208.150]wlan
[151.0.208.150-wlan-view]ssid-profile name ipera-wifi
[151.0.208.150-ipera-wifi]ssid name_of_ssid
[151.0.208.150- ipera-wifi]quit
# Create VAP Profile and associate it with authentication profile
[151.0.208.150-wlan-view]vap-profile name ipera-wifi
[151.0.208.150-wlan-vap-prof-ipera-wifi]service-vlan vlan-id 200
[151.0.208.150-wlan-vap-prof-ipera-wifi]ssid-profile ipera-wifi
[151.0.208.150-wlan-vap-prof-ipera-wifi]security-profile ipera-wifi
[151.0.208.150-wlan-vap-prof-ipera-wifi]authentication-profile portal
CONFIGURING AP GROUP AND SETTING THE RADIO PROFILE TO VAP-PROFILE
The following schema defines the functional priorities of the operations necessary to configure AP groups, radio profile, and vap-profile.
# Create a new ap-group
[151.0.208.150-wlan-view]ap-group name default
[151.0.208.150-wlan-ap-group-default]vap-profile ipera-wifi wlan id_wlan radio all
# Change the AP update mode to ac-mode
[151.0.208.150-wlan-view]ap update mode ac-mode
[151.0.208.150-wlan-view]ap auth-mode no-auth
CREATING A QOS PROFILE AND ASSOCIATE IT TO A USER-GROUP
For example, we'll configure a QoS profile to limit the bandwidth in Uplink and Downlink to 1Mb/s for a specific user group (group-1M). The User-group name will represent the Filter-Id (In this case group-1M) to configure on IPERA Starling.
# Create a new QoS profile (example to limit a bandwidth in Uplink and downlink to 1 Mb/s)
[151.0.208.150]qos-profile name limit-1M
[151.0.208.150-qosprofile-limit-1M]car inbound cir 1024
[151.0.208.150-qosprofile-limit-1M]car outbound cir 1024
[151.0.208.150-qosprofile-limit-1M]quit
# Create a new User-Group and associate it with qos-profile
[151.0.208.150]user-group group-1M
[151.0.208.150]qos-profile limit-1M
ENTERING THE DEVICE DETAILS INTO THE ADMIN PANEL
For Huawei devices, the IPERA Starling platform requires only the MAC address. The Identifier field is not required.
Network 2 (APs and STAs)
It’s mandatory to configure the following VLAN on a local switch:
- The service VLAN with the same ID as the previously configured on the AC (Vlan200) with a DHCP server for the STAs (customer devices) will connect through the SSID. In this case, the address pool will be 192.168.50.1/24
- The Management VLAN for the APs with the same ID and pool as the previously configured on the AC (Vlan30) with a DHCP server for the APs. In this case, the pool will be 192.168.30.1/24
- We have two possibilities to configure the CapWap source IP address on APs
- Recommended for a small number of Aps
Enter for each AP via telnet or SSH with the default credentials admin/admin@huawei.com.
In this example AC_ip_address = 151.0.208.150 (Capwap source IP address)
[fce3-3ca3-c820]ap-address static ac-list ‘AC_ip_address’
Info: The configuration takes effect after the AP is restarted.
[fce3-3ca3-c820]reboot
- Recommended for a large number of Aps
In the DHCP server for management APs configure an option-43 with sub-option 2 ip-address ‘AC_ip_address’. In this specific example, we have option 43 sub-option 2 ip-address 151.0.208.150
CONFIGURATION PARAMETERS
AWS
Network 1 (Access Controller)
The system name of the AC has to set to a public IP address.
Configure a service VLAN in tagged mode (Vlan200).
Configure a management VLAN (to manage the APs) (Vlan30).
Capwap source IP address has to be set to AC IP address.
Configure ACL to permit navigation to *.iperawifi.com domain and IPERA RADIUS IP addresses.
RADIUS server primary (Authentication) → 35.156.39.198 on port 1812 secret provided by IPERA
RADIUS server primary (Accounting) → 35.156.39.198 on port 1813 secret provided by IPERA
RADIUS server secondary (Authentication) → 35.156.23.166 on port 1812 secret provided by IPERA
RADIUS server secondary (Accounting) → 35.156.23.166 on port 1813 secret provided by IPERA
Configure the RADIUS server template:
- radius-server shared-key cipher secret provided by IPERA Starling
- radius-server authentication 35.156.39.198 & 35.156.23.166 1812
- radius-server accounting 35.156.39.198 & 35.156.23.166 1813
Set URL to IPERA Starling Splash portal
- Redirection URL : https://engage.iperawifi.com/onboarding
- Success URL: https://engage.iperawifi.com/onboarding/?res=success
- URL-Parameter: user-ipaddress wlanuserip user-mac user-mac ac-ip wlanapip sysname wlanacname ap-mac ap-mac ssid ssid redirect-url switch_url
Set web auth-server to IP address of Splash Portal IP address:
- Server-IP: 35.156.56.30 (IPERA Starling splash portal IP)
- Port: 50100 (default port communication between AC and Portal)
- URL-Template: u1
- Source-IP: 151.0.208.150 (IP address of the AC)
Configure an authentication profile
authentication-profile name portal
Configure a VAP profile and associate it with WLAN and SSID profile.
vap-profile name ipera-wifi
- service-vlan vlan-id 200
- ssid-profile ipera-wifi
- security-profile ipera-wifi
- authentication-profile portal
Create an AP group and associate it with the VAP profile previously created.
Network 2 (Switch, APs, and STAs)
- On the switch, create one service VLAN with the same ID configured on AC in tagged mode(Vlan200) and one for the AP management with the same ID and pool configured on the AC (Vlan30)
- Create one DHCP server for the STAs and one for the APs (eventually with the option 43 sub option 2) recommended for large networks.
Azure
Network 1 (Access Controller)
The system name of the AC has to set to a public IP address.
Configure a service VLAN in tagged mode (Vlan200).
Configure a management VLAN (to manage the APs) (Vlan30).
Capwap source IP address has to be set to AC IP address.
Configure ACL to permit navigation to *.iperawifi.com domain and IPERA RADIUS IP addresses.
RADIUS server primary (Authentication) → 20.174.25.122 on port 1812 secret provided by IPERA
RADIUS server primary (Accounting) → 20.174.25.122 on port 1813 secret provided by IPERA
RADIUS server secondary (Authentication) → 20.174.42.3 on port 1812 secret provided by IPERA
RADIUS server secondary (Accounting) → 20.174.42.3 on port 1813 secret provided by IPERA
Configure the RADIUS server template:
- radius-server shared-key cipher secret provided by IPERA Starling
- radius-server authentication 20.174.25.122 & 20.174.42.3 1812
- radius-server accounting 20.174.25.122 & 20.174.42.3 1813
Set URL to IPERA Starling Splash portal
- Redirection URL : https://me.iperawifi.com/onboarding
- Success URL: https://me.iperawifi.com/onboarding/?res=success
- URL-Parameter: user-ipaddress wlanuserip user-mac user-mac ac-ip wlanapip sysname wlanacname ap-mac ap-mac ssid ssid redirect-url switch_url
Set web auth-server to IP address of Splash Portal IP address:
- Server-IP: 35.156.56.30 (IPERA Starling splash portal IP)
- Port: 50100 (default port communication between AC and Portal)
- URL-Template: u1
- Source-IP: 151.0.208.150 (IP address of the AC)
Configure an authentication profile
authentication-profile name portal
Configure a VAP profile and associate it with WLAN and SSID profile.
vap-profile name ipera-wifi
- service-vlan vlan-id 200
- ssid-profile ipera-wifi
- security-profile ipera-wifi
- authentication-profile portal
Create an AP group and associate it with the VAP profile previously created.
Network 2 (Switch, APs, and STAs)
- On the switch, create one service VLAN with the same ID configured on AC in tagged mode(Vlan200) and one for the AP management with the same ID and pool configured on the AC (Vlan30)
- Create one DHCP server for the STAs and one for the APs (eventually with the option 43 sub option 2) recommended for large networks.
For further support, please contact support@ipera.ai
Any changes on the above parameters and values will be communicated with IPERA customers in advance.
Comments
0 comments
Please sign in to leave a comment.