(cache)Configuring an IoT Card - WLAN AC AirEngine X700 V600R024C00 CLI-based Configuration Guide

Operations

0 / 500

Please evaluate and leave your comments:

Configuring an IoT Card

The following AP running V600 supports IoT cards:

AirEngine 6776-58TI

The following APs running V200 support IoT cards:

AirEngine 5760-22W, AirEngine 5760-22WD, AirEngine 5760-51, AirEngine 6760-X1, AirEngine 6760-X1E, AirEngine 8760-X1-PRO
AirEngine 5761-11W, AirEngine 5761-11WD, AirEngine 5761-12W, AirEngine 5761-21, AirEngine 5761S-11, AirEngine 5761S-11W, AirEngine 5761S-21, AirEngine 6761-21T, AirEngine 6761S-21T
AirEngine 5761-11, AirEngine 5761S-12, AirEngine 5761S-13, AirEngine 6761-21, AirEngine 6761S-21, AirEngine 6761-21E
AirEngine 5762-13W, AirEngine 5762-15HW, AirEngine 5762S-13W
AirEngine 5762-16W
AirEngine 6761-22T and AirEngine 5761-12
AirEngine 8761-X1
AirEngine 5762-17W
AirEngine 5562-17W
AirEngine 5561-12 and AirEngine 6561-21T
AirEngine 8771-X1T
eKitEngine 6760S-56
Only intrinsically safe APs (AirEngine 5761-11EI) support the baud rate configuration for communication between APs and IoT cards.

Configuring an IoT Card Based on the Serial Port Protocol

Context

To install a USB card on an AP, you need to first enable the USB function of the AP. For details, see Configuring the USB Function for APs.

To install a PCIe card on an AP, you need to first enable the PCIe function of the AP. For details, see the power enable command.

The following describes how to configure APs to connect to serial port cards and communicate with a host computer. Perform these configurations on the WAC.

Procedure

Enter the system view.
```
system-view
```
Enter the WLAN view.
```
wlan
```
Create an IoT profile and enter its view.
```
iot-profile name profile-name
```
By default, no IoT profile is created.
(Optional) Configure the IoT card type.
```
type common
```
The default type of an IoT card is common.

In the education system solution of the Chinese Academy of Sciences, the IoT card type is fixed at cas-edu. In other scenarios, the IoT card type is common.
(Optional) Configure a shared key when the IoT card type is common.
```
share-key
```
By default, no shared key is configured.

Ensure that the same shared key is configured on the host computer.
Configure the domain name, IP address, and port number of the host computer.
```
management-server { domain domain-name | server-ip server-ip } server-port server-port-num [ ext-channel ]
```
By default, no host computer is configured.
(Optional) Configure a trusted host.
```
config-agent permit ip-address ip-address { net-mask | mask-len }
```
By default, no trusted host is configured.

If no trusted host is configured, all hosts can communicate with an AP as long as reachable routes are available. This poses security risks to the AP.
Return to the WLAN view.
```
quit
```
Enter the AP view or AP group view.
- Enter the AP group view.
```
ap-group name group-name
```
- Enter the AP view.
```
ap-id ap-id
```
The configurations take effect in the following views listed in descending order of priority: IoT card interface view of an AP, IoT card interface view of an AP group.
Enter the IoT card interface view.
```
card { card-number | usb }
```
Set the connection type between IoT cards and APs to serial.
```
card connect-type serial
```
By default, the connection type between IoT cards and APs is serial.
Bind the IoT profile and configure the local port number mapping to the IoT card interface.
```
iot-profile profile-name config-agent { tcp | udp } [ port port ] [ ext-port ext-port ]
```
By default, no IoT profile is bound to an IoT card interface.

A port number within the range from 50200 to 50202 is recommended. If another port number is used, a port conflict may occur, which generates an alarm.

Verifying the Configuration

Run the display ap-card all command to check brief information about cards on APs.
Run the display ap ap-id card { all | card-number | usb } command to check detailed information about cards on an AP.
Run the display ap-card statistics { all | ap-id ap-id [ card { card-number | usb } ] } command to check statistics about packets sent and received by cards on APs.
Run the display iot-profile { name profile-name | all } command to check the IoT profile configuration.
Run the display references iot-profile name profile-name command to check reference information about an IoT profile.

Configuring an IoT Card Based on the Ethernet Port Protocol

Context

To install a USB card on an AP, you need to first enable the USB function of the AP. For details, see Configuring the USB Function for APs.

To install a PCIe card on an AP, you need to first enable the PCIe function of the AP. For details, see the power enable command.

The following describes how to configure APs to connect to Ethernet port cards. Perform these configurations on the WAC.

Procedure

Enter the system view.
```
system-view
```
Enter the WLAN view.
```
wlan
```
Create an AP wired port profile and enter its view.
```
wired-port-profile name profile-name
```
By default, the AP wired port profile default is bound to an AP group, but no AP wired port profile is bound to an AP.
Configure the working mode for AP wired interfaces.
```
mode endpoint
```
Configure the PVID for AP wired interfaces.
```
vlan pvid vlan-id
```
By default, the PVID of an AP wired interface is 1.
Add AP wired interfaces to a VLAN in untagged mode.
```
vlan untagged vlan-id
```
By default, an AP wired interface allows packets from all VLANs to pass. The wired interfaces are added to VLAN 1 in untagged mode and to other VLANs in tagged mode.
Return to the WLAN view.
```
quit
```
Enter the AP view or AP group view.
- Enter the AP group view.
```
ap-group name group-name
```
- Enter the AP view.
```
ap-id ap-id
```
The configurations take effect in the following views listed in descending order of priority: IoT card interface view of an AP, IoT card interface view of an AP group.
Enter the IoT card interface view.
```
card { card-number | usb }
```
Apply the AP wired port profile.
```
wired-port-profile profile-name
```
By default, the AP wired port profile default is bound to an AP group, but no AP wired port profile is bound to an AP.
Set the connection type between IoT cards and APs to Ethernet.
```
card connect-type ethernet
```
Perform this configuration in either the AP system profile view or IoT card interface view. The configurations take effect in the following views listed in descending order of priority: IoT card interface view of an AP, IoT card interface view of an AP group, AP system profile view.

By default, the connection type between IoT cards and APs is serial.

Verifying the Configuration

Run the display wired-port-profile { all | name profile-name } command to check the configuration of an AP wired port profile.
Run the display references wired-port-profile name profile-name command to check reference information about an AP wired port profile.
Run the display ap-card all command to check brief information about IoT cards on APs.
Run the display ap ap-id card { all | card-number | usb } command to check detailed information about cards on an AP.

Configuring the RS485 Port on an AP

Prerequisites

Before configuring the RS485 port on an AP, you have completed the following tasks:

Connect the uninterruptible power supply (UPS) to the AP's RS485 port.
Ensure that the network between the AP and a computer is reachable.
Configure parameters for the host computer to interconnect with the AP.

Context

As shown in Figure 10-116, an AP has an RS485 port that can transparently transmit RS485 packets. After the AP sets up a TCP or UDP link with a host computer, the host computer can remotely manage the UPS through the AP's RS485 port. The host computer and AP set up a link with each other using the client/server (C/S) architecture. The AP can function as a client or server. In actual deployments, you can determine the AP role based on the role supported by the host computer. When configuring interconnection parameters, ensure that the client uses the same communication protocol as the server.

Figure 10-116 Networking diagram for a host computer to manage the UPS through an AP's RS485 port

This function is supported only by intrinsically safe APs that support communication with the UPS.

The RS485 packet structure may vary depending on the specific vendor. To ensure that the functions are available, select the host computer and UPS that support the same RS485 packet structure.

Procedure

Enter the system view.
```
system-view
```
Enter the WLAN view.
```
wlan
```
Create an IoT profile and enter its view.
```
iot-profile name profile-name
```
By default, no IoT profile is created.

Configure host computer parameters.

management-server { domain domain-name | server-ip server-ip } server-port server-port-num [ ext-channel ]

By default, no host computer is configured.

Return to the WLAN view.
```
quit
```
Enter the AP view or AP group view.
- Enter the AP group view.
```
ap-group name group-name
```
- Enter the AP view.
```
ap-id ap-id
```
The configurations take effect in the following views listed in descending order of priority: IoT card interface view of an AP, IoT card interface view of an AP group.
Enter the IoT card interface view.
```
card 1
```
Bind the IoT profile and configure the local port number mapping to the IoT card interface. A port number within the range from 50200 to 50202 is recommended. If another port number is used, a port conflict may occur, which generates an alarm.
- When the AP functions as a client, configure the protocol used by the AP to communicate with the host computer.
```
iot-profile profile-name config-agent { tcp | udp }
```
- When the AP functions as a server, configure the protocol and local port number used by the AP to communicate with the host computer.
```
iot-profile profile-name config-agent { tcp | udp } port port
```
(Optional) Configure the baud rate used by the AP to communicate with the IoT card.
```
baud-rate { 9600 | 19200 | 38400 | 57600 | 115200 | 921600 }
```
By default, no baud rate is configured, and an AP can automatically adapt to the baud rate.

In most cases, an AP can adjust the baud rate adaptively with an IoT card. However, for some special cards, such as a card with an RS485 port, the AP does not support baud rate adaptation. In this case, set this parameter to the same as the baud rate of the card.

Verifying the Configuration

Run the display ap ap-id card { all | card-number | usb } command to check detailed information about cards on an AP.
Check information reported by the UPS on the host computer.
Run the display iot-profile { name profile-name | all } command to check the IoT profile configuration.

Example for Configuring an IoT Card Based on the Serial Port Protocol

Networking Requirements

A school pays much attention to safety of its students, deploys smart locks, and plans to use technical methods to query students' safety information. To meet these requirements, Huawei provides the Education IoT Solution that can reuse the existing WLAN of the school, as shown in Figure 10-117.

WAC networking mode: Layer 2 off-path networking
DHCP deployment mode: The WAC functions as a DHCP server to assign IP addresses to APs and STAs.

Service data forwarding mode: direct forwarding

Figure 10-117 Network diagram of the IoT card configuration based on the serial port protocol

In this example, interface1, interface2, interface3, and interface4 represent 10GE0/0/1, 10GE0/0/2, 10GE0/0/3, and 10GE0/0/4, respectively.

Table 10-73 provides an example of data planning.

Table 10-73 Data planning

Item	Data
Management VLAN for APs	VLAN 100
Service VLAN for STAs	VLAN 101
DHCP server	The WAC functions as a DHCP server to assign IP addresses to APs and STAs.
IP address pool for APs	10.23.100.2–10.23.100.254/24
IP address pool for STAs	10.23.101.2–10.23.101.254/24
WAC's source interface	VLANIF 100: 10.23.100.1/24
AP group	Name: ap-group1 Referenced profiles: VAP profile wlan-net and regulatory domain profile default Local port mapping to the IoT card interface: 50201
Regulatory domain profile	Name: default Country code: CN
SSID profile	Name: wlan-net SSID name: wlan-net
Security profile	Name: wlan-net Security policy: WPA-WPA2+PSK+AES Password: YsHsjx_202206
VAP profile	Name: wlan-net Forwarding mode: direct forwarding Service VLAN: VLAN 101 Referenced profiles: SSID profile wlan-net and security profile wlan-net
IoT profile	Name: wlan-iot IP address of the host computer: 10.23.200.1 Port numbers of the host computer: 800 (port used by the server to receive RFID tag packets transparently transmitted by the card); 805 (port used by the server to receive communication packets from the card)

Configuration Roadmap

Configure network connectivity between the WAC, APs, and other network devices.
Configure APs to go online.
1. Create an AP group and add APs that require the same configuration to the group for unified configuration.
2. Configure WAC system parameters, including the country code and WAC's source interface for communication with APs.
3. Configure the AP authentication mode and import APs so that they can go online normally.
Configure WLAN service parameters so that STAs can access the WLAN.
Configure communication parameters between the APs and host computer.

Procedure

Configure DeviceA, APs, and the WAC to communicate with each other.

# Configure DeviceA. Add 10GE0/0/1, 10GE0/0/2, 10GE0/0/3, and 10GE0/0/4 to VLAN 100 (management VLAN) and VLAN 101 (service VLAN).

<HUAWEI> system-view
[HUAWEI] sysname DeviceA
[DeviceA] vlan batch 100 101
[DeviceA] interface 10ge 0/0/1
[DeviceA-10GE0/0/1] port link-type trunk
[DeviceA-10GE0/0/1] port trunk allow-pass vlan 100 to 101
[DeviceA-10GE0/0/1] quit
[DeviceA] interface 10ge 0/0/2
[DeviceA-10GE0/0/2] port link-type trunk
[DeviceA-10GE0/0/2] port trunk pvid vlan 100
[DeviceA-10GE0/0/2] port trunk allow-pass vlan 100 to 101
[DeviceA-10GE0/0/2] quit
[DeviceA] interface 10ge 0/0/3
[DeviceA-10GE0/0/3] port link-type trunk
[DeviceA-10GE0/0/3] port trunk pvid vlan 100
[DeviceA-10GE0/0/3] port trunk allow-pass vlan 100 to 101
[DeviceA-10GE0/0/3] quit
[DeviceA] interface 10ge 0/0/4
[DeviceA-10GE0/0/4] port link-type trunk
[DeviceA-10GE0/0/4] port trunk pvid vlan 100
[DeviceA-10GE0/0/4] port trunk allow-pass vlan 100 to 101
[DeviceA-10GE0/0/4] quit

# Configure the WAC. Add 10GE0/0/1 to VLAN 100 (management VLAN) and VLAN 101 (service VLAN).

<HUAWEI> system-view
[HUAWEI] sysname WAC
[WAC] vlan batch 100 101
[WAC] interface 10ge 0/0/1
[WAC-10GE0/0/1] port link-type trunk
[WAC-10GE0/0/1] port trunk allow-pass vlan 100 101
[WAC-10GE0/0/1] quit

Configure network connectivity between the APs and server.
Configure routes based on the actual networking situation to ensure network interworking between the APs and host computer.
Configure the WAC as a DHCP server to assign IP addresses to APs and STAs.
# Configure the DHCP server based on interface address pools.
Configure a DNS server address as required. The common methods are as follows:
- In an interface address pool scenario, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
- In a global address pool scenario, run the dns-list ip-address &<1-8> command in the IP address pool view.
```
[WAC] dhcp enable
[WAC] interface vlanif 100
[WAC-Vlanif100] ip address 10.23.100.1 24
[WAC-Vlanif100] dhcp select interface
[WAC-Vlanif100] quit
[WAC] interface vlanif 101
[WAC-Vlanif101] ip address 10.23.101.1 24
[WAC-Vlanif101] dhcp select interface
[WAC-Vlanif101] quit
```

Configure APs to go online.

# Create an AP group to which APs requiring the same configuration can be added.

[WAC] wlan
[WAC-wlan] ap-group name ap-group1
[WAC-wlan-ap-group-ap-group1] quit

# Create a regulatory domain profile, configure the country code of the WAC in the profile, and bind the profile to the AP group.

[WAC-wlan] regulatory-domain-profile name default
[WAC-wlan-regulate-domain-default] country-code cn
[WAC-wlan-regulate-domain-default] quit
[WAC-wlan] ap-group name ap-group1
[WAC-wlan-ap-group-ap-group1] regulatory-domain-profile default
Warning: This configuration change will clear the channel and power configurations of radios, and may restart APs. Continue?[Y/N]:y
[WAC-wlan-ap-group-ap-group1] quit
[WAC-wlan] quit

# Configure the WAC's source interface.

[WAC] capwap source interface vlanif 100
Set the DTLS PSK(contains 8-32 plain-text characters, or 128 or 148 cipher-text characters that must be a combination of at least tw
o of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):********
Confirm PSK:********
Set the user name for FIT APs(The value is a string of 4 to 31 characters, which can contain letters, underscores, and digits, and m
ust start with a letter):********
Set the password for FIT APs(plain-text password of 8-128 characters or cipher-text password of 128-268 characters that must be a co
mbination of at least three of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):******
Confirm password:********
Set the PSK of the global offline management VAP(plain-text password of 8-63 characters or cipher-text password of 128-188 character
s that must be a combination of at least two of the following: lowercase letters a to z, uppercase letters A to Z, digits, and speci
al characters):********
Confirm PSK:********

# Enable the function of establishing CAPWAP DTLS sessions in none authentication mode.

[WAC] capwap dtls no-auth enable
Warning: This operation allows for device access in non-DTLS encryption mode even when DTLS is enabled and brings security risks. After the device goes online for the first time, disable this function to prevent security risks. Continue? [Y/N]:y

By default, DTLS encryption for CAPWAP control tunnels is enabled on the WAC. With this function enabled, APs fail to go online after being imported. In this case, enable the function of establishing CAPWAP DTLS sessions in none authentication mode so that the APs can obtain security credentials. After the APs go online, disable this function promptly to prevent unauthorized APs from going online.

# Import an AP on the WAC, and add the AP to the AP group ap-group1. Configure a name for the AP based on the AP's position, so that the AP can be easily located based on its name. For example, if an AP with the MAC address of 00e0-fc76-e360 is deployed in a classroom, name the AP room_1. If the APs with the MAC addresses of 00e0-fc76-e460 and 00e0-fc76-e560 are deployed inside and outside the school door, name the APs door_1 and door_2, respectively.

[WAC] wlan
[WAC-wlan] ap auth-mode mac-auth
Warning: The authentication mode is switched to MAC address authentication. Ensure that the APs added offline have MAC address information. Otherwise, configurations of these APs may be lost after the device restarts. Continue? [Y/N]:y
[WAC-wlan] ap-id 0 ap-mac 00e0-fc76-e360
[WAC-wlan-ap-0] ap-name room_1
[WAC-wlan-ap-0] ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y
[WAC-wlan-ap-0] quit
[WAC-wlan] ap-id 1 ap-mac 00e0-fc76-e460
[WAC-wlan-ap-1] ap-name door_1
[WAC-wlan-ap-1] ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y
[WAC-wlan-ap-1] quit
[WAC-wlan] ap-id 2 ap-mac 00e0-fc76-e560
[WAC-wlan-ap-2] ap-name door_2
[WAC-wlan-ap-2] ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y
[WAC-wlan-ap-2] quit

# Power on the AP and run the display ap all command to check the AP state. If the State field displays nor, the AP goes online successfully.

[WAC-wlan] display ap all
Total AP information: 
nor  : normal          [3] 
ExtraInfo : Extra information      
P  : insufficient power supply  
Total: 3
---------------------------------------------------------------------------------------------- 
ID   MAC            Name   Group     IP            Type                  State STA Uptime ExtraInfo 
---------------------------------------------------------------------------------------------- 
0    00e0-fc76-e360 room_1 ap-group1 10.23.100.254 AirEngine5760-51      nor   0   51S    - 
1    00e0-fc76-e460 door_1 ap-group1 10.23.100.253 AirEngine5760-51      nor   0   45S    - 
2    00e0-fc76-e560 door_2 ap-group1 10.23.100.252 AirEngine5760-51      nor   0   25S    - 
----------------------------------------------------------------------------------------------

Configure WLAN service parameters.

# Create the security profile wlan-net and configure a security policy in the profile.

In this example, the security policy is set to WPA-WPA2+PSK+AES and the password to YsHsjx_202206. In actual situations, configure the security policy based on service requirements.

[WAC-wlan] security-profile name wlan-net
[WAC-wlan-sec-prof-wlan-net] security wpa-wpa2 psk pass-phrase YsHsjx_202206 aes
[WAC-wlan-sec-prof-wlan-net] quit

# Create the SSID profile wlan-net and set the SSID name to wlan-net.

[WAC-wlan] ssid-profile name wlan-net
[WAC-wlan-ssid-prof-wlan-net] ssid wlan-net
[WAC-wlan-ssid-prof-wlan-net] quit

# Create the VAP profile wlan-net, set the service data forwarding mode and service VLAN, and bind the security profile and SSID profile to the VAP profile.

[WAC-wlan] vap-profile name wlan-net
[WAC-wlan-vap-prof-wlan-net] forward-mode direct-forward
[WAC-wlan-vap-prof-wlan-net] service-vlan vlan-id 101
[WAC-wlan-vap-prof-wlan-net] security-profile wlan-net
[WAC-wlan-vap-prof-wlan-net] ssid-profile wlan-net
[WAC-wlan-vap-prof-wlan-net] quit

# Bind the VAP profile wlan-net to radios 0 and 1 of APs in the AP group.

[WAC-wlan] ap-group name ap-group1
[WAC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 0
[WAC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 1
[WAC-wlan-ap-group-ap-group1] quit

Configure an IoT card.

# Configure communication parameters between the APs and host computer.

[WAC-wlan] iot-profile name wlan-iot
[WAC-wlan-iot-prof-wlan-iot] type common
[WAC-wlan-iot-prof-wlan-iot] management-server server-ip 10.23.200.1 server-port 805
[WAC-wlan-iot-prof-wlan-iot] management-server server-ip 10.23.200.1 server-port 800
[WAC-wlan-iot-prof-wlan-iot] quit
[WAC-wlan] ap-group name ap-group1
[WAC-wlan-ap-group-ap-group1] card 1
[WAC-wlan-ap-group-ap-group1-card-1] card connect-type serial
[WAC-wlan-ap-group-ap-group1-card-1] iot-profile wlan-iot config-agent tcp port 50201
[WAC-wlan-ap-group-ap-group1-card-1] quit
[WAC-wlan-ap-group-ap-group1] quit

Verifying the Configuration

# The WLAN service configuration is automatically delivered to the APs. After the service configuration is complete, run the display vap ssid wlan-net command to check VAP profile information. If Status in the command output displays ON, the VAPs have been successfully created for the corresponding AP radios.

[WAC-wlan] display vap ssid wlan-net
WID : WLAN ID 
-------------------------------------------------------------------------------- 
AP ID AP name RfID WID    BSSID          Status  Auth type     STA   SSID 
-------------------------------------------------------------------------------- 
0     room_1  0    1      00E0-FC76-E360 ON      WPA/WPA2-PSK  1     wlan-net 
0     room_1  1    1      00E0-FC76-E370 ON      WPA/WPA2-PSK  0     wlan-net 
0     door_1  0    1      00E0-FC76-E460 ON      WPA/WPA2-PSK  1     wlan-net 
0     door_1  1    1      00E0-FC76-E470 ON      WPA/WPA2-PSK  0     wlan-net 
0     door_2  0    1      00E0-FC76-E560 ON      WPA/WPA2-PSK  1     wlan-net 
0     door_2  1    1      00E0-FC76-E570 ON      WPA/WPA2-PSK  0     wlan-net 
------------------------------------------------------------------------------------

# Run the display iot-profile name wlan-iot command to check the IoT profile configuration.

[WAC-wlan] display iot-profile name wlan-iot
-------------------------------------------------------------------------------- 
Type                             : common 
Agent permit IP address          : -
Agent permit net-mask            : -
Management server IP address     : 10.23.200.1 
Management server port           : 805 
Management server IP address     : 10.23.200.1 
Management server port           : 800 
ExtManagement server IP address  : - 
ExtManagement server port        : - 
Share key                        : - 
Antenna status                   : -  
--------------------------------------------------------------------------------

Configuration Scripts

DeviceA

#
sysname DeviceA
#
vlan batch 100 to 101
#
interface 10GE0/0/1
 port link-type trunk
 port trunk allow-pass vlan 100 to 101
#
interface 10GE0/0/2
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100 to 101
#
interface 10GE0/0/3
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100 to 101
#
interface 10GE0/0/4
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100 to 101
#
return

WAC

#
sysname WAC
#
vlan batch 100 to 101
#
dhcp enable
#
interface Vlanif100
 ip address 10.23.100.1 255.255.255.0
 dhcp select interface
#
interface Vlanif101
 ip address 10.23.101.1 255.255.255.0
 dhcp select interface
#
interface 10GE0/0/1
 port link-type trunk
 port trunk allow-pass vlan 100 to 101
#
capwap source interface vlanif 100
#
wlan
 security-profile name wlan-net
  security wpa-wpa2 psk pass-phrase %+%##!!!!!!!!!"!!!!(!!!!*!!!!7LTnVOK_g:P(0L.)>b_*#Lf}!-lgAQ50~^%!!!!!2jp5!!!!!!>!!!!])4=/r=`2WNY
2h:%>Eb,L5KYE40RK6|UX29h+HkG%+%# aes
 ssid-profile name wlan-net
  ssid wlan-net
 vap-profile name wlan-net
  service-vlan vlan-id 101
  ssid-profile wlan-net
  security-profile wlan-net
 regulatory-domain-profile name default
 iot-profile name wlan-iot 
  management-server server-ip 10.23.200.1 server-port 800
  management-server server-ip 10.23.200.1 server-port 805
 ap-group name ap-group1
  radio 0
   vap-profile wlan-net wlan 1
  radio 1
   vap-profile wlan-net wlan 1
  card 1
   iot-profile wlan-iot config-agent tcp port 50201
 ap-id 0 type-id 130 ap-mac 00e0-fc76-e360 ap-sn 210235419610D2000066
  ap-name room_1
  ap-group ap-group1
 ap-id 1 type-id 130 ap-mac 00e0-fc76-e460 ap-sn 210235419610D2000067
  ap-name door_1
  ap-group ap-group1
 ap-id 2 type-id 130 ap-mac 00e0-fc76-e560 ap-sn 210235419610D2000068
  ap-name door_2
  ap-group ap-group1
#
return

Example for Configuring an IoT Card Based on the Network Port Protocol

Networking Requirements

As shown in Figure 10-118, a supermarket wants to deploy a network to provide the wireless network access and expand IoT applications to easily display and manage prices of commodities in the supermarket using ESLs.

WAC networking mode: Layer 2 off-path networking
DHCP deployment mode: The WAC functions as a DHCP server to assign IP addresses to APs and STAs.

Service data forwarding mode: direct forwarding

Figure 10-118 Network diagram of the IoT card configuration based on the Ethernet port protocol

In this example, interface1, interface2, and interface3 represent 10GE0/0/1, 10GE0/0/2, and 10GE0/0/3, respectively.

Table 10-74 provides an example of data planning.

Table 10-74 Data planning

Item	Data
Management VLAN for APs	VLAN 100
Service VLAN for STAs	VLAN 101
VLAN for communication between the ESL management system and ESLs	VLAN 102
DHCP server	The WAC functions as a DHCP server to assign IP addresses to APs and STAs.
IP address pool for APs	10.23.100.2–10.23.100.254/24
IP address pool for STAs	10.23.101.2–10.23.101.254/24
WAC's source interface	VLANIF 100: 10.23.100.1/24
AP group	Name: ap-group1 Referenced profiles: VAP profile wlan-net, regulatory domain profile default, radio profile wlan-radio2g, AP system profile ap-system, and AP wired port profiles wired1 and wired2
Regulatory domain profile	Name: default Country code: CN
SSID profile	Name: wlan-net SSID name: wlan-net
Security profile	Name: wlan-net Security policy: WPA-WPA2+PSK+AES Password: YsHsjx_202206
VAP profile	Name: wlan-net Forwarding mode: direct forwarding Service VLAN: VLAN 101 Referenced profiles: SSID profile wlan-net and security profile wlan-net
AP system profile	Name: ap-system Connection type between IoT cards and APs: Ethernet
AP wired port profiles	Name: wired1 Working mode of AP wired interfaces: root VLAN of AP wired interfaces: 102 (tagged) Name: wired2 Working mode of AP wired interfaces: endpoint VLAN of AP wired interfaces: 102 (untagged) PVID of AP wired interfaces: 102

Configuration Roadmap

Configure network connectivity between the WAC, APs, and other network devices.
Configure APs to go online.
1. Create an AP group and add APs that require the same configuration to the group for unified configuration.
2. Configure WAC system parameters, including the country code and WAC's source interface for communication with APs.
3. Configure the AP authentication mode and import APs so that they can go online normally.
Configure WLAN service parameters so that STAs can access the WLAN.
Configure the interconnection between the ERP system and the ESL management system.
Configure the ESL management system to communicate with ESLs.

Procedure

Configure DeviceA, APs, and the WAC to communicate with each other.

# Configure DeviceA. Add 10GE0/0/1 and 10GE0/0/2 to VLAN 100 (management VLAN) and VLAN 101 (service VLAN).

<HUAWEI> system-view
[HUAWEI] sysname DeviceA
[DeviceA] vlan batch 100 101
[DeviceA] interface 10ge 0/0/1
[DeviceA-10GE0/0/1] port link-type trunk
[DeviceA-10GE0/0/1] port trunk allow-pass vlan 100 to 101
[DeviceA-10GE0/0/1] quit
[DeviceA] interface 10ge 0/0/2
[DeviceA-10GE0/0/2] port link-type trunk
[DeviceA-10GE0/0/2] port trunk pvid vlan 100
[DeviceA-10GE0/0/2] port trunk allow-pass vlan 100 to 101
[DeviceA-10GE0/0/2] quit

# Configure the WAC. Add 10GE0/0/1 to VLAN 100 (management VLAN) and VLAN 101 (service VLAN).

<HUAWEI> system-view
[HUAWEI] sysname WAC
[WAC] vlan batch 100 101
[WAC] interface 10ge 0/0/1
[WAC-10GE0/0/1] port link-type trunk
[WAC-10GE0/0/1] port trunk allow-pass vlan 100 101
[WAC-10GE0/0/1] quit

Configure the WAC as a DHCP server to assign IP addresses to APs and STAs.
# Configure the DHCP server based on interface address pools.
Configure a DNS server address as required. The common methods are as follows:
- In an interface address pool scenario, run the dhcp server dns-list ip-address &<1-8> command in the VLANIF interface view.
- In a global address pool scenario, run the dns-list ip-address &<1-8> command in the IP address pool view.
```
[WAC] dhcp enable
[WAC] interface vlanif 100
[WAC-Vlanif100] ip address 10.23.100.1 24
[WAC-Vlanif100] dhcp select interface
[WAC-Vlanif100] quit
[WAC] interface vlanif 101
[WAC-Vlanif101] ip address 10.23.101.1 24
[WAC-Vlanif101] dhcp select interface
[WAC-Vlanif101] quit
```

Configure APs to go online.

# Create an AP group to which APs requiring the same configuration can be added.

[WAC] wlan
[WAC-wlan] ap-group name ap-group1
[WAC-wlan-ap-group-ap-group1] quit

# Create a regulatory domain profile, configure the country code of the WAC in the profile, and bind the profile to the AP group.

[WAC-wlan] regulatory-domain-profile name default
[WAC-wlan-regulate-domain-default] country-code cn
[WAC-wlan-regulate-domain-default] quit
[WAC-wlan] ap-group name ap-group1
[WAC-wlan-ap-group-ap-group1] regulatory-domain-profile default
Warning: This configuration change will clear the channel and power configurations of radios, and may restart APs. Continue?[Y/N]:y
[WAC-wlan-ap-group-ap-group1] quit
[WAC-wlan] quit

# Configure the WAC's source interface.

The CAPWAP source interface or source address can be successfully configured only when all of the following security-related configurations exist: PSK for DTLS encryption, user name and password for logging in to an AP, and password for logging in to the global offline management VAP. If any of these configurations does not exist, the system prompts you to supplement related configurations first.

[WAC] capwap source interface vlanif 100
Set the DTLS PSK(contains 8-32 plain-text characters, or 128 or 148 cipher-text characters that must be a combination of at least tw
o of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):********
Confirm PSK:********
Set the user name for FIT APs(The value is a string of 4 to 31 characters, which can contain letters, underscores, and digits, and m
ust start with a letter):********
Set the password for FIT APs(plain-text password of 8-128 characters or cipher-text password of 128-268 characters that must be a co
mbination of at least three of the following: lowercase letters a to z, uppercase letters A to Z, digits, and special characters):******
Confirm password:********
Set the PSK of the global offline management VAP(plain-text password of 8-63 characters or cipher-text password of 128-188 character
s that must be a combination of at least two of the following: lowercase letters a to z, uppercase letters A to Z, digits, and speci
al characters):********
Confirm PSK:********

# Enable the function of establishing CAPWAP DTLS sessions in none authentication mode.

[WAC] capwap dtls no-auth enable
Warning: This operation allows for device access in non-DTLS encryption mode even when DTLS is enabled and brings security risks. After the device goes online for the first time, disable this function to prevent security risks. Continue? [Y/N]:y

[WAC] wlan
[WAC-wlan] ap auth-mode mac-auth
Warning: The authentication mode is switched to MAC address authentication. Ensure that the APs added offline have MAC address information. Otherwise, configurations of these APs may be lost after the device restarts. Continue? [Y/N]:y
[WAC-wlan] ap-id 0 ap-mac 00e0-fc12-3456
[WAC-wlan-ap-0] ap-name area_1 
[WAC-wlan-ap-0] ap-group ap-group1
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power and antenna gain configuration s of the radio, Whether to continue? [Y/N]:y
[WAC-wlan-ap-0] quit

# Power on the AP and run the display ap all command to check the AP state. If the State field displays nor, the AP goes online successfully.

[WAC-wlan] display ap all
Total AP information: 
nor  : normal          [1] 
ExtraInfo : Extra information      
P  : insufficient power supply  
Total: 1
---------------------------------------------------------------------------------------------- 
ID   MAC            Name   Group     IP            Type                  State STA Uptime ExtraInfo 
---------------------------------------------------------------------------------------------- 
0    00e0-fc12-3456 area_1 ap-group1 10.23.100.254 AirEngine5760-51      nor   0   25S    -
----------------------------------------------------------------------------------------------

Configure WLAN service parameters.

# Create the security profile wlan-net and configure a security policy in the profile.

In this example, the security policy is set to WPA-WPA2+PSK+AES and the password to YsHsjx_202206. In actual situations, configure the security policy based on service requirements.

[WAC-wlan] security-profile name wlan-net
[WAC-wlan-sec-prof-wlan-net] security wpa-wpa2 psk pass-phrase YsHsjx_202206 aes
[WAC-wlan-sec-prof-wlan-net] quit

# Create the SSID profile wlan-net and set the SSID name to wlan-net.

[WAC-wlan] ssid-profile name wlan-net
[WAC-wlan-ssid-prof-wlan-net] ssid wlan-net
[WAC-wlan-ssid-prof-wlan-net] quit

# Create the VAP profile wlan-net, set the service data forwarding mode and service VLAN, and bind the security profile and SSID profile to the VAP profile.

[WAC-wlan] vap-profile name wlan-net
[WAC-wlan-vap-prof-wlan-net] forward-mode direct-forward
[WAC-wlan-vap-prof-wlan-net] service-vlan vlan-id 101
[WAC-wlan-vap-prof-wlan-net] security-profile wlan-net
[WAC-wlan-vap-prof-wlan-net] ssid-profile wlan-net
[WAC-wlan-vap-prof-wlan-net] quit

# Bind the VAP profile wlan-net to radios 0 and 1 of APs in the AP group.

[WAC-wlan] ap-group name ap-group1
[WAC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 0
[WAC-wlan-ap-group-ap-group1] vap-profile wlan-net wlan 1 radio 1
[WAC-wlan-ap-group-ap-group1] quit

Configure the interconnection between the ERP system and the ESL management system based on the actual networking. The configuration is not mentioned here.

Configure Layer 2 communication between IoT cards and the ESL management system.

# On DeviceA, add 10GE0/0/2 connected to the AP and 10GE0/0/3 connected to the ESL management system to VLAN 102.

[DeviceA] vlan batch 102
[DeviceA] interface 10ge 0/0/2
[DeviceA-10GE0/0/2] port trunk allow-pass vlan 102
[DeviceA-10GE0/0/2] quit
[DeviceA] interface 10ge 0/0/3
[DeviceA-10GE0/0/3] port link-type trunk
[DeviceA-10GE0/0/3] port trunk pvid vlan 102
[DeviceA-10GE0/0/3] port trunk allow-pass vlan 102
[DeviceA-10GE0/0/3] quit

Configure an IoT card.

# Configure the AP wired port profile wired1.

[WAC-wlan] quit
[WAC] vlan batch 102
[WAC] wlan
[WAC-wlan] wired-port-profile name wired1
[WAC-wlan-wired-port-wired1] mode root
Warning: If the AP goes online through a wired port, the incorrect port mode configuration will cause the AP to go out of management.  This fault can be recovered only by modifying the configuration on the AP. Continue? [Y/N]:y
[WAC-wlan-wired-port-wired1] vlan tagged 102
[WAC-wlan-wired-port-wired1] quit

# Bind the AP wired port profile wired1 to the AP group.

[WAC-wlan] ap-group name ap-group1
[WAC-wlan-ap-group-ap-group1] wired-port-profile wired1 gigabitethernet 0
[WAC-wlan-ap-group-ap-group1] quit

# In the AP system profile, set the connection type between IoT cards and APs to Ethernet. Configure the AP wired port profile wired2. Then apply the AP system profile and AP wired port profile.

[WAC-wlan] ap-system-profile name ap-system
[WAC-wlan-ap-system-prof-ap-system] card connect-type ethernet
[WAC-wlan-ap-system-prof-ap-system] quit
[WAC-wlan] wired-port-profile name wired2
[WAC-wlan-wired-port-wired2] mode endpoint
Warning: If the AP goes online through a wired port, the incorrect port mode configuration will cause the AP to go out of management . This fault can be recovered only by modifying the configuration on the AP. Continue? [Y/N]:y
[WAC-wlan-wired-port-wired2] vlan pvid 102
[WAC-wlan-wired-port-wired2] vlan untagged 102
[WAC-wlan-wired-port-wired2] quit
[WAC-wlan] ap-group name ap-group1
[WAC-wlan-ap-group-ap-group1] ap-system-profile ap-system
[WAC-wlan-ap-group-ap-group1] card 1
[WAC-wlan-ap-group-ap-group1-card-1] wired-port-profile wired2
[WAC-wlan-ap-group-ap-group1-card-1] quit
[WAC-wlan-ap-group-ap-group1] quit

# Restart the AP so that the configurations in AP wired port profiles can take effect.

[WAC-wlan] ap-reset all
Warning: Reset AP(s), continue?[Y/N]:y

Initialize the ESL card, register ESLs, associate the ESL IDs with commodity codes, and configure the ESL service. For details, contact the vendor to obtain the operation guide.

Verifying the Configuration

[WAC-wlan] display vap ssid wlan-net
WID : WLAN ID 
Total: 2
-------------------------------------------------------------------------------- 
AP ID AP name RfID WID    BSSID          Status  Auth type     STA   SSID 
-------------------------------------------------------------------------------- 
0     area_1  0    1      00e0-fc12-3456 ON      WPA/WPA2-PSK  1     wlan-net 
0     area_1  1    1      00e0-fc12-3457 ON      WPA/WPA2-PSK  0     wlan-net
------------------------------------------------------------------------------------

# Run the display wired-port-profile name profile-name command to check the configuration of an AP wired port profile.

[WAC-wlan] display wired-port-profile name wired1
...
Port work mode                                 : root
...
Port Tagged VLAN                               : 102
Port untagged VLAN                             : 1
Port PVID VLAN                                 : -
...

[WAC-wlan] display wired-port-profile name wired2
...
Port work mode                                 : endpoint
...
Port Tagged VLAN                               : -
Port untagged VLAN                             : 1 102
Port PVID VLAN                                 : 102
...

Configuration Scripts

DeviceA

#
sysname DeviceA
#
vlan batch 100 to 102
#
interface 10GE0/0/1
 port link-type trunk
 port trunk allow-pass vlan 100 to 101
#
interface 10GE0/0/2
 port link-type trunk
 port trunk pvid vlan 100
 port trunk allow-pass vlan 100 to 102
#
interface 10GE0/0/3
 port link-type trunk
 port trunk pvid vlan 102
 port trunk allow-pass vlan 102
#
return

WAC

#  
sysname WAC 
#
vlan batch 100 to 102
#
dhcp enable
#
interface Vlanif100
 ip address 10.23.100.1 255.255.255.0
 dhcp select interface
#
interface Vlanif101
 ip address 10.23.101.1 255.255.255.0
 dhcp select interface
#
interface 10GE0/0/1
 port link-type trunk
 port trunk allow-pass vlan 100 to 101
#
capwap source interface vlanif 100
#
wlan
 security-profile name wlan-net
  security wpa-wpa2 psk pass-phrase %+%##!!!!!!!!!"!!!!(!!!!*!!!!7LTnVOK_g:P(0L.)>b_*#Lf}!-lgAQ50~^%!!!!!2jp5!!!!!!>!!!!])4=/r=`2WNY
2h:%>Eb,L5KYE40RK6|UX29h+HkG%+%# aes
 ssid-profile name wlan-net
  ssid wlan-net
 vap-profile name wlan-net
  service-vlan vlan-id 101
  ssid-profile wlan-net
  security-profile wlan-net
 regulatory-domain-profile name default
 ap-system-profile name ap-system
  card connect-type ethernet
 wired-port-profile name wired1
  mode root
  vlan tagged 102
 wired-port-profile name wired2
  mode endpoint
  vlan pvid 102
  vlan untagged 102
 ap-group name ap-group1
  ap-system-profile ap-system
  wired-port-profile wired1 gigabitethernet 0
  regulatory-domain-profile default
  radio 0
   vap-profile wlan-net wlan 1
  radio 1
   vap-profile wlan-net wlan 1
  card 1
   wired-port-profile wired2
 ap-id 0 type-id 130 ap-mac 00e0-fc12-3456 ap-sn 210235419610D2000066
  ap-name area_1
  ap-group ap-group1
#
return