五、(H3C)基于802.1x+AD+DHCP+NPS动态下发vlan华三交换机配置

一、配置网络设备

以下为拓扑图

1、配置核心交换机（华为S7712）

sysname Core-Switch                         更改主机名

vlan batch 31 32 222 223                    批量创建vlan

int vlan 32                                 创建管理vlan 32虚拟接口

ip address 172.16.32.254 24                 配置管理vlan 32 网关地址

int vlan 31                                  创建服务器vlan 31虚拟接口

ip address 172.16.31.254 24                 配置服务器vlan 31 网关地址

int vlan 222                                创建业务vlan 222虚拟接口

ip address 172.16.222.254 24                 配置业务vlan 222 网关地址

dhcp select relay

dhcp relay server-ip 172.16.31.66           配置DHCP中服继务器为172.16.31.66

int vlan 223                                创建业务vlan 223虚拟接口

ip address 172.16.223.254 24                配置业务vlan 223 网关地址

dhcp select relay

dhcp relay server-ip 172.16.31.66           配置DHCP中继服务器为172.16.31.66

开启DHCP服务

dhcp enable

G10/0/1端口配置

int G10/0/1

description To 802.1x Switch-G1/0/24

port link-type trunk

port trunk pvid vlan 32

port trunk allow-pass vlan all

G10/0/2接口配置

int G10/0/2

description To Server Switch-G0/0/48

port link-type trunk

port trunk pvid vlan 32

port trunk allow-pass vlan all

2、配置服务器端交换机（S5700）

sysname Server Switch更改主机名

vlan batch 31 32              创建vlan 31、32

int Vlan 32                   创建管理VLAN 32虚拟接口

ip address 172.16.32.252 24   配置管理IP地址

配置默认路由

ip route 0.0.0.0 0.0.0.0 172.16.32.254

上联端口G0/0/48配置

interface GigabitEthernet0/0/1

description To Core-Switch-G10/0/2

port link-type access

port default vlan 31

连接服务器端口G0/0/1配置

interface GigabitEthernet0/0/1

description To Windows Server 2008

port link-type access

port default vlan 31

     3、配置接入交换机 (华三S5120)

sysname 802.1x Switch           更改主机名

vlan 32                        创建管理VLAN 32

vlan 222 to 223                创建业务VLAN 222和223

int Vlan 32                    创建管理VLAN 32虚拟接口

ip address 172.16.32.253 24

                              配置管理IP为172.16.32.253/24

创建radius 模版为test.com

radius scheme test.com

server-type extended

primary authentication 172.16.31.66

primary accounting 172.16.31.66

keyauthentication test.com

keyaccounting test.com

创建域为test.com

domain test.com

authentication lan-access radius-schemetest.com

authorization lan-access radius-schemetest.com

accounting lan-access radius-scheme test.com

access-limit disable

stateactive

idle-cut disable

self-service-url disable

配置默认域

domain default enable test.com

全局开启dot1x

dot1x

配置dot1x验证方式

dot1x authentication-method eap

开启DHCP 服务

dhcp enable

配置默认路由

ip route 0.0.0.0 0.0.0.0 172.16.32.254

配置接入的端口G1/0/1

interface GigabitEthernet1/0/1

description To Dynamic 802.1x-huan.yan-PC

port link-type hybrid

undo port hybrid vlan 1

port hybrid vlan 222 to 223 untagged

port hybrid pvid vlan 222

undo dot1x handshake

dot1x

配置接入的端口G1/0/2

interface GigabitEthernet1/0/2

description To Dynamic 802.1x-obama-PC

port link-type hybrid

undo port hybrid vlan 1

port hybrid vlan 222 to 223 untagged

port hybrid pvid vlan 222

undo dot1x handshake

dot1x

配置上联端口

interface GigabitEthernet1/0/24

description To Core-Switch-G10/0/1

port link-type trunk

port trunk permit vlan all

port trunk pvid vlan 32

网络设备全部配置完毕

本文出自 “yanhuan” 博客，请务必保留此出处http://yanhuan.blog.51cto.com/1761673/1260083