01-08 WDS Configuration

NetEngine AR
CLI-based Configuration Guide - WLAN-AC 8 WDS Configuration
8 WDS Configuration
This chapter describes how to configure the WLAN Wireless Distribution System
(WDS). Different from APs on a traditional WLAN, APs on a WDS network are
connected in wireless mode and can set up multi-hop wireless links.
8.1 Overview of WDS

8.2 Understanding WDS
8.3 Application Scenarios for WDS
8.4 Understanding WDS Profiles
8.5 Configuration Precautions for WDS
8.6 Default Settings for WDS
8.7 Configuring WDS
8.8 Maintaining WDS
8.9 Configuration Examples for WDS
8.1 Overview of WDS
Definition
A wireless distribution system (WDS) connects two or more wired or wireless LANs
wirelessly to establish a large network.
Purpose
On a traditional WLAN, APs exchange data with STAs using wireless channels and
connect to a wired network through uplinks. To expand the coverage area of a
wireless network, APs need to be connected by switches. This deployment involves
high costs and takes a long time. In some places, such as subways, tunnels, and
docks, it is difficult to connect APs to the Internet through wired links. WDS
technology can connect APs wirelessly in these places, which reduces network
deployment costs, makes the network easy to expand, and allows flexible
networking.
Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 297

NetEngine AR
8.2 Understanding WDS
WDS Concepts
Figure 8-1 WDS networking
WDS network
AP VAP:
Root wired
STA VAP: VAP12
interface
VAP13
VAP0
AP3 AP2 AP1
(leaf) (middle) (root) AC
STA Internet
STA
Switch
Endpoint STA
wired
interface
LAN
: Service wireless virtual link
: Management wireless virtual link
PC
● Service VAP: On a traditional WLAN, an AP is a physical entity that provides

WLAN services to STAs. A service virtual access point (VAP) is a logical entity
that provides access service for users. Multiple VAPs can be created on an AP
to provide access service for multiple user groups. In Figure 8-1, VAP0 created
on AP3 is a service VAP.
● WDS VAP: On a WDS network, an AP is a functional entity that provides WDS
service for neighboring devices. WDS VAPs include AP and STA VAPs. AP VAPs
provide connections for STA VAPs. In Figure 8-1, VAP13 created on AP3 is a
STA VAP, and VAP12 created on AP2 is an AP VAP.
● Wireless virtual link (WVL): a connection set up between a STA VAP and an
AP VAP on neighboring APs, as shown in Figure 8-1.
● AP working mode: Depending on its location on a WDS network, an AP can
work in root, middle, or leaf mode, as shown in Figure 8-1.
– Root: The AP directly connects to an AC through a wired link and uses an
AP VAP to set up wireless virtual links with a STA VAP.
– Middle: The AP uses a STA VAP to connect to an AP VAP on an upstream
AP and uses an AP VAP to connect to a STA VAP on a downstream AP.

NetEngine AR
– Leaf: The AP uses a STA VAP to connect to an AP VAP on an upstream AP.

● Working mode of an AP's wired interface: On a WDS network, depending on
the location of the AP, a wired interface works in root or endpoint mode.
– Root: The wired interface connects to an upstream wired network.
– Endpoint: The wired interface connects to a downstream user host or
LAN.
NOTE
On a WDS network, one wired interface must work in root mode to connect to the
wired network.
WDS Implementation
● AP online process
After WDS is enabled on an AP, the AP automatically creates WDS VAPs (AP
VAP and STA VAP). The AP uses the WDS VAPs to set up WVLs with other APs.
The AP connects to the AC through the WVL and obtains configurations from
the AC.
● Service intercommunication
On a WDS network, service data is transmitted over the WVLs. After an AP
goes online, it needs to set up service links through WVLs. Figure 8-2 shows
how a service link is set up between AP2 and AP3 on the WDS network
shown in Figure 8-1.
Figure 8-2 Setting up a service link
AP3 AP2
(STA VAP) (AP VAP)
Probe Request
1
Probe Response
2
Authentication Request
3
Authentication Response
4
Association Request
5
Association Response
6
Access authentication
7
Key negotiation
8

NetEngine AR
a. Probe request
AP3 broadcasts a Probe Request frame carrying a WDS-Name field
(similar to SSID in WLAN service).
b. Probe response
AP2 receives the Probe Request frame and sends AP3 a Probe Response
frame.
c. Authentication request
After AP3 receives the Probe Response frame, it sends AP2 an
Authentication Request frame.
d. Authentication response
After AP2 receives the Authentication Request frame, it determines
whether to allow access from AP3, depending on the WDS whitelist
configuration:
▪ If the WDS whitelist is not enabled, AP2 allows access from AP3 and
sends an Authentication Response frame to notify AP3 that the
authentication has succeeded.
▪ If the WDS whitelist is enabled, AP2 checks whether the MAC

address of AP3 is included in the WDS whitelist.
○ If the MAC address of AP3 is included in the WDS whitelist, AP2
allows access from AP3 and sends an Authentication Response
frame to notify AP3 that the authentication has succeeded.
○ If the MAC address of AP3 is not included in the WDS whitelist,
AP2 sends an Authentication Response frame with an error code,
indicating that the authentication has failed. The process ends
and the service wireless virtual link (WVL) cannot be set up.
e. Association request
After AP3 receives the Authentication Response frame indicating
successful authentication, it sends an Association Request frame to AP2.
f. Association response
After AP2 receives the Association Request frame, it sends an Association
Response frame to request AP3 to start the access authentication.
g. Access authentication
On a WDS network, the access authentication method for a STA VAP
must be WPA2-PSK. Therefore, AP3 and AP2 use a pre-configured shared
key for negotiation. If they decrypt messages sent from each other using
the shared key, they have the same shared key and the access
authentication is successful.
h. Key negotiation
AP3 and AP2 negotiate an encryption key to encrypt service packets.
NOTE
● After a service link is set up, APs periodically send link status messages to each other. If one
AP does not receive any from the other AP, it disconnects the service link and starts to set up
a new one.
● If the AC delivers new WDS parameter settings to APs, the APs use them to set up service
links.

NetEngine AR
WDS Network Architecture

A WDS network can be deployed in point-to-point or point-to-multipoint mode.
● Point-to-point deployment
As shown in Figure 8-3, AP1 sets up wireless virtual links with AP2 to provide
wireless access service for users.
Figure 8-3 Point-to-point WDS deployment
AP1
STA Internet
AP2 AC
STA
LAN
PC PC : Service wireless virtual link

● Point-to-multipoint deployment
As shown in Figure 8-4, AP1, AP2, and AP3 set up wireless virtual links with
AP4. Data from all STAs associating with AP1, AP2, and AP3 is forwarded by
AP4.

NetEngine AR
Figure 8-4 Point-to-multipoint WDS deployment
PC
LAN
STA
AP1
STA
Internet
STA
AP2 AP4 AC
STA
AP3
STA
LAN

PC
8.3 Application Scenarios for WDS

In WDS application, APs can be deployed in the hand-in-hand or back-to-back
mode.
Hand-in-Hand WDS Networking

As shown in Figure 8-5, AP1 is a single-band AP that works at 2.4 GHz frequency
band, AP2 and AP3 are all dual-band APs. AP1 and AP2 use 2.4 GHz radio to set
up wireless virtual links (WVLs), while AP2 and AP3 use 5 GHz radio to set up
WVLs. AP3 connects STAs to the WLAN through the 2.4 GHz radio. On a hand-in-
hand WDS network, AP1, AP2, and AP3 use different radios to set up WVLs.

NetEngine AR
Figure 8-5 Hand-in-hand WDS networking applications
AP3 AP2 AP1

(leaf) (root/leaf) (root) Switch AC
Internet
5G 2.4G
STA STA PC PC

NOTE
In the figure, AP2 on 2.4 GHz radio functions as a leaf node for AP1 and AP2 on 5 GHz
radio functions as a root node for AP3.
If the APs supporting dual 5G radios, you can set radio 0 of the AP1 and AP2 to the 5G
radio.
Back-to-Back WDS Networking

In outdoor scenarios, such as school campus, plantations, and mountain areas,
wired networks are difficult to deploy. When networks to be connected are far
from each other or blocked by obstacles, APs can be cascaded as trunk bridges in
back-to-back mode. This networking ensures sufficient bandwidth on wireless links
for long distance data transmission. Figure 8-6 shows the back-to-back WDS
networking.

NetEngine AR
Figure 8-6 Back-to-back WDS networking
Internet
AC
Switch PC
AP1
(root)
PC
AP2
(leaf) @2
AP3
(root)
AP4 AP5 AP6

(leaf) (leaf) (leaf)
STA STA STA STA STA STA

8.4 Understanding WDS Profiles

A WDS profile contains major parameters required for configuring the WDS
function. To enable radios of an AP group or a specified AP to set up WDS links, a
WDS profile must be applied to the radios.
When configuring WDS services, use the WDS profile with the following profiles:
● Security profile: After a security profile is bound to a WDS profile, parameters
in the security profile will be used for WDS link setup to ensure security of

NetEngine AR
WDS links. Currently, the WDS profile supports only the security policy
WPA2+PSK+AES.
● WDS whitelist profile: A WDS whitelist profile contains MAC addresses of
neighboring APs allowed to set up WDS links with an AP. After a WDS
whitelist profile is applied to an AP radio, only APs with MAC addresses in the
whitelist can access the AP, and other APs are denied. In the WDS, only APs
with radios working in root mode and middle mode can have a whitelist
configured. APs in leaf mode require no whitelist.
NOTE
● A neighboring AP with the MAC address in the whitelist can set up a wireless virtual
link with the local AP only after passing security authentication.
● If no WDS whitelist profile is used, all neighboring APs can access the local AP.
● AP group radio or AP radio: You can configure major feature parameters for
radios in an AP group or a specified AP radio, including the working channel
and bandwidth, antenna gain, transmit power, and radio coverage distance.
For example, when configuring the WDS function, configure the same channel
for radios of WDS APs.
● Radio profile: The radio profile is classified into the 2G and 5G radio profiles.
You can configure other radio parameters for WDS links through a radio
profile.
By default, the system provides the WDS profile default. By default, the security
profile default-wds is referenced by a WDS profile regardless of whether the WDS
profile is the default profile provided by the system or a WDS profile created by
users. The default username and password are available in AR Router Default
Usernames and Passwords (Enterprise Network or Carrier). If you have not
obtained the access permission of the document, see Help on the website to find
out how to obtain it. If the default security profile default-wds is used, you are
advised to change the security key of the profile to ensure security.
8.5 Configuration Precautions for WDS

● On a WDS network, an 802.11ac AP cannot interoperate with non-802.11ac
APs regardless of the radio types used by the AP. Only 802.11ac APs can
interoperate with each other.
● When planning a WDS network, pay attention to the following:
– The back-to-back WDS networking involves two WDS networks. A single
WDS network cannot form a back-to-back WDS network.
– Only one root node exists on the WDS network.
– A middle node sets up WDS links only with the leaf node and root node.
Middle nodes do not set up WDS links between each other.
– Each WDS link allows a maximum of three hops (a 3-hop WDS link
includes a root node, a middle node, and a leaf node).
– Each node on the WDS link supports a maximum of six subnodes.
● This chapter provides only WDS configurations. After the WDS configurations
are complete, APs can connect to an AC through WDS links. To use WLAN
services, you also need to configure basic WLAN services. For configurations
of basic WLAN services, see 4 Basic WLAN Service Configuration.

NetEngine AR
● When dual-band APs are used on WDS networks, the root AP and leaf AP
cannot use radio 0 or radio 1 simultaneously to establish a WDS link.
● When configuring the WDS function, ensure that the root, middle, and leaf
nodes use the same WDS profile; otherwise, WDS links cannot be set up or
the existing WDS links get disconnected.
● Avoid using radar channels to configure WDS links; otherwise, the following
problems may occur:
– Establishing WDS links on radar channels takes several minutes or several
ten minutes longer than establishing WDS links on non-radar channels.
– Radar signals cause disconnection of established WDS links.
● If WDS services are configured on an AP radio, WIDS on the radio does not
take effect.
● Radio calibration does not take effect on radios enabled with WDS functions.
● If you set the CAPWAP heartbeat interval or the number of heartbeat packet
transmissions too small using the capwap echo interval interval-value or
capwap echo times times-value command, WDS links may fail to be
established. Therefore, you are advised to use the default values.
● If WDS is enabled simultaneously with dual-link backup, the AC sends
CAPWAP heartbeat packets three times at an interval of 25 seconds by
default. This may cause unstable WDS links status and result in user access
failures. You are advised to run the capwap echo times times-value
command to set the number of heartbeat packet transmissions to 6 or a
larger value.
8.6 Default Settings for WDS

Table 8-1 lists the default settings for WDS.
Table 8-1 Default settings for WDS
Parameter Default Setting
Security profile bound to a WDS default-wds

profile
WDS mode of a WDS profile leaf
WDS name of a WDS profile HUAWEI-WLAN-WDS
Default WDS profile default
WDS whitelist profile None
8.7 Configuring WDS

Pre-configuration Tasks
Before configuring WDS, complete the following tasks:

NetEngine AR
● Create an AP group.
● Configure network interconnections.
● Configure AC system parameters.
Procedure
Perform the following steps in the listed order.
8.7.1 Adding an AP
Context
You can add APs in any of the following modes:
● Importing APs offline: The APs' MAC addresses and serial numbers (SNs) are
configured on an AC before APs go online. The AC starts to set up connections
with the APs if the MAC addresses or SNs of the APs match the configured
ones.
● Configuring the AC to automatically discover an AP: The AP authentication
mode is set to no authentication; alternatively, the AP authentication mode is
set to MAC or SN authentication and the AP whitelist is configured on the AC.
When an AP in the whitelist connects to the AC, the AC discovers the AP, and
the AP goes online.
● Manually confirming APs added to the list of unauthorized APs: The AP
authentication mode is set to MAC or SN authentication, and the AP whitelist
is configured on the AC. When an AP out of the whitelist connects to the AC,
the AC adds the AP to the list of unauthorized APs. After the AP identity is
confirmed, the AP can go online.
Depending on its location on a WDS network, an AP can work in root, middle, or

leaf mode. As shown in Figure 8-7, AP1 is a root node, AP2 is a middle node, and
AP3 is a leaf node. You can configure an AP's working mode based on actual
situations.
Figure 8-7 WDS networking
AP3 AP2 AP1

(leaf) (middle) (root)
Internet
STA AC
LAN
STA

PC : Management wireless virtual link

NetEngine AR
Procedure
● Add an AP offline.
a. Run the system-view command to enter the system view.
b. Run the wlan ac command to enter the WLAN view.
c. (Optional) Run the ap blacklist mac ap-mac1 [ to ap-mac2 ] command
to add the AP to an AP blacklist.
By default, no AP is in an AP blacklist.
d. Run the ap auth-mode { mac-auth | sn-auth } command to set the AP
authentication mode to MAC address authentication or SN
authentication.
The default AP authentication mode is MAC address authentication.

e. Run the ap-id ap-id [ type-id type-id | ap-type ap-type ] [ ap-mac ap-
mac ] [ ap-sn ap-sn ] or ap-mac ap-mac [ type-id type-id | ap-type ap-
type ] [ ap-id ap-id ] [ ap-sn ap-sn ] command to import the AP offline
and enter the AP view.
f. Run the ap-name ap-name command to configure the AP name.
By default, no AP name is configured for an AP.

g. Run the ap-group group-name command to add the AP to an AP group.
By default, no AP group is configured.

● Configure the AC to automatically discover an AP.
NOTE
If no AP name or AP group is configured for an automatically discovered AP on the AC, the

configuration file of the AP name or AP group will not be generated in the AP view.
If an AP is deleted from the AC, the configuration in the AP view will be automatically
deleted.
– Set the AP authentication mode to no authentication.
i. Run the system-view command to enter the system view.
ii. Run the wlan ac command to enter the WLAN view.
iii. (Optional) Run the ap blacklist mac ap-mac1 [ to ap-mac2 ]
command to add the AP to an AP blacklist.
iv. Run the ap auth-mode no-auth command to set the AP
authentication mode to no authentication.
NOTE
The non-authentication mode brings security risks. You are advised to set
the authentication mode to MAC address authentication or SN
authentication, which is more secure.
– Set the AP authentication mode to MAC address or SN authentication.
i. Run the system-view command to enter the system view.
ii. Run the wlan ac command to enter the WLAN view.

NetEngine AR
iii. (Optional) Run the ap blacklist mac ap-mac1 [ to ap-mac2 ]

command to add the AP to an AP blacklist.
iv. Run the ap auth-mode { mac-auth | sn-auth } command to set the
AP authentication mode to MAC address authentication or SN
authentication.
v. Configure the AP whitelist.
○ Run the ap whitelist mac ap-mac1 [ to ap-mac2 ] command to
add the AP with the specified MAC address to the whitelist if the
AP authentication mode is set to MAC address authentication.
By default, no MAC address is added to the AP whitelist.
○ Run the ap whitelist sn ap-sn1 [ to ap-sn2 ] command to add
the AP with the specified SN to the whitelist if the AP
authentication mode is set to SN authentication.
By default, no SN is added to the AP whitelist.
● Manually confirm the AP added to the list of unauthorized APs.
a. Run the system-view command to enter the system view.
b. Run the wlan ac command to enter the WLAN view.
c. (Optional) Run the ap blacklist mac ap-mac1 [ to ap-mac2 ] command
to add the AP to an AP blacklist.
d. Run the ap auth-mode { mac-auth | sn-auth } command to set the AP
authentication mode to MAC address authentication or SN
authentication.

e. Run the display ap unauthorized record command to check information
about unauthorized APs.
f. Run the ap-confirm { all | mac ap-mac | sn ap-sn } command to confirm
the unauthorized APs. After confirmation, the APs work in normal state.
----End
8.7.2 Configuring WDS Radio Parameters
Context
To ensure that WDS links can be set up successfully on a WDS network, you need
to configure radio parameters for WDS links according to actual service
requirements.
● On a WDS network, radios of APs must work on the same channel.
● You need to configure the radio coverage distance parameter based on
distances between APs. The APs automatically adjust the values of
acktimeout, slottime, and ctstimeout based on the configured distance
parameter to set up WDS links correctly.

NetEngine AR
Procedure
Step 1 Run system-view
The system view is displayed.
Step 2 Run wlan ac
The WLAN view is displayed.
Step 3 Enter the radio view.
● Enter the AP group radio view.
a. Run the ap-group name group-name command to enter the AP group
view.
b. Run the radio radio-id command to enter the radio view.
● Enter the AP radio view.
a. Run the ap-id ap-id, ap-mac ap-mac, or ap-name ap-name command to
enter the AP view.
Step 4 Run channel { 20mhz | 40mhz-minus | 40mhz-plus | 80mhz | 160mhz } channel
or channel 80+80mhz channel1 channel2
The working bandwidth and channel are configured for the radio.
By default, the working bandwidth of a radio is 20 MHz, and no working channel
is configured for a radio.
On a WDS network, radios of APs must work on the same channel.
The 80 MHz, 160 MHz, and 80+80 MHz working bandwidths are only supported in
the 5G radio view.
Working channels of radios vary according to countries and regions. To conform to
local laws and regulations, you need to configure different working channels
under different country codes. You can run the display ap configurable channel
{ ap-name ap-name | ap-id ap-id } command to check the channels supported by
the specified AP.
Step 5 Run coverage distance distance
The radio coverage distance parameter is specified.
By default, the radio coverage distance parameter is 3 (unit: 100 m) for all radios.
You can configure the radio coverage distance parameter based on distances
between APs and the APs automatically adjust the values of slottime, acktimeout,
and ctstimeout based on the configured distance parameter to improve data
transmission efficiency.
Step 6 Run antenna-gain antenna-gain
The antenna gain is configured for the radio.
By default, no antenna gain is configured for AP radios.
The antenna gain is the ratio of the power density produced by an antenna to the
power density that should be obtained at the same point if the power accepted by

NetEngine AR
the antenna were radiated equally. It can measure the capability for an antenna to
receive and send signals in a specified direction, which is one of the most
important parameters to select a BTS antenna. In the same condition, if the
antenna gain is high, the wave travels far.
The antenna gain of an AP radio configured using the command must be
consistent with the gain of the antenna connected to the AP.
The maximum antenna gain should comply with laws and regulations of the
corresponding country. For details, see the Country Code & Channel Compliance
Table.
Step 7 Run eirp eirp
The transmit power is configured for the radio.
By default, the transmit power of a radio is 127 dBm.
You can configure the transmit power for a radio based on actual network
environments, enabling radios to provide the required signal strength and
improving signal quality on WLANs.
Step 8 Run frequency 5g
Radio 0 is configured to work on the 5 GHz frequency band.
By default, radio 0 works on the 2.4 GHz frequency band, and radio 2 work on the
5 GHz frequency band.
Step 9 Run quit
Return to the AP group view or AP view.
Step 10 Run quit
Return to the WLAN view.
Step 11 Run radio-2g-profile name profile-name or radio-5g-profile name profile-name
The 2G or 5G radio profile view is displayed.
Step 12 Run wifi-light signal-strength
The blinking frequency of the Wireless indicator on the AP is configured to reflect
the signal strength.
By default,
● If WDS is enabled on an AP, the blinking frequency of the Wireless LED
reflects the strength of signals received from a WDS AP.
– If the AP works in leaf mode, the blinking frequency of the Wireless LED
reflects the strength of signals received from a middle AP.
– If the AP works in middle mode, the blinking frequency of the Wireless
LED reflects the strength of signals received from a root AP.
– If the AP works in root mode, the blinking frequency of the Wireless LED
reflects the weakest signal strength of middle APs.
● If the WDS functions are disabled on an AP, the blinking frequency of the
Wireless LED reflects the service traffic volume on the radio.
During installation and commissioning of an AP that has the WDS function
enabled, you need to adjust AP locations and antenna directions to obtain strong

NetEngine AR
signals. If the blinking frequency of the Wireless LED shows the signal strength,
onsite installation personnel can know the signal strength in real time. The wifi-
light command allows you to specify the parameter reflected by the blinking
frequency of the Wireless LED. For example, you can specify the parameter to
signal strength during installation and service traffic volume after installation.
NOTE
This command takes effect only when the AP has the WDS function enabled. If the WDS
functions are disabled on the AP, the Wireless LED always shows service traffic volume.
Step 13 (Optional) Configure the frame aggregation function and length of the
aggregated frames.
The frame aggregation function can improve the channel resource usage efficiency
and overall WDS network performance.
● Configure the frame aggregation function for the 802.11n protocol.
a. Run the undo ht a-mpdu disable command to enable the frame
aggregation function for the 802.11n protocol.
By default, aggregation of MPDUs is enabled.
b. Run the ht a-mpdu max-length-exponent max-length-exponent-index
command to set the length of aggregated frames for the 802.11n
protocol.
By default, the index for the maximum length of an A-MPDU is 3. The
maximum length of the A-MPDU is 65535 bytes.
● Configure the frame aggregation function for the 802.11ac protocol.
Run the vht a-mpdu max-length-exponent max-length-exponent-index
command to set the length of aggregated frames for the 802.11ac protocol.
By default, the index for the maximum length of an A-MPDU is 7. The
maximum length of the A-MPDU is 1048575 bytes.
NOTE
The length of an A-MPDU can only be configured in a 5G radio profile.

All frames on radios working in 802.11ac mode are A-MPDUs. Therefore, you do not
need to enable the frame aggregation function for the 802.11ac protocol.
----End
Follow-up Procedure
In the AP group view or AP view, run the radio-2g-profile profile-name { radio
{ radio-id | all } } or radio-5g-profile profile-name { radio { id | all } } command
to bind the 2.4G or 5G radio profile to the AP radio. Alternatively, you can run the
radio-2g-profile profile-name or radio-5g-profile profile-name command in the
AP group radio view or AP radio view to bind the 2.4G or 5G radio profile to the
AP radio.

NetEngine AR
8.7.3 Configuring Parameters for an AP's Wired Interface
Context
You can configure the wired interface on a root AP to connect to the AC or
configure the wired interface on an AP to deploy a Layer 2 network or directly
associate with STAs.
On WDS networks, an AP wired interface can work in the following modes:

● root mode: The wired interface that connects the root AP to the AC must
work in root mode.
● endpoint mode: When the wired interface of an AP works in endpoint mode,
the AP's wired interface can directly connect to a STA or be used to deploy
Layer 2 networks.
Procedure
Step 2 Run wlan ac
Step 3 Run wired-port-profile name profile-name
An AP wired port profile is created and the AP wired port profile view is displayed.
By default, the system provides the AP wired port profile default.
Step 4 Set parameters for an AP wired interface.

● Configure a wired interface to work in root mode.
a. Run the mode root command to configure an AP's wired interface to
work in root mode.
By default, the GigabitEthernet interface of a common AP works in root
mode, the Ethernet interface in endpoint mode, and the Eth-trunk
interface in root mode.
● Configure a wired interface to work in endpoint mode.
a. Run the mode endpoint command to configure an AP's wired interface
to work in endpoint mode.
By default, the GigabitEthernet interface of a common AP works in root
mode, the Ethernet interface in endpoint mode, and the Eth-trunk
interface in root mode.
b. Run the vlan pvid vlan-id command to configure the PVID of an AP's
wired interface.
By default, no PVID is configured for an AP wired interface.
c. Run the vlan { tagged | untagged } { vlan-id1 [ to vlan-id2 ] } &<1-10>
command to add an AP's wired interface to VLANs.
By default, an AP wired interface is added to VLAN 1 in untagged mode.

NetEngine AR
NOTE
An AP's wired interface can be added to a maximum of 256 VLANs.

d. Run the user-isolate { all | l2 } command to enable user isolation on an
AP's wired interface.
By default, user isolation is disabled on an AP's wired interface.
----End
Follow-up Procedure
Run the wired-port-profile profile-name interface-type interface-number
command in the AP group view or AP view to bind the specified AP wired port
profile to the AP's wired interface.
8.7.4 Configuring a Security Profile
Context
You need to configure a security profile and a security policy for the WDS to
ensure security. Currently, the security policy can only be WPA2+PSK+AES. For
details about WPA2, PSK, and AES, see 7 WLAN Security Configuration.
By default, the system provides the WDS profile default. By default, the security
profile default-wds is referenced by a WDS profile regardless of whether the WDS
profile is the default profile provided by the system or a WDS profile created by
users. The default username and password are available in AR Router Default
Usernames and Passwords (Enterprise Network or Carrier). If you have not
obtained the access permission of the document, see Help on the website to find
out how to obtain it. If the default security profile default-wds is used, you are
advised to change the security key of the profile to ensure security.
Procedure
Step 2 Run wlan ac
Step 3 Run security-profile name profile-name
A security profile is created, and the security profile view is displayed.
By default, security profiles default and default-wds are available in the system.
Step 4 Run security wpa2 psk { pass-phrase | hex } key-value aes
A security policy is configured for the security profile.
----End

NetEngine AR
8.7.5 (Optional) Configuring a WDS Whitelist

Context
A WDS whitelist profile contains MAC addresses of neighboring APs allowed to set
up WDS links with an AP. After a WDS whitelist profile is applied to an AP radio,
only APs with MAC addresses in the whitelist can access the AP, and other APs are
denied. In the WDS, only APs with radios working in root mode and middle mode
can have a whitelist configured. APs in leaf mode require no whitelist.
NOTE
● WDS links can be set up only when neighboring APs with MAC addresses in the whitelist
succeed in authentication.
● If the AP uses no whitelist, all the neighboring APs can connect to the bridge.
Procedure
Step 2 Run wlan ac
Step 3 Run wds-whitelist-profile name whitelist-name
A WDS whitelist profile is created, and the WDS whitelist profile view is displayed.
By default, no WDS whitelist profile is available in the system.
Step 4 Run peer-ap mac mac-address
MAC addresses of neighboring APs that are allowed to connect to an AP are
added to the WDS whitelist profile.
By default, no MAC address of a neighboring AP is added to a WDS whitelist
profile.
Step 5 Run quit
Step 6 Enter the radio view.
● Enter the AP group radio view.
view.
● Enter the AP radio view.
enter the AP view.
Step 7 Run wds-whitelist-profile whitelist-name

NetEngine AR
The WDS whitelist profile is bound to the AP radio.
By default, no WDS whitelist profile is bound to an AP radio.
----End
8.7.6 Configuring a WDS Profile
Context
A WDS profile contains major parameters required for configuring the WDS
function. To enable radios of an AP group or a specified AP to set up WDS links, a
WDS profile must be applied to the radios.
Procedure
Step 2 Run wlan ac
Step 3 Run wds-profile name profile-name
A WDS profile is created and the WDS profile view is displayed.
By default, the system provides the WDS profile default.
Step 4 Run wds-name name
A WDS name is set for the WDS profile. WDS nodes use a WDS name to identify
connections between them.
By default, the WDS name of a WDS profile is HUAWEI-WLAN-WDS.
Step 5 Run wds-mode { root | middle | leaf }
The WDS mode is configured in the WDS profile.
By default, the WDS mode in a WDS profile is leaf.
Step 6 Run security-profile profile-name
A security profile is bound to the WDS profile.
By default, the security profile default-wds is bound to a WDS profile.
NOTE
By default, the system provides the WDS profile default. By default, the security profile
default-wds is referenced by a WDS profile regardless of whether the WDS profile is the
default profile provided by the system or a WDS profile created by users. The default
username and password are available in AR Router Default Usernames and Passwords
(Enterprise Network or Carrier). If you have not obtained the access permission of the
document, see Help on the website to find out how to obtain it. If the default security
profile default-wds is used, you are advised to change the security key of the profile to
ensure security.

NetEngine AR
Step 7 Run vlan tagged { vlan-id1 [ to vlan-id2 ] } &<1-10>

A VLAN or a group of VLANs are added to the WDS profile in tagged mode.
By default, no VLAN is configured in a WDS profile.
When configuring WDS, perform this step to configure service VLANs in the WDS
profile so that packets from the service VLANs can be transmitted over WDS links.
NOTE
A maximum of 256 VLANs can be added to a WDS profile.
Step 8 (Optional) Run dhcp trust port

A DHCP trusted port is configured in the WDS profile.
By default, no DHCP trusted port is configured in a WDS profile.
NOTE
After a DHCP trusted port is enabled in a WDS profile and the WDS profile is applied to an
AP, the AP receives the DHCP OFFER, ACK, and NAK packets sent by authorized DHCP
servers and forwards the packets to STAs so that the STAs can obtain valid IP addresses and
go online.
Step 9 (Optional) Run priority-map trust { dot1p | dscp }

The priority mapping trusted by the WDS air interface is configured.
By default, the WDS air interface trusts the mapping from DSCP priorities to
802.11e user priorities.
Step 10 (Optional) Run priority-map dscp { dscp-value1 [ to dscp-value2 ] } &<1-10>
dot11e dot11e-value
The WDS air interface to configured to trust the mapping from DSCP priorities to
802.11e user priorities.
Table 8-2 describes the mapping from DSCP priorities to 802.11e user priorities by
default.
Table 8-2 Mapping from DSCP priorities to 802.11e user priorities
DSCP Priority 802.11e User Priority
0-7 0
8-15 1
16-23 2
24-31 3
32-39 4
40-47 5
48-55 6
56-63 7

NetEngine AR
Step 11 Run quit
Step 12 Apply the WDS profile. You can use any of the following methods according to
actual situations:
NOTE
A WDS link uses the VAPs with the WLAN ID 13 and ID 14, which cannot be occupied by other
WLAN services.
● Bind the WDS profile to an AP group.
view.
b. Run the wds-profile profile-name radio { all | radio-id } command to
bind the WDS profile to the AP group.
By default, no WDS profile is bound to an AP group or AP.
● Bind the WDS profile to an AP.
enter the AP view.
b. Run the wds-profile profile-name radio { all | radio-id } command to
bind the WDS profile to the AP.
By default, no WDS profile is bound to an AP group or AP.
● Bind the WDS profile to AP group radios.
view.
c. Run the wds-profile profile-name command to bind the WDS profile to
AP group radios.
By default, no WDS profile is bound to an AP radio.
● Bind the WDS profile to an AP radio.
enter the AP view.
c. Run the wds-profile profile-name command to bind the WDS profile to
the AP radio.
By default, no WDS profile is bound to an AP radio.
----End
8.7.7 Verifying the WDS Configuration
Prerequisites
The WDS configuration is complete.

NetEngine AR
Procedure
● Run the display references wds-profile name profile-name command to
check reference information of a specified WDS profile.
● Run the display wds-profile { all | name profile-name } command to check
information of a WDS profile.
● Run the display references wds-whitelist-profile name whitelist-name
command to check reference information of a specified WDS whitelist profile.
● Run the display wds-whitelist-profile { all | name whitelist-name }
command to check information of a WDS whitelist profile.
----End
8.8 Maintaining WDS
8.8.1 Checking Information About WDS Links

Procedure
● Run the display wds vap { ap-group ap-group-name | ap-id ap-id [ radio
radio-id ] | ap-name ap-name [ radio radio-id ] } [ wds-name wds-name ]
command to check information about WDS VAPs.
● Run the display wds vap { all | wds-name wds-name } command to check
information about WDS VAPs of a specified WDS name or all WDS names.
● Run the display wlan wds link { all | ap-id ap-id [ radio radio-id ] | ap-name
ap-name [ radio radio-id ] | wds-profile profile-name } command to check
information about WDS links.
----End
8.8.2 Configuring Antenna Alignment VAPs
Context
During WDS network deployment, you can configure antenna alignment VAPs for
WDS nodes to facilitate antenna alignment between neighboring APs. When
commissioning the network onsite, connect a mobile terminal to an antenna
alignment VAP and start the antenna alignment program on the terminal to
collect signal strength information of the peer AP radio. The collected information
boosts easy antenna alignment operations.
You can log in to Huawei technical support website and search for Probe Handset
Unit to download the Antenna Alignment program.
● Enterprise technical support website: https://support.huawei.com/enterprise
● Carrier technical support website: https://support.huawei.com
Procedure

NetEngine AR

Step 2 Run wlan ac
Step 3 Run security-profile name profile-name
The security profile used by antenna alignment VAPs is created and the security
profile view is displayed.
By default, security profiles default and default-wds are available in the system.
Step 4 Run security { wpa | wpa2 | wpa-wpa2 } psk { pass-phrase | hex } key-value
{ aes | tkip | aes-tkip }
The security policy and key are configured.
By default, the security policy is open system.
NOTE
The antenna alignment VAP supports only the WEP or WPA/WPA2 PSK authentication mode.
You can run the security wep share-key and wep key key-id { wep-40 | wep-104 | wep-128 }
{ pass-phrase | hex } key-value commands to configure WEP authentication.
Step 5 Run quit

Step 6 Run ssid-profile name profile-name
An SSID profile is created and the SSID profile view is displayed.
By default, the system provides the SSID profile default.
Step 7 Run ssid ssid
The SSID name is configured.
By default, the SSID HUAWEI-WLAN is configured in an SSID profile.
Step 8 Run quit
Step 9 Run vap-profile name profile-name
A VAP profile is created and the VAP profile view is displayed.
By default, the system provides the VAP profile default.
Step 10 Run temporary-management enable
The VAPs are configured as the offline management VAP and antenna alignment
VAP.
By default, a VAP is a service VAP.
Step 11 Run ssid-profile profile-name
The SSID profile is bound to the VAP profile.
By default, the SSID profile default is bound to a VAP profile.

NetEngine AR
Step 12 Run security-profile profile-name

The security profile is bound to a VAP profile.
By default, the security profile default is bound to a VAP profile.
Step 13 Run quit
Step 14 Run ap-system-profile name profile-name
An AP system profile is created and the AP system profile view is displayed.
By default, the system provides the AP system profile default.
Step 15 Run temporary-management enable
The offline management VAP and antenna alignment VAP functions are enabled.
By default, offline management VAP and antenna alignment VAP functions are
disabled.
Step 16 Run quit
Step 17 Apply the VAP profile. You can use any of the following methods:
● Bind the VAP profile to an AP group.
view.
b. Run the vap-profile profile-name wlan wlan-id { radio { radio-id | all } }
command to bind the VAP profile to the radio.
By default, no VAP profile is bound to a radio.
● Bind the VAP profile to an AP.
enter the AP view.
b. Run the vap-profile profile-name wlan wlan-id { radio { radio-id | all } }
command to bind the VAP profile to the radio.
● Bind the VAP profile to AP group radios.
view.
c. Run the vap-profile profile-name wlan wlan-id command to bind the
VAP profile to AP group radios.
● Bind the VAP profile to an AP radio.
enter the AP view.
c. Run the vap-profile profile-name wlan wlan-id command to bind the
VAP profile to AP group radios.

NetEngine AR

Step 18 Run quit
Step 19 Apply the AP system profile. You can use any of the following methods:
● Bind the AP system profile to an AP group.
view.
b. Run the ap-system-profile profile-name command to bind the AP
system profile to the AP group.
By default, the AP system profile default is bound to an AP group, but no
AP system profile is bound to an AP.
● Bind the AP system profile to an AP.
enter the AP view.
b. Run the ap-system-profile profile-name command to bind the AP
system profile to the AP.
By default, the AP system profile default is bound to an AP group, but no
AP system profile is bound to an AP.
Step 20 Run quit
Step 21 Run commit { all | ap-name ap-name | ap-id { ap-id1 [ to ap-id2 ] } &<1-10> }
Configurations are delivered to APs.
----End
8.9 Configuration Examples for WDS
8.9.1 Example for Configuring Back-to-Back WDS

Networking Requirements
On some enterprise networks, wired network deployment is restricted by
construction conditions. When networks to be connected are far from each other
or blocked by obstacles, APs cannot all be connected to an AC in wired mode. To
solve this issue, back-to-back wireless distribution system (WDS) technology is
used to cascade APs in wired mode as trunk bridges. This networking ensures
sufficient bandwidth of wireless links for long-distance data transmission.
● AC1 networking mode: Layer 2 networking in bypass mode
● DHCP deployment mode:
– AC1 functions as a DHCP server to assign IP addresses to APs.
– The aggregation switch (Switch_A) functions as a DHCP server to assign
IP addresses to STAs.

NetEngine AR
● Wireless backhaul mode: back-to-back WDS

● Backhaul radio: 5 GHz radio
Figure 8-8 Networking diagram for configuring back-to-back WDS
Switch_A
GE0/0/2 GE0/0/3
Network
GE0/0/1 GE1/0/0
AC1 GE0/0/1 AC2
10.23.101.2/24
Management VLAN: VLAN 100
Service VLAN: VLAN 101
GE0/0/2
Switch_B
AP_1 Area A
(root)
AP_2 Area B
(leaf)
GE0/0/2
Switch_C
GE0/0/1
AP_3
(root)
AP_4 Area C
(leaf)
VLAN 101 PC
Wireless virtual
link

NetEngine AR
Data Planning
Table 8-3 AP data planning

AP Name Model MAC Address
AP_1 AP8130DN 00-e0-fc-12-34-56
AP_2 AP8130DN 00-e0-fc-12-34-57
AP_3 AP8130DN 00-e0-fc-12-34-58
AP_4 AP8130DN 00-e0-fc-12-34-59
Table 8-4 AC1 data planning

Item Data
Management VLAN VLAN 100

for APs
Service VLAN for the VLAN 101

wired PC
DHCP server AC1 functions as the DHCP server for APs, and
Switch_A functions as the DHCP server for STAs.
IP address pool for 10.23.100.2–10.23.100.254/24

APs
IP address pool for 10.23.101.3–10.23.101.254/24

the wired PC
IP address of AC1's VLANIF 100: 10.23.100.1/24

source interface
WDS profiles ● wds-net1 (used by AP_1): WDS mode root,

referenced WDS whitelist wds-list1, permitting access
only from AP_2
● wds-net2 (used by AP_3): WDS mode root,
referenced WDS whitelist wds-list2, permitting access
only from AP_4
● wds-net3 (used by AP_2 and AP_4): referencing no
WDS whitelist
WDS roles ● AP_1: root

● AP_2: leaf
● AP_3: root
● AP_4: leaf
WDS name wds-net

NetEngine AR
Item Data
WDS whitelists ● wds-list1: contains the MAC address of AP_2 and is

bound to AP_1.
● wds-list2: contains the MAC address of AP_4 and is
bound to AP_3.
Radios used by WDS Radio 1 (on AP_1 and AP_2):

● Bandwidth: 80 MHz
● Channel: 157
● Radio coverage distance parameter: 4 (unit: 100 m)
Radio 1 (on AP_3 and AP_4):
● Bandwidth: 80 MHz
● Channel: 149
● Radio coverage distance parameter: 4 (unit: 100 m)
Security profile ● Name: wds-sec

● Security policy: WPA2+PSK+AES
● Password type: PASS-PHRASE
● Password: a1234567
AP groups ● wds-root1: AP_1

● wds-root2: AP_3
● wds-leaf1: AP_2
● wds-leaf2: AP_4. The wired interface of AP_4 is
connected to a PC, and an AP wired port profile needs
to be configured for AP_4. Therefore, AP_2 and AP_4
are added to different AP groups.
Configuration Roadmap
1. Configure WDS links between Area A and Area B so that AP_1 and AP_2 can
go online on AC1.
2. Configure Switch_C to enable AP_2 and AP_3 to communicate with each other
through a wired network.
3. Configure WDS links between Area B and Area C so that AP_4 can go online
on AC1.
4. Configure the wired interface of AP_4 to allow the wired PC connected to it to
access the network.
Procedure
1. Configure the network devices.
# On Switch_B, add GE0/0/1 and GE0/0/2 to VLAN 100 and VLAN 101, and
specify VLAN 100 as the default VLAN of GE0/0/1.
<HUAWEI> system-view
[HUAWEI] sysname Switch_B

NetEngine AR
[Switch_B] vlan batch 100 to 101

[Switch_B] interface gigabitEthernet 0/0/1
[Switch_B-GigabitEthernet0/0/1] port link-type trunk
[Switch_B-GigabitEthernet0/0/1] port trunk pvid vlan 100
[Switch_B-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 to 101
[Switch_B-GigabitEthernet0/0/1] port-isolate enable
[Switch_B-GigabitEthernet0/0/1] quit
[Switch_B] interface gigabitEthernet 0/0/2
[Switch_B-GigabitEthernet0/0/2] port link-type trunk
[Switch_B-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 to 101
[Switch_B-GigabitEthernet0/0/2] quit
# On Switch_A, add GE0/0/1 to VLAN 100 and VLAN 101, GE0/0/2 to VLAN
100, and GE0/0/3 to VLAN 101.
[HUAWEI] sysname Switch_A
[Switch_A] vlan batch 100 to 101
[Switch_A] interface gigabitEthernet 0/0/1
[Switch_A-GigabitEthernet0/0/1] port link-type trunk
[Switch_A-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 to 101
[Switch_A-GigabitEthernet0/0/1] quit
[Switch_A-GigabitEthernet0/0/2] port trunk allow-pass vlan 100
[Switch_A-GigabitEthernet0/0/3] port trunk allow-pass vlan 101
# On Switch_C, add GE0/0/1 and GE0/0/2 to VLAN 101.
[HUAWEI] sysname Switch_C
[Switch_C] vlan batch 101
[Switch_C] interface gigabitEthernet 0/0/1
[Switch_C-GigabitEthernet0/0/1] port link-type trunk
[Switch_C-GigabitEthernet0/0/1] port trunk allow-pass vlan 101
[Switch_C-GigabitEthernet0/0/1] quit
[Switch_C] interface gigabitEthernet 0/0/2
[Switch_C-GigabitEthernet0/0/2] port link-type trunk
[Switch_C-GigabitEthernet0/0/2] port trunk allow-pass vlan 101
[Switch_C-GigabitEthernet0/0/2] quit
# On AC2, add GE1/0/0 to VLAN 101. Create VLANIF 101 and set its IP
address to 10.23.101.2/24.
<Huawei> system-view
[Huawei] sysname AC2
[AC2] vlan batch 101
[AC2] interface gigabitethernet 1/0/0
[AC2-GigabitEthernet1/0/0] port link-type trunk
[AC2-GigabitEthernet1/0/0] port trunk allow-pass vlan 101
[AC2-GigabitEthernet1/0/0] quit
[AC2] interface vlanif 101
[AC2-Vlanif101] ip address 10.23.101.2 24
[AC2-Vlanif101] quit
2. Configure AC1 to communicate with other devices on the network.
NOTE
If AC1 is directly connected to APs, set the default VLAN of AC1's interface connected
to the APs to the management VLAN 100.
# On AC1, add GE0/0/1 to VLAN 100.
[HUAWEI] sysname AC1
[AC1] vlan batch 100 to 101
[AC1] interface gigabitEthernet 0/0/1
[AC1-GigabitEthernet0/0/1] port link-type trunk
[AC1-GigabitEthernet0/0/1] port trunk allow-pass vlan 100
[AC1-GigabitEthernet0/0/1] quit

NetEngine AR
3. Configure DHCP servers to assign IP addresses to APs and STAs.

# Configure Switch_A as the DHCP server to assign IP addresses to STAs
through an interface address pool.
NOTE
Configure an IP address for the DNS server based on site requirements. The common
methods are as follows:
● In the interface address pool scenario, run the dhcp server dns-list ip-address
&<1-8> command in the VLANIF interface view.
● In the global address pool scenario, run the dns-list ip-address &<1-8> command
in the IP address pool view.
[Switch_A] dhcp enable
[Switch_A] interface vlanif 101
[Switch_A-Vlanif101] ip address 10.23.101.1 24
[Switch_A-Vlanif101] dhcp select interface
[Switch_A-Vlanif101] quit
# Enable AC1 as the DHCP server to assign IP addresses to APs from an

interface address pool.
[AC1] dhcp enable
[AC1] interface vlanif 100
[AC1-Vlanif100] ip address 10.23.100.1 24
[AC1-Vlanif100] dhcp select interface
[AC1-Vlanif100] quit
4. On AC1, create AP groups, and configure the country code and source
interface.
# Create AP groups wds-root1 and wds-root2 for root APs and AP groups
wds-leaf1 and wds-leaf2 for leaf APs.
[AC1] wlan ac
[AC1-wlan-view] ap-group name wds-root1
[AC1-wlan-ap-group-wds-root1] quit
[AC1-wlan-view] ap-group name wds-leaf1
[AC1-wlan-ap-group-wds-leaf1] quit
# Create a regulatory domain profile, configure the country code for AC1 in
the profile, and bind the profile to the AP groups.
[AC1-wlan-view] regulatory-domain-profile name domain1
[AC1-wlan-regulate-domain-domain1] country-code cn
[AC1-wlan-regulate-domain-domain1] quit
[AC1-wlan-ap-group-wds-root1] regulatory-domain-profile domain1
Warning: This configuration change will clear the channel, power, and antenna gain configurations of
radios, and may restart APs. Continue?[Y/N]:y
[AC1-wlan-ap-group-wds-root2] regulatory-domain-profile domain1
[AC1-wlan-ap-group-wds-leaf1] regulatory-domain-profile domain1
[AC1-wlan-ap-group-wds-leaf2] regulatory-domain-profile domain1

NetEngine AR
# Configure AC1's the source interface.

[AC1] capwap source interface vlanif 100
# Add AP_1 to AP group wds-root1, AP_3 to AP group wds-root2, AP_2 to AP

group wds-leaf1, and AP_4 to AP group wds-leaf2.
NOTE
The default AP authentication mode is MAC address authentication. If the default

setting is retained, you do not need to run the ap auth-mode mac-auth command.
This example uses the AP8130DN with two radios: radio 0 and radio 1.
[AC1] wlan ac
[AC1-wlan-view] ap auth-mode mac-auth
[AC1-wlan-view] ap-id 1 ap-mac 00-e0-fc-12-34-56
[AC1-wlan-ap-1] ap-name AP_1
[AC1-wlan-ap-1] ap-group wds-root1
Warning: This operation may cause AP reset. If the country code changes, it will clear channel, power
and
antenna gain configurations of the radio, Whether to continue? [Y/N]:y
[AC1-wlan-ap-1] quit
[AC1-wlan-ap-2] ap-group wds-leaf1
and
[AC1-wlan-ap-3] ap-group wds-root2
and
[AC1-wlan-ap-4] ap-group wds-leaf2
and
5. Configure WDS service parameters.

# Configure radio parameters for WDS nodes. Radio 1 of the AP8130DN is
used as an example. The parameter coverage distance is the radio coverage
distance parameter, which is 3 (unit: 100 m) by default. This example sets the
radio coverage distance parameter to 4. You can configure the parameter
based on site requirements.
NOTE
On a WDS network, radios that set up WDS links must work on the same channel.
[AC1-wlan-ap-group-wds-root1] radio 1
[AC1-wlan-group-radio-wds-root1/1] channel 80mhz 157
Warning: This action may cause service interruption. Continue?[Y/N]y
[AC1-wlan-group-radio-wds-root1/1] coverage distance 4
[AC1-wlan-group-radio-wds-root1/1] quit
[AC1-wlan-group-radio-wds-root2/1] channel 80mhz 149
[AC1-wlan-group-radio-wds-root2/1] coverage distance 4

NetEngine AR

[AC1-wlan-ap-group-wds-leaf1] radio 1
[AC1-wlan-group-radio-wds-leaf1/1] channel 80mhz 157
[AC1-wlan-group-radio-wds-leaf1/1] coverage distance 4
[AC1-wlan-group-radio-wds-leaf1/1] quit
[AC1-wlan-ap-group-wds-leaf2] radio 1
[AC1-wlan-group-radio-wds-leaf2/1] channel 80mhz 149
[AC1-wlan-group-radio-wds-leaf2/1] coverage distance 4
[AC1-wlan-group-radio-wds-leaf2/1] quit
# Configure the security profile wds-sec used by WDS links, and set the
security policy to WPA2+PSK+AES.
[AC1-wlan-view] security-profile name wds-sec
[AC1-wlan-sec-prof-wds-sec] security wpa2 psk pass-phrase a1234567 aes
[AC1-wlan-sec-prof-wds-sec] quit
# Configure WDS whitelists. Configure the WDS whitelist wds-list1 to be

bound to AP_1 to permit access only from AP_2. Configure the WDS whitelist
wds-list2 to be bound to AP_3 to permit access only from AP_4.
[AC1-wlan-view] wds-whitelist-profile name wds-list1
[AC1-wlan-wds-whitelist-wds-list1] peer-ap mac 00-e0-fc-12-34-57
[AC1-wlan-wds-whitelist-wds-list1] quit
[AC1-wlan-view] wds-whitelist-profile name wds-list2
[AC1-wlan-wds-whitelist-wds-list2] peer-ap mac 00-e0-fc-12-34-59
[AC1-wlan-wds-whitelist-wds-list2] quit
# Configure the WDS profile wds-net1. Set the WDS name to wds-net and
the WDS mode to root. Bind the security profile wds-sec to the WDS profile,
allowing packets from the service VLAN 101 to pass through in tagged mode.
[AC1-wlan-view] wds-profile name wds-net1
[AC1-wlan-wds-prof-wds-net1] wds-name wds-net
[AC1-wlan-wds-prof-wds-net1] wds-mode root
[AC1-wlan-wds-prof-wds-net1] security-profile wds-sec
[AC1-wlan-wds-prof-wds-net1] vlan tagged 101
[AC1-wlan-wds-prof-wds-net1] quit
the WDS mode to root. Bind the security profile wds-sec to the WDS profile,
[AC1-wlan-wds-prof-wds-net2] wds-mode root
the WDS mode to leaf. Bind the security profile wds-sec to the WDS profile,
[AC1-wlan-wds-prof-wds-net3] wds-mode leaf
# Bind the WDS whitelist wds-list1 to radio 1 of APs in the AP group wds-
root1 to permit access only from AP_2. Bind the WDS whitelist wds-list2 to
radio 1 of APs in the AP group wds-root2 to permit access only from AP_4.
[AC1-wlan-group-radio-wds-root1/1] wds-whitelist-profile wds-list1

NetEngine AR
[AC1-wlan-group-radio-wds-root2/1] wds-whitelist-profile wds-list2
6. Configure the AP wired port profile wired-port used by the wired interface of
AP_4 and set the working mode of AP_4's wired interface to endpoint. In this
example, the PVID of the wired interface of AP_4 is set to VLAN 101 and the
wired interface is added to VLAN 101 in untagged mode.
[AC1-wlan-view] wired-port-profile name wired-port
[AC1-wlan-wired-port-wired-port] mode endpoint
Warning: If the AP goes online through a wired port, the incorrect port mode configuration will cause
the AP to go out of management. This fault can be recovered only by modifying the configuration on
the AP. Continue? [Y/N]:y
[AC1-wlan-wired-port-wired-port] vlan pvid 101
[AC1-wlan-wired-port-wired-port] vlan untagged 101
[AC1-wlan-wired-port-wired-port] quit
7. Bind WDS profiles to the AP groups to make WDS services take effect.
# Bind the WDS profile wds-net1 to the AP group wds-root1.
[AC1-wlan-ap-group-wds-root1] wds-profile wds-net1 radio 1
# Bind the WDS profile wds-net2 to the AP group wds-root2.

[AC1-wlan-ap-group-wds-root2] wds-profile wds-net2 radio 1
# Bind the WDS profile wds-net3 to the AP group wds-leaf1.

[AC1-wlan-ap-group-wds-leaf1] wds-profile wds-net3 radio 1
# Bind the WDS profile wds-net3 and AP wired port profile wired-port to the
AP group wds-leaf2.
NOTE
After binding the AP wired port profile in endpoint mode to the AP groups, configure
the APs to go online on AC1 and obtain configurations. Then restart the APs to make
the configurations take effect.
[AC1-wlan-ap-group-wds-leaf2] wds-profile wds-net3 radio 1
[AC1-wlan-ap-group-wds-leaf2] wired-port-profile wired-port gigabitethernet 0
[AC1-wlan-view] quit
[AC1] quit
8. Verify that the APs go online and restart AP_4.

# After the configuration is complete, run the display ap all command to
check whether WDS nodes go online successfully. If State displays as nor, the
APs have gone online successfully.
<AC1> display ap all
Total AP information:
nor : normal [4]
Extra information: P : insufficient power supply
---------------------------------------------------------------------------------------------------
ID MAC Name Group IP Type State STA Uptime ExtraInfo
---------------------------------------------------------------------------------------------------
1 00-e0-fc-12-34-57 AP_1 wds-root1 10.23.100.250 AP8130DN nor 0 20M:16S -

NetEngine AR
4 00-e0-fc-12-34-59 AP_4 wds-leaf2 10.23.100.251 AP8130DN nor 0 17S -

2 00-e0-fc-12-34-58 AP_2 wds-leaf1 10.23.100.253 AP8130DN nor 0 3M:55S -
3 00-e0-fc-12-34-56 AP_3 wds-root2 10.23.100.252 AP8130DN nor 0 2M:55S -
-------------------------------------------------------------------------------------------------
Total: 4
Run the display wlan wds link all command to check information about
WDS links.
<AC1> display wlan wds link all
Rf : radio ID Dis : coverage distance(100m)
Ch : channel Per : drop percent(%)
TSNR : total SNR(dB) P- : peer
WDS : WDS mode Re : retry ratio(%)
RSSI : RSSI(dBm) MaxR : max RSSI(dBm)
-------------------------------------------------------------------------------------------------
APName P-APName Rf Dis Ch WDS P-Status RSSI MaxR Per Re TS NR
SNR(Ch0~3:dB)
-------------------------------------------------------------------------------------------------
AP_1 AP_2 1 4 157 root normal -44 -40 0 3 50 45/49/-/-
AP_2 AP_1 1 4 157 leaf normal -38 -36 0 49 57 36/31/57/-
AP_3 AP_4 1 4 149 root normal -11 -7 0 1 83 81/80/-/-
AP_4 AP_3 1 4 149 leaf normal -4 -4 0 0 91 90/85/-/-
-------------------------------------------------------------------------------------------------
Total: 4
Verify that the APs go online and restart AP_4 to make the working mode of
the AP's wired interface take effect.
<AC1> system-view
[AC1] wlan
[AC1-wlan-view] ap-reset ap-group wds-leaf2
Warning: Reset AP(s), continue?[Y/N]:y
9. Verify the configuration.

After AP_4 goes online again, verify that the wired PC connected to it can
access the network.
Configuration Files
● Switch_A configuration file
#
sysname Switch_A
#
vlan batch 100 to 101
#
dhcp enable
#
interface Vlanif101
ip address 10.23.101.1 255.255.255.0
dhcp select interface
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 100 to 101
#
port trunk allow-pass vlan 100
#
#
return
● Switch_B configuration file

#
sysname Switch_B
#

NetEngine AR

#
port trunk pvid vlan 100
port-isolate enable group 1
#
#
return
● Switch_C configuration file

#
sysname Switch_C
#
vlan batch 101
#
#
#
return
● AC1 configuration file

#
sysname AC1
#
#
dhcp enable
#
interface Vlanif100
ip address 10.23.100.1 255.255.255.0
dhcp select interface
#
#
capwap source interface vlanif100
#
wlan ac
security-profile name wds-sec
security wpa2 psk pass-phrase %^%#n}5+DgC3wLB.hJ34j5;*QMv<8"9#{Bq@ghBI3L9K%^%# aes
wds-whitelist-profile name wds-list1
peer-ap mac 00-e0-fc-12-34-57
wds-whitelist-profile name wds-list2
peer-ap mac 00-e0-fc-12-34-59
wds-profile name wds-net1
security-profile wds-sec
vlan tagged 101
wds-name wds-net
wds-mode root
vlan tagged 101
wds-name wds-net
wds-mode root
vlan tagged 101
wds-name wds-net
regulatory-domain-profile name domain1

NetEngine AR
wired-port-profile name wired-port

mode endpoint
vlan pvid 101
vlan untagged 101
ap-group name wds-leaf1
regulatory-domain-profile domain1
radio 1
wds-profile wds-net3
channel 80mhz 157
coverage distance 4
ap-group name wds-leaf2
wired-port-profile wired-port gigabitethernet 0
radio 1
channel 80mhz 149
coverage distance 4
ap-group name wds-root1
radio 1
wds-whitelist-profile wds-list1
channel 80mhz 157
coverage distance 4
ap-group name wds-root2
radio 1
wds-whitelist-profile wds-list2
channel 80mhz 149
coverage distance 4
ap-id 1 type-id 39 ap-mac 00-e0-fc-12-34-57 ap-sn 210235554710CB000042
ap-name AP_1
ap-group wds-root1
ap-id 2 type-id 39 ap-mac 00-e0-fc-12-34-58 ap-sn 210235555310CC000094
ap-name AP_2
ap-group wds-leaf1
ap-id 3 type-id 39 ap-mac 00-e0-fc-12-34-56 ap-sn 210235419610D2000097
ap-name AP_3
ap-group wds-root2
ap-id 4 type-id 39 ap-mac 00-e0-fc-12-34-59 ap-sn 210235557610DB000046
ap-name AP_4
ap-group wds-leaf2
#
return
● AC2 configuration file

#
sysname AC2
#
vlan batch 101
#
interface Vlanif101
ip address 10.23.101.2 255.255.255.0
#
#
return

01-08 WDS Configuration

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

01-08 WDS Configuration

Uploaded by

Copyright:

Available Formats

NetEngine AR

CLI-based Configuration Guide - WLAN-AC 8 WDS Configuration

8.1 Overview of WDS

8.1 Overview of WDS

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 297

8.2 Understanding WDS

Figure 8-1 WDS networking

● Service VAP: On a traditional WLAN, an AP is a physical entity that provides

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 298

– Leaf: The AP uses a STA VAP to connect to an AP VAP on an upstream AP.

Figure 8-2 Setting up a service link

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 299

▪ If the WDS whitelist is enabled, AP2 checks whether the MAC

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 300

WDS Network Architecture

Figure 8-3 Point-to-point WDS deployment

PC PC : Service wireless virtual link

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 301

Figure 8-4 Point-to-multipoint WDS deployment

: Service wireless virtual link

8.3 Application Scenarios for WDS

Hand-in-Hand WDS Networking

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 302

Figure 8-5 Hand-in-hand WDS networking applications

AP3 AP2 AP1

: Service wireless virtual link

Back-to-Back WDS Networking

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 303

Figure 8-6 Back-to-back WDS networking

AP4 AP5 AP6

STA STA STA STA STA STA

: Service wireless virtual link

8.4 Understanding WDS Profiles

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 304

8.5 Configuration Precautions for WDS

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 305

8.6 Default Settings for WDS

Table 8-1 Default settings for WDS

Parameter Default Setting

Security profile bound to a WDS default-wds

WDS mode of a WDS profile leaf

WDS name of a WDS profile HUAWEI-WLAN-WDS

Default WDS profile default

WDS whitelist profile None

8.7 Configuring WDS

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 306

Depending on its location on a WDS network, an AP can work in root, middle, or

Figure 8-7 WDS networking

AP3 AP2 AP1

: Service wireless virtual link

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 307

The default AP authentication mode is MAC address authentication.

By default, no AP name is configured for an AP.

By default, no AP group is configured.

If no AP name or AP group is configured for an automatically discovered AP on the AC, the

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 308

iii. (Optional) Run the ap blacklist mac ap-mac1 [ to ap-mac2 ]

The default AP authentication mode is MAC address authentication.

8.7.2 Configuring WDS Radio Parameters

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 309

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 310

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 311

The length of an A-MPDU can only be configured in a 5G radio profile.

Issue 06 (2021-08-06) Copyright © Huawei Technologies Co., Ltd. 312