Aruba无线网络配置培训

1、CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线网络培训无线网络培训People move. Networks must follow.CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved公司简介公司简介 市场形象： 全球领先的安全无线网络供应商 全球唯一的WLAN专业上市公司 硅谷技术公司排名(#1 ranking) 全球客户数量：6500+CONFIDENTIAL Copyright 2007. Aru

2、ba Networks, Inc. All rights reserved连接性连接性Aruba产品的市场定位产品的市场定位融合的移动应用QoS, Roaming, Handovers, Location, RFID安全接入Authentication, Encryption, Intrusion Prevention移动设备管理Security, Battery Life, Device ManagementWireless LAN 覆盖RF Management, Rogue AP Detection安全性安全性移动性移动性用户分级Employees, Contractors, Guest

3、sCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA以用户为中心的网络以用户为中心的网络 q 高性能无线园区网q 即插即用的远程接入点q 适合各种规模的分支办公室网络q 安全的企业无线网状网q RFprotect 无线入侵防范Who, What, Where, When, How?q 基于角色的安全策略q 叠加的网络安全特性q 整合的网络准入控制q 安全访客接入q 持续的话音呼叫 q 数据会话的永续性q 应用感知的服务质量q 基于定位的应用q 视频优化自适应无线局域网基于身份的安全性应用层质量保证

4、Follow-MeApplicationsFollow-MeSecurityFollow-MeManagementFollow-Me Connectivity q 多厂商设备管理 q 用户级管理和报表q 可视的无线热区图q 非法AP识别和定位q 故障诊断专家系统统一的用户网络管理CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved自动优化：不需要人工干预的智能网络自动优化：不需要人工干预的智能网络 自适应射频管理（Adaptive Radio Management ）基于可用频谱对WLAN进行持续优化1.对频

5、谱进行实时扫描和监视2.自动选择最佳信道和功率，降低网络冲突和干扰，并在AP失效时自动对盲区进行覆盖3.基于用户和流量进行负载均衡4.对双频段用户提供频段指引5.公平接入快速和慢速客户端6.基于负载感知的射频扫描物理位置时间可用信道 挑战 动态射频环境 在一个期望的覆盖范围，可以使用的工作信道并不是一成不变的，与环境中存在的干扰和用户密度、流量负载等有关大厅大厅自习室自习室会议室会议室办公室办公室/公位公位CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved便于扩展：随时随地对无线网络进行扩展便于扩展：随时随

6、地对无线网络进行扩展6分支机构分支机构/办公室办公室公司总部公司总部Internet 服务服务来客来客Internet 访问访问DMZINTERNETGUESTCORPCORP语音语音VOICEDSL路由器路由器GUESTVLANInternet 服服务务分割隧道分割隧道用于传输互联网流量的分割隧道以用户为中心的内置防火墙防火防火墙墙/NATFan TrayUp to 4 M3 Mark IRedundant PSUs40 x 1000Base-X (SFP)8x 10GBase-X (XFP)业界最强大的无线控制器业界最强大的无线控制器 单台支持单台支持80G线速转发线速转发 单台管理单台管

7、理2048个无线个无线AP从室内向室外扩展从室内向室外扩展向更加广阔的向更加广阔的Internet扩展扩展CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved基于身份的访问控制和带宽管理基于身份的访问控制和带宽管理用户权限管理Who(用户认证)+What(认证方式) +When(接入时间)+Where(接入位置)+How(接入终端)CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved基于用户的无线状态防火墙基于用户的无线状态

8、防火墙 单一物理网络设施 任意对用户进行分组 不同组或用户设定不同L2-L7策略控制 不同用户设定不同的上下行带宽分配 不同用户设定的不同QOS级别Aruba的的Firewall可以检测到可以检测到ICMP,TCP Sync,IP Session,IP Spoofing, RST Relay,ARP等多种潜在网络攻击等多种潜在网络攻击,并自动将攻击者放入黑名单并自动将攻击者放入黑名单,断开无线连接断开无线连接 Virtual AP 1SSID: ABC.COMVirtual AP 2SSID: VOICE标准客户标准客户免费客户免费客户路由器路由器WEB门户门户移动性控制器移动性控制器接入点接

9、入点VIP唯一权限、唯一权限、QoS, 策略策略免费客户语音普通客户VIP客户话音客户话音客户AAA 基基础设础设施施入门客户入门客户相同或不同的VLANCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线网络的组网架构无线网络的组网架构Email Server10/100 MbpsL2/3DHCP Server1.3.4.通讯过程：1.AP连接到现有网络的交换机端口，加电起动后，获得IP地址2.AP通过各种方式获得ARUBA控制器的Loop IP地址（静态获得、DHCP返回、DNS解析、组播、

10、广播）3.AP与控制器之间建立PAPI隧道（UDP 8211），通过FTP或TFTP到ARUBA控制器上比对并下载AP的image软件和配置文档，并根据配置信息建立AP与控制器之间的GRE隧道，同时向无线用户提供无线接入服务4.无线用户通过SSID连接无线网络，所有的用户流量都通过AP与ARUBA控制器之间的GRE隧道直接传递到ARUBA控制器上，进行相应的加解密、身份验证、授权、策略和转发2.CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved配置配置ARUBA无线控制器无线控制器 管理员登陆(admin/

11、saic_admin) Cli Web 管理帐号 网络配置 Vlan IP address IP route IP dhcp 安全配置 Policy Role AAA 无线配置 SSID Virtual APCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved配置配置ARUBA无线控制器无线控制器管理员登陆管理员登陆CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved登陆登陆ARUBA无线控制器无线控制器 Command l

12、ineUser: adminPassword: *(Aruba800) enPassword:*(Aruba800) #configure tEnter Configuration commands, one per line. End with CNTL/Z Web UIhttps:/ Admin帐号管理#mgmt-user (Aruba800) (config) #mgmt-user admin root Password:*Re-Type password:*(Aruba800) (config) #CONFIDENTIAL Copyright 2007. Aruba Networks,

13、 Inc. All rights reserved配置配置ARUBA无线控制器无线控制器ARUBA无线控制器的网络配置无线控制器的网络配置CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的网络配置无线控制器的网络配置 配置Vlan(Aruba800) (config) #vlan 200(Aruba800) (config) #interface fastethernet 1/0接入模式：(Aruba800) (config-if)#switchport access vlan 200

14、 (Aruba800) (config-if)#switchport mode access中继模式：(Aruba800) (config-if)#switchport trunk allowed vlan all (Aruba800) (config-if)#switchport mode trunk (Aruba800) (config-if)#show vlanVLAN CONFIGURATION-VLAN Name Ports- - -1 Default FE1/1-7 100 VLAN0100 GE1/8 200 VLAN0200 FE1/0 配置IP address(Aruba80

15、0) (config) #interface vlan 200(Aruba800) (config-subif)#ip address 54 (vlan interface)(Aruba800) (config-subif)#ip helper-address (DHCP relay)CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的网络配置无线控制器的网络配置 配置IP route配置缺省路由: (Aruba

16、800) (config) #ip default-gateway 配置静态路由：(Aruba800) (config) #ip route (Aruba800) (config) #show ip route Codes: C - connected, O - OSPF, R - RIP, S - static M - mgmt, U - route usable, * - candidate defaultGateway of last resort is to netwo

17、rk S* /0 1/0 via *S /24 1/0 via *C is directly connected, VLAN1C is directly connected, VLAN100C is directly connected, VLAN200 配置dhcp server(Aruba800) (config) #ip dhcp pool user_pool(Aruba800) (config-dhcp)#default-r

18、outer 54(Aruba800) (config-dhcp)#dns-server (Aruba800) (config-dhcp)#network (Aruba800) (config-dhcp)#exit(Aruba800) (config) #service dhcpCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved配置配置ARUBA无线控制器无线控制器ARUBA无线控制器的安全配置无线控制器的安全配置CO

19、NFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA控制器的安全配置控制器的安全配置Rule 1Rule 2Rule 3Rule nRule 1Rule 2Rule 1Rule 1Rule 2Rule 3Rule 4Rule 1Rule 2Rule 3Rule 4Policy 1Policy 2Policy 3Policy 4Policy 5Role 1 Policy 1 Policy 2Role 2 Policy 1 Policy 3 Policy 4Role 3 Policy 4 Policy 5R

20、ole 4 Policy 4User1 User2 User3 User4 User5 User6 UserNRole Derivation:1) Locally Derived2) Server Assigned3) Default RoleAssigns usersto a roleMethods:PoliciesRolesDerivationCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved ARUBA控制器的安全配置控制器的安全配置AddressesHTTPFTPDNSetcDenyPermitNa

21、tLogQueue802.1p assignmentTOSTime Range策略示例：ip access-list session Internet_Only user any udp 68 deny user any svc-dhcp permituser host svc-dns permituser host svc-dns permituser alias Internal-Network deny loguser any any permit 防火墙策略：一组按照特定次序排列的规则的集合别名的定义：1)网络别名netdestinati

22、on Internal-Network network network netdestination External-network network network invert2)服务别名netservice svc-http tcp 80CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved ARUBA控制器的

23、安全配置控制器的安全配置AddressesHTTPFTPDNSetcDenyPermitNatLogQueue802.1p assignmentTOSTime Range 防火墙策略：一组按照特定次序排列的规则的集合CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedCreating RolesCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedCreating Policies212-21CONFIDENTIAL Copy

24、right 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的安全配置无线控制器的安全配置用户角色（用户角色（Role）决定了每个用户的访问权限）决定了每个用户的访问权限每一个role都必须与一个或多个policy绑定防火墙策略按次序执行最后一个隐含的缺省策略是“deny all”可以设定role的带宽限制和会话数限制用户角色（用户角色（Role）的分配可以通过多种方式实现）的分配可以通过多种方式实现基于接入认证方式的缺省角色 (i.e. 802.1x, VPN, WEP, etc.)由认证服务器导出的用户角色(i.e. RADI

25、US/LDAP属性)本地导出规则ESSIDMACEncryption typeEtc.ARUBA控制器中的每一个用户都会被分配一个控制器中的每一个用户都会被分配一个Role!CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的安全配置无线控制器的安全配置(Aruba800) #show rights RoleTable-Name ACL Bandwidth ACL List Type- - - - -ap-role 4 Up: No Limit,Dn: No Limit control,

26、ap-acl Systemauthenticated 39 Up: No Limit,Dn: No Limit allowall,v6-allowall Userdefault-vpn-role 37 Up: No Limit,Dn: No Limit allowall,v6-allowall Userguest 3 Up: No Limit,Dn: No Limit http-acl,https-acl,dhcp-acl,icmp-acl,dns-acl,v6-http-acl,v6-https-acl,v6-dhcp-acl,v6-icmp-acl,v6-dns-acl Userguest

27、-logon 6 Up: No Limit,Dn: No Limit logon-control,captiveportal Userlogon 1 Up: No Limit,Dn: No Limit logon-control,captiveportal,vpnlogon,v6-logon-control Userstateful-dot1x 5 Up: No Limit,Dn: No Limit Systemvoice 38 Up: No Limit,Dn: No Limit sip-acl,noe-acl,svp-acl,vocera-acl,skinny-acl,h323-acl,dh

28、cp-acl,tftp-acl,dns-acl,icmp-acl UserCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的安全配置无线控制器的安全配置(Aruba800) #show rights authenticatedDerived Role = authenticated Up BW:No Limit Down BW:No Limit L2TP Pool = default-l2tp-pool PPTP Pool = default-pptp-pool Periodic re

29、authentication: Disabled ACL Number = 39/0 Max Sessions = 65535access-list List-Position Name Location- - -1 allowall 2 v6-allowall allowall-Priority Source Destination Service Action TimeRange Log Expired Queue TOS 8021P Blacklist Mirror DisScan- - - - - - - - - - - - - -1 any any any permit Low v6

30、-allowall-Priority Source Destination Service Action TimeRange Log Expired Queue TOS 8021P Blacklist Mirror DisScan- - - - - - - - - - - - - -1 any any any permit Low Expired Policies (due to time constraints) = 0CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的安全配置无线控

31、制器的安全配置定义用户角色（role）(Aruba800) (config) #user-role visitors(Aruba800) (config-role) #access-list session internet-only(Aruba800) (config-role) #max-sessions 100(Aruba800) (config-role) #exit(Aruba800) (config) #CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的安全配置无线控制器的

32、安全配置基于接入认证方式的缺省角色（role）分配(Aruba800) (config) #show aaa profile defaultAAA Profile default-Parameter Value- -Initial role logonMAC Authentication Profile N/AMAC Authentication Default Role guestMAC Authentication Server Group default802.1X Authentication Profile N/A802.1X Authentication Default Role

33、guest802.1X Authentication Server Group N/ARADIUS Accounting Server Group N/AXML API server N/ARFC 3576 server N/AUser derivation rules N/AWired to Wireless Roaming EnabledSIP authentication role N/A(Aruba800) (config) #show aaa authentication captive-portal defaultCaptive Portal Authentication Prof

34、ile default-Parameter Value- -Default Role guestServer Group defaultRedirect Pause 10 secUser Login EnabledGuest Login DisabledLogout popup window EnabledUse HTTP for authentication DisabledLogon wait minimum wait 5 secLogon wait maximum wait 10 seclogon wait CPU utilization threshold 60 %Max Authen

35、tication failures 0Show FQDN DisabledUse CHAP (non-standard) DisabledSygate-on-demand-agent DisabledLogin page /auth/index.htmlWelcome page /auth/welcome.htmlShow Welcome Page YesAdding switch ip address in redirection URL DisabledCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reserved

36、ARUBA无线控制器的安全配置无线控制器的安全配置基于接入认证方式的缺省角色（role）分配CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的安全配置无线控制器的安全配置基于服务期返回规则的角色（role）分配(Aruba800) (config) #aaa server-group test(Aruba800) (Server Group test) #set role condition memberOf contains student set-value student说明：从

37、LDAP服务器获取用户属性，并以此为依据分配用户角色时，只能通过CLI进行配置CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的安全配置无线控制器的安全配置基于用户定义规则的角色（role）分配(Aruba800) (config) #aaa derivation-rules user test_rule(Aruba800) (user-rule) #set role condition encryption-type equals dynamic-aes set-value auth

38、enticated position 1(Aruba800) (user-rule) #set role condition encryption-type equals dynamic-tkip set-value guest position 2CONFIDENTIAL Copyright 2009. Aruba Networks, Inc. All rights reservedBlacklisting ClientsCONFIDENTIAL Copyright 2009 Aruba Networks, Inc. All rights reservedWhat Is Blacklisti

39、ng? Deauthenticated from the network If a client is connected to the network when it is blacklisted, a deauthentication message is sent to force the client to disconnect. Blocked from associating to APs Blacklisting prevents a client from associating with any AP in the network for a specified amount

40、 of time. Blocked from other SSIDs While blacklisted, the client cannot associate with another SSID in the network.2-31CONFIDENTIAL Copyright 2009 Aruba Networks, Inc. All rights reservedMethods Of Blacklisting Manually blacklist Admin user can blacklist a specific client via the clients screen at M

41、onitoring Clients Firewall policy A firewall Policy can result in the client being blacklisted Fails to Authenticate A client fails to successfully authenticate for a configured number of times for a specified authentication method. The client is automatically blacklisted. IDS Attack The detection o

42、f a denial of service or man in the middle (MITM) attack in the network. 2-32CONFIDENTIAL Copyright 2009 Aruba Networks, Inc. All rights reservedDuration Of Blacklisting Blacklist Duration on Per-SSID basis Configured in Virtual AP Profile2-33CONFIDENTIAL Copyright 2009 Aruba Networks, Inc. All righ

43、ts reservedRule based BlacklistingConfiguration - Access control - PoliciesCONFIDENTIAL Copyright 2009 Aruba Networks, Inc. All rights reservedConfiguring Firewall Policy Blacklisting This rule set is used to blacklist clients attaching to the controller IP address2-35CONFIDENTIAL Copyright 2009 Aru

44、ba Networks, Inc. All rights reservedViewing Blacklist Clients Monitoring Blacklist Clients This screen allows clients to be put back into production/logon roles by removing them from the blacklist2-36CONFIDENTIAL Copyright 2009 Aruba Networks, Inc. All rights reservedConsiderations When Blacklistin

45、g Clients Policy enforcement Devices with weak encryption Deny Guest from corporate access May be disruptive to employees2-37CONFIDENTIAL Copyright 2009. Aruba Networks, Inc. All rights reservedBandwidth ContractsCONFIDENTIAL Copyright 2009 Aruba Networks, Inc. All rights reservedBandwidth Contracts

46、 Applied to Roles Specified in Kbps or Mbps Upstream - Downstream For all Users or Per User 2-39CONFIDENTIAL Copyright 2009 Aruba Networks, Inc. All rights reservedBandwidth Contracts2-40CONFIDENTIAL Copyright 2009 Aruba Networks, Inc. All rights reservedApply BW-Contract To The Role2-41CONFIDENTIAL

47、 Copyright 2007. Aruba Networks, Inc. All rights reserved配置配置ARUBA无线控制器无线控制器ARUBA无线控制器的无线配置无线控制器的无线配置CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的无线配置无线控制器的无线配置AP GroupWireless LANRF ManagementAPQoSIDSVirtual APPropertiesSSIDAAAa/g RadioSettingsRFOptimizationsSyste

48、m ProfileEthernetRegulatorySNMPVoIPa/g ManagementVirtual APPropertiesSSIDAAAVLANVLANCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的无线配置无线控制器的无线配置 加密方法加密方法确保数据在空中传输时的私密性可以选择不加密(open)、二层加密(WEP, TKIP, AES) 或者三层加密 (VPN) 认证方式认证方式确保接入无线网络的用户都是合法用户认证方式可以选择不认证，或者MAC、EAP、capt

49、ive portal、VPN等认证方式 访问控制访问控制对接入无线网络的合法用户流量进行有效控制，包括可以访问的网络资源、带宽、时间等WLAN服务的配置要点服务的配置要点SSID ProfileAAA ProfileRoleCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的无线配置无线控制器的无线配置(Aruba800) #show wlan virtual-ap defaultVirtual AP profile default-Parameter Value- -Virtual A

50、P enable EnabledAllowed band allSSID Profile defaultVLAN 100Forward mode tunnelDeny time range N/AMobile IP EnabledHA Discovery on-association DisabledDoS Prevention DisabledStation Blacklisting EnabledBlacklist Time 3600 secAuthentication Failure Blacklist Time3600 secFast Roaming DisabledStrict Co

51、mpliance DisabledVLAN Mobility DisabledAAA Profile defaultRemote-AP Operation standardCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的无线配置无线控制器的无线配置SSID Profile的定义(Aruba800) (config) #wlan ssid-profile test(Aruba800) (SSID Profile “test”) #essid test（WLAN显示的SSID名称）(Ar

52、uba800) (SSID Profile “test”) #opmode ? （WLAN可以选用的加密方式）dynamic-wep WEP with dynamic keysopensystem No encryptionstatic-wep WEP with static keyswpa-aes WPA with AES encryption and dynamic keys using 802.1Xwpa-psk-aes WPA with AES encryption using a pre-shared keywpa-psk-tkip WPA with TKIP encryption

53、using a pre-shared keywpa-tkip WPA with TKIP encryption and dynamic keys using 802.1Xwpa2-aes WPA2 with AES encryption and dynamic keys using 802.1Xwpa2-psk-aes WPA2 with AES encryption using a pre-shared keywpa2-psk-tkip WPA2 with TKIP encryption using a pre-shared keywpa2-tkip WPA2 with TKIP encry

54、ption and dynamic keys using 802.1XxSec xSec encryption(Aruba800) (SSID Profile “test”) #opmode opensystemCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的无线配置无线控制器的无线配置SSID Profile的定义CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的无线配置无

55、线控制器的无线配置AAA Profile的定义配置基于Open的AAA Profile(Aruba800) (config) #aaa profile test (Aruba800) (AAA Profile test) #clone default配置基于Portal认证的CaptivePortal Profile(Aruba800) (config) #aaa authentication captive-portal test(Aruba800) (Captive Portal Authentication Profile test) #clone default(Aruba800) (

56、Captive Portal Authentication Profile test) #default-role guest(Aruba800) (Captive Portal Authentication Profile test) #no enable-welcome-page(Aruba800) (Captive Portal Authentication Profile test) #server-group testCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的无线配置

57、无线控制器的无线配置配置LDAP服务器(Aruba800) (config) #aaa authentication-server ldap test(Aruba800) (LDAP Server test) # host 0(Aruba800) (LDAP Server test) #admin-dn admin(Aruba800) (LDAP Server test) #admin-passwd admin(Aruba800) (LDAP Server test) #base-dn cn=users,dc=qa,dc=domain,dc=com(Aruba800) (L

58、DAP Server test) #allow-cleartext (Aruba800) (LDAP Server test) #CONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的无线配置无线控制器的无线配置配置Server-Group(Aruba800) (config) #aaa server-group test(Aruba800) (Server Group test) #auth-server test(Aruba800) (Server Group test) #set r

59、ole condition memberOf contains guest set-value guest (Aruba800) (config) #show aaa server-group testFail Through:NoAuth Servers-Name Server-Type trim-FQDN Match-Type Match-Op Match-Str- - - - - -test Ldap No Role/VLAN derivation rules -Priority Attribute Operation Operand Type Action Value Valid- -

60、 - - - - - -1 memberOf contains guest String set role guest NoCONFIDENTIAL Copyright 2007. Aruba Networks, Inc. All rights reservedARUBA无线控制器的无线配置无线控制器的无线配置在用户初始角色（initial role）中调用CaptivePortal Profile(Aruba800) (config) #user-role logon(Aruba800) (config-role) #captive-portal test(Aruba800) (config