Configuring a Dual‑SSID Fat AP on a Huawei AR Router

This document explains how to configure a Huawei AR router to act as a fat access point providing two SSIDs – one for employees and one for guests – using VLANs, DHCP, and WLAN settings.

Data planning : Use the AR router as the DHCP server. Create VLAN 10 for employee traffic (SSID employee, password huawei@123, subnet 10.10.10.0/24) and VLAN 20 for guest traffic (SSID guest, password abcd@123, subnet 10.10.20.0/24).

Interface and DHCP configuration : [AR] vlan batch 10 20 // create VLANs [AR] dhcp enable // enable global DHCP [AR] interface vlanif 10 // create VLANIF10 [AR-Vlanif10] ip address 10.10.10.1 255.255.255.0 // set gateway for VLAN10 [AR-Vlanif10] dhcp select interface // enable DHCP on the interface [AR-Vlanif10] dhcp server dns-list 114.114.114.114 // DNS for clients

[AR-Vlanif10] quit

[AR] interface vlanif 20

// create VLANIF20 [AR-Vlanif20] ip address 10.10.20.1 255.255.255.0 // set gateway for VLAN20

[AR-Vlanif20] dhcp server dns-list 114.114.114.114

[AR-Vlanif20] quit

WLAN business configuration :

Enable dot1x globally: [AR] dot1x enable Employee SSID :

Create WLAN‑BSS1 and bind to VLAN 10:

[AR] interface wlan-bss 1

[AR-Wlan-Bss1] port hybrid tagged vlan 10

[AR-Wlan-Bss1] quit

Enter WLAN view and create security and traffic profiles for employee:

[AR] wlan

[AR-wlan-view] security-profile name employee

[AR-wlan-sec-prof-employee] security-policy wpa2

[AR-wlan-sec-prof-employee] wpa2 authentication-method psk pass-phrase cipher huawei@123 encryption-method ccmp

[AR-wlan-sec-prof-employee] quit

[AR-wlan-view] traffic-profile name employee

[AR-wlan-traffic-prof-employee] quit

Create the service set and bind the components:

[AR-wlan-view] service-set name employee

[AR-wlan-service-set-employee] ssid employee

[AR-wlan-service-set-employee] wlan-bss 1

[AR-wlan-service-set-employee] security-profile name employee

[AR-wlan-service-set-employee] traffic-profile name employee

[AR-wlan-service-set-employee] quit

Guest SSID (similar steps for VLAN 20):

Create WLAN‑BSS2 and bind to VLAN 20:

[AR] interface wlan-bss 2

[AR-Wlan-Bss2] port hybrid tagged vlan 20

[AR-Wlan-Bss2] quit

Configure security profile for guest:

[AR] wlan

[AR-wlan-view] security-profile name guest

[AR-wlan-sec-prof-guest] security-policy wpa2

[AR-wlan-sec-prof-guest] wpa2 authentication-method psk pass-phrase cipher abcd@123 encryption-method ccmp

[AR-wlan-sec-prof-guest] quit

[AR-wlan-view] traffic-profile name guest

[AR-wlan-traffic-prof-guest] quit

Create the guest service set and bind components:

[AR-wlan-view] service-set name guest

[AR-wlan-service-set-guest] ssid guest

[AR-wlan-service-set-guest] wlan-bss 2

[AR-wlan-service-set-guest] security-profile name guest

[AR-wlan-service-set-guest] traffic-profile name guest

[AR-wlan-service-set-guest] quit

Exit the WLAN view:

[AR-wlan-view] quit