6) Réseaux d’Entreprise & Wi-Fi

! VLANs & Trunk (Cisco IOS)
vlan 10
 name USERS
vlan 20
 name VOICE
interface Gig1/0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 spanning-tree portfast trunk
!
! LACP
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
interface Gig1/0/2
 channel-group 1 mode active
interface Gig1/0/3
 channel-group 1 mode active

# Arista MLAG (extraits)
interface Port-Channel10
 switchport mode trunk
 mlag 10
interface Ethernet1
 channel-group 10 mode active
# Juniper (QFX) LACP
set interfaces ae0 aggregated-ether-options lacp active
set interfaces ae0 unit 0 family ethernet-switching interface-mode trunk

! QoS 802.1p/DSCP
mls qos
mls qos map cos-dscp 0 8 16 24 32 46 48 56
! Multicast
ip igmp snooping
ip pim sparse-mode

! Protections
spanning-tree portfast default
spanning-tree bpduguard default
spanning-tree guard root
spanning-tree loopguard default
storm-control broadcast level 1.00 0.50

show spanning-tree detail
show spanning-tree inconsistentports
show interfaces status err-disabled

! HSRP
interface Vlan10
 standby 10 ip 10.10.10.254
 standby 10 priority 110
 standby 10 preempt
! VRRP
interface Vlan20
 vrrp 20 ip 10.10.20.254
 vrrp 20 priority 120
 vrrp 20 preempt

# vPC (Nexus) — schéma
feature vpc
vpc domain 10
  peer-keepalive destination 10.0.0.2 source 10.0.0.1
interface port-channel10
 switchport mode trunk
 vpc 10

ip multicast-routing
ip pim rp-address 10.10.10.10
ip pim sparse-mode
ip igmp snooping vlan 10

! AAA & RADIUS
aaa new-model
radius server ISE
 address ipv4 10.0.0.10 auth-port 1812 acct-port 1813
 key SuperSecret
aaa authentication dot1x default group radius
! Port d'accès
interface Gig1/0/20
 switchport mode access
 authentication port-control auto
 mab
 dot1x pae authenticator

ip dhcp snooping
ip dhcp snooping vlan 10,20
interface Gig1/0/1
 ip dhcp snooping trust
ip arp inspection vlan 10,20
interface Gig1/0/20
 ip verify source

• Limiter SSID (<= 4) pour réduire overhead; DTIM 3-4.
• Puissance modérée, cellules petites; airtime plutôt que RSSI seul.

• Architectures WLC (CAPWAP) vs contrôleurs cloud (Aruba/Cisco/ Meraki/Ruckus).
• Fonctions: RRM/ARM, band-steering, load-balancing, TPC, rogue AP detection.

• Surveys: prédictif (plans), passif, actif. Outils: Ekahau, TamoGraph.
• KPIs: SNR > 25 dB, RSSI > -65 dBm, airtime utilisation, retries < 10%.

# hostapd (extrait WPA2/WPA3-Enterprise avec EAP-TLS)
interface=wlan0
ssid=Enterprise
wpa=2
wpa_key_mgmt=WPA-EAP-SUITE-B-192 WPA-EAP
ieee80211w=2
auth_server_addr=10.0.0.10
auth_server_port=1812
auth_server_shared_secret=SuperSecret

• SSIDs: Corp (802.1X), Guest (captive portal, Internet only), IoT (MAB, ACL serrées).
• ACL dynamiques ou micro-seg (SGT/TrustSec) depuis RADIUS.

# Mapping DSCP -> WMM (ex. Cisco WLC)
! EF (46) -> AC_VO, AF41 -> AC_VI, Best Effort -> AC_BE

• VoWi-Fi: codecs bas débit (Opus), DTIM adapté, contention minimale.
• 2 SSIDs max sur sites denses; airtime fairness activée.

# Attributs RADIUS classiques
Tunnel-Type = VLAN
Tunnel-Medium-Type = IEEE-802
Tunnel-Private-Group-ID = 30
# dACL / SGT (Cisco TrustSec)
cts role-based enforcement

• Guest: portail captif, durée limitée, sponsor; accès Internet only.
• IoT: profils par OUI/DHCP, réseau isolé + ACL strictes; certs IoT si possible.

! Switch d'accès (Cisco)
aaa authorization network default group radius
ip device tracking
interface Gig1/0/22
 authentication port-control auto
 mab
 dot1x pae authenticator
 spanning-tree portfast

# KPIs Wi-Fi
SNR, RSSI, MCS, retries, airtime utilization, channel utilization, DFS events
# Diag terrain
wireshark, spectrum analyzer (clean vs noisy), ping roam, iPerf test

# Exemples de runbooks
1) Utilisateur Wi-Fi lent: vérifier RSSI/SNR, retries, clients sur 2.4 GHz -> orienter 5/6 GHz.
2) Boucle L2: ports err-disabled, logs STP, storm control; isoler segments.
3) Auth 802.1X KO: logs RADIUS, certificat, horloge (NTP), VLAN attribué.