Edge-Core серии ES3528,ES3510,ES3510MA,ES3528M в связке с MikBiLL
Описание
Принцип работы весьма прост.
По событию на порту свича, коммутатор отсылает запрос у radiusd чтобы узнать что делать с абонентом.
Микбил отвечает какой номер влана применить на порту. Вланы можно создать абсолютно разные т е влан для страницы без денег, влан для незарегистрированных абонентов, рабочий влан и т д Т е мы имеем действующий комплекс с таким функционалом:
- интерактивный доступ на свиче, меняется влан на порту чтобы проинформировать абонента
- логирование в биллинге событий на портах свича.
Настройка Сегмента
Создадим сегмент
Далее создаем все действующие сегменты А так же сегмент для страницы без денег и как минимум для неавторизованых включений
Настройка Системных опций
В системных опцияз задаем какие vlan будут без денег, гостевые и т д.
Настройка Устройства
Создаем "Тип устройства"
Создаем свич , задаем ему тип, указываем его IP
Указываем в свиче порты uplink
Указываем рабочий vlan для абонентов в этом свиче. Указать только 1 vlan в котором они будут получать услугу интернет.
Настройка шейпера для свича
Пример конфига
!<stackingDB>00</stackingDB> !<stackingMac>01_70-72-cf-4d-8d-81_03</stackingMac> ! ! ! hostname 7/10_1 sntp server 66.187.233.4 192.36.143.150 131.173.17.7 ! sntp client sntp poll 3600 clock timezone UTC hour 2 minute 0 after-utc ! ! snmp-server location 7/10_1 snmp-server contact mikbill@mikbill.ru ! ! ! ! clock timezone-predefined GMT+0200-Helsinki,Kyiv,Riga,Sofia,Tallinn,Vilnius network-access aging ! ! ! upgrade opcode auto upgrade opcode path tftp://10.10.0.1/ ! ! ! snmp-server community public ro snmp-server community private rw ! vlan database vlan 1 name DefaultVlan media ethernet state active vlan 110 name inet_to_user media ethernet state active vlan 800 name nomoney media ethernet state active vlan 801 name guest media ethernet state active vlan 2000 name managment media ethernet state active vlan 3001 name IPTV_MVR media ethernet state active ! spanning-tree mst configuration ! mvr mvr group 239.100.0.0 239.100.0.254 mvr vlan 3001 ! ! ip dhcp snooping no ip dhcp snooping verify mac-address ip dhcp snooping vlan 1,110,800-801 ip dhcp snooping information option encode no-subtype ! ip arp inspection ip arp inspection validate dst-mac ip arp inspection validate ip ip arp inspection validate src-mac ! interface vlan 1 ip igmp snooping immediate-leave interface vlan 110 ip igmp snooping immediate-leave interface vlan 800 ip igmp snooping immediate-leave interface vlan 801 ip igmp snooping immediate-leave interface vlan 2000 ip address 10.0.7.10 255.255.0.0 ip igmp snooping immediate-leave interface vlan 3001 ip igmp snooping immediate-leave ! interface ethernet 1/1 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/2 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/3 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/4 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/5 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/6 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/7 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/8 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/9 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/10 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/11 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/12 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/13 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/14 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/15 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/16 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/17 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/18 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/19 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/20 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/21 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/22 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/23 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/24 ip source-guard sip-mac ip igmp max-groups 5 mvr type receiver mvr immediate network-access mode mac-authentication ! interface ethernet 1/25 ip dhcp snooping trust switchport allowed vlan add 110,800-801,2000,3001 tagged mvr type source ! interface ethernet 1/26 ip dhcp snooping trust switchport allowed vlan add 110,800-801,2000,3001 tagged mvr type source ! interface ethernet 1/27 ip dhcp snooping trust switchport allowed vlan add 110,800-801,2000,3001 tagged mvr type source ! interface ethernet 1/28 ip dhcp snooping trust switchport allowed vlan add 110,800-801,2000,3001 tagged mvr type source ! ! ip default-gateway 10.0.0.1 ! radius-server 1 host 10.0.0.2 auth-port 1812 acct-port 1813 timeout 5 retransmit 10 key secret ! aaa group server radius test ! mac-authentication reauth-time 864000 ! line console silent-time 0 ! line VTY ! end !