Nortel 2360, 2380 Installation And Basic Configuration Manual
Reklama
Reklama
Part No. 320656-A
July 2005
4655 Great America Parkway
Santa Clara, CA 95054
WLAN—Security Switch 2300 Series
Installation and Basic Configuration
Guide
*320655-A*
2
Copyright © Nortel Networks Limited 2005. All rights reserved.
The information in this document is subject to change without notice. The statements, configurations, technical data, and recommendations in this document are believed to be accurate and reliable, but are presented without express or implied warranty. Users must take full responsibility for their applications of any products specified in this document. The information in this document is proprietary to Nortel Networks.
Trademarks
*Nortel Networks, the Nortel Networks logo, and the Globemark are trademarks of Nortel Networks.
*Microsoft, MS, MS-DOS, Windows, and Windows NT are registered trademarks of Microsoft Corporation.
*Adobe and Acrobat Reader are trademarks of Adobe Systems Incorporated.
All other trademarks and registered trademarks are the property of their respective owners.
Restricted rights legend
Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph
(c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013.
Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software, the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the
Commercial Computer Software-Restricted Rights clause at FAR 52.227-19.
Statement of conditions
In the interest of improving internal design, operational function, and/or reliability, Nortel Inc. reserves the right to make changes to the products described in this document without notice.
Nortel Inc. does not assume any liability that may occur due to the use or application of the product(s) or circuit layout(s) described herein.
Portions of the code in this software product may be Copyright © 1988, Regents of the University of California. All rights reserved. Redistribution and use in source and binary forms of such portions are permitted, provided that the above copyright notice and this paragraph are duplicated in all such forms and that any documentation, advertising materials, and other materials related to such distribution and use acknowledge that such portions of the software were developed by the University of California, Berkeley. The name of the University may not be used to endorse or promote products derived from such portions of the software without specific prior written permission.
SUCH PORTIONS OF THE SOFTWARE ARE PROVIDED “AS IS” AND WITHOUT ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
In addition, the program and information contained herein are licensed only pursuant to a license agreement that contains restrictions on use and disclosure (that may incorporate by reference certain limitations and notices imposed by third parties).
320656-A
3
USA requirements only
Federal Communications Commission (FCC) Compliance Notice: Radio Frequency Notice
Note: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to
Part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy. If it is not installed and used in accordance with the instruction manual, it may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to take whatever measures may be necessary to correct the interference at their own expense.
Legal Information
•
•
This section includes the following legal information:
“Limited Product Warranty” on page 3
“Trademarks and Service Marks” on page 5
Limited Product Warranty
The following sections describe the Nortel standard Product Warranty for End Users.
Products
WLAN—Security Switch (2300) Series
WLAN—Access Points (233x) Series
Limited Warranty
Nortel standard warranty for hardware is one (1) year. Nortel warrants software materials to be defect free for
90 Days from time of purchase. Nortel requires purchasing the software subscription if a customer would like to receive new WLAN—Security Switch (2300), Nortel WLAN — Management System software. This limited warranty extends only to you the original purchaser of the Product.
Exclusive Remedy
Your sole remedy under the limited warranty described above is, at Nortel ’s sole option and expense, the repair or replacement of the non-conforming Product or refund of the purchase price of the non-conforming
Products. Nortel ’s obligation under this limited warranty is subject to compliance with Nortel ’s then-current
Return Material Authorization (“RMA”) procedures. All replaced Products will become the property of Nortel
. Exchange Products not returned to Nortel will be invoiced at full Product list prices. Replacement Products may be new, reconditioned or contain refurbished materials. In connection with any warranty services hereunder, Nortel may in its sole discretion modify the Product at no cost to you to improve its reliability or performance.
Warranty Claim Procedures
Should a Product fail to conform to the limited warranty during the applicable warranty period as described above, Nortel must be notified during the applicable warranty period in order to have any obligation under the limited warranty.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
4
The End Customer or their designated reseller must obtain a Return Material Authorization number (RMA number) from Nortel for the non-conforming Product and the non-conforming Product must be returned to
Nortel according to the then-current RMA procedures. The End Customer or their designated reseller is responsible to ensure that the shipments are insured, with the transportation charges prepaid and that the RMA number is clearly marked on the outside of the package. Nortel will not accept collect shipments or those returned without an RMA number clearly visible on the outside of the package.
Exclusions and Restrictions
Nortel shall not be responsible for any software, firmware, information or memory data contained in, stored on or integrated with any Product returned to Nortel pursuant to any warranty or repair.
Upon return of repaired or replaced Products by Nortel , the warranty with respect to such Products will continue for the remaining unexpired warranty or sixty (60) days, whichever is longer. Nortel may provide out-of-warranty repair for the Products at its then-prevailing repair rates.
The limited warranty for the Product does not apply if, in the judgment of Nortel , the Product fails due to damage from shipment, handling, storage, accident, abuse or misuse, or it has been used or maintained in a manner not conforming to Product manual instructions, has been modified in any way, or has had any Serial
Number removed or defaced. Repair by anyone other than Nortel or an approved agent will void this warranty.
EXCEPT FOR ANY EXPRESS LIMITED WARRANTIES FROM Nortel Networks SET FORTH ABOVE,
THE PRODUCT IS PROVIDED “AS IS”, AND Nortel Networks AND ITS SUPPLIERS MAKE NO
WARRANTY, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, WITH RESPECT TO PRODUCT
OR ANY PART THEREOF, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTY OF
TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR
THOSE ARISING FROM COURSE OF PERFORMANCE, DEALING, USAGE OR TRADE. Nortel
Networks’S SUPPLIERS MAKE NO DIRECT WARRANTY OF ANY KIND TO END CUSTOMER FOR
THE LICENSED MATERIALS. NEITHER Nortel Networks NOR ANY OF ITS SUPPLIERS WARRANT
THAT THE LICENSED MATERIALS OR ANY PART THEREOF WILL MEET END CUSTOMER'S
REQUIREMENTS OR BE UNINTERRUPTED, OR ERROR-FREE, OR THAT ANY ERRORS IN THE
PRODUCT WILL BE CORRECTED. SOME STATES/JURISDICTIONS DO NOT ALLOW THE EXCLU-
SION OF IMPLIED WARRANTIES SO THE ABOVE EXCLUSIONS MAY NOT APPLY TO END
CUSTOMER. THIS LIMITED WARRANTY GIVES END CUSTOMER SPECIFIC LEGAL RIGHTS. END
CUSTOMER MAY ALSO HAVE OTHER RIGHTS, WHICH VARY FROM STATE/JURISDICTION TO
STATE/JURISDICTION.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL Nortel
Networks OR ITS SUPPLIERS BE LIABLE FOR THE COST OF PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES, LOSS OF PROFITS, OR FOR ANY SPECIAL, CONSEQUENTIAL, INCI-
DENTAL, PUNITIVE OR INDIRECT DAMAGES (OR DIRECT DAMAGES IN THE CASE OF Nortel
Networks’S SUPPLIERS) ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, TORT
(INCLUDING WITHOUT LIMITATION NEGLIGENCE), STRICT LIABILITY OR OTHERWISE
ARISING OUT OF OR RELATED TO THE PRODUCT OR ANY USE OR INABILITY TO USE THE
PRODUCT. Nortel Networks’S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THE
PRODUCT, OR USE OR INABILITY TO USE THE PRODUCT, WHETHER IN CONTRACT, TORT
(INCLUDING WITHOUT LIMITATION NEGLIGENCE), STRICT LIABILITY OR OTHERWISE,
SHALL NOT EXCEED THE PRICE PAID FOR THE PRODUCT. THE LIMITATIONS SET FORTH IN
THIS SECTION SHALL APPLY EVEN IF Nortel Networks AND/OR ITS SUPPLIERS ARE ADVISED OF
THE POSSIBILITY OF SUCH DAMAGE, AND NOTWITHSTANDING THE FAILURE OF ESSENTIAL
320656-A
5
PURPOSE OF ANY LIMITED REMEDY. Nortel Networks NEITHER ASSUMES NOR AUTHORIZES
ANY OTHER PERSON TO ASSUME FOR IT ANY OTHER LIABILITY IN CONNECTION WITH THE
SALE, INSTALLATION, MAINTENANCE OR USE OF ITS PRODUCTS.
Trademarks and Service Marks
Nortel, and the Nortel logo are registered trademarks, and management software is a trademark of Nortel All other trademarks belong to their respective holders.
FCC Statements for WLAN—Security Switches (23x0)
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to
Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense.
•
•
•
•
FCC Statements for WLAN—Access Points (233x)
This section includes the following FCC statements for WLAN—Access Points (233x):
“Class A Statement” on page 5
“RF Radiation Hazard Warning” on page 6
“Non-Modification Statement” on page 6
“Deployment Statement” on page 6
Class A Statement
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to
Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
6
RF Radiation Hazard Warning
To ensure compliance with FCC RF exposure requirements, this device must be installed in a location such that the antenna of the device will be greater than 20 cm (8 in.) from all persons. Using higher gain antennas and types of antennas not covered under the FCC certification of this product is not allowed.
Installers of the radio and end users of the Nortel 2300 Series must adhere to the installation instructions provided in this manual.
Non-Modification Statement
Use only the supplied internal antenna supplied by the manufacturer. Unauthorized antennas, modifications, or attachments could damage the badge and could violate FCC regulations and void the user’s authority to operate the equipment.
Deployment Statement
This product is certified for indoor deployment only. Do not install or use this product outdoors.
Industry Canada Required User Information for WLAN—Access Points
(233x)
This device has been designed to operate with antennae having maximum gains of 7.8 dBi (2.4 GHz) and
7.4 dBi (5 GHz).
Antennae having higher gains is strictly prohibited per regulations of Industry Canada. The required antenna impedance is 50 ohms.
To reduce potential radio interference to other users, the antenna type and its gain should be so chosen that the equivalent isotropically radiated power (EIRP) is not more than that required for successful communication.
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to
Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense.
To ensure compliance with EMC standards applied to the Nortel WLAN — Wireless Security Switches
(2300), shielded twisted pair (STP) 10/100Base-T cabling must be used.
320656-A
Contents
Getting Help from the Nortel Web site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Getting Help over the phone from a Nortel Solutions Center . . . . . . . . . . . . . 11
Getting Help from a specialist by using an Express Routing Code . . . . . . . . . 11
Getting Help through a Nortel distributor or reseller . . . . . . . . . . . . . . . . . . . . 11
Introducing the Nortel WLAN 2300 System . . . . . . . . . . . . . . . . . . . . . . 13
WLAN—Security Switch Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Authentication, Authorization, and Accounting . . . . . . . . . . . . . . . . . . . . . . . . 34
Installing and Connecting a WLAN—Security Switch . . . . . . . . . . . . . 37
7
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
8 Contents
Installation Requirements and Recommendations . . . . . . . . . . . . . . . . . . . . . . . . 38
WLAN Management Software Network Plan . . . . . . . . . . . . . . . . . . . . . . . . . 39
Installing a Power Supply in a 2370 or 2380 Switch . . . . . . . . . . . . . . . . . . . . . . . 46
Powering On a 2360, 2370, or 2380 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Connecting to a Serial Management Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Troubleshooting a Serial Management Connection . . . . . . . . . . . . . . . . . . . . . . . . 51
Connecting to an AP Access Point or Other 10/100 Ethernet Device . . . . . . . 51
Connecting to Gigabit Ethernet Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
WSS Setup Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
WLAN Management Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
How a WLAN—Security Switch Gets its Configuration . . . . . . . . . . . . . . . . . . . . . 59
How Remote WSS Configuration Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Staging a WSS for Configuration by WLAN Management Software . . . . . . . 70
320656-A
Contents 9
WLAN Management Software Requirements . . . . . . . . . . . . . . . . . . . . . . . . 75
Opening the QuickStart Network Plan in WLAN Management Software . . . . . . . 77
Configuring a 2370, 2360, or 2380 Switch for Basic Service . . . . . . . . 79
Configuring VLANs and IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Enabling Secure Communication for WLAN Management Software or Web View 88
Generating a Self-Signed Certificate for Network Users . . . . . . . . . . . . . . . . . 95
Installing a Certificate Assigned by a Certificate Authority for Network Users 95
Displaying Certificate Information for Network Users . . . . . . . . . . . . . . . . . . . 97
Configuring a Port for a Wired Authentication User . . . . . . . . . . . . . . . . . . . 101
Configuring APs for Wireless Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Configuring a Nonseed Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Configuring Pass-Through Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . 117
Configuring EAP Offload with Server Authentication . . . . . . . . . . . . . . . . . . 121
Configuring a 2350 Switch for a Branch Office. . . . . . . . . . . . . . . . . . 125
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
10 Contents
Requirements for AP Access Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Requirements for the 2350 Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Appendix A: WSS Technical Specifications . . . . . . . . . . . . . . . . . . . . 155
Appendix B: WSS Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Appendix C: Translated Warning Conventions and Warnings . . . . . 161
320656-A
11
How to get Help
This section explains how to get help for Nortel products and services.
Getting Help from the Nortel Web site
The best way to get technical support for Nortel products is from the Nortel Technical Support Web site: http://www.nortel.com/support
This site provides quick access to software, documentation, bulletins, and tools to address issues with Nortel products.
More specifically, the site enables you to:
• download software, documentation, and product bulletins
• search the Technical Support Web site and the Nortel Knowledge Base for answers to technical issues
• sign up for automatic notification of new software and documentation for Nortel equipment
• open and manage technical support cases
Getting Help over the phone from a Nortel Solutions Center
If you don’t find the information you require on the Nortel Technical Support Web site, and have a Nortel support contract, you can also get help over the phone from a Nortel Solutions Center.
In North America, call 1-800-4NORTEL (1-800-466-7865).
Outside North America, go to the following Web site to obtain the phone number for your region: http://www.nortel.com/callus
Getting Help from a specialist by using an Express Routing Code
To access some Nortel Technical Solutions Centers, you can use an Express Routing Code (ERC) to quickly route your call to a specialist in your Nortel product or service. To locate the ERC for your product or service, go to: http://www.nortel.com/erc
Getting Help through a Nortel distributor or reseller
If you purchased a service contract for your Nortel product from a distributor or authorized reseller, contact the technical support staff for that distributor or reseller.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
12 How to get Help
320656-A
13
Introducing the Nortel WLAN
2300 System
This guide shows you how to install a Nortel WLAN—Security Switch (WSS) in a Nortel WLAN 2300 System wireless
LAN (WLAN) and deploy basic IEEE 802.11 wireless service.
Read this guide if you are a network administrator or other person installing WSSs and deploying 802.11 wireless service in a network.
Nortel WLAN 2300 System
The Nortel WLAN 2300 System is an enterprise-class WLAN solution that seamlessly integrates with an existing wired enterprise network. The Nortel system provides secure connectivity to both wireless and wired users in large environments such as office buildings, hospitals, and university campuses and in small environments such as branch offices.
The Nortel Mobility System fulfills the three fundamental requirements of an enterprise WLAN: It eliminates the distinction between wired and wireless networks, allows users to work safely from anywhere ( secure mobility ), and provides a comprehensive suite of intuitive tools for planning and managing the network before and after deployment, greatly easing the operational burden on IT resources.
The Nortel WLAN 2300 System consists of the following components:
• WLAN—Management Software System tool suite (WMS) —A full-featured graphical user interface (GUI) application used to plan, configure, deploy, and manage a WLAN and its users
• One or more WLAN—Security Switchs(WSS) —Distributed, intelligent machines for managing user connectivity, connecting and powering Access Point (AP) access points, and connecting the WLAN to the wired network backbone
• Multiple Access Point (AP) access points —Wireless access points (APs) that transmit and receive radio frequency
(RF) signals to and from wireless users and connect them to a WSS
• WLAN 2300 System Software (WSS Software) —The operating system that runs all WSSs and AP access points in a WLAN, and is accessible through a command-line interface (CLI), the Web View interface, or the WLAN
Management Software GUI
Documentation
Consult the following documents to plan, install, configure, and manage a Nortel WLAN 2300 System.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
14 Introducing the Nortel WLAN 2300 System
Planning, Configuration, and Deployment
• Nortel WLAN Management Software User’s Guide . Instructions for planning, configuring, deploying, and managing the entire WLAN with the WLAN Management Software tool suite. Read this guide to learn how to plan wireless services, how to configure and deploy Nortel equipment to provide those services, and how to optimize and manage your WLAN.
• Nortel WLAN Management Software Reference Manual.
Detailed instructions and information for all WLAN
Management Software planning, configuration, and management features.
Installation
• Nortel WLAN 2300 System Software Quick Start Guide.
Instructions for performing basic setup of secure (802.1X) and guest (Web-based AAA™) access, for configuring a Mobility Domain for roaming, and for accessing a sample network plan in WLAN Management Software for advanced configuration and management <<need to delete the
RM sample plan in the about chap for all manuals, if RM sample plans stay out of the QS>>
• Nortel WLAN—Security Switch Installation and Basic Configuration Guide . Instructions and specifications for installing a WSS in a Nortel WLAN 2300 System WLAN, and basic instructions for deploying a secure IEEE
802.11 wireless service
• Nortel 2330 Access Point Installation Guide . Instructions and specifications for installing an AP access point and connecting it to a WSS
• Nortel 2300 Series Regulatory Information . Important safety instructions and compliance information that you must read before installing Nortel products
Configuration and Management
• Nortel WLAN Management Software Reference Manual . Instructions for planning, configuring, deploying, and managing the entire WLAN with the WLAN Management Software tool suite
• Nortel WLAN 2300 System Software Configuration Guide . Instructions for configuring and managing the system through the WSS Software CLI
• Nortel WLAN 2300 System Software Command Reference . Functional and alphabetic reference to all WSS Software commands supported on WSSs and AP access points
320656-A
Introducing the Nortel WLAN 2300 System 15
Safety and Advisory Notices
The following kinds of safety and advisory notices appear in this manual. For translations of the warning conventions
.
Caution!
This situation or condition can lead to data loss or damage to the product or other property.
Warning! This situation or condition can cause injury.
Warning! High voltage. This situation or condition can cause injury due to electric shock.
Warning! Radiation. This situation or condition can cause injury due to improper handling of fiber-optic equipment.
Note.
This information is of special interest.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
16 Introducing the Nortel WLAN 2300 System
Text and Syntax Conventions
Nortel manuals use the following text and syntax conventions:
Convention
Monospace text
Bold text
Italic text
Menu Name > Command
[ ] (square brackets)
{ }
(curly brackets)
| (vertical bar)
Use
Sets off command syntax or sample commands and system responses.
Highlights commands that you enter or items you select.
Designates command variables that you replace with appropriate values, or highlights publication titles or words requiring special emphasis.
Indicates a menu item that you select. For example, File > New indicates that you select New from the File menu.
Enclose optional parameters in command syntax.
Enclose mandatory parameters in command syntax.
Separates mutually exclusive options in command syntax.
320656-A
17
WLAN—Security Switch
Overview
A Nortel WLAN—Security Switch (WSS) provides mobility and authentication, authorization, and accounting (AAA) services for wireless or wired users. A WSS also controls the operation of Nortel Access Point (AP) access points, which control and manage IEEE 802.11 operation over the air.
Warning! Installation must be performed by qualified service personnel only.
Read and follow all warning notices and instructions marked on the product or included in the documentation. Before installing the product, read the Nortel
2300 Series Regulatory Information document. (For translations of this warning, see
“Qualified Service Personnel Warning” on page 163 .)
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
18 WLAN—Security Switch Overview
WSS Model Numbers
Table 1 lists the WSS model numbers.
Model
2350
2370
2360
2361
2380
Table 1: WSS Model Numbers
Port Configuration Power Supply Configuration
Two 10/100BASE-TX Ethernet ports
Port 1 provides an uplink to the network.
Port 2 supports Power over Ethernet (PoE) and provides direct connection to an AP access point.
One 100-150 VAC autosensing AC power supply
Twenty 10/100BASE-TX Ethernet ports
Two slots for 1000BASE-SX or 1000BASE-LX fiber-optic gigabit Ethernet ports
All 20 of the 10/100 Ethernet ports support
PoE.
One 100-240 VAC autosensing AC power supply
A second power supply can be inserted before or after switch installation.
Eight 10/100 Ethernet ports, six of which support PoE
Eight 10/100 Ethernet ports, six of which support PoE
One 100-120 VAC / 200-240 VAC autosensing AC power supply
Two 100-120 VAC / 200-240 VAC autosensing AC power supplies
Four dual-interface gigabit Ethernet ports. Each port has a 1000BASE-TX copper interface and a Gigabit interface converter (GBIC) slot for insertion of a 1000BASE-SX or 1000BASE-LX fiber-optic interface.
Two 100-120 VAC / 200-240 VAC autosensing AC power supplies
320656-A
WLAN—Security Switch Overview 19
Hardware Features
2350 Switch
A 2350 switch is compact and can be installed on a tabletop.
shows a front view and the external hardware features of an 2350 switch.
Figure 1.
Nortel 2350 Switch—Front View
Factory Reset switch
Factory Reset
LED
1 2
Serial console port
10/100 Ethernet uplink port
10/100 and AP
Ethernet port
Power supply input
Power supply LED
Caution!
Do not stack 2350 switches. Stacked 2350 switches can overheat and cause loss of equipment functionality or permanent damage.
Caution!
Ensure adequate airflow around 2350 switches. The 2350 switch uses natural convection cooling and requires free entry of air. Airflow blockage can cause the system to overheat and result in a loss of equipment functionality or permanent damage.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
20 WLAN—Security Switch Overview
2370 Switch
A WSS-2370 is two rack units (RUs) high and can be installed in a standard 48.26-cm (19-inch) equipment rack or on a tabletop. Figure 2 shows a front view of a 2370 switch.
Figure 2.
Nortel WSS-2370 Switch—Front View
44.2 cm
(17.4 inches)
46.23 cm
(18.2 inches)
8.81 cm
(3.47 inches)
100-240V
50/60 Hz
8A MAX
DISCONNECT
ALL POWER
BEFORE
SERVICING
Rst
Console
21 22 Link
AP
Link
AP
Mgmt
1 2 3 4 5 6 7 8 9 10
11 12 13 14 15 16 17 18 19 20
Figure 3 shows a rear view of a WSS-2370. A switch’s serial number, MAC address, and other identifying information are readily available on the serial number ID label.
Figure 3.
Nortel WSS-2370 —Rear View
WSS-2270
Serial number ID label
The serial number ID label is in the same location on the rear of a 2360 or 2380 switch.
320656-A
WLAN—Security Switch Overview 21
Figure 4 shows the external hardware features of a WSS-2370.
Figure 4.
WSS-2370—Front Panel Control Features
Power supply LED
Power supply
Restart switch
Serial console port
Flash card slot
Eject button
Mgmt
LED
100-240V
50/60 Hz
8A MAX
DISCONNECT
ALL POWER
BEFORE
SERVICING
Rst
Console
21 22 Link
AP
Link
AP
Mgmt
1 2 3 4 5 6 7 8 9 10
11 12 13 14 15 16 17 18 19 20
AC power inlet
Power supply serial number
GBIC slots Gigabit link
LEDs
10/100 and
AP/PoE
LEDs
10/100 Ethernet ports
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
22 WLAN—Security Switch Overview
2360 Switch
A 2360 switch is one RU high and also can be installed in a standard 48.26-cm (19-inch) equipment rack or on a
shows a front view of a WSS-2360.
Figure 5.
Nortel WSS-2360—Front View
44.2 cm
(17.4 inches)
25.6 cm
(10.8 inches)
Rst
4.4 cm
(1.72 inches)
shows the external hardware features of a WSS-2360.
Figure 6.
WSS-2360—Front Panel Control Features
Power supply
Restart switch
Serial console port
Rst
Power supply LED
10/100 Ethernet uplink ports
10/100 and
AP/PoE LEDs
10/100 and AP
Ethernet ports
The rear of the switch contains a label with the serial ID, MAC address, and other identifying information.
320656-A
WLAN—Security Switch Overview 23
2380 Switch
A 2380 switch is two rack units (RUs) high and can be installed in a standard 48.26-cm (19-inch) equipment rack or on a tabletop. The dimensions of an 2380 switch are the same as the dimensions of a 2370 switch. (See
Figure 2 .)
Figure 7 shows a front view of a 2380 switch and identifies the external hardware features.
Figure 7.
2380 Switch—Front Panel Control Features
Power supply LED
Power supply
Restart switch
Serial console port
Flash card slot
Eject button
Mgmt
LED
Mgmt
100-240V
50/60 Hz
8A MAX
DISCONNECT
ALL POWER
BEFORE
SERVICING
Rst Console
AC power inlet
Power supply serial number
GBIC slot Gigabit link
LEDs
1000BASE-TX port
Like the other switch models, the rear of the 2380 switch contains a label with the serial ID, MAC address, and other identifying information.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
24 WLAN—Security Switch Overview
Management Features
• Serial console port—The serial console port provides a direct management connection to a WSS’s command-line interface (CLI). The port has a DB-9 female connector and supports the EIA-232D signaling standard.
• Restart switch—The restart switch allows you to restart an 2360, 2380, or 2370 without removing the power cord(s).
Caution!
The 2350 does not have a restart switch but does have a factory reset switch. Do not attempt to restart a configured 2350 by pressing its factory reset switch!
On an 2350 that is fully booted, the factory reset switch erases the configuration. If you do accidentally press the factory reset switch and erase the configuration, you can use the Web Quick Start to reconfigure the switch.
• Status LEDs—The Ethernet ports and power supplies on all switch models have LEDs that indicate their status. The management CPU on an 2370 or 2380 switch also has an LED. (For details, see
.)
• Flash card slot (2370 and 2380 only)—The flash card slot is not used for normal WSS operation.
320656-A
WLAN—Security Switch Overview 25
Power Features
• Power supplies—A 2370 or 2380 switch comes with one 100-240 VAC autosensing AC power supply.
You can add a second supply for load sharing and redundancy. The power supplies are hot-swappable.
A 2360 switch contains either one or two 100-120 VAC / 200-240 VAC autosensing AC power supplies. The 2360 power supplies are fixed-configuration supplies and cannot be inserted or removed.
A 2350 switch uses an external power supply, which comes with the switch.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
26 WLAN—Security Switch Overview
Network Interfaces
• 10/100 Ethernet ports—A 2350 switch has two 10/100BASE-TX Ethernet ports. A WSS-2370 has twenty
10/100BASE-TX Ethernet ports. A 2360 switch has eight 10/100BASE-TX Ethernet ports. Each port has a standard RJ-45 connector and uses Category 5 (Cat 5) cable based on the EIA/TIA-586 standard.
On the 2350, port 2 can be configured for AP access points and can support Power over
Ethernet (PoE). Port 1 is an uplink port only and does not support PoE.
On a 2370, ports 1 through 20 can be configured for AP access points and can support PoE. On the 2360 switch, ports 1 through 6 can be configured for AP access points and can support PoE.
Ports 7 and 8 on the 2360 switch are uplink ports only and do not support PoE.
The 10/100 Ethernet ports on the 2360 switch provide automatic MDI/MDX, which automatically crosses over the send and receive signals if required.
A 2380 switch provides high-bandwidth centralized control of many indirectly connected AP access points. The switch does not have 10/100 Ethernet ports and does not provide PoE.
• Gigabit interface converter (GBIC) slots (2370 and 2380 only)—A 2370 switch has two slots allowing insertion of 1000BASE-SX or 1000BASE-LX fiber-optic GBICs to provide gigabit Ethernet interfaces to the network.
The fiber-optic GBICs have standard SC Duplex connectors and use either single-mode fiber
(SMF) for LX or multimode fiber (MMF) for SX. GBICs are available separately and are not included with the switch.
A 2380 switch has four ports. Each port has a slot for a 1000BASE-SX or 1000BASE-LX fiber-optic GBIC, and a built-in 1000BASE-TX copper interface with an RJ-45 connector. Only one interface, copper or fiber, can be active on a port. The GBIC interface is active by default.
320656-A
WLAN—Security Switch Overview 27
Status LEDs
The WSSs have LEDs that indicate port, power, and CPU status.
2360, 2380, and 2370 LEDs
.
Table 2 lists the LEDs for models 2370, 2360, and 2380.
Table 2: WSS Status LEDs—2370, 2360, 2380
LED Appearance Meaning
Mgmt
(2370 and 2380 only)
Bright green, then fade
(repeated)
WSS is operating normally.
Note: This LED appearance is sometimes called breathing .
Blinking green WSS is booting.
Quickly blinking amber
Power supply status Solid green
Solid amber
Unlit
Gigabit fiber link activity
(2370 and 2380 only)
Solid green
Blinking amber (2370)
Gigabit copper link activity
(2370 and 2380 only)
Blinking green (2380)
Solid green
Blinking green
WSS was unable to boot completely.
DC power output is on.
Power fault has occurred.
AC power is off.
1000-Mbps fiber link is operational.
Traffic is active on the 1000-Mbps fiber link.
Traffic is active on the 1000-Mbps fiber link.
1000-Mbps copper link is operational.
Traffic is active on the 1000-Mbps copper link.
Link
(2370 and 2360 only)
Solid green
Solid amber
Blinking green
Blinking amber
100-Mbps link is operational.
10-Mbps link is operational.
Traffic is active on the 100-Mbps link.
Traffic is active on the 10-Mbps link.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
28 WLAN—Security Switch Overview
Table 2: WSS Status LEDs—2370, 2360, 2380 (continued)
LED Appearance
AP
(2370 and 2360 only)
Solid green
Alternating green and amber
Solid amber
Blinking amber
Unlit
Meaning
For an AP access point’s active link, with
PoE enabled, all the following are true:
• AP access point has booted.
• AP access point has received a valid configuration from the WSS.
• Management link with an AP access point is operational.
AP access point is booting with an image received from the WSS.
If the LED remains in this state indefinitely, the boot or configuration attempt has failed.
PoE is on but no AP access point is connected to the link.
AP is not connected or is unresponsive, or there is a PoE problem.
Port is not configured as an AP access port, or PoE is off.
2350 LEDs
Figure 8 on page 28 shows the locations of the 2350 LEDs.
Table 3 describes the LEDs.
Figure 8.
2350 LEDs
Factory Reset
LED
1 2
AP LED
LED
Power status
320656-A
Link LED
Power supply LED
Table 3: WSS Status LEDs—2350
Appearance
Solid green
Unlit
Meaning
The switch is receiving power.
The switch is not receiving power.
WLAN—Security Switch Overview 29
Table 3: WSS Status LEDs—2350 (continued)
LED
Link
(ports 1 and 2)
Factory Reset
(port 1 only)
AP (port 2 only)
Appearance
Solid green
Solid amber
Blinking green
Blinking amber
Solid green
Blinking green
Unlit
Solid green
Alternating green and amber
Solid amber
Blinking amber
Unlit
Meaning
100-Mbps link is operational.
10-Mbps link is operational.
Traffic is active on the 100-Mbps link.
Traffic is active on the 10-Mbps link.
The switch is booting and is loading its configuration file. This LED state lasts for three seconds.
The switch is booting but the factory reset switch is being pressed. The switch does not load its configuration file but instead contacts WLAN Management Software to request a configuration.
This LED state lasts for three seconds.
The switch has finished booting.
For an AP access point’s active link, with
PoE enabled, all the following are true:
• AP access point has booted.
• AP access point has received a valid configuration from the WSS.
• Management link with an AP access point is operational.
AP access point is booting with an image received from the WSS.
If the LED remains in this state indefinitely, the boot or configuration attempt has failed.
PoE is on but no AP access point is connected to the link.
AP is not connected or is unresponsive, or there is a PoE problem.
Port is not configured as an AP access port, or PoE is off.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
30 WLAN—Security Switch Overview
Software Features
WLAN 2300 System Software (WSS Software) provides a combination of standard wired LAN features and wireless LAN features that enable you to integrate the switch into your wired network and provide network access for wired or wireless users.
320656-A
WLAN—Security Switch Overview 31
Management Features
• Serial and network command-line interface (CLI) access—You can access the CLI through a direct serial connection or through the network using Secure Shell (SSH) or Telnet.
• WLAN Management Software management application—WLAN Management Software is an extensive GUI application for planning, configuring, deploying, and managing a Nortel network and its users. WLAN
Management Software uses Secure Sockets Layer protocol (SSL) to interact with WSS Software.
• Software and configuration management—You can store multiple software images and configuration files in the
WSS’s nonvolatile storage.
• Web View manager—Web View is a Web-based application for configuring and managing a single WSS through a
Web browser. Web View creates a secure connection by using Hypertext Transfer Protocol over Secure Sockets
Layer (HTTPS).
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
32 WLAN—Security Switch Overview
Layer 2 Switching Features
• Spanning Tree Protocol (STP)—WSS Software supports Per-VLAN Spanning Tree (PVST+). PVST+ allows a separate spanning tree in each virtual LAN (VLAN). Optional fast convergence features allow you to quickly resume traffic forwarding after a topology change.
• Load-sharing port groups—You can configure multiple physical ports into a single logical link for traffic load sharing and physical link redundancy.
• Virtual LANs (VLANs)—WSS Software supports logical segmentation of a switch’s ports into separate Layer 2 collision domains. A port can be a member of one or more VLANs. Each VLAN can have its own IP interface.
WSS Software supports the 802.1Q tag format.
• Internet Group Management Protocol (IGMP) snooping for multicast containment—The WSS can learn about the multicast sources and receivers in the network and restrict forwarding for a multicast group to the users for that group. IGMPv1 and IGMPv2 are supported.
320656-A
WLAN—Security Switch Overview 33
IP Services
• IP interfaces—You can configure an IP interface for each VLAN.
• IP ping and traceroute—You can test IP connectivity between the WSS and other devices.
• Domain Name Service (DNS)—You can configure the switch to use DNS servers for name resolution. You also can configure a default domain name to append to hostnames.
• Network Time Protocol (NTP)—A WSS can sets its time and date by polling an NTP server.
• System log—A WSS generates log messages to log system events. The log messages are stored locally and also can be exported to syslog servers.
• Simple Network Management Protocol (SNMP)—A WSS can be configured to generate SNMP traps for major system events.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
34 WLAN—Security Switch Overview
Authentication, Authorization, and Accounting
• 802.1X—A WSS can authenticate users based on 802.1X protocols. Based on authentication, users are assigned
VLAN membership, access control, and roaming boundaries.
• MAC authentication—If a device does not support 802.1X, you can configure authentication based on the source
MAC address to assign VLAN membership, access control, and roaming boundaries.
• Guest authentication—Guests can be authenticated by a shared set of authorization attributes that assign VLAN membership, access control, and roaming boundaries.
• Local and remote authentication—You can authenticate users locally using information configured on the WSS, or use a Remote Authentication Dial-In User Service (RADIUS) server. When you use a remote server, the WSS can enhance performance by performing some of the AAA tasks locally or distributing the load across multiple servers.
320656-A
WLAN—Security Switch Overview 35
Roaming
• AP access point roaming—You can configure the WSS to allow users to roam from one AP access point to another on the same WSS.
• Mobility Domain™ roaming—You also can configure a group of WSSs to allow users to roam from one switch to another. Regardless of the wired subnet connections, each user maintains the same IP address and session across the network.
• Session management—You can display session information and statistics for users.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
36 WLAN—Security Switch Overview
RF Management
• Auto-RF—WSS Software can automatically assign channels and power settings to AP access points based on RF information collected from the network.
• Radio frequency (RF) topology—With WLAN Management Software , you can verify site coverage and capacity.
• Rogue detection and countermeasures—AP access points can be used to gather RF information for validating an RF deployment plan, and for detecting and combatting rogue access points.
• User-based RF—You can gather statistics on a per-user basis as users roam across the network.
320656-A
37
Installing and Connecting a
WLAN—Security Switch
Note.
Before installing a WSS, you might need to generate a network plan with WLAN
Management Software . (See
“WLAN Management Software Network Plan” on page 39
.)
Unpacking a WSS
The shipping carton for a WSS contains the following items:
• One WSS, with one power supply (or two power supplies, if you ordered the 2361)
• For some countries, one country-specific power cord
• One serial cable for connection to the management console (not included with the 2350)
• Two rack-mount brackets (not applicable to the 2350)
• Four adhesive rubber feet
• One documentation pack that includes this guide
• One set of release notes
Figure 9 shows the contents of the shipping carton for a 2370 switch. The contents of a 2360 or 2380 shipping carton are similar. The 2350 carton contains the switch, a power supply and cord, rubber feet, a documentation pack, and release notes.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
38 Installing and Connecting a WLAN—Security Switch
Figure 9.
WSS-2370 Switch Shipping Carton Contents
WSS with installed power supply
Documentation pack
Power cord
Serial cable
Rubber feet
Rack-mount brackets
Before you begin installation:
1
Open the carton and carefully remove the contents, if you have not already done so.
2
Place the packing materials back in the carton and save the carton.
3
Verify that you received each item in the previous list. If any item is missing or damaged, contact Nortel.
Installation Requirements and Recommendations
For best results, follow these requirements and recommendations before installing a WSS.
320656-A
Installing and Connecting a WLAN—Security Switch 39
WLAN Management Software Network Plan
If you are using WLAN Management Software to plan your Nortel Mobility System installation, Nortel recommends that you create and verify a network plan for the entire Nortel network installation before installing WSSs or AP access points. A network plan provides the following information:
• Number of WSSs required at your site, and where to install them
• Number of AP access points required for adequate WLAN capacity in each coverage area, and where to install them
• Configuration settings for all the WSSs and AP access points in the WLAN, which can be automatically deployed to the devices by WLAN Management Software .
(For information about installing WLAN Management Software and creating and verifying a network plan, see the
Nortel WLAN Management Software User’s Guide .)
Installation Location
Caution!
The WSS has been designed and tested to be installed in an operating ambient temperature of 0° C to +50° C (32° F to 122° F). To reduce the risk of equipment damage, install equipment with consideration to these ambient conditions.
Caution!
Do not stack 2350 switches. Stacked 2350 switches can overheat and cause loss of equipment functionality or permanent damage.
Caution!
Ensure adequate airflow around 2350 switches. The 2350 switch uses natural convection cooling and requires free entry of air. Airflow blockage can cause the system to overheat and result in a loss of equipment functionality or permanent damage.
WSS-2370 and 2380 switch fans and air inlets are located on the sides of the switch. 2360 switch fans are located in the rear of the switch and air inlets are located on the sides of the switch. In the 2370 and 2380 switches, separate power supply fans are located on the front. Make sure these areas have adequate ventilation after installation. Do not block air vents.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
40 Installing and Connecting a WLAN—Security Switch
Cable Requirements
Warning! The gigabit Ethernet fiber-optic interfaces use Class 1 lasers. To reduce the risk of eye injury, do not stare into the interface or otherwise direct
the laser beam into your eye. (For translations of this warning, see “Laser
To avoid installation problems, use the proper cables.
Serial Console Cable
The serial console port has a female DB-9 connector and supports the EIA-232D signaling standard. You need a standard DB-9-male-to-DB-9-female PC modem cable. Table 4 lists the pin signals.
WSS Pin
2
3
5
Table 4: Serial Console Pin Signals
Usage
Receive
Transmit
Ground
PC Pin
3
2
5
Usage
Transmit
Receive
Ground
Network Cables
Table 5 lists the interface types supported by WSSs and the cable type required for each type of interface.
Link Type
10/100BASE-T
1000BASE-SX
Table 5: Ethernet Interfaces
Cable Type
Connector
Type
Cat 5 copper
Straight-through or crossover signaling
RJ-45
Multimode 50-µm fiber
Multimode 62.5-µm fiber
SC
SC
Maximum Distance
100 m (328 feet)
550 m (1804.5 feet)
275 m (902.2 feet)
320656-A
Installing and Connecting a WLAN—Security Switch 41
Link Type
1000BASE-LX
1000BASE-TX
Table 5: Ethernet Interfaces (continued)
Cable Type
Connector
Type
Single mode 9/10-µm fiber
Multimode 50-µm fiber
Multimode 62.5-µm fiber
Cat 5 copper
Can use straight-through or crossover signaling, provided all four wire pairs are connected
SC
SC
SC
RJ-45
Maximum Distance
10,000 m (32,808.4 feet)
550 m (1804.5 feet)
550 m (1804.5 feet)
100 m (328 feet)
10/100 Ethernet Cable Wiring
Connections on the 10/100 ports require Category 5 (Cat 5) cable based on the EIA/TIA-586 standard. For direct connection to an AP access point, a router, or an end station such as a PC, printer, or server, use a straight-through cable.
For direct connection to another switch, use a crossover cable. (The 10/100 Ethernet ports on the 2360 switch provide automatic MDI/MDX, which automatically crosses over the send and receive signals if required.)
Table 6 lists the pin signals for 10/100 Ethernet straight-through wiring. Pins 4, 5, 7, and 8 are used only when Power over Ethernet (PoE) is enabled on the port. RD means Receive Data and TD means Transmit Data .
Table 6: 10/100 Ethernet Straight-Through Pin Signals
7
8
5
6
3
4
1
2
WSS
Pin Function
RD+
RD-
TD+
PoE+
PoE+
TD-
PoE-
PoE-
7
8
5
6
3
4
1
2
Other Device
Pin Function
TD+
TD-
RD+
PoE+
PoE+
RD-
PoE-
PoE-
AP Cable Requirement
Use a straight-through Ethernet cable to connect an AP access point directly to a WSS or indirectly through another device.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
42 Installing and Connecting a WLAN—Security Switch
1000BASETX Gigabit Ethernet Cable Wiring
Use Cat 5 Enhanced (Cat 5E) or better cable. 1000BASE-TX uses all 8 wires in the cable. The wiring can be straight-through or crossover. The port automatically configures its pin signals accordingly.
Note.
PoE is not supported on 1000BASE-TX links. All wires in the cable are used for data.
Installation Hardware and Tools
Caution!
To reduce the risk of equipment damage, make sure the WSS is installed so that the mechanical load on the device is evenly distributed. For example, make sure the switch is level in the equipment rack, is evenly fastened by screws on either side, and does not have a heavy object resting on one side of the switch.
Table 7 lists the mounting hardware and tools required for each type of installation.
Table 7: Required Mounting Hardware and Tools
Mounting Option
Required Hardware and
Tools
Included with the
Product
Equipment rack
• Front-mount or center-mount option for the 2370 or 2380 switch
• Front-mount option for the
2360 switch
Mounting brackets
Four rack-mount screws and screwdriver
Note: Equipment racks vary, and the screw and screwdriver type depend on the equipment rack.
Yes
No
Power cords Yes (one)
Tabletop
(applicable to all switch models)
Serial console cable
Four adhesive rubber feet
Power cord(s)
Serial console cable
Yes
Yes
Yes
Yes
Installing a WSS
You can mount a WSS-2370, 2360, or 2380 switch in a standard 48.26-cm (19-inch) equipment rack or on a tabletop.
Each WSS is shipped with two brackets for rack mounting and four adhesive rubber feet for tabletop mounting. The
320656-A
Installing and Connecting a WLAN—Security Switch 43
WSS-2370 and 2380 mounting brackets support either front or center mounting. The 2360 mounting brackets support front mounting only.
The 2350 switch does not have rack mounting brackets but can be installed on a tabletop.
To install a WSS, use one of the following procedures.
Warning! Earth grounding is required for a WSS installed in a rack. If you are relying on the rack to provide ground, the rack itself must be grounded with a ground strap to the earth ground. Metal screws attaching the switch to the rack provide ground attachment to the rack. (For translations of this warning, see
“Earth Ground Warning” on page 165 .)
Warning! In the U.S., overcurrent protection must be provided by the installation. Branch circuit protection in accordance with National Fire Protection
Association (NFPA) 70, National Electrical Code (NEC) is required. Consideration must be given to the electrical ratings on the WSS and branch circuit protection. Do not install equipment such that the branch circuit current and voltage protection is exceeded. Pay particular attention to the earthing connection for the supply connections. When using an extension cord or power strip, pay attention to the grounding type.
Caution!
Do not stack 2350 switches. Stacked 2350 switches can overheat and cause loss of equipment functionality or permanent damage.
Caution!
Ensure adequate airflow around 2350 switches. The 2350 switch uses natural convection cooling and requires free entry of air. Airflow blockage can cause the system to overheat and result in a loss of equipment functionality or permanent damage.
Equipment Rack Installation
You can install a 2370 or 2380 switch into a front-mount or center-mount equipment rack. You can install a 2360 switch into a front-mount equipment rack.
• Figure 10 shows how to install a 2370 or 2380 switch into a front-mount equipment rack. (Installation of a 2360 switch is similar.)
• Figure 11 shows how to install a 2370 or 2380 switch into a center-mount equipment rack.
Refer to these figures as you perform the procedure.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
44 Installing and Connecting a WLAN—Security Switch
Figure 10. WSS-2370 or 2380 Installation—Front-Mount Equipment Rack
First, attach brackets to chassis.
Then, install chassis into rack.
320656-A
Installing and Connecting a WLAN—Security Switch 45
Figure 11. 2370 or 2380 Installation—Center-Mount Equipment Rack
First, attach brackets to chassis.
Then, install chassis into rack.
1
Remove the four bracket screws from each side of the WSS.
2
Align a bracket over the screw holes:
● For a front-mount equipment rack, align the bracket so that the bracket flange is flush with the
WSS’s front panel and extends away from the switch.
● For a center-mount equipment rack, align the bracket so that the bracket flange is located near the center screw holes.
3
Reinsert the screws to secure the brackets to the WSS.
4
Repeat for the other bracket.
Warning! Nortel recommends that you ask someone to assist you with the remaining steps. If you accidentally drop the WSS, you can be injured and the switch can be damaged. (For translations of this
warning, see “Rack Installation Warnings” on page 166 .)
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
46 Installing and Connecting a WLAN—Security Switch
5
Lift the WSS into position in the equipment rack.
Warning! To prevent the WSS from slipping, do not release the switch until all the rack-mount screws are tight. (For translations of this
warning, see “Rack Installation Warnings” on page 166 .)
6
Insert the bottom rack-mount screws into the bracket flanges to secure the WSS to the equipment rack, then insert the top screws.
7
Do one of the following:
●
If you are installing a second power supply into a 2370 or 2380 switch, go to
Supply in a 2370 or 2380 Switch” on page 46
.
●
If you are ready to turn on power, go to “Powering On a WSS” on page 48.
Tabletop Installation
1
On a clean work surface with no debris, carefully turn the WSS upside down.
2
Wipe the four placement locations for the rubber feet to clear away any oil or dust. The location areas are marked by X ’s.
3
Attach the four rubber adhesive feet over the X ’s.
4
Turn the WSS right-side up, and place the switch in position on the table.
5
Do one of the following:
●
If you are installing a second power supply into a WSS-2370 or 2380 switch, go to
Power Supply in a 2370 or 2380 Switch” .
●
If you are ready to turn on power, go to “Powering On a WSS” on page 48.
Installing a Power Supply in a 2370 or 2380 Switch
A 2370 or 2380 switch is shipped with a single 100-240 VAC autosensing AC power supply. One power supply provides enough power for a fully configured system. You can add a second power supply for load sharing and redundancy. A WSS containing one power supply can have the supply installed in either slot. If the switch contains two power supplies and one supply fails, the other supply automatically takes over to provide uninterrupted operation.
The power supplies are hot-swappable. You can remove or insert a power supply while the other power supply is running.
Use the following procedures to install a second power supply or replace a failed power supply.
(You cannot insert or remove power supplies in a 2360 switch.)
Note.
To attach the power supply to an 2350, see
“Powering On a 2350” on page 49
.
320656-A
Installing and Connecting a WLAN—Security Switch 47
Installing a New Power Supply
1
If you are replacing a failed power supply and have not already removed it from the WSS, go to
“Replacing a Power Supply” on page 47 .
2
If you are installing a new power supply in an unused slot, loosen the thumbscrew with a #2 Phillips-head screwdriver and remove the cover plate.
Store the cover plate in a safe place in case you need to use it at another time.
3
Remove the new power supply from its packaging and lift the supply by grasping the front handle with one hand and supporting the supply from the bottom with the other hand.
4
Insert the power supply into the WSS’s slot as shown in Figure 12 , pushing gently but firmly until the supply is fully seated and flush with the switch’s front panel.
Figure 12. Inserting a Power Supply in a 2370 or 2380 Switch
5
Tighten the thumbscrew using a #2 Phillips-head screwdriver.
6
Go to “Powering On a WSS” on page 48.
Replacing a Power Supply
1
Remove the power cord from the power supply.
2
Loosen the thumbscrew using a #2 Phillips-head screwdriver as shown in Figure 13 .
3
Use the handle to pull the power supply partway out of the slot as shown in Figure 13 .
Caution!
Support the bottom of the power supply while removing it from the
WSS. If the rear of the power supply is not supported, the supply will fall when you remove it, possibly damaging the rear components of the supply.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
48 Installing and Connecting a WLAN—Security Switch
Figure 13. Removing a Power Supply from an 2370 or 2380 Switch
Loosen thumbscrew
4
5
Place your other hand under the supply to support it and remove the supply the rest of the way out of the slot.
Go to step 3
of “Installing a New Power Supply” on page 47.
Powering On a WSS
Warning! The WSS relies on the building’s installation for overcurrent protection. Ensure that a fuse or circuit breaker no larger than 120 VAC,
15 A U.S. (240 VAC, 10 A international) is used on the phase conductors. (For translations of this warning, see
“Overcurrent Warning” on page 168
.)
Powering On a 2360, 2370, or 2380
To power on an 2360, 2370, or 2380 switch:
320656-A
Installing and Connecting a WLAN—Security Switch 49
1
Make sure any insertable power supply is fully seated in the WSS.
2
For each power supply that you are using on the WSS, attach a power cord to an AC power source.
Note.
If the WSS has two power supplies, use a separate AC power source for each supply to add redundancy. If one power source fails, the switch can continue to operate using the other power source.
3
Plug each power cord into a WSS power supply.
The WSS begins booting as soon as you plug in the power cord(s).
4
Observe the power supply LED for each connected power supply to verify that the LED is steadily glowing green. This indicates normal power supply operation.
5
On the 2370 or 2380 switch only, wait a few seconds, then observe the Mgmt LED to verify that it is breathing (repeatedly flashing bright green, then fading) to indicate that the WSS has successfully booted and is operating normally.
Powering On a 2350
To power on a 2350 switch:
1
Plug the power supply into an AC power source.
2
Plug the power supply into the Power port.
The LED turns green when the 2350 is receiving power.
Connecting to a Serial Management Console
Initial configuration of the WSS requires a connection to the switch’s CLI through the serial console port.
Figure 14 shows how to install a serial cable on a 2370 switch. The procedure is the same on an 2360, 2380, or
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
50 Installing and Connecting a WLAN—Security Switch
Figure 14. Serial Cable Installation
Serial port Serial cable Serial port on computer
To connect a PC to the serial console port:
1
Insert the serial cable into the PC port as shown in Figure 14 .
2
Insert the other end of the cable into the serial console port on the WSS as shown in Figure 14 .
3
Start a standard VT100 terminal emulation application on the PC, and configure the following modem settings:
●
●
●
9600 bps
8 bits
1 stop
● No parity
● Hardware flow control off or disabled
4
Open a connection on a serial port.
● If the WSS is already powered on, press Enter three times to display a command prompt:
2370>
Go to
step 4 in “Accessing the CLI” on page 80.
Note.
For simplicity, the command prompt examples in the documentation show a switch model (such as 2370 ) and the CLI access level ( > for restricted access or # for enabled access) only. The default command prompt on your WSS shows your switch’s model number and also contains the last three octets of the switch’s MAC address. For example, the default command prompt on an 2370 switch with MAC address 00:0B:0E:00:04:0A is 2370-00040A> .
● If a command prompt does not appear, go to
“Troubleshooting a Serial Management Connection”
.
320656-A
Installing and Connecting a WLAN—Security Switch 51
Troubleshooting a Serial Management Connection
1
Verify that the WSS is powered on.
2
Verify that the serial cable is fully inserted in the PC and WSS ports.
3
Verify that the correct modem settings are configured in the terminal emulation application:
●
●
●
9600 bps
8 bits
1 stop
● No parity
● Hardware flow control off or disabled
4
Verify that you opened the connection on the PC port connected to the WSS.
For example, if you inserted the cable in PC port COM1, make sure you open the connection on COM1 instead of COM2 or another port.
If none of the previous steps results in a management connection, use another serial cable.
Connecting to the Network
Use the following procedures to connect a WSS to AP access points or other 10/100 Ethernet devices and to gigabit
Ethernet devices.
Connecting to an AP Access Point or Other 10/100 Ethernet Device
Note.
The 10/100 Ethernet ports are configured as wired network ports by default. You must change the port type for locally connected AP access points, and for wired end stations that use AAA through the WSS to access the network.
Note.
For installations in Japan: Provide an earthing connection before you connect the mains plug to the mains. When disconnecting the earthing connection, make sure to disconnect only after you pull out the mains plug for the mains.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
52 Installing and Connecting a WLAN—Security Switch
Figure 15 shows how to install a Cat 5 cable for a 10/100 Ethernet port. Refer to this figure as you perform the procedure.
Figure 15. 10/100 Cat 5 Cable Installation
Ethernet port
Ethernet cable
(Cat 5 cable)
AP, switch, server
or other device
To connect to an AP or other 10/100 Ethernet device:
1
Insert a Cat 5 cable with a standard RJ-45 connector as shown in Figure 15 :
●
●
For direct connection to an AP access point, use a straight-through cable.
For connection to a router or to an end station such as a PC, printer, or server, use a straight-through cable.
● For connection to another switch, use a crossover cable. (For cable requirements, see
Note.
The 10/100 Ethernet ports on the 2360 switch provide automatic
MDI/MDX.
2
If the cable is directly attached to an AP access point:
● For a first-time installation, set the port type to activate the link. (For information, see
“Configuring APs for Wireless Users” on page 102 .)
● If the port type is already set for an AP access point, observe the appearance of the AP
LED for the port:
320656-A
Installing and Connecting a WLAN—Security Switch 53
AP LED Appearance
Solid green
Alternating green and amber
Solid amber
Blinking amber
Unlit
Meaning
For an AP access point’s active link, with PoE enabled, all the following are true:
• AP access point has booted.
• AP access point has received a valid configuration from the WSS.
• Management link with an AP access point is operational.
For an AP access point’s secondary link, the link is present.
AP access point is booting with an image received from the WSS.
PoE is on, but no AP access point is connected to the link.
AP access point is unresponsive or there is a PoE problem.
PoE is off.
3
If the cable is attached to a wired end station that uses AAA through the WSS to access the network:
●
.)
● If the port type is already set for a wired authentication port, go on to
4
If the cable is directly attached to a device other than an AP access point: step 4 .
a
Observe the appearance of the Link LED for the port:
Link LED Appearance
Solid green
Solid amber
Blinking green
Blinking amber
Unlit
Meaning
100-Mbps link is operational.
10-Mbps link is operational.
Traffic is active on the 100-Mbps link.
Traffic is active on the 10-Mbps link.
Link is not operational.
b
If the Link LED is unlit, check the cable and verify that the device at the other end of the link is operating.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
54 Installing and Connecting a WLAN—Security Switch
Connecting to Gigabit Ethernet Devices
Warning! The gigabit Ethernet fiber-optic interfaces use Class 1 lasers. To reduce the risk of eye injury, do not stare into the interface or otherwise direct
the laser beam into your eye. (For translations of this warning, see “Laser
Connecting to a Copper Gigabit Device (2380 only)
Insert a Cat 5 cable with a standard RJ-45 connector. The cable can use straight-through or crossover signalling.
1
Insert the Cat 5 cable into the port’s RJ-45 (copper) interface.
2
Access the command-line interface (CLI) on the switch, use the enable command to enter configuration mode, and use the following command to set the active interface on the port to RJ-45 (copper): set port preference port-list rj45
3
Observe the lower LED to the left of the port:
●
●
●
If the LED is solid green, the 1000-Mbps link is operational.
If the LED is blinking green, traffic is active on the 1000-Mbps link.
If the LED is unlit, the link is not operational. Check the cable and verify that the device at the other end of the link is operational.
Connecting to a Fiber Gigabit Device (2370 or 2380)
You must install a gigabit interface converter (GBIC) to connect a 2370 or 2380 switch to 1000BASE-SX or
1000BASE-LX cable. Figure 16 shows how to install a GBIC. Figure 17 shows how to remove one. Refer to these
figures as you perform the procedures. (For cable requirements, see “Network Cables” on page 40.)
Figure 16. GBIC Installation in 2370 Switch
GBIC
320656-A
Installing and Connecting a WLAN—Security Switch 55
Figure 17. GBIC Removal from 2370 Switch
Squeeze the lock clips to release GBIC.
To install a GBIC:
1
Insert the GBIC into a GBIC slot on the front panel until it clicks into place.
2
Remove the protective covering(s) from the port connector(s) and set them aside in a safe place for later use.
3
Insert the network cable.
Note.
For 1000BASE-SX or 1000BASE-LX fiber, make sure you insert the two cable ends in the proper sides (transmit or receive). Otherwise, the link does not work.
4
Observe the upper LED to the right of the GBIC port:
●
●
●
If the LED is green, the 1000-Mbps link is operational.
If the LED is blinking amber, traffic is active on the 1000-Mbps link.
If the LED is unlit, the link is not operational. Check the cable and verify that the device at the other end of the link is operational.
To remove a GBIC:
1
Remove the network cable(s).
2
Insert the protective covering(s) into the port connector(s).
3
Squeeze the clips on the sides of the GBIC and pull the GBIC out of the slot.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
56 Installing and Connecting a WLAN—Security Switch
320656-A
57
WSS Setup Methods
How a WLAN—Security Switch Gets its Configuration . . . . . . . . . . . . . . . . . . . . . . 59
Opening the QuickStart Network Plan in WLAN Management Software . . . . . . . . . 77
This chapter describes the methods you can use to configure a WSS, and refers you to information for each method.
Depending on your configuration needs, you can use one or a combination of these methods.
Note.
For easy installation, use one of the quick-start methods described in this chapter instead of using the CLI instructions in later chapters in the manual.
Overview
WSS Software provides the following quick-start methods for new (unconfigured) switches:
• Web Quick Start (2350 and 2360 only)
• CLI quickstart command
You can use either quick-start method to configure a switch to provide wireless service. You also can use any of the following management applications to configure a new switch or to continue configuration of a partially configured switch:
• WLAN Management Software
• CLI
• Web View
Quick Starts
The Web Quick Start enables you to easily configure a 2350 or 2360 switch to provide wireless access to up to ten users.
The Web Quick Start is accessible only on unconfigured 2350 and 2360 switches. The interface is not available on other switch models or on any switch that is already configured.
The quickstart command enables you to configure a 2350, 2360, 2370, or 2361 switch to provide wireless access to any number of users.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
58 WSS Setup Methods
WLAN Management Software
You can use WLAN Management Software to remotely configure a switch using one of the following techniques:
• Drop ship—On model 2350 only, you can press the factory reset switch during power on until the right
LED above port 1 flashes for 3 seconds. Activating the factory reset causes the 2350 to bypass the Web
Quick Start and request its configuration from WLAN Management Software instead.
• Staged WSS—On any switch model, you can stage the switch to request its configuration from WLAN
Management Software , by preconfiguring IP parameters and enabling the auto-config option.
(These options are described in more detail in “Remote WSS Configuration” on page 67.)
You also can use WLAN Management Software to plan your network, create WSSs in the plan, then deploy the switch configurations to the real switches. For information, see the following:
• Nortel WLAN Management Software User’s Guide
• Nortel WLAN Management Software Reference Manual
To open a sample network plan, see
“Opening the QuickStart Network Plan in WLAN Management Software” on page 77
.
CLI
You can configure a switch using the CLI by attaching a PC to the switch’s Console port. See the following:
•
“Configuring a 2370, 2360, or 2380 Switch for Basic Service” on page 79
•
“Configuring a 2350 Switch for a Branch Office” on page 125
• Nortel WLAN 2300 System Software Configuration Guide
After you configure the switch for SSH or Telnet access, you also can use these protocols to access the CLI.
Web View
You can use a switch’s web management interface, Web View, to configure the switch. For access informa-
tion, see “Enabling and Logging Into Web View” on page 97 .
Note.
Web View is different from the Web Quick Start application. Web View is a web-based management application that is available at any time on a switch that already has IP connectivity. (Web View access also requires the switch’s HTTPS server to be enabled.) The Web Quick Start application is accessible only on unconfigured switches.
320656-A
WSS Setup Methods 59
How a WLAN—Security Switch Gets its Configuration
shows how a WSS gets a configuration when you power it on.
Figure 18. WSS Startup Algorithm
Switch is powered on.
Does switch have a configuration?
No
Switch boots using its configuration file.
Is auto-config enabled?
No
Switch displays
CLI prompt.
Yes
Model WSS-2350?
Yes
No
Was factory reset pressed during power on?
Yes
Switch contacts
WMS to request configuration.
No
Model WSS-2360?
Yes
No
Boots with no configuration.
You must use the CLI to start configuring the switch.
Web Quick Start is enabled.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
60 WSS Setup Methods
Web Quick Start (2350 and 2360 Only)
You can use the Web Quick Start to configure the switch to provide wireless access to up to ten network users.
To access the Web Quick Start, attach a PC directly to port 1 or port 2 on the switch and use a web browser on
Note.
The Web Quick Start application is different from Web View. Web View is a web-based management application that is available at any time on a switch that already has IP connectivity. (Web View access also requires the switch’s HTTPS server to be enabled.) The Web Quick Start application is accessible only on unconfigured switches.
Note.
The Web Quick Start application is supported only on switch models 2350 and
2360. After you finish the Web Quick Start, it will not be available again unless you clear
(erase) the switch’s configuration.
Web Quick Start Parameters
The Web Quick Start enables you to configure basic wireless access for a small office. You can use the Web
Quick Start to configure the following parameters:
• System name of the switch
• Country code (the country where wireless access will be provided)
• Administrator username and password
• Management IP address and default gateway
• Time and date (statically configured or provided by an NTP server)
• Management access
You can individually select Telnet, SSH, and Web View. You also can secure the Console port.
Access requires the administrator username and password.
• Power over Ethernet (PoE), for ports directly connected to AP access points
• SSIDs and authentication types. The Web Quick Start enables you to configure one secure SSID and one clear SSID. You can configure additional SSIDs using the CLI or WLAN Management Software .
• Usernames and passwords for your wireless users. You can configure up to ten users with the Web Quick
Start. To configure additional users, use the CLI or WLAN Management Software .
Web Quick Start Requirements
To use the Web Quick Start, you need the following:
320656-A
WSS Setup Methods 61
• AC power source for the switch
• PC with an Ethernet port that you can connect directly to the switch
• Category 5 (Cat 5) or higher Ethernet cable
If the PC is connected to the network, power down the PC or disable its network interface card (NIC), then unplug the
PC from the network.
Note.
You can use a Layer 2 device between the switch and the PC. However, do not attach the switch to your network yet. The switch requires the PC you attach to it for configuration to be in the 192.168.100.x subnet, and uses the WSS Software DHCP server to assign the PC an address from this subnet. If you attach the unconfigured switch to your network, the switch disables the WSS Software DHCP server, if the switch detects another
DHCP server on the network. If the network does not have a DCHP server, the switch’s
DHCP server remains enabled and will offer IP addresses in the 192.168.100.x subnet in response to DHCP Requests.
Accessing the Web Quick Start
To access the Web Quick Start:
1
Use a Category 5 (Cat 5) or higher Ethernet cable to connect the switch directly to a PC that has a web browser.
2
Connect the switch to an AC power source.
If the green power LED is lit, the switch is receiving power.
Note.
If you are configuring an 2350, do not press the factory reset switch during power on. Pressing this switch on an unconfigured switch causes the switch to attempt to contact a WLAN Management Software server instead of displaying the Web Quick Start. (Other switch models also have reset switches, but the reset switch simply restarts these other models without clearing the configuration.)
3
Enable the PC’s NIC that is connected to the switch, if not already enabled.
4
Use a web browser to access IP address 192.168.100.1.
This is a temporary, well-known address assigned to the unconfigured switch when you power it on. The
Web Quick Start enables you to change this address.
The first page of the Quick Start Wizard appears.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
62 WSS Setup Methods
5
Click Next to begin. The wizard screens guide you through the configuration steps.
Caution!
Use the wizard’s Next and Back buttons to navigate among the wizard pages. Do not use the browser’s navigation buttons.
6
After guiding you through the configuration, the wizard displays a summary of the configuration values you selected. Here is an example:
7
Review the configuration settings, then click Finish to save the changes or click Back to change settings.
If you want to quit for now and start over later, click Cancel .
320656-A
WSS Setup Methods 63
If you click Finish , the wizard saves the configuration settings into the switch’s configuration file. If the switch is rebooted, the configuration settings are restored when the reboot is finished.
The switch is ready for operation. You do not need to restart the switch.
Caution!
On a 2350, do not press the factory reset switch! On an 2350 that is fully booted, the factory reset switch erases the configuration. If you do accidentally press the factory reset switch and erase the configuration, you can use the Web Quick Start to reconfigure the switch.
For more advanced configuration, use the CLI or WLAN Management Software . See the following:
•
“Configuring a 2370, 2360, or 2380 Switch for Basic Service” on page 79
•
“Configuring a 2350 Switch for a Branch Office” on page 125
• Nortel WLAN 2300 System Software Configuration Guide
• Nortel WLAN 2300 System Software Command Reference
• Nortel WLAN Management Software User’s Guide
• Nortel WLAN Management Software Reference Manual
CLI quickstart Command
The quickstart command runs a script that interactively helps you configure the following items:
• System name
• Country code (regulatory domain)
• System IP address
• Default route
• Administrative users and passwords
• Unencrypted (clear) SSID names
• Usernames and passwords for guest access using WebAAA
• Encrypted (crypto) SSID names and dynamic WEP encryption for encrypted SSIDs’ wireless traffic
• Usernames and passwords for secure access using 802.1X authentication using PEAP-MSCHAP-V2 and secure wireless data encryption using dynamic Wired Equivalent Privacy (WEP)
• Directly connected AP access points
• Distributed AP access points
The quickstart command displays a prompt for each of these items, and lists the default if applicable. You can advance to the next item, and accept the default if applicable, by pressing Enter.
Depending on your input, the command also automatically generates the following key pairs and self-signed certificates:
• SSH key pair (always generated)
• Admin key pair and self-signed certificate (always generated)
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
64 WSS Setup Methods
• EAP (802.1X) key pair and self-signed certificate (generated if you type usernames and passwords for users of encrypted SSIDs)
• Web-based AAA key pair and self-signed certificate (generated if you type usernames and passwords for users of unencrypted SSIDs)
The command automatically places all ports that are not used for directly connected AP access points into the default
VLAN (VLAN 1).
Caution!
The quickstart command is for configuration of a new switch only. After prompting you for verification, the command erases the switch’s configuration before continuing. If you run this command on a switch that already has a configuration, the configuration will be erased. In addition, error messages such as Critical AP Notice for directly connected APs can appear.
To run the quickstart command:
1
Attach a PC to the WSS’s serial console port. (Use these modem settings: 9600 bps, 8 bits, 1 stop, no parity, hardware flow control disabled .)
2
Press Enter three times, to display a username prompt (Username:), a password prompt (Password:), and then a command prompt such as the following:
2370-aabbcc>
(Each switch has a unique system name that contains the model number and the last half of the switch’s
MAC address.)
3
Access the enabled level (the configuration level) of the CLI:
2370-aabbcc> enable
4
Press Enter at the Enter password prompt.
5
Type quickstart . The command asks you a series of questions. You can type ?
for more help. To quit, press Ctrl + C .
.
Another question the script asks is, “Do you wish to configure wireless?” If you answer y , the script goes on to ask you for SSID and user information, for unencrypted and encrypted SSIDs. If you answer n , the script generates key pairs for SSH and the administrative users you entered, generates a self-signed administrative certificate, and then ends.
Quickstart Example
This example configures the following parameters:
• System name: 2370-Corp
• Country code (regulatory domain): US
320656-A
WSS Setup Methods 65
• System IP address: 10.10.10.4, on IP interface 10.10.10.4 255.255.255.0
Note.
The quickstart script asks for an IP address and subnet mask for the system IP address, and converts the input into an IP interface with a subnet mask, and a system IP address that uses that interface. Likewise, if you configure this information manually instead of using the quickstart command, you must configure the interface and system IP address separately.
• Default route: 10.10.10.1
• Administrative user mxadmin , with password letmein. The only management access the switch allows by default is
CLI access through the serial connection.
• System Time and date parameters:
●
●
●
Date: 15th of November, 2004
Time: 6:58 PM
Timezone: PST (Pacific Standard Time), with an offset of -8 hours from Universal Coordinated Time
(UTC)
• Unencrypted SSID name: public
• Username user1 and password pass1 for WebAAA; username user2 and password pass2 for WebAAA
• Encrypted SSID name: corporate
• Username alice and password alicepass for 802.1X authentication; username bob and password bobpass for
802.1X authentication
• Directly connected AP access points on port 2 and 3, each model 2330 (applies only to WSS models 2360 and
2370)
The IP addresses, usernames, and passwords in this document are examples. Use values that are appropriate for your organization.
If you configure time and date parameters, you will be required to enter a name for the timezone, and then enter the value of the timezone (the offset from UTC) separately. You can use a string of up to 32 alphabetic characters as the timezone name.
Figure 19 shows an example. Users bob and alan can access encrypted SSID corporate on either of the AP access points.
Users user1 and user2 can use the same APs to access unencrypted SSID public . Although the same hardware supports both SSIDs and sets of users, AAA ensures that only the users who are authorized to access an SSID can access that
SSID. Users of separate SSIDs can even be in the same VLAN, as they are in this example.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
66 WSS Setup Methods
Figure 19. Single-Switch Deployment
Console
Port
2
WSS-2270-Corp
10.10.10.4
Port
3
Backbone
Corporate resources
Internet alan
320656-A user2 bob user1
2370-aabbcc# quickstart
This will erase any existing config. Continue? [n]: y
Answer the following questions. Enter '?' for help. ^C to break out
System Name [2370]: 2370-Corp
Country Code [US]: US
System IP address []: 10.10.10.4
System IP address netmask []: 255.255.255.0
Default route []: 10.10.10.1
Admin username [admin]: mxadmin
Admin password []: letmein
Do you wish to set the time? [y]: y
Enter the date (dd/mm/yy) []: 15/11/04
Enter the time (hh:mm:ss) []: 18:58:00
Enter the timezone []: PST
Enter the offset from GMT for 'PST' in hh:mm [0:0]: -8
Do you wish to configure wireless? [y]: y
Enter a clear SSID to use: public
Do you want to do WEB-AAA? [y]: y
Enter a username with which to do web-aaa, <cr> to exit: user1
Enter a password for guesta: pass1
Enter a username with which to do web-aaa, <cr> to exit: user2
Enter a password for guestb: pass2
Enter a username with which to do web-aaa, <cr> to exit:
Do you want to do 802.1x and PEAP-MSCHAPv2? [y]: y
Enter a crypto SSID to use: corporate
Enter a username with which to do PEAP-MSCHAPv2, <cr> to exit: alan
WSS Setup Methods 67
Enter a password for alice: alanpass
Enter a username with which to do PEAP-MSCHAPv2, <cr> to exit: bob
Enter a password for bob: bobpass
Enter a username with which to do PEAP-MSCHAPv2, <cr> to exit:
Do you wish to configure access points? [y]: y
Enter a port number [1-20] on which an AP resides, <cr> to exit:
2
Enter AP model on port 2: AP-2330
Enter a port number [1-20] on which an AP resides, <cr> to exit:
3
Enter AP model on port 3: AP-2330
Enter a port number [1-20] on which an AP resides, <cr> to exit:
Do you wish to configure distributed access points? [y]: n success: created keypair for ssh success: created keypair for admin success: created self-signed certificate for admin success: created keypair for eap success: created self-signed certificate for eap success: created keypair for webaaa success: created self-signed certificate for webaaa success: remember to save this config
2370-aabbcc# save config
6
Optionally, enable Telnet.
2370-aabbcc# set ip telnet server enable
7
Verify the configuration changes.
2370-aabbcc# show config
8
Save the configuration changes.
2370-aabbcc# save config
Remote WSS Configuration
You can use WLAN Management Software Services running in your corporate network to configure WSSs in remote offices. The following remote configuration scenarios are supported:
• Drop ship—WLAN Management Software Services running in the corporate network can configure a 2350 switch shipped directly to a remote office. This option does not require any preconfiguration of the switch.
• Staged—You can stage any model of switch by preconfiguring IP connectivity and enabling auto-config, then sending the switch to the remote office. The switch contacts WLAN Management Software Services in the corporate network to complete its configuration.
The drop ship option is supported only for the 2350. The staged option is supported for all switch models. Both options require WLAN Management Software Services. If you know a switch’s serial number, you can create a complete configuration for the switch in WLAN Management Software . When the switch requests its configuration from WLAN
Management Software , WLAN Management Software sends the configuration for that serial number. If you do not
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
68 WSS Setup Methods know the switch’s serial number, you can upload the partially configured switch into WLAN Management Software , finish its configuration, then deploy the completed configuration back to the switch.
How Remote WSS Configuration Works
Drop Ship (2350 Only)
1
The 2350 is shipped directly to the remote office where it will be deployed.
2
The network administrator at the corporate office preconfigures the switch in a WLAN Management
Software network plan. The switch configuration must have a name for the switch, the model must be
2350, and the serial number must match the switch’s serial number. The configuration should also include all other settings required for the deployment, including AP configuration, SSIDs, AAA settings, and so on.
3
Someone at the remote office where the switch is delivered physically installs the switch by connecting port 1 to the network. If the switch will manage a directly connected AP, the AP needs to be physically installed and connected by an Ethernet cable to port 2. If Distributed APs will be managed, these also must be physically installed, connected to the network by Ethernet cables, and connected to Power over
Ethernet (PoE) sources.
Note.
Drop ship configuration requires a DHCP server at the remote office. The
2350 uses the DHCP server to obtain an IP configuration in order to communicate with WLAN Management Software Services in the corporate network. The drop ship option also requires an entry in the local DNS server that maps the hostname wlan-config-srv to the IP address of the host where WLAN Management Software
Services are installed.
4
The person at the remote office powers on the 2350, and inserts a paperclip or similar object into the
2350’s factory reset hole to press the factory reset switch. Normally, the factory reset LED (the right LED above port 1) remains solidly lit for 3 seconds after power on. However, when the factory reset switch is pressed, the LED flashes for 3 seconds instead.
Figure 20 shows the location of the factory reset switch and the LED.
Figure 20. Factory Reset Switch on 2350
Factory Reset switch
Factory Reset
LED
1 2
Serial console port
10/100 Ethernet uplink port
10/100 and AP
Ethernet port
Power supply input
Power supply LED
320656-A
WSS Setup Methods 69
5
Because the factory reset switch was pressed while the switch was starting, the 2350 configures the following items, to enable itself to contact WLAN Management Software Services:
● Self-signed administrative certificate (required for communication with WLAN Management
Software )
● Ports 1 and 2 in the default VLAN (VLAN 1)
● DHCP client on VLAN 1 enabled
6
The 2350 uses the DHCP client to obtain an IP configuration from a local DHCP server. After obtaining an IP configuration, the switch sends a DNS query for the IP address of well-known hostname wlan-config-srv.
7
DNS replies with the IP address of the host where WLAN Management Software Services are installed.
The 2350 sends a configuration request to WLAN Management Software Services.
8
WLAN Management Software receives the configuration request, and looks in the currently open network plan for an 2350 configuration with the same serial number as the one in the configuration request.
● If the network plan contains a configuration with a matching serial number, WLAN Management
Software deploys the configuration to the switch and restarts the switch. The switch boots using the
configuration it received from WLAN Management Software . (See “Preconfiguring a Switch in
.)
● If the network plan does not have a configuration with a matching serial number, a verification warning appears in WLAN Management Software . The warning lists the switch’s serial number and
IP address. The network administrator can upload the switch into the network plan, configure switch
parameters, and deploy the configuration to the switch. (See “Uploading a Partially Configured
Switch and Completing its Configuration with WLAN Management Software” on page 76.)
Staged WSS
1
The switch is shipped to a network administrator who configures IP address and DNS information on the switch, and enables the auto-config option, to configure the switch to contact WLAN Management
Software Services in the corporate network.
The network administrator can configure the switch to use a DCHP client to obtain IP information, or can statically configure the information. The IP address and default gateway are required.
DNS information is optional, but is recommended if DNS is available. If DNS is available, an entry must be added to the DNS server that maps the IP address of the host where WLAN Management Software
Service are installed to the well-known hostname wlan-config-srv. Otherwise, an IP alias can be configured on the switch itself to map the address to the hostname.
2
The preconfigured switch is shipped to the remote office where it will be deployed.
3
Someone at the remote office physically installs the switch and APs.
4
The person at the remote office powers the switch on. The switch boots using the configuration created during staging.
5
The switch either uses its DHCP client to obtain an IP address from a local DHCP server, or uses a statically configured address. This depends on the switch’s preconfiguration.
6
If the auto-config option is enabled, the switch sends a DNS query for the IP address of well-known hostname wlan-config-srv.
7
DNS replies with the IP address of the host where WLAN Management Software Services are installed.
The switch sends a request to WLAN Management Software Services in the corporate network for a configuration. (If the auto-config option is not enabled, the switch boots using its configuration file. You can use the CLI, WLAN Management Software , or Web View to complete its configuration.)
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
70 WSS Setup Methods
8
WLAN Management Software receives the configuration request, and looks in the currently open network plan for a switch configuration with the same model and serial number as the one in the configuration request.
● If the network plan contains a configuration with a matching model and serial number, WLAN
Management Software sends the configuration to the switch and restarts the switch. The switch
.)
● If the network plan does not have a configuration with a matching model and serial number, a verification warning appears in WLAN Management Software . The warning lists the switch’s serial number and IP address. The network administrator can upload the switch into the network plan,
configure switch parameters, and deploy the configuration to the switch. (See “Uploading a Partially
Configured Switch and Completing its Configuration with WLAN Management Software” on page 76.)
Staging a WSS for Configuration by WLAN Management Software
The auto-config option must be enabled on a WSS in order for the switch to try to contact WLAN Management Software
Services for configuration. The auto-config option is automatically enabled on an unconfigured 2350 when the factory reset switch is pressed during power on. However, auto-config is disabled by default on other models.
If you want another WSS model to be able to access WLAN Management Software Services for a configuration, you must preconfigure the WSS with the following information:
• IP address
• Gateway address
• Domain name and DNS server address
You can enable the switch to use the WSS Software DHCP client to obtain this information from a DHCP server in the local network where the switch will be deployed. Alternatively, you can statically configure the information.
The IP address and DNS information are configured independently. You can configure the combination of settings that work with the network resources available at the deployment site. The following examples show some of the combinations you can configure.
If DNS is available, an entry must be added to the DNS server that maps the IP address of the host where WLAN
Management Software Service are installed to the well-known hostname wlan-config-srv. Otherwise, an IP alias can be configured on the switch itself to map the address to the hostname.
You also must configure an administrative certificate, to enable the switch to communicate with WLAN Management
Software . You can configure a self-signed certificate or install one from a certificate authority (CA). These examples install a self-signed certificate.
Example 1: Deployment Site Has DHCP and Local DNS
The deployment site in this example has a DHCP server. The switch is configured to use the WSS Software DHCP client to obtain an IP address, default gateway address, DNS domain name, and DNS server IP addresses.
1
Configure a VLAN:
2361# set vlan 1 port 7 success: change accepted.
320656-A
WSS Setup Methods 71
2
Enable the DHCP client on VLAN 1:
2361# set interface 1 ip dhcp-client enable success: change accepted.
3
Enable the auto-config option:
2361# set auto-config enable success: change accepted.
4
Create a self-signed administrative certificate, to enable the WSS to communicate with WLAN
Management Software :
2360# crypto generate key admin 1024 key pair generated
2360# crypto generate self-signed admin
Country Name:
State Name:
Locality Name:
Organizational Name:
Organizational Unit:
Common Name: [email protected]
Email Address:
Unstructured Name:
Self-signed cert for admin is
-----BEGIN CERTIFICATE-----
MIICUzCCAbygAwIBAgICA+cwDQYJKoZIhvcNAQEEBQAwNjELMAkGA1UEBhMCVVM x
CzAJBgNVBAgTAkNBMRowGAYDVQQDFBF0ZWNocHVic0B0cnB6LmNvbTAeFw0wMzA
0
...
Lm8wmVYLxP56MpCUAm9O8C2foYgOY40=
-----END CERTIFICATE-----
5
Save the configuration changes:
2361# save config success: configuration saved.
Example 2: Deployment Site Has No DHCP and No DNS
The deployment site in this example does not have a DHCP server or a local DNS server. Therefore, IP and DNS information must be statically configured. Because no DNS server is available, an IP alias is configured to map the IP address of the host where WLAN Management Software Services are installed to the well-known hostname wlan-config-srv.
1
Configure a VLAN:
2361# set vlan 1 port 7 success: change accepted.
2
Configure an IP interface on the VLAN.
2361# set interface 1 ip 192.168.1.252 255.255.255.0
success: change accepted.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
72 WSS Setup Methods
3
Configure a default route through the local gateway:
2361# set ip route default 192.168.1.1 0 success: change accepted.
4
Configure the default DNS domain name:
2361# set ip dns domain example.com
Domain name changed
5
Configure an IP alias to map the WLAN Management Software server IP address to the well-known name wlan-config-srv:
2361# set ip alias wlan-config-srv 172.16.22.84
6
Enable the auto-config option:
2361# set auto-config enable success: change accepted.
7
Create a self-signed administrative certificate, to enable the WSS to communicate with WLAN
Management Software :
2360# crypto generate key admin 1024 key pair generated
2360# crypto generate self-signed admin
Country Name:
State Name:
Locality Name:
Organizational Name:
Organizational Unit:
Common Name: [email protected]
Email Address:
Unstructured Name:
Self-signed cert for admin is
-----BEGIN CERTIFICATE-----
MIICUzCCAbygAwIBAgICA+cwDQYJKoZIhvcNAQEEBQAwNjELMAkGA1UEBhMCVVM x
CzAJBgNVBAgTAkNBMRowGAYDVQQDFBF0ZWNocHVic0B0cnB6LmNvbTAeFw0wMzA
0
...
Lm8wmVYLxP56MpCUAm9O8C2foYgOY40=
-----END CERTIFICATE-----
8
Save the configuration changes:
2361# save config success: configuration saved.
Example 3: Deployment Site Has DNS But No DHCP
The deployment site in this example does not have a DHCP server but does have a local DNS server. The configuration is similar to Example 1, but includes DNS configuration information instead of an IP alias.
320656-A
WSS Setup Methods 73
1
Configure a VLAN:
2361# set vlan 1 port 7 success: change accepted.
2
Configure an IP interface on the VLAN.
2361# set interface 1 ip 192.168.1.252 255.255.255.0
success: change accepted.
3
Configure a default route through the local gateway:
2361# set ip route default 192.168.1.1 0 success: change accepted.
4
Configure the default DNS domain name:
2361# set ip dns domain example.com
Domain name changed
5
Configure DNS server information:
2361# set ip dns server 192.168.11.2
6
Enable the WSS Software DNS client:
2361# set ip dns server enable success: change accepted.
7
Enable the auto-config option:
2361# set auto-config enable success: change accepted.
8
Create a self-signed administrative certificate, to enable the WSS to communicate with WLAN
Management Software :
2360# crypto generate key admin 1024 key pair generated
2360# crypto generate self-signed admin
Country Name:
State Name:
Locality Name:
Organizational Name:
Organizational Unit:
Common Name: [email protected]
Email Address:
Unstructured Name:
Self-signed cert for admin is
-----BEGIN CERTIFICATE-----
MIICUzCCAbygAwIBAgICA+cwDQYJKoZIhvcNAQEEBQAwNjELMAkGA1UEBhMCVVM x
CzAJBgNVBAgTAkNBMRowGAYDVQQDFBF0ZWNocHVic0B0cnB6LmNvbTAeFw0wMzA
0
...
Lm8wmVYLxP56MpCUAm9O8C2foYgOY40=
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
74 WSS Setup Methods
-----END CERTIFICATE-----
9
Save the configuration changes:
2361# save config success: configuration saved.
Example 4: Deployment Site Has DHCP But Local DNS Domain Differs From
Corporate DNS Domain
The deployment site in this example has a DHCP server, so the switch’s DHCP client is enabled. Static IP address and default gateway information are not required. The site also has a local DNS server. However, the local DNS domain name is different from the corporate DNS domain name where WLAN Management Software Services are located. The static DNS configuration on the switch overrides the DNS configuration from the DHCP server.
1
Configure a VLAN:
2361# set vlan 1 port 7 success: change accepted.
2
Enable the DHCP client on VLAN 1:
2361# set interface 1 ip dhcp-client enable success: change accepted.
3
Configure the default DNS domain name:
2361# set ip dns domain examplecorp.com
Domain name changed
4
Configure DNS server information:
2361# set ip dns server 192.168.11.2
5
Enable the WSS Software DNS client:
2361# set ip dns server enable success: change accepted.
6
Enable the auto-config option:
2361# set auto-config enable success: change accepted.
7
Create a self-signed administrative certificate, to enable the WSS to communicate with WLAN
Management Software :
2360# crypto generate key admin 1024 key pair generated
2360# crypto generate self-signed admin
Country Name:
State Name:
Locality Name:
Organizational Name:
Organizational Unit:
Common Name: [email protected]
320656-A
WSS Setup Methods 75
Email Address:
Unstructured Name:
Self-signed cert for admin is
-----BEGIN CERTIFICATE-----
MIICUzCCAbygAwIBAgICA+cwDQYJKoZIhvcNAQEEBQAwNjELMAkGA1UEBhMCVVM x
CzAJBgNVBAgTAkNBMRowGAYDVQQDFBF0ZWNocHVic0B0cnB6LmNvbTAeFw0wMzA
0
...
Lm8wmVYLxP56MpCUAm9O8C2foYgOY40=
-----END CERTIFICATE-----
8
Save the configuration changes:
2361# save config success: configuration saved.
WLAN Management Software Requirements
• WLAN Management Software Version 4.0 or higher must be installed and the WLAN Management Software
Services must be running.
• The WLAN Management Software Services option to accept remote connections must be enabled. (This option is disabled by default.)
• The WLAN Management Software Services option to always accept self-signed certificates must be enabled. This is required if you are using the drop-ship option with an 2350, or you have staged any model switch with a self-signed certificate. (This option is disabled by default.)
• The network plan containing the WSSs must be open.
Preconfiguring the switch in the network plan is optional. If you know the switch’s serial number, you can preconfigure the switch in the network plan, and let WLAN Management Software Services deploy the configuration to the switch.
If you do not know the switch’s serial number, you still can use WLAN Management Software to configure the switch.
However, you will need to wait for the switch to contact WLAN Management Software , so you can upload the switch’s configuration, modify the configuration, then deploy the modified configuration back to the switch.
Preconfiguring a Switch in WLAN Management Software
If you know the switch’s serial number, use the following procedure to set up the switch’s configuration in WLAN
Management Software .
1
Start WLAN Management Software Services.
2
Start a WLAN Management Software client and connect to WLAN Management Software Services.
3
Select Tools > WLAN Management Software Services Setup from the menu bar in the main WLAN
Management Software window. The WLAN Management Software Services Setup wizard appears.
4
On the Service Settings tab of the wizard (displayed by default), select Allow remote access , in the
Access Control area.
5
Select the WSS Connection Settings tab.
6
Select Accept self-signed certificates , in the Connection Security area.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
76 WSS Setup Methods
7
Click Save , then click Close .
8
Open the network plan for the site, or select File > New to create a new network plan.
9
Select Config > Insert > WLAN—Security Switch to access the Create WLAN Security Switch wizard.
10
Enter a name for the switch in the WSS Name box.
11
Select the switch model.
12
Enter the serial number in the Serial Number box.
13
Configure other parameters as required for the switch’s deployment.
14
Click Finish to save the switch configuration and close the wizard.
Leave WLAN Management Software Services running, with the network plan open. When the switch is powered on at the remote site (and the factory reset switch is pressed, if an 2350), the switch contacts WLAN Management Software
Services to request a configuration.
After the remote switches have their configurations, Nortel recommends that you disable the WLAN Management
Software Services option to accept self-signed certificates.
Uploading a Partially Configured Switch and Completing its Configuration with
WLAN Management Software
Even if you do not know the serial number of a WSS, you still can configure the switch in WLAN Management
Software . When the switch contacts WLAN Management Software for a configuration, WLAN Management Software generates a warning message such as the following:
No Matching configuration found for serial number – serial-number ; IP= ip-addr
You can upload the switch into WLAN Management Software , complete its configuration, then deploy the complete configuration back to the switch.
1
Open the Verification tab and click on the warning message.
2
In the Resolutions section, click on Upload WSS to display the Upload WLAN Security Switch wizard.
The IP address is already filled in.
3
Type the Enable password, if one is configured on the switch. If an Enable password has not been configured yet, leave the Enable Password box blank.
4
Click Finish .
WLAN Management Software uploads the configuration file from the switch into the network plan. The switch appears in the Equipment section of the Organizer panel.
5
Right-click on the switch and select Edit . The Modify Mobility Exchange wizard appears.
6
Create or modify parameter settings for the switch.
After you complete all the changes, make sure you save the changes by clicking Finish at the bottom of the Modify Mobility Exchange wizard.
7
Select Manage > Verification from the menu bar in the main WLAN Management Software window.
The Verification tab appears.
8
Select the Config Verification tab.
9
Review any error or warning messages for the switch.
320656-A
WSS Setup Methods 77
10
Click on an error or warning message to display more information, and a list of resolutions for the error or warning condition.
11
Click on a resolution to correct the error or warning condition.
12
After you save all changes to the switch’s configuration, select Manage > Deploy from the toolbar in the main WLAN Management Software window. The Deploy Configurations wizard appears.
13
Click Deploy Now to deploy the revised configuration to the WSS.
Opening the QuickStart Network Plan in WLAN
Management Software
WLAN Management Software comes with two sample network plans:
• QuickStart —Contains a two-floor building with two WSSs and two AP access points on each switch. Each switch and its APs provide coverage for a floor. The Nortel equipment is configured to provide both clear (unencrypted) and secure (802.1X) wireless access.
• StarterKit —Contains a simple rectangle as a floor plan, but with one WSS and four AP access points. You can modify this plan to deploy the Nortel starter kit (STR-B-xx).
The QuickStart network plan contains a configuration similar to the one created by the CLI quicktstart example in
management traffic, corporate users, and guest users. Otherwise, the configuration is the same.
To open the network plan:
1
Install WMS, if not already installed. (See the “Getting Started” chapter of the Nortel WMS User’s Guide or the “Installing WMS” chapter of the Nortel WMS Reference Manual .)
2
Start WMS by doing one of the following:
● On Windows systems, select
WMS icon on the desktop.
Start > Programs > Nortel > WMS > WMS , or double-click the
● On UNIX and Linux systems, change directories to
./WMS .
WMS_installation_directory /bin, and enter
If you are starting WLAN Management Software for the first time, or you have not entered license information previously, the License Information dialog box appears. Enter the serial number and License, then click OK .
3
When the WLAN Management Software Services Connection dialog appears, enter the IP address and
UDP port of WLAN Management Software Services (if installed on a different machine than the client), and click Next .
4
If the Certificate Check dialog appears, click Accept to complete the connection to WLAN Management
Software Services.
5
Select Tools > WLAN Management Software Services Setup .
6
In the Network Plan area of the Service Settings tab, select QuickStart, if not already selected.
7
Click Save , then click Close .
8
Select File > Open , then repeat
and
to log on to WLAN Management Software Services.
The QuickStart plan is opened.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
78 WSS Setup Methods
320656-A
79
Configuring a 2370, 2360, or
2380 Switch for Basic Service
Note.
Use this chapter for setting up a 2370, 2360, or 2380. To set up a 2350, see
Chapter , “Configuring a 2350 Switch for a Branch Office,” on page 125 . To quickly perform
basic setup instead of using this chapter, see the Nortel WLAN 2300 System Software
Quick Start Guide
or “WSS Setup Methods” on page 57
.
Enabling Secure Communication for WLAN Management Software or Web View . . 88
If your WSS does not yet have an IP address and you are accessing the CLI through the serial console port, go first to
“Accessing the CLI” on page 80 .
Note.
This chapter shows CLI command syntax and examples and includes complex terminology. For syntax descriptions, additional configuration, and a glossary of terms, see the Nortel Mobility System Software Command Reference and the Nortel Mobility System
Software Configuration Guide .
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
80 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Accessing the CLI
To enter the configuration commands in this chapter, you must log in to the enabled access level of the CLI.
The default username and password are null strings.
To log in from the serial console to the enabled access level for configuration:
1
Press Enter to display a username prompt.
Username:
2
Press Enter again to display a password prompt.
Username:
Password:
3
Press Enter a third time to display a command prompt.
Username:
Password:
2370>
Note.
For simplicity, the command prompt examples in the documentation show a switch model (such as 2370 ) and the CLI access level ( > for restricted access or # for enabled access) only. The default command prompt on your WSS shows your switch’s model number and also contains the last three octets of the switch’s MAC address. For example, the default command prompt on a 2370 switch with MAC address 00:0B:0E:00:04:0A is 2370-00040A> .
4
Type the enable command and press Enter once more to display the prompt for the enabled access level.
Username:
Password:
2370> enable
2370#
Configuration Overview
To configure a WSS for basic service, perform the following tasks, in this order:
1
Configure an enable password. (See “Configuring an Enable Password” on page 82
.)
2
Configure time and date parameters. (See
“Configuring the Time and Date” on page 83 .)
3
Configure IP connectivity. (See
“Configuring IP Connectivity” on page 85 .)
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 81
4
Enable secure communication for WLAN Management Software or Web View management.
Perform this task only if you intend to use these interfaces. (See
Communication for WLAN Management Software or Web View” on page 88 .)
5
Specify the country of operation. (See
“Specifying the Country of Operation” on page 98 .)
Note.
If you plan to use WLAN Management Software or Web View to configure the switch, you can stop using the CLI after this configuration task.
6
Specify a system IP address. (See
“Specifying a System IP Address” on page 100 .)
7
Set the port types for ports connected to wired or wireless authentication users. (See
“Configuring for Authenticating Users” on page 101 .)
8
Configure Mobility Domain parameters. (See page 114
.)
“Configuring Mobility Domain Parameters” on
9
Configure authentication for network users. (See
.)
“Configuring User Authentication” on
10
Verify the changes and save them to the configuration file. (See
Figure 21 shows the Nortel network configured by the command examples in this chapter. All CLI configuration examples in this chapter apply to the WSS named WSS1 . In most cases, the examples are valid for WSS models 2360, 2370, and 2361. The exception is that the 2380 switch supports Distributed AP access points only. (Distributed APs are connected to the WSS through an intermediate Layer 2 or Layer 3 network.) Thus,
WSS1 in Figure 21 can be a 2360 or 2370 switch but not a 2380 switch. WSS2 and WSS3 can be any model
WSS.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
82 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Figure 21. Example Nortel Network serial-id 0322199997
AP-2330 serial-id 0322199996
AP-2330 serial-id 0322199999
AP-2330
Port
1
Port
2
WSS1
System IP address
10.10.10.4
Port
3
Port
4
Port
5
Wired authentication client
AP-2330 serial-id 0322199995
VLANs on WSS1
VLAN 2 mgmt, port 5, 10.10.10.4/24
VLAN 4 blue, port 5, tag 20, 10.10.20.2/24
VLAN 3 red, port 5, tag 30
WSS2
System IP address
10.10.40.4
Layer 2
RADIUS servers
10.10.70.20
10.10.20.19/24
10.10.30.19/24
10.10.40.19/24
Router
10.10.60.19/24 10.10.70.40
Layer 2
10.10.10.19/24
10.10.60.18/24
AP-2330 serial-id 0322199998
Router
10.10.50.19/24
WMS
Layer 2
WSS3
System IP address
10.10.50.4
Configuring an Enable Password
WSS Software does not require you to change the enable password from the default (null string). However,
Nortel recommends that you configure an enable password to provide at least minimal security to the WSS before you proceed to more advanced configuration options.
To configure an enable password, use the following command: set enablepass
To configure an enable password:
1
If you are not already at the enabled access level, enter the enable command.
2370> enable
2
At the enabled prompt, enter set enablepass .
2370# set enablepass
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 83
3
When you are prompted for your old password, press Enter.
Enter old password:
4
When you are prompted for a new password, enter an enable password of up to 32 alphanumeric characters, with no spaces.
Enter new password:
The password you enter is not displayed.
5
When you are prompted to retype your password, reenter the enable password.
Retype new password:
WSS Software does not display your password, but lets you know that the enable password is set: success: password changed
Configuring the Time and Date
To set the system time and date:
1
Set the time zone to specify the offset from Coordinated Universal Time (UTC).
2
Configure WSS Software to offset the time by an additional hour for daylight savings time or similar summertime period, if applicable.
3
Specify the IP address of a Network Time Protocol (NTP) server or statically set the time and date.
Note.
Nortel recommends that you set the time and date parameters before you install certificates on the WSS. Generally, certificates are valid for one year beginning with the system time and date that are in effect when you generate the certificate request. If the switch’s time and date are incorrect, the certificate might not be valid.
To configure time and date parameters, use the following commands: set timezone zone-name {hours [ minutes ]} set summertime summer-name [ start week weekday month hour min end week weekday month hour min ] set timedate { date mmm dd yyyy [ time hh:mm:ss ]} set ntp { enable | disable } set ntp server ip-addr
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
84 Configuring a 2370, 2360, or 2380 Switch for Basic Service
To verify the changes, use the following commands: show timezone show summertime show timedate show ntp
The following commands configure the timezone as PST (Pacific Standard Time) with an offset of -8 hours from UTC and enable the standard summertime offset and name it PDT (Pacific Daylight Time). Additional commands configure an NTP server and enable the WSS’s NTP client.
2370# set timezone PST -8 success: change accepted.
2370# set summertime PDT success: change accepted.
2370# set ntp server 192.168.1.10
2370# set ntp enable success: NTP Client enabled
The following commands display time and date parameters and the current time and date:
2370# show timezone
Timezone is set to 'PST', offset from UTC is -8:0 hours.
2370# show summertime
Summertime is enabled, and set to 'PDT'.
Start : Sun Apr 04 2004, 02:00:00
End : Sun Oct 31 2004, 02:00:00
Offset : 60 minutes
Recurring : yes, starting at 2:00 am of first Sunday of April
and ending at 2:00 am on last Sunday of October.
2370# show ntp
NTP client: enabled
Current update-interval: 20(secs)
Current time: Fri Feb 06 2004, 12:02:57
Timezone is set to 'PST', offset from UTC is -8:0 hours.
Summertime is enabled.
Last NTP update: Fri Feb 06 2004, 12:02:46
NTP Server Peer state Local State
---------------------------------------------------
192.168.1.5 SYSPEER SYNCED
2370# show timedate
Fri Feb 06 2004, 12:03:04 PST
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 85
Configuring IP Connectivity
To configure IP connectivity:
1
Configure a VLAN, assign a port to the VLAN that can provide IP connectivity through the network for administrative purposes, and configure an IP address on the VLAN. (See
2
Configure a default route. (See
“Configuring a Default Route” on page 87
.)
3
Test the IP configuration. (See “Verifying IP Connectivity” on page 87 .)
Configuring VLANs and IP Addresses
Any or all VLANs on the switch can have an IP address. WLAN Management Software and Web View require IP connectivity to a WSS to manage the switch. User traffic also requires VLANs, although you do not need to configure every user’s VLAN on every WSS. To configure a VLAN and an IP address, use the following commands: set vlan vlan-num name name set vlan vlan-id port port-list [ tag tag-value ] set interface vlan-id ip { ip-addr mask | ip-addr / mask-length }
Note.
The vlan-id parameter can be the VLAN number or the VLAN name.
To verify the changes, use the following commands: show vlan config show interface
The following commands configure a VLAN named mgmt and two additional VLANs over an 802.1Q trunk link for network traffic:
2370# set vlan 2 name mgmt success: change accepted.
2370# set vlan mgmt port 5 success: change accepted.
2370# set vlan 3 name red success: change accepted.
2370# set vlan red port 5 tag 30 success: change accepted.
2370# set vlan 4 name blue success: change accepted.
2370# set vlan blue port 5 tag 20 success: change accepted.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
86 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Note.
To avoid confusion, do not assign numbers as VLAN names. Every VLAN on an
WSS has both a VLAN name used for authorization purposes and a VLAN number. VLAN numbers can vary uniquely for each WSS and are not related to 802.1Q tag values even when used. VLAN names must be unique among all WSSs in a Mobility Domain.
The following command displays VLAN information:
2370# show vlan config
Admin VLAN Tunl Port
VLAN Name Status State Affin Port Tag State
---- ---------------- ------ ----- ----- ---------------- ----- -----
1 default Up Down 5
2 mgmt Up Down 5
5 none Up
3 red Up Down 5
5 30 Up
4 blue Up Down 5
5 20 Up
Note.
The default VLAN listed in the sample show vlan output is present in a WSS’s configuration by default but does not contain any ports unless you add them. Nortel recommends that you do not use the default VLAN (VLAN 1) for user traffic or rename the default VLAN. Instead, configure other VLANs and use those VLANs for user traffic. This is because the default VLAN might not be in the same subnet on each switch.
The following commands configure IP addresses on some of the VLANs. (WSS Software does not require an
IP address on every VLAN.)
2370# set interface mgmt ip 10.10.10.4/24 success: change accepted.
2370# set interface blue ip 10.10.20.2/24 success: change accepted.
2370# show interface
VLAN Name Address Mask Enabled State RIB
---- --------------- --------------- --------------- ------- ----- ---------
2 mgmt 10.10.10.4 255.255.255.0 YES Up
4 blue ipv4
10.10.20.2 255.255.255.0 YES Up ipv4
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 87
Configuring a Default Route
If WLAN Management Software or Web View and a WSS are in different subnets, you need to configure a default route on the WSS. To configure a default route, use the following command: set ip route default gateway metric
To verify the change, use the following command: show ip route
The following commands add a default route that uses gateway 10.10.20.19 with a path cost of 1, and verify the change:
2370# set ip route default 10.10.20.19 1 success: change accepted.
2370# show ip route
Router table for IPv4
Destination/Mask Proto Metric NH-Type Gateway VLAN:Interface
_________________ _______ ______ _______ _______________ _______________
0.0.0.0/ 0 Static 1 Router 10.10.20.19 vlan:4:ip
10.10.10.4/24 IP 0 Direct vlan:2:ip
10.10.10.4/32 IP 0 Local vlan:2:ip:10.10.10.4/24
10.10.10.255/32 IP 0 Local vlan:2:ip:10.10.10.4/24
10.10.20.2/24 IP 0 Direct vlan:4:ip
10.10.20.2/32 IP 0 Local vlan:4:ip:10.10.20.2/24
10.10.20.255/32 IP 0 Local vlan:4:ip:10.10.20.2/24
224.0.0.0/ 4 IP 0 Local MULTICAST
The 0.0.0.0 route is the default route. The 10.10.10.
x and 10.10.20.
x routes in this example are automatically added by
WSS Software when you configure the corresponding IP interfaces. The 224.0.0.0 route is for IGMP snooping. WSS
Software automatically places this route in the configuration.
Verifying IP Connectivity
To verify that the WSS can send and receive IP traffic, use the following command: ping host
The ping command sends an Internet Control Message Protocol (ICMP) echo packet to the specified device and listens for a reply packet. For host , specify the IP address of a host device on the network.
Note.
If you configure the Domain Name Service (DNS) or set a local alias for the host device, you can specify the DNS hostname or the alias instead of the IP address of the device. (For information, see the WLAN 2300 System Software Configuration Guide.
)
The following command verifies IP connectivity to IP address 10.10.20.19:
2370# ping 10.10.20.19
PING 10.10.20.19 (10.10.20.19) from 10.10.20.2 : 56(84) bytes of data.
64 bytes from 10.10.20.19: icmp_seq=1 ttl=255 time=0.769 ms
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
88 Configuring a 2370, 2360, or 2380 Switch for Basic Service
64 bytes from 10.10.20.19: icmp_seq=2 ttl=255 time=0.628 ms
64 bytes from 10.10.20.19: icmp_seq=3 ttl=255 time=0.676 ms
64 bytes from 10.10.20.19: icmp_seq=4 ttl=255 time=0.619 ms
64 bytes from 10.10.20.19: icmp_seq=5 ttl=255 time=0.608 ms
--- 20.20.20.1 ping statistics ---
5 packets transmitted, 5 packets received, 0 errors, 0% packet loss
Enabling Secure Communication for WLAN
Management Software or Web View
To enable secure communication between WLAN Management Software or Web View and a WSS, install a server certificate on the WSS. (See
“Installing a Certificate” on page 90
.)
For Web View, you also need to enable the HTTPS server on the switch and enable Transport Layer Security
(TLS) in the Web browser. (See “Enabling and Logging Into Web View” on page 97 .)
Figure 22 shows an example of a WSS prepared for WLAN Management Software with certificate authority
(CA) certificates.
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 89
Figure 22. Secure WLAN Management Software Communication Using
CA Certificates
Certificate authority
WMS
Router
10.10.10.19/24
VLAN 2 mgmt
Port 5
10.10.10.4/24 WSSwitch
Server certificate
Certificate authority certificate
AP AP
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
90 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Installing a Certificate
To manage a WSS, WLAN Management Software or a Web browser using Web View must be able to authenticate the switch and establish an encrypted session to it. This requires the switch to have a server certificate.
Use one of the following methods to enable secure communication between WLAN Management Software or
Web View and a WSS:
• Generate a self-signed certificate on the switch.
(See “Generating a Self-Signed Certificate” on page 90
.)
• Alternatively, request a certificate for the WSS from a CA and install the certificate into the switch along with the CA’s own certificate.
(See “Installing a Certificate Assigned by a Certificate Authority” on page 91
Certificate Authority’s Certificate” on page 93 .)
Generating a Self-Signed Certificate
As an alternative to using a certificate assigned by a CA, you can generate a self-signed certificate on the
WSS. To use a self-signed certificate generated by the WSS, use the following commands: crypto generate key admin { 512 | 1024 | 2048 } crypto generate self-signed admin
The following commands generate a public-private key pair and a self-signed certificate:
2370# crypto generate key admin 1024 key pair generated
2370# crypto generate self-signed admin
Country Name:
State Name:
Locality Name:
Organizational Name:
Organizational Unit:
Common Name: [email protected]
Email Address:
Unstructured Name:
Self-signed cert for admin is
-----BEGIN CERTIFICATE-----
MIICUzCCAbygAwIBAgICA+cwDQYJKoZIhvcNAQEEBQAwNjELMAkGA1UEBhMCVVMx
CzAJBgNVBAgTAkNBMRowGAYDVQQDFBF0ZWNocHVic0B0cnB6LmNvbTAeFw0wMzA0
...
Lm8wmVYLxP56MpCUAm9O8C2foYgOY40=
-----END CERTIFICATE-----
The common name is required. The other fields are optional. Use a common name that uniquely identifies the
WSS. Use a fully qualified name if such names are supported on your network.
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 91
WSS Software automatically installs the keys and self-signed certificate into its certificate and key store.
Note.
When you select an option to import information from the WSS into WLAN
Management Software , it displays a dialog that shows the switch’s certificate information and provides options for handling the certificate. You can configure WLAN Management
Software to always accept self-signed certificates from WSSs. (For more information, see the Nortel WLAN Management Software Reference Manual .)
Installing a Certificate Assigned by a Certificate Authority
You can install a WSS certificate assigned by a CA in one of the following ways:
• Install a PKCS #12 object file—To use this method: a
Use TFTP to download onto the switch a PKCS #12 object file containing a public-private key pair and a certificate assigned by the CA.
b
Assign a one-time password to authenticate the PKCS #12 object file.
c
Install the public-private key pair and certificate from the PKCS #12 object file into the switch’s certificate and key store.
(For more information, see “Installing a Certificate from a PKCS #12 Object File” on page 91 .)
• Install a PKCS #7 object file—To use this method: a
Generate a public-private key pair on the switch.
b
Generate a certificate request on the switch.
c
Use the request (a PKCS #10 object) to obtain a certificate from the CA.
d
Install the certificate assigned by the CA (a PKCS #7 object file) into the switch’s certificate and key store.
(For more information, see “Installing a Certificate from a PKCS #7 Object File” on page 92 .)
In either case, you also need to install the CA’s own certificate on the switch and on the WLAN Management
Software or Web View host. The CA’s certificate allows WLAN Management Software or Web View to verify that the switch certificate assigned by the CA is valid.
Note.
Some certificate authorities refer to PKCS object files as base64 encoded files.
Installing a Certificate from a PKCS #12 Object File
To install a public-private key pair and a certificate assigned by a CA in a PKCS #12 object file, use the following commands: copy tftp:// ip-addr / source-url [ destination-url ] crypto otp admin string crypto pkcs12 admin filename
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
92 Configuring a 2370, 2360, or 2380 Switch for Basic Service
These commands copy the PKCS #12 object file from a TFTP server to the WSS, configure a one-time password, and install the PKCS #12 object file. The password allows the public-private key pair and the certificate to be installed together from the same object file. WSS Software removes the password after completing the crypto pkcs12 command.
Here is an example:
2370# copy tftp://10.10.10.10/p12file
2370# crypto otp admin temppwd
2370# crypto pkcs12 admin p12file
Installing a Certificate from a PKCS #7 Object File
To generate a public-private key pair, and request and install a certificate assigned by a CA in a PKCS #7 object file, use the following commands: crypto generate key admin { 512 | 1024 | 2048 } crypto generate request admin crypto certificate admin PEM-formatted-certificate
The following commands generate a key pair and a certificate request:
2370# crypto generate key admin 1024 key pair generated
2370# crypto generate request admin
Country Name:
State Name:
Locality Name:
Organizational Name:
Organizational Unit:
Common Name: [email protected]
Email Address:
Unstructured Name:
CSR for admin is
-----BEGIN CERTIFICATE REQUEST-----
MIIBdTCB3wIBADA2MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExGjAYBgNVBAMU
EXRlY2hwdWJzQHRycHouY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4
...
2L8Q9tk+G2As84QYMwe9RJAjfbYM5bdWRUFiLzvK7BJgqBsCZz4DP00=
-----END CERTIFICATE REQUEST-----
The common name is required. The other fields are optional. Use a common name that uniquely identifies the WSS. Use a fully qualified name if such names are supported on your network.
After you submit the certificate request to a CA and receive a signed certificate from the CA as a PKCS #7 object file, install the certificate into the WSS’s certificate and key store:
1
Open the PKCS #7 object file with an ASCII text editor (such as Notepad) or a browser.
2
Type the crypto certificate admin command at the WSS’s prompt.
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 93
3
After the prompt, copy and paste the PKCS #7 object file into the CLI. For example:
2370# crypto certificate admin
Enter PEM-encoded certificate
-----BEGIN CERTIFICATE-----
MIIGDDCCBbagAwIBAgIKFrJ2aAAAAAAAnDANBgkqhkiG9w0BAQUFADCBm zErMCkG
CSqGSIb3DQEJARYcYWRtaW5pc3RyYXRvckB0cmFwZXplc3FhLmNvbTELM
AkGA1UE
...
bDQNTaS4W0ytUGuJm1RjyA==
-----END CERTIFICATE-----
Note.
You must paste the entire block, from the beginning:
-----BEGIN CERTIFICATE REQUEST----to the end:
-----END CERTIFICATE REQUEST----.
The certificate server and WSS Software recognize the block only through the beginning and ending delimiters.
Installing a Certificate Authority’s Certificate
In addition to installing the WSS certificate issued by the CA, you also need to install the CA’s own certificate into the WSS switch’s certificate and key store. The CA certificate allows WLAN Management Software or
Web View to verify that the WSS’s certificate is valid. You need to install the CA’s certificate whether you installed the switch certificate from a PKCS #7 object file or a PKCS #12 object file.
To install a CA’s certificate:
1
Request a copy of the CA certificate as a PKCS #7 object file from the CA, then open the file with an ASCII text editor (such as Notepad) or a browser.
2
Type the crypto ca-certificate admin command.
3
After the prompt, copy and paste the PKCS #7 object file into the CLI. For example:
2370# crypto ca-certificate admin
Enter PEM-encoded certificate
-----BEGIN CERTIFICATE-----
MIIDwDCCA2qgAwIBAgIQL2jvuu4P05FAQICyewU3ojANBgkqhkiG9w0BA
QUFADCB mzErMCkGCSqGSIb3DQEJARYcYWRtaW5pc3RyYXRvckB0cmFwZXplc3FhL mNvbTEL
...
RGpOeQ==
-----END CERTIFICATE-----
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
94 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Displaying Certificate Information
Use the following command to display administrative certificate information: show crypto certificate admin
This command displays the following information about the certificate:
• X.509 version number
• Serial number
• Subject (the certificate holder’s identifying information)
• Signature algorithm used by the signer of the certificate
• Issuer information (CA information, unless the certificate is self-signed)
• Period during which the certificate is valid
Installing a Server Certificate for Network Users
To use an 802.1X authentication protocol that includes local EAP processing on a WSS, the switch must have a server certificate. You can generate a certificate on the switch itself or install a certificate assigned by a certificate authority (CA). If you use a certificate assigned by a CA, you also need to install the CA’s own certificate for validation.
Note.
If you use an authentication protocol that uses EAP-TLS on the WSS, users also need certificates. (For more information, see the Nortel Mobility System Software
Configuration Guide .)
The command syntax for installing certificates for management by WLAN Management Software or Web
View and installing certificates for network users is very similar. The CLI commands for configuring network user authentication use the eap option instead of the admin option, but are otherwise the same. Likewise, the procedures are the same.
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 95
Generating a Self-Signed Certificate for Network Users
As an alternative to using a certificate assigned by a CA, you can generate a self-signed certificate on the
WSS. To use a self-signed certificate, use the following commands: crypto generate key eap { 1024 | 2048 } crypto generate self-signed eap
The common name is required. The other fields are optional. WSS Software automatically installs the key and self-signed certificate into its certificate and key store.
Installing a Certificate Assigned by a Certificate Authority for
Network Users
You can install a certificate assigned by a CA in one of the following ways:
• Install a PKCS #12 object file
• Install a PKCS #7 object file
In either case, you also need to install the CA’s own certificate. The CA certificate allows users to verify that the switch certificate assigned by the CA is valid.
Installing a Certificate for Network Users from a PKCS #12 Object File
To install a public-private key pair and a certificate assigned by a CA in a PKCS #12 object file, use the following commands: copy tftp:// ip-addr / source-url [ destination-url ] crypto otp eap string crypto pkcs12 eap filename
These commands copy the PKCS #12 object file from a TFTP server to the WSS, configure a one-time password, and install the PKCS #12 object file. The password allows the public-private key pair and the certificate to be installed together from the same object file. WSS Software removes the password after completing the crypto pkcs12 command.
Installing a Certificate for Network Users from a PKCS #7 Object File
To generate a public-private key pair, and request and install a certificate assigned by a CA in a PKCS #7 object file, use the following commands: crypto generate key eap { 1024 | 2048 } crypto generate request eap crypto certificate eap PEM-formatted-certificate
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
96 Configuring a 2370, 2360, or 2380 Switch for Basic Service
After you submit the certificate request to a CA and receive a signed certificate from the CA as a PKCS #7 object file, install the certificate into the WSS’s certificate and key store:
1
Open the PKCS #7 object file with an ASCII text editor (such as Notepad).
2
Type the crypto certificate eap command at the WSS’s command prompt.
3
After the prompt, paste the PKCS #7 object file into the CLI. For example:
2370# crypto certificate eap
Enter PEM-encoded certificate
-----BEGIN CERTIFICATE-----
MIIGDDCCBbagAwIBAgIKFrJ2aAAAAAAAnDANBgkqhkiG9w0BAQUFADCBm zErMCkG
CSqGSIb3DQEJARYcYWRtaW5pc3RyYXRvckB0cmFwZXplc3FhLmNvbTELM
AkGA1UE
...
bDQNTaS4W0ytUGuJm1RjyA==
-----END CERTIFICATE-----
Note.
You must paste the entire block, from the beginning:
-----BEGIN CERTIFICATE REQUEST----- to the end:
-----END CERTIFICATE REQUEST-----.
The certificate server and WSS Software recognize the block only through the beginning and ending delimiters.
Installing a Certificate Authority’s Certificate for Network Users
In addition to installing the WSS certificate issued by the CA, you also need to install the CA’s own certificate into the WSS’s certificate and key store. The CA certificate allows users to verify that the WSS’s certificate is valid. You need to install the CA’s certificate whether you installed the switch certificate from a PKCS #7 object file or a PKCS #12 object file.
To install a CA’s certificate:
1
Request a copy of the CA certificate as a PKCS #7 object file from the CA, then open the file with an ASCII text editor (such as Notepad).
2
Type the crypto ca-certificate eap command.
3
After the prompt, paste the PKCS #7 object file into the CLI. For example:
2370# crypto ca-certificate eap
Enter PEM-encoded certificate
-----BEGIN CERTIFICATE-----
MIIDwDCCA2qgAwIBAgIQL2jvuu4P05FAQICyewU3ojANBgkqhkiG9w0BA
QUFADCB mzErMCkGCSqGSIb3DQEJARYcYWRtaW5pc3RyYXRvckB0cmFwZXplc3FhL mNvbTEL
...
RGpOeQ==
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 97
-----END CERTIFICATE-----
Displaying Certificate Information for Network Users
Use the following command to display certificate information for network users: show crypto certificate eap
Enabling and Logging Into Web View
Use the procedure in this section if you plan to use Web View to continue configuring the switch. Otherwise, skip this
section and go to “Specifying the Country of Operation” .
Web View uses Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS), which requires TLS. To use Web
View:
• Enable the HTTPS server on the WSS.
• Enable TLS 1.0, SSL 2.0, or SSL 3.0 in the Web browser.
To enable the HTTPS server on the WSS, type the following command: set ip https server enable
To enable TLS 1.0, SSL 2.0, or SSL 3.0 in Microsoft Internet Explorer:
1
Select Tools > Internet Options to display the Internet Options dialog box.
2
Select the Advanced tab.
3
Scroll to the bottom of the list of options and select the TLS 1.0, SSL 2.0, or SSL 3.0 option to enable it.
4
Click OK .
To log in to a WSS with Web View:
1
Type https:// ip-addr in the Web browser’s Address or Location field and press Enter.
For ip-addr
, type an IP address you configured on the switch. (See “Configuring VLANs and IP
2
In the Password field, type the enable password you configured on the switch.
(See “Configuring an Enable Password” on page 82
.)
Leave the User name field blank.
3
Click OK .
Note.
If your web browser has the Google toolbar installed, one of the toolbar’s options can cause some of the fields in Web View to be highlighted in yellow. If you want to turn off the yellow highlighting, disable the Automatically highlight fields that Autofill can fill option, which is one of the toolbar’s options.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
98 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Specifying the Country of Operation
You must specify the country in which you plan to operate the WSS and its AP access points. WSS Software does not allow you to configure or enable the AP access point radios until you specify the country of operation.
Note.
If you plan to upload the WSS’s configuration into WLAN Management Software
(with the Changes > Upload WLAN—Security Switch option), you must specify the country of operation with the CLI before uploading the configuration. If the country of operation is not specified, WLAN Management Software rejects the configuration.
To specify the country, use the following command: set system countrycode code
For the country code, specify one of the codes listed in
Country
Australia
Austria
Belgium
Brazil
Canada
China
Czech Republic
Denmark
Finland
France
Germany
Greece
Hong Kong
Hungary
Iceland
India
Ireland
Israel
Italy
Table 8: Country Codes
Code
IN
IE
IL
IT
DK
FI
FR
DE
GR
HK
HU
IS
AU
AT
BE
BR
CA
CN
CZ
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 99
Table 8: Country Codes (continued)
Country
Japan
Liechtenstein
Luxembourg
Malaysia
Mexico
Netherlands
New Zealand
Norway
Poland
Portugal
Saudi Arabia
Singapore
Slovakia
Slovenia
South Africa
South Korea
Spain
Sweden
Switzerland
Taiwan
Thailand
United Arab Emirates
United Kingdom
United States
Code
PL
PT
SA
SG
SK
SI
ZA
KR
JP
LI
LU
MY
MX
NL
NZ
NO
TH
AE
GB
US
ES
SE
CH
TW
To verify the configuration change, use the following command: show system
The following example sets the country code to US (United States) and verifies the setting:
2370# set system countrycode US success: change accepted.
2370# show system
===============================================================================
Product Name: 2370
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
100 Configuring a 2370, 2360, or 2380 Switch for Basic Service
System Name: 2370
System Countrycode: US
System Location:
System Contact:
System Description: 2370
System IP: 0.0.0.0
System MAC: 00:0B:0E:02:76:F6
===============================================================================
Boot Time: 2003-05-07 08:28:39
Uptime: 0 days 04:00:07
===============================================================================
Fan status: fan1 OK fan2 OK fan3 OK
Temperature: temp1 ok temp2 ok temp3 ok
PSU Status: Lower Power Supply DC ok AC ok Upper Power Supply missing
Memory: 115.09/496.04 (23%)
Total Power Over Ethernet : 32.000
===============================================================================
Specifying a System IP Address
You can designate one of the IP addresses configured on a WSS’s VLAN to be the system IP address of the switch. The system IP address provides a common IP interface and source IP address for some Nortel management and Mobility Domain operations. The system IP address is required by some features, including roaming. The system IP address is also used by default for other features, including RADIUS and the system log.
To assign one of the configured IP addresses to be the system IP address, use the following command: set system ip-address ip-addr
Enter an IP address in dotted decimal notation. This command sets the IP address you specify to be the system
IP address.
To verify the configuration change, use the following command: show system
The following commands configure the system IP address to be 10.10.10.4, the IP address on VLAN mgmt , and verify the change:
2370# set system ip-address 10.10.10.4
success: change accepted.
2370# show system
===============================================================================
Product Name: 2370
System Name: 2370
System Countrycode:
System Location:
System Contact:
System Description: 2370
System IP: 10.10.10.4
System MAC: 00:0B:0E:02:76:F6
===============================================================================
Boot Time: 2003-05-07 08:28:39
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 101
Uptime: 0 days 04:00:07
===============================================================================
Fan status: fan1 OK fan2 OK fan3 OK
Temperature: temp1 ok temp2 ok temp3 ok
PSU Status: Lower Power Supply DC ok AC ok Upper Power Supply missing
Memory: 115.09/496.04 (23%)
Total Power Over Ethernet : 32.000
===============================================================================
Configuring for Authenticating Users
A WSS can provide authentication, authorization, and accounting (AAA) services for wireless and wired users. Wireless users are attached to a WSS through an AP access point. Wired users are attached to a WSS through wired authentication ports.
By default, all WSS’s ports are set as wired network ports. Wired network ports connect the switch to other networking devices such as switches and routers.
• To provide authentication to a wired user, you must set that user’s port to be a wired authentication port.
• To provide authentication to wireless users, you must configure the WSS to support a Mobility Point. How you configure the WSS will depend on how the AP is connected to the WSS. There are two categories of AP to WSS connection: directly connected and distributed.
●
●
A directly connected AP connects to one or two 10/100 ports on a WSS. The WSS 10/100 port provides PoE to the AP. The WSS forwards data only to and from the configured AP on that port.
The port numbers on the WSS configured for direct attached APs reference a particular AP.
An AP that is not directly connected to a WSS is considered a Distributed AP. The WSS contains a configuration for a Distributed AP based on the AP’s serial number. Similar to ports configured for directly connected APs, Distributed AP configurations are numbered and can reference a particular
AP. These numbered configurations do not, however, reference any physical port.
Note.
A Distributed AP is a leaf device. You do not need to enable STP on the port that is directly connected to the AP. If Spanning Tree Protocol (STP) is enabled on the port that is directly connected to a Distributed AP, Nortel recommends that you enable port fast convergence (called PortFast on some vendors’ devices) on the port or disable STP on the port. (For more information, see the “Configuring AP Access Points” chapter in the Nortel WLAN 2300 System
Software Configuration Guide .)
Configuring a Port for a Wired Authentication User
A wired authentication user connects to the WSS by a network cable. The user must authenticate before connecting to the network. To set a port type for a wired authentication user, use the following command: set port type wired-auth port-list [ tag tag-list ] [ max-sessions num ]
The following example sets port 3 for a wired authentication user:
2370# set port type wired-auth 3
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
102 Configuring a 2370, 2360, or 2380 Switch for Basic Service success: change accepted
Configuring APs for Wireless Users
A wireless user makes a wireless connection through an AP to the WSS. The user must authenticate before connecting to the network. To allow wireless users, you must configure the WSS to support an AP. To prepare an AP access point for use, perform the following tasks, in this order:
1
Configure the WSS for the AP access it will be supporting and enable Power over Ethernet (PoE) if required. (See “Configuring for a Directly-Connected AP” on page 105 and “Configuring for a
Distributed AP” on page 106 .)
2
Configure a service profile for each SSID and its encryption settings. (See
3
Configure a radio profile. (See
“Configuring a Radio Profile” on page 110 .)
4
Enabling the Radios” on page 113 .)
AP Connection Requirements
You can connect an AP access point to a WSS directly to a 10/100 port supplying PoE or through an intermediate network. There are two types of AP to WSS connection: direct and distributed.
• In direct connection, an AP connects to one or two 10/100 ports on a WSS. The WSS port is then configured specifically for a direct attachment to an AP. There is no intermediate networking equipment between the WSS and
AP and only one AP is connected to the WSS port. The WSS 10/100 port provides PoE to the AP. The WSS also forwards data only to and from the configured AP on that port. The port numbers on the WSS configured for directly attached APs reference a particular AP.
• An AP that is not directly connected to a WSS is considered a Distributed AP. There may be intermediate Layer 2 switches or Layer 3 IP routers between the WSS and AP. The WSS may communicate to the Distributed AP through any network port. (A network port is any port connecting the switch to other networking devices, such as switches and routers, and it can also be configured for 802.1Q VLAN tagging.) The WSS contains a configuration for a Distributed AP based on the AP’s serial number. Similar to ports configured for directly connected APs,
Distributed AP configurations are numbered and can reference a particular AP. These numbered configurations do not, however, reference any physical port.
Figure 23 shows examples of direct and network AP access point connections.
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 103
Figure 23. Local and Network AP Access Point Connections
AP1 AP2
Port
2
WSS1
System IP address
10.10.10.4
Port
5
Layer 2 Router
Router
AP4
Layer 2
AP3
This example has the following configuration requirements for the APs:
• AP1 is directly connected to the WSS. WSS1 needs port 2 configured as a directly connected AP.
• AP2 is connected through a Layer 2 network to WSS1. WSS1 needs a Distributed AP configuration in order to boot and configure AP2. The Layer 2 network must provide DHCP services to AP2.
• AP3 is connected through a Layer 3 network (Layer 2 networks separated by IP routers) to WSS1. WSS1 needs a
Distributed AP configuration in order to boot and configure AP3. The Layer 2 network that AP3 is attached to must provide DHCP services. The network’s DNS server must have a NORTEL.
mynetwork .com or wlan-switch.
mynetwork .com entry pointing to any WSS in the Mobility Domain.
• AP4 is dual-homed. It has two connections, both through an intermediate Layer 2 network to WSS1. WSS1 needs a
Distributed AP configuration in order to boot and configure AP4. For more information on resiliency options for connecting APs to WSSs, see the “Configuring AP Access Points” chapter of the Nortel WLAN 2300 Series System
Software Configuration Guide .
The following sections list the configuration requirements for direct attached APs and Distributed APs.
Local Connection Requirements
When an AP connects directly to a WSS’s 10/100 port, the WSS port must be configured as an AP access port, which supports AP traffic only. There is no intermediate networking equipment between the WSS and AP and only one AP is connected to the WSS port. The WSS 10/100 port provides PoE to the AP. The WSS forwards data only to and from the configured AP on that port.
Distributed AP Network Requirements
When an AP connects indirectly to a WSS, the WSS must be configured with a Distributed AP configuration. The WSS can communicate with the Distributed AP through any network port. (In the CLI, a Distributed AP configuration is referred to as a DAP .)
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
104 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Because distributed APs are not directly attached to a WSS, they require additional support from the network in order to function. Information on the booting and operation sequence for Distributed APs is covered in the
“Configuring AP Access Points” chapter of the Nortel Mobility System Software Configuration Guide .
• Power—PoE must be provided on one of the Ethernet connections to the AP. Be sure to utilize a PoE injection device that has been tested by Nortel. Providing PoE on both of the Ethernet connections (if the
AP has two) allows for redundant PoE.
• DHCP—A Distributed AP uses TCP/IP for communication, and relies on DHCP to obtain IP parameters.
Therefore, DHCP services must be available on the subnet that the AP is connected to. DHCP must provide the following parameters to the AP:
●
●
●
●
IP address
Domain name
DNS server address
Gateway address
Optionally, the Offer message can also contain a list of WSS IP addresses or hostnames, in the option 43 field of the DHCP message.
• DNS—If the intermediate network between the WSS and Distributed AP includes one or more IP routers, create a NORTEL.
mynetwork .com or wlan-switch.
mynetwork .com entry on the DNS server. The entry needs to map one of these names to the system IP address of the switch. If the subnet contains more than one WSS in the same Mobility Domain, you can use the system IP address of any of the switches. (For redundancy, you can create more than one DNS entry, and map each entry to a different WSS in the subnet.)
The DNS entry allows the AP to communicate with a WSS that is not on the AP’s subnet. If the
AP is unable to locate a WSS on the subnet it is connected to, the AP sends DNS requests to both NORTEL and wlan-switch , where the DNS suffix for mynetwork .com is learned through
DHCP.
● If only NORTEL for NORTEL .
is defined in DNS, the AP contacts the WSS whose IP address is returned
● If only wlan-switch is defined in DNS, the AP contacts the WSS whose IP address is returned for wlan-switch .
● If both NORTEL and wlan-switch are defined in DNS, the AP contacts the WSS whose IP address is returned for NORTEL . The AP ignores the IP address returned for wlan-switch .
● If both NORTEL and wlan-switch are defined in DNS, and the AP is unable to contact the
IP address returned for NORTEL , the AP never contacts the IP address returned for wlan-switch . The AP does not boot.
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 105
After the AP contacts the WSS, the WSS relays information about WSSs in the network that contain a
Distributed AP configuration specific to that Distributed AP.
Caution!
Do not enable PoE on network ports unless you intend to power a third-party device. If you enable PoE under other conditions, power can damage the device.
Configuring for a Directly-Connected AP
Caution!
When you set the port type for use by locally connected APs, you must specify the PoE state (enabled or disabled) of the port. If you enable PoE on a port connected to another device, physical damage to the device can result.
To set a port for a locally-connected AP, use the following command: set port type ap port-list model { AP2750 | mp-52 | mp-101 | mp-122 | mp-241 | mp-252 | mp-262 | mp-341 | mp-352 | 2330} poe { enable | disable }
[ radiotype { 11a | 11b | 11g }]
You must specify a port list of one or more port numbers, the AP model number, and the PoE state.
AP access point models AP2750, MP-241 and MP-341 have a single radio that can be configured for 802.11a or
802.11b/g. Other AP models have two radios. One radio is always 802.11a. The other radio is 802.11b/g, but can be configured for 802.11b or 802.11g exclusively. If the country of operation specified by the set system countrycode command does not allow 802.11g, the default is 802.11b.
Note.
All AP models except the 2330 and AP2750 have been discontinued but are still supported by the command.
AP radios configured for 802.11g also allow associations from 802.11b clients by default. To disable support for
802.11b associations, use the set radio-profile 11g-only command on the radio profile that contains the radio.
Note.
You cannot configure any gigabit Ethernet port, or port 7 or 8 on an 2360 switch, as an AP point. To manage an AP access point on a 2380 switch, configure a Distributed
AP connection on the switch. (See “Configuring for a Distributed AP” on page 106 .)
AP model MP-262 requires an external antenna for the 802.11b/g radio. AP-3 xx models have an internal 802.1b/g antenna as well as a connector for an external antenna, so use of an external antenna is optional on these models. The
2330 also has a connector for an optional external 802.11a antenna. To specify the antenna model, use the set {ap | dap} radio antennatype command. (See
“Configuring Radio-Specific Parameters” on page 112 .)
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
106 Configuring a 2370, 2360, or 2380 Switch for Basic Service
To verify the configuration changes, use the following commands. Use show ap config for directly connected
APs and use show dap config
for Distributed APs. (See “Displaying Radio Configuration Information” on page 114
for an example.) show ap config [ port-list [ radio { 1 | 2 }]] show dap config [ dap-num [ radio { 1 | 2 }]]
The following example sets ports 1, 2, and 4 for AP access point model
2330
:
2370# set port type ap 1,2,4 model 2330 poe enable
This may affect the power applied on the configured ports. Would you like to continue? (y/n) [n] y success: change accepted.
To verify the configuration change, use the following command: show ap config [ port-list [ radio { 1 | 2 }]]
Here is an example:
2370# show ap config 1
Port 1: AP model: 2330, POE: enable, bias: high, name: MP01
boot-download-enable: YES
load balancing group: none
Radio 1: type: 802.11g, mode: disabled, channel: 6
tx pwr: 15, profile: default
auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10
Radio 2: type: 802.11a, mode: disabled, channel: 36
tx pwr: 11, profile: default
auto-tune max-power: default, min-client-rate: 24, max-retransmissions: 10
Configuring for a Distributed AP
To create a configuration for a Distributed AP (referred to as a DAP in the CLI), use the following command: set dap dap-num serial-id serial-ID model { AP2750 | mp-52 | mp-101 | mp-122 | mp-241 | mp-252 | mp-262
| mp-341 | mp-352 | 2330}
[ radiotype { 11a | 11b | 11g }]
The dap-num parameter identifies the Distributed AP connection for the AP. The range of valid connection ID numbers depends on the WSS model:
• For a 2380, you can specify a number from 1 to 300.
• For a 2370, you can specify a number from 1 to 100.
• For a 2360, you can specify a number from 1 to 30.
For the serial-id parameter, specify the serial ID of the AP. The serial ID is listed on the AP case. To display the serial ID using the CLI, use the show version details command.
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 107
The model and radiotype parameters have the same options as they do with the set port type ap command.
Because the WSS does not supply power to an indirectly connected AP, the set dap command does not use the poe parameter.
Note.
You can configure an AP configuration template for automatically configuring
Distributed APs when they boot using the WSS. For information, see the “Configuring a
Template for Automatic AP Configuration” section of the “Configuring AP Access Points” chapter in the Nortel Mobility System Software Configuration Guide .
The following example configures connections for two Distributed APs that are indirectly connected to the
WSS. Note that when you create a connection, you assign it a number that can be used later for displaying and configuration, much like the physical ports for directly connected APs:
2370# set dap 1 serial-id 0322199999 model 2330 success: change accepted.
2370# set dap 2 serial-id 0322199998 model 2330 success: change accepted.
To verify the configuration change, use the following command: show dap config [ dap-num [ radio { 1 | 2 }]]
Here is an example:
2370 # show dap config
Dap 1: serial-id: 0322199999, AP model: 2330, bias: high, name: DMP01 fingerprint: boot-download-enable: YES load balancing group: none
Radio 1: type: 802.11g, mode: disabled, channel: dynamic
tx pwr: 14, profile: default
auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10
Radio 2: type: 802.11a, mode: disabled, channel: dynamic
tx pwr: 11, profile: default
auto-tune max-power: default, min-client-rate: 24, max-retransmissions: 10
Dap 2: serial-id: 0322199998, AP model: 2330, bias: high, name: DMP02 fingerprint: boot-download-enable: YES load balancing group: none
Radio 1: type: 802.11g, mode: disabled, channel: dynamic
tx pwr: 14, profile: default
auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10
Radio 2: type: 802.11a, mode: disabled, channel: dynamic
tx pwr: 11, profile: default
auto-tune max-power: default, min-client-rate: 24, max-retransmissions: 10
Configure the same Distributed AP on each of the WSSs you want to use to manage the AP access point associated with the Distributed AP. Make sure to use the same Distributed AP number and serial ID on each WSS.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
108 Configuring a 2370, 2360, or 2380 Switch for Basic Service
To display configuration information for all Distributed APs configured in the Mobility Domain, use the following command: show dap global [ dap-num | serial-id serial-ID ]
The following command lists configuration information for the Distributed APs in Figure 21 on page 82 :
2370# show dap global
Total number of entries: 12
DAP Serial Id WSS IP Address Bias
--- ----------- --------------- ----
1 0322199999 10.10.10.4 HIGH
- 0322199999 10.10.40.4 HIGH
- 0322199999 10.10.50.4 HIGH
2 0322199998 10.10.10.4 HIGH
- 0322199998 10.10.40.4 HIGH
- 0322199998 10.10.50.4 HIGH
- 0322199997 10.10.40.4 HIGH
- 0322199997 10.10.50.4 HIGH
- 0322199996 10.10.40.4 HIGH
- 0322199996 10.10.50.4 HIGH
- 0322199995 10.10.40.4 HIGH
- 0322199995 10.10.50.4 HIGH
This example assumes that each WSS in Figure 21 is configured with a Distributed AP connection (DAP) for each AP that is not directly connected to the WSS. The APs that are directly connected to 10.10.10.4 (WSS1) are not configured as Distributed APs on WSS1, but they are configured as Distributed APs on the other WSS.
On WSS1, the directly connected APs are configured using AP access ports, with the set port type ap command.
A DAP number is listed only for Distributed APs that are configured on the WSS on which you type the command. For Distributed APs configured on other WSSs, a hyphen ( - ) is displayed in the DAP field.
The bias determines the WSS a Distributed AP prefers for booting, configuration, and data transfer. (For information about bias and how to configure it, see the Nortel WLAN 2300 System Software Configuration Guide.
)
Configuring a Service Profile
A service profile controls advertisement and encryption for an SSID. You can specify the following:
• Whether SSIDs that use the service profile are beaconed
• Whether the SSIDs are encrypted or clear (unencrypted)
• For encrypted SSIDs, the encryption settings to use
• The fallthru authentication method for users that are not authenticated with 802.1X or MAC
authentication. The fallthru method can be Web, last-resort, or none. (See “Configuring for
Authenticating Users” on page 101
.)
Table 9 on page 109 lists the parameters controlled by a service profile and their default values.
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 109
Parameter auth-dot1x auth-fallthru auth-psk beacon cipher-ccmp cipher-tkip cipher-wep104 cipher-wep40 psk-phrase psk-raw rsn-ie shared-key-auth ssid-name ssid-type
Table 9.Defaults for Service Profile Parameters
Default
Value enable web-portal disable enable disable enable disable disable
No passphrase defined
No preshared key defined disable disable trapeze crypto
Radio Behavior When
Parameter Set To Default
Value
When the Wi-Fi Protected Access
(WPA) information element (IE) is enabled, uses 802.1X to authenticate
WPA clients.
Uses Web-based AAA for users who do not match an 802.1X or MAC authentication rule for the SSID requested by the user.
Does not support using a preshared key
(PSK) to authenticate WPA clients.
Sends beacons to advertise the SSID managed by the service profile.
Does not use Counter with Cipher
Block Chaining Message
Authentication Code Protocol (CCMP) to encrypt traffic sent to WPA clients.
When the WPA IE is enabled, uses
Temporal Key Integrity Protocol (TKIP) to encrypt traffic sent to WPA clients.
Does not use Wired Equivalent Privacy
(WEP) with 104-bit keys to encrypt traffic sent to WPA clients.
Does not use WEP with 40-bit keys to encrypt traffic sent to WPA clients.
Uses dynamically generated keys rather than statically configured keys to authenticate WPA clients.
Uses dynamically generated keys rather than statically configured keys to authenticate WPA clients.
Does not use the RSN IE in transmitted frames.
Does not use shared-key authentication.
This parameter does not enable PSK authentication for WPA. To enable PSK encryption for WPA, use the set radio-profile auth-psk command.
Uses the SSID name trapeze .
Encrypts wireless traffic for the SSID.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
110 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Parameter wpa-ie
Table 9.Defaults for Service Profile Parameters (continued)
tkip-mc-time web-aaa-form wep key-index wep active-multicast-index wep active-unicast-index
Default
Value
Radio Behavior When
Parameter Set To Default
Value
60000 Uses Michael countermeasures for
60,000 ms (60 seconds) following detection of a second MIC failure within 60 seconds.
Not configured For Web-based AAA users, serves the default login web page or, if configured, the SSID-specific login web page.
No keys defined Uses dynamic WEP rather than static
WEP.
1
1 disable
Note: If you configure a WEP key for static WEP, WSS Software continues to also support dynamic WEP.
Uses WEP key 1 for static WEP encryption of multicast traffic if WEP encryption is enabled and keys are defined.
Uses WEP key 1 for static WEP encryption of unicast traffic if WEP encryption is enabled and keys are defined.
Does not use the WPA IE in transmitted frames.
To create a service profile and assign an SSID to it, use the following command: set service-profile name ssid-name ssid-name
To display a service profile, use the following command: show service-profile name
The following commands configure a service profile named corp1 , and assign encrypted SSID private_wlan to it:
2370# set service-profile corp1 ssid-name private_wlan success: change accepted.
2370# set service-profile corp1 ssid-type crypto success: change accepted.
Configuring a Radio Profile
A radio profile is a named set of radio parameters that you can apply to multiple radios. A radio profile can contain information for two types of SSIDs:
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 111
• Encrypted SSID—Clients using this SSID must use encryption. Use the encrypted SSID for secured access to your enterprise network.
• Clear SSID—Clients using this SSID do not use encryption. Use the clear SSID for public access to nonsecure portions of your network.
A radio can send and receive traffic for both types of SSID at the same time. By default, a radio sends beacons to advertise the encrypted SSID but does not advertise the clear SSID.
To configure and display a radio profile, use the following commands: set radio-profile name show radio-profile name
Note.
Nortel recommends that you do not use the name default . WSS Software already contains a radio profile named default . (For information about the default radio profile, see the Nortel 2300 Series System Software Configuration Guide.
)
The following command configures radio profile rp1 :
2370# set radio-profile rp1 success: change accepted.
Table 10 lists the radio profile parameters and their default values. For information about these parameters and how to change them, see the Nortel Mobility System Software Configuration Guide.
Parameter
11g-only active-scan beacon-interval countermeasures dtim-interval frag-threshold
Table 10.Defaults for Radio Profile Parameters
Default
Value disable
Radio Behavior When
Parameter Set To Default
Value
Allows associations with 802.11g and
802.11b clients.
enable
Note: This parameter applies only to
802.11b/g radios.
Sends probe any requests (probe requests with a null SSID name) to solicit probe responses from other access points.
Waits 100 ms between beacons. 100
Not configured Does not issue countermeasures against any device.
1 Sends the delivery traffic indication map (DTIM) after every beacon.
2346 Transmits frames up to 2346 bytes long without fragmentation.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
112 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Parameter wmm
Table 10.Defaults for Radio Profile Parameters (continued)
long-retry max-rx-lifetime max-tx-lifetime preamble-length rts-threshold service-profile short-retry
Default
Value
5
2000
2000 short
Radio Behavior When
Parameter Set To Default
Value
Sends a long unicast frame up to five times without acknowledgment.
Allows a received frame to stay in the buffer for up to 2000 ms (2 seconds).
Allows a frame that is scheduled for transmission to stay in the buffer for up to 2000 ms (2 seconds).
Advertises support for short 802.11b preambles, accepts either short or long
802.11b preambles, and generates unicast frames with the preamble length specified by the client.
2346
No service profiles defined
5 enable
Note: This parameter applies only to
802.11b/g radios.
Transmits frames longer than 2346 bytes by means of the
Request-to-Send/Clear-to-Send
(RTS/CTS) method.
Default settings for all service profile parameters, including encryption parameters, are used.
Sends a short unicast frame up to five times without acknowledgment.
Prioritizes traffic based on the Wi-Fi
Multimedia (WMM) standard.
Configuring Radio-Specific Parameters
The following parameters are specific to individual radios and are not controlled by a radio profile:
• Channel number
• Transmit power (in decibels referred to 1 milliwatt)
• External antenna model (if applicable)
These parameters have the following defaults:
• Channel number:
●
●
The default channel number for 802.11b/g is 6.
The default channel number for 802.11a is the lowest valid channel number for the country of operation.
• Transmit power—Highest setting allowed for the country of operation or highest setting supported on the hardware, whichever is lower
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 113
• External antenna model—internal antenna used by default (except the MP-262, which uses ANT1060 by default)
Note.
The channel and power defaults listed above apply only when Auto-RF is disabled. Auto-RF can automatically set and adjust the channel and power settings on radios. By default, Auto-RF for channel assignment is enabled, and Auto-RF for power setting is disabled.
You are not required to set any of these radio-specific parameters (except the external antenna type, if different from the default). Auto-RF sets the channels automatically to avoid channel interference, and the default power levels are high enough for most installations.
If you do need to set the channels or power manually, use the following commands: set { ap port-list | dap dap-num } radio { 1 | 2 } channel channel-number set { ap port-list | dap dap-num } radio { 1 | 2 } tx-power power-level
To change the external antenna type, use the following command: set { ap port-list | dap dap-num } radio
{ 1 antennatype ANT1060 | ANT1120 | ANT1180 | internal } |
{ 2 antennatype ANT5060 | ANT5120 | ANT5180 | internal }
The following command configures radio 1 (the 802.11b/g radio) on Distributed AP 1 to use external antenna model ANT1060:
2370# set dap 1 radio 1 antennatype ANT1060 success: change accepted.
To enable or disable Auto-RF for channel or power assignment, use the following commands: set radio-profile name auto-tune channel-config { enable | disable } set radio-profile name auto-tune power-config { enable | disable }
Applying a Radio Profile to Radios and Enabling the Radios
To apply a radio profile to radios, use the following command: set { ap port-list | dap dap-num } radio { 1 | 2 } radio-profile name mode { enable | disable }
The following commands applies radio profile rp1 to radio 1 on AP access ports 1, 2, and 4 and on Distributed
AP 1 and Distributed AP 2 and enables the radios:
2370# set ap 1,2,4 radio 1 radio-profile rp1 mode enable success: change accepted.
2370# set dap 1,2 radio 1 radio-profile rp1 mode enable success: change accepted.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
114 Configuring a 2370, 2360, or 2380 Switch for Basic Service
The following command applies radio profile rp1 to radio 2 on AP access ports 1, 2, and 4 and on Distributed
AP 1 and enables the radios:
2370# set ap 1,2,4 radio 2 radio-profile rp1 mode enable success: change accepted.
2370# set dap 1 radio 2 radio-profile rp1 mode enable success: change accepted.
Displaying Radio Configuration Information
To verify radio configuration changes, use the following commands: show ap config [ port-list [ radio { 1 | 2 }]] show dap config [ dap-num [ radio { 1 | 2 }]]
Here is an example:
2370# show ap config 1
Port 1: AP model: 2330, POE: enable, bias: high, name: MP01
boot-download-enable: YES
load balancing group: none
Radio 1: type: 802.11g, mode: disabled, channel: 6
tx pwr: 15, profile: default
auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10
Radio 2: type: 802.11a, mode: disabled, channel: 36
tx pwr: 11, profile: default
auto-tune max-power: default, min-client-rate: 24, max-retransmissions: 10
Configuring Mobility Domain Parameters
A Mobility Domain is a collection of WSSs that work together to support a roaming user. A user can roam across the network from one WSS to another while maintaining the same IP address and session.
Each Mobility Domain has one seed member that maintains a list of the system IP addresses of all the members. Nonseed members communicate with the seed initially to retrieve and store the IP connectivity information of other WSSs, and subsequently if configurations of member switches change or switches are added or deleted. For normal operation, the seed switch need not be available for the rest of the Mobility
Domain to function.
Note.
All WSSs in a Mobility Domain use their system IP addresses as a basis to communicate. To support the services of the Mobility Domain, the system IP address of every WSS in a Mobility Domain requires basic IP connectivity with the system IP addresses of all other WSSs in the Mobility Domain. (For configuration information, see
“Specifying a System IP Address” on page 100
.)
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 115
Configuring the Seed
To configure the current WSS to be the seed of a Mobility Domain, use the following commands: set mobility-domain mode seed domain-name mob-dom-name
To specify the WSSs that are members of the Mobility Domain, use the following command: set mobility-domain member ip-addr
Enter the system IP address of the member switch. You do not need to enter the subnet mask. Repeat the command for each member.
To verify the change, use the following command: show mobility-domain
The following commands configure a WSS to be the Mobility Domain seed, add two nonseed members to the member list, and verify the change:
2370# set mobility-domain mode seed domain-name corp success: change accepted.
2370# set mobility-domain member 10.10.40.4
success: change accepted.
2370# set mobility-domain member 10.10.50.4
success: change accepted.
2370# show mobility-domain
Mobility Domain name: corp
Member State Status
--------------- ------------- --------------
10.10.10.4
10.10.40.4
10.10.50.4
STATE_UP SEED
STATE_UP MEMBER
STATE_UP MEMBER
Configuring a Nonseed Member
To configure the current WSS to be a member of a Mobility Domain but not the seed for the domain, use the following command: set mobility-domain mode member seed-ip ip-addr
Enter the system IP address of the seed switch.
Configuring User Authentication
WSS Software provides the following types of authentication:
• IEEE 802.1X—If the network user’s network interface card (NIC) supports 802.1X, WSS Software checks for an 802.1X authentication rule that matches the username (and SSID, if wireless access is
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
116 Configuring a 2370, 2360, or 2380 Switch for Basic Service requested), and that uses the Extensible Authentication Protocol (EAP) requested by the NIC. If a matching rule is found, WSS Software uses the requested EAP to check the RADIUS server group or local database for the username and password entered by the user. If matching information is found, WSS
Software grants access to the user.
• MAC—If the username does not match an 802.1X authentication rule, but the MAC address of the user’s
NIC or Voice-over-IP (VoIP) phone and the SSID (if wireless) do match a MAC authentication rule, WSS
Software checks the RADIUS server group or local database for matching user information. If the MAC address (and password, if on a RADIUS server) matches, WSS Software grants access. Otherwise, WSS
Software attempts the fallthru authentication type, which can be Web, last-resort, or none.
• Web—A network user attempts to access a web page over the network. The WSS intercepts the HTTP or
HTTPS request and serves a login Web page to the user. The user enters the username and password, and
WSS Software checks the RADIUS server group or local database for matching user information. If the username and password match, WSS Software redirects the user to the web page she requested.
Otherwise, WSS Software denies access to the user.
• Last-resort—A network user requests access to the network, without entering a username or password.
WSS Software checks for a last-resort authentication rule for the requested SSID (or for wired , if the user is on a wired authentication port). If a matching rule is found, WSS Software checks the RADIUS server group or local database for username last-resort-wired (for wired authentication access) or last-resortssid , where ssid is the SSID requested by the user. If the user information is on a RADIUS server, WSS Software also checks for a password.
Users cannot access the network unless they are authorized. You can configure a WSS to authenticate users with user information on a group of RADIUS servers or in a local user database on the switch. You also can configure a switch to offload some authentication tasks from the server group.
• Pass-through—The switch establishes an Extensible Authentication Protocol (EAP) session directly between the client and RADIUS server. All authentication information and certificate exchanges pass through the switch. In this case, the switch does not need a certificate.
• Local—The switch performs all authentication with information in a local user database configured on the switch. No RADIUS servers are required. In this case, the switch needs a certificate. If you plan to use
EAP with Transport Layer Security (EAP-TLS), the clients also need certificates.
• Offload—The switch offloads all EAP processing from a RADIUS server by establishing a TLS session between the switch and the client. In this case, the switch needs a certificate. If you plan to use the
EAP-TLS authentication protocol, the clients also need certificates.
This section provides examples for configuring Protected EAP with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MS-CHAP-V2) authentication for 802.1X users, in pass-through and offload configurations. (For information about configuring other authentication types, see the Nortel WLAN
2300 System Software Configuration Guide.
)
VLANs and Users
For each user, an attribute must be set in the local database or on a RADIUS server to assign the user to a
VLAN. This is true regardless of the authentication type you use. You can use either of the following attributes to assign a user to a VLAN:
• Tunnel-Private-Group-ID—This attribute is described in RFC 2868, RADIUS Attributes for Tunnel
Protocol Support .
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 117
• VLAN-Name—This attribute is a Nortel vendor-specific attribute (VSA).
Note.
You cannot configure the Tunnel-Private-Group-ID attribute in the local user database.
Specify the VLAN name, not the VLAN number. The examples in this chapter assume the VLAN is assigned on a
RADIUS server with either of the valid attributes.
Other RADIUS attributes and VSAs are optional. (For information about Nortel VSAs, see the Nortel Mobility System
Software Configuration Guide.
)
Configuring Pass-Through Authentication
To configure a WSS to use a group of RADIUS servers to perform all user authentication:
1
Configure the RADIUS servers and add them to a server group. You must configure a server group even if
.)
2
Set the authentication protocol to pass-through. Pass-through authentication does not require local user
information or user certificates on the WSS. (See “Configuring the Authentication Protocol for
Pass-Through Authentication” on page 119
.)
Figure 24 shows an example of pass-through user authentication.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
118 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Figure 24. Pass-Through User Authentication
RADIUS server
Router
User
A
WSSwitch
TLS
AP AP User A
Configuring RADIUS Servers for Pass-Through Authentication
To configure WSS Software to use a RADIUS server, use the following command: set radius server { server-name } [ address ip-addr ] [ auth-port port-number ] [ acct-port port-number ] [ timeout seconds ] [ retransmit number ] [ deadtime minutes ]
[ key string ] [ author-password password ]
To add the server(s) to a server group, use the following command: set server group group-name members server-name1 [ server-name2 ] [ server-name3 ]
[ server-name4 ]
To configure WSS Software to load-balance authentication requests among the servers, use the following command: set server group group-name load-balance enable | disable
To verify the change, use the following command: show aaa
The following commands configure two RADIUS servers, add them to server group grp1 , enable load balancing of authentication sessions among the servers, and verify the change:
2370# set radius server svr1 address 10.10.70.20 key rad1pword
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 119 success: change accepted.
2370# set radius server svr2 address 10.10.70.40 key rad2pword success: change accepted.
2370# set server group grp1 members svr1 svr2 success: change accepted.
2370# set server group grp1 load-balance enable success: change accepted.
2370# show aaa
Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server Addr Ports T/o Tries Dead State
------------------------------------------------------------------svr1 svr2
10.10.70.20
10.10.70.40
1812 1813 5 3 0 UP
1812 1813 5 3 0 UP
Server groups
grp1 (load-balanced): svr1 svr2
Configuring the Authentication Protocol for Pass-Through Authentication
To configure the authentication protocol for 802.1X users, use the following command: set authentication dot1x { ssid ssid-name | wired } user-glob [ bonded ] protocol method1 [ method2 ] [ method3 ] [ method4 ]
To verify the change, use the following command: show aaa
Note.
The asterisk in the example below is a wildcard. You cannot use a wildcard to represent the delimiter characters in user globs, which are the at sign ( @ ) and the dot ( .
).
To match a username that contains a delimiter, you must specify the delimiter in the user glob as shown in these examples. Alternatively, use a double asterisk (**) with no delimiters to match all usernames.
Note.
If you have more than one authentication rule, add the rules in the order you want
WSS Software to use them. For example, add the most specific rules first and the most general rules (rules that match most widely) last.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
120 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Authentication Example for Users in a Windows Domain
The following command configures an authentication rule for a set of users, known as a user glob, in a
Microsoft Windows domain. The command configures all users in the EXAMPLE Windows domain to use any supported EAP type to communicate with EAP-capable RADIUS server group grp1 , when attempting to access SSID private_wlan . The server group authenticates the users.
2370# set authentication dot1x ssid private_wlan EXAMPLE\* pass-through grp1 success: change accepted.
Authentication Example for Users in a UNIX Domain
The following commands add authentication rules for user globs in a UNIX domain. Users are authenticated by using any supported EAP type to communicate with EAP-capable RADIUS server group grp1 .
2370# set authentication dot1x ssid private_wlan *@mktg.example.com pass-through grp1 success: change accepted.
2370# set authentication dot1x ssid private_wlan *@eng.example.com pass-through grp1 success: change accepted.
2370# set authentication dot1x ssid private_wlan *@*.*.com pass-through grp1 success: change accepted.
2370# set authentication dot1x ssid private_wlan *@*.com pass-through grp1 success: change accepted.
Displaying the Server Group and Authentication Configuration
The show aaa command displays the server group and authentication configuration on a WSS. In the following example, the configuration contains a server group with two RADIUS servers and an authentication rule for users in a Windows domain.
2370# show aaa
Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server Addr Ports T/o Tries Dead State
------------------------------------------------------------------svr1 svr2
10.10.70.20
10.10.70.40
1812 1813 5 3 0 UP
1812 1813 5 3 0 UP
Server groups
grp1 (load-balanced): svr1 svr2 set authentication dot1x ssid private_wlan EXAMPLE\* pass-through grp1
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 121
Configuring EAP Offload with Server Authentication
You can configure a WSS to perform all EAP processing locally and use RADIUS servers for authentication and authorization. To configure a WSS to perform EAP processing locally and use RADIUS servers for MS-CHAP-V2:
1
Install server certificates on the WSS. You can install certificates assigned by a CA or generate self-signed certificate on the switch.
(See “Installing a Server Certificate for Network Users” on page 94
,
Certificate for Network Users” on page 95 , and “Installing a Certificate Assigned by a Certificate
Authority for Network Users” on page 95
.)
2
Configure the RADIUS servers and add them to server group. You must configure a server group even if you have only one server.
(See “Configuring RADIUS Servers for Pass-Through Authentication” on page 118 .)
3
Set the 802.1X authentication protocol to PEAP-MS-CHAP-V2. With this protocol setting, a WSS performs EAP locally and uses a RADIUS server to complete the process by performing authentication and authorization with MS-CHAP-V2.
(See “Configuring the Authentication Protocol for Offload Authentication” on page 122
.)
Figure 25 shows an example of offload user authentication.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
122 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Figure 25. Offload User Authentication
Certificate authority
TLS
RADIUS server
Router
WSSwitch
MS-CHAP-V2
User
A
Server certificate
Certificate authority certificate
User A AP AP
Configuring RADIUS Servers for Offload Authentication
(See “Configuring RADIUS Servers for Pass-Through Authentication” on page 118 .) The commands for
configuring a RADIUS server group are exactly the same for offload and pass-through user authentication.
Configuring the Authentication Protocol for Offload Authentication
To configure the authentication protocol for 802.1X users, use the following command. A user glob represents a set of users.
set authentication dot1x { ssid ssid-name | wired } user-glob [ bonded ] protocol method1 [ method2 ] [ method3 ] [ method4 ]
320656-A
Configuring a 2370, 2360, or 2380 Switch for Basic Service 123
To verify the change, use the following command: show aaa
The following command configures a WSS to authenticate users in the EXAMPLE Windows domain who request access to SSID private_wlan , by processing EAP locally on the WSS, and by using a RADIUS server in server group grp1 for MS-CHAP-V2 authentication and authorization:
2370# set authentication dot1x ssid private_wlan EXAMPLE\* peap-mschapv2 grp1 success: change accepted.
Note.
The asterisk in this example is a wildcard. You cannot use a wildcard to represent the delimiter characters in user globs, which are the at sign ( @ ) and the dot ( .
). To match a username that contains a delimiter, you must specify the delimiter in the user glob as shown in these examples. Alternatively, use a double asterisk (**) with no delimiters to match all usernames.
Note.
If you have more than one authentication rule, add the rules in the order you want
WSS Software to use them. For example, add the most specific rules first and the most general rules (rules that match most widely) last.
2370# show aaa
Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server Addr Ports T/o Tries Dead State
------------------------------------------------------------------svr1 svr2
10.10.70.20
10.10.70.40
1812 1813 5 3 0 UP
1812 1813 5 3 0 UP
Server groups
grp1 (load-balanced): svr1 svr2 set authentication dot1x ssid private_wlan EXAMPLE\* peap-mschapv2 grp1
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
124 Configuring a 2370, 2360, or 2380 Switch for Basic Service
Displaying and Saving the Configuration
WSS Software immediately implements configuration changes by updating the device’s running configuration. The software does not automatically retain configuration changes after a software reboot or a power cycle. To review and save configuration changes, use the following commands: show config [ area area ] [ all ] save config
The show config command without the all option displays only those configuration changes that are different from the default settings of the WSS and its AP access points. The all option displays the entire configuration including the default values of all parameters.
The following command displays the beginning of the configuration file on a WSS configured with the commands in this chapter:
2370# show config
# Configuration nvgen'd at 2005-4-29 14:12:37
# Image 4.0.1
# Model 2370
# Last change occurred at 2005-4-29 14:03:52 set ip route default 10.10.20.19 1 set system name 2370 set system ip-address 10.10.10.4
set system countrycode US set timezone pdt -8 0 set summertime PDT start first sun apr 4 0 end last sun oct 31 0 set service-profile corp1 ssid-name private_wlan set service-profile corp1 ssid-type crypto set radius server svr1 address 10.10.70.20 key rad1pword set radius server svr2 address 10.10.70.40 key rad2pword set server group grp1 members svr1 svr2 set server group grp1 load-balance enabled set enablepass password b6b706525e1814394621eeb2a1c4d5803fcf set authentication dot1x ssid private_wlan EXAMPLE\* pass-through grp1 set radio-profile rp1 set dap 1 serial-id 0322199999 model 2330 set dap 1 radio 1 antennatype ANT1060 set dap 2 serial-id 0322199998 model 2330 set port type ap 1,2,4 model 2330 poe enable press any key to continue, q to quit.
2370# save config
Configuration saved to configuration.
320656-A
Configuring a 2350 Switch for a Branch Office
Note.
Use this chapter for setting up an 2350. To set up an 2370, 2360, or 2380, see
Chapter , “Configuring a 2370, 2360, or 2380 Switch for Basic Service,” on page 79
. To quickly perform basic setup instead of using this chapter, see the Nortel WLAN 2300
System Software Quick Start Guide or
“WSS Setup Methods” on page 57 .
Note.
This chapter shows CLI command syntax and examples and includes complex terminology. For syntax descriptions, additional configuration, and a glossary of terms, see the Nortel WLAN 2300 System Software Command Reference and the Nortel WLAN 2300
System Software Configuration Guide .
Branch Office Network Example
The 2350 can manage up to three AP access points to provide enterprise-class wireless service to the branch office or small office. You can use the 2350 as a standalone switch or as part of the corporate network. Figure 26 shows an example of an 2350 deployed as part of a corporate network.
125
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
126 Configuring a 2350 Switch for a Branch Office
Figure 26. Example Nortel Network with Branch Office
Distributed AP serial-id 0123456789
Branch Office LAN
10.10.20.1
Access
Router
10.10.20.15
WSS-2350
Local printer, file servers,
IP-PBX, etc.
Directly
Connected AP
Internet
VPN Tunnel
Public
DNS
192.168.4.69
VLAN Tunnel
Access
Router
Corporate Office NOC
WSS-2380
Corporate
DNS
RADIUS
Server
Group corpradius
10.10.40.28 - 29
WMS
Clients
WMS
Monitoring
Service
The 2350 connects to the branch office’s local LAN subnet, and can communicate with the corporate LAN over the company’s VPN connection. The 2350 also can use corporate resources such as RADIUS servers, and can be centrally managed along with the rest of the Nortel network with WLAN Management Software .
320656-A
Configuring a 2350 Switch for a Branch Office 127
When configured as part of a Nortel Mobility Domain that also contains the WSSs at the central office, the
2350 enables visitors from the central office to access their corporate resources. This access does not require the corporate VLANs to be configured on the 2350. Instead, the 2350 tunnels the user’s traffic back to the
WSS that is configured with the user’s VLAN.
Membership in the corporate Mobility Domain also enables the 2350 to use the RADIUS servers at the central office for AAA services, including authentication of visiting users and assignment of visiting users to their corporate VLANs.
An 2350 can boot and manage up to three APs. One AP can be directly connected and can receive power from the 2350. Additional APs can be indirectly connected to the 2350 through the office LAN, in which case the
APs are Distributed APs . To provide power to Distributed APs, use a power injector or a third-party switch that supports PoE.
Installation Requirements
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
128 Configuring a 2350 Switch for a Branch Office
Requirements for AP Access Points
• Cat 5 Ethernet cable—APs must have a wired connection to the 2350, either directly or through the network.
• Power—The 2350 can provide Power over Ethernet (PoE) to one AP. If you plan to install more APs or you cannot attach the AP directly to the 2350, you will need another power source, such as a power injector or a third-party switch.
• Location—Wireless traffic is sent and received using high-frequency radio waves. Radio frequency (RF) obstacles such as walls, doors, metal shelves, and so on cause attenuation of the radio signals, weakening the signals.
For optimal results, Nortel recommends choosing an installation location that has a minimum of RF obstacles between the AP and the likely locations of wireless users. Nortel also recommends installing the AP on a wall or ceiling, high enough to be above obstacles such as desks and file cabinets.
For advanced wireless planning, you can use WLAN Management Software , a full-featured graphical user interface (GUI) client application used to plan, configure, and deploy a WLAN and its users.
320656-A
Configuring a 2350 Switch for a Branch Office 129
Requirements for the 2350 Switch
• Network connection—The 2350 requires a 10/100 Ethernet connection to the office LAN.
• AC Power—The 2350 comes with an external power supply and a power cord for attachment to an AC power receptacle.
Caution!
Do not stack 2350 switches. Stacked 2350 switches can overheat and cause loss of equipment functionality or permanent damage.
Caution!
Ensure adequate airflow around 2350 switches. The 2350 switch uses natural convection cooling and requires free entry of air. Airflow blockage can cause the system to overheat and result in a loss of equipment functionality or permanent damage.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
130 Configuring a 2350 Switch for a Branch Office
Network Requirements
The 2350 requires the following network components. Your branch office LAN most likely has most or all of these components already.
• NTP server, to provide date and time information to the 2350
• DNS server, to resolve hostnames into IP addresses
• TFTP server, to install software upgrades. A TFTP server might also be required to install security certificates.
• Access router, to provide users access to the Internet and to resources at the corporate office. To enable the 2350 to tunnel to the corporate office, VPN must be available on the access router.
Optionally, you can use a DHCP server to give the switch its IP address. This chapter shows how to configure the address statically.
You do not need a DHCP server to give APs their IP addresses. The switch actually assigns IP addresses to the APs.
Installing the 2350 Switch
To install the 2350 and AP access points:
1
Install the APs.
(See Installing a Nortel Model 2330 Access Point .)
2
Place the switch on a tabletop.
3
Plug the power supply into an AC power source.
4
Plug the power supply into the Power port.
The LED turns green when the 2350 is receiving power.
5
Attach the 2350 to the network by plugging a 10/100 Ethernet cable into port 1 (PoE).
6
If you are connecting an AP directly to the 2350, attach the AP to the 2350 by plugging the Ethernet cable attached to the AP into port 2 (Uplink).
Software Configuration Parameters
During configuration of the 2350 switch, you will be required to supply values to the switch for some parameters.
Table 11 on page 131 lists the parameters. For convenience, the table also provides space to write down the values you
320656-A
Configuring a 2350 Switch for a Branch Office 131 plan to use. After you gather this information, use the CLI commands listed in Table 12 on page 137 to configure the parameters on the 2350.
Table 11: Configuration Parameter List
Configuration Parameters
1.
Enable password
Secures management access to the configuration level of the CLI.
Values
CAUTION!
To maintain security, either do not write passwords on this document, or make sure this document is securely stored when you are not using it.
2.
Administrator username and password
Secures management access to the switch.
By default, a user can still access the monitor level of the CLI through the console even if an enable password is configured.
3.
CLI management access
In addition to the serial console, you can use
Secure Shell (SSH) or Telnet to access the
CLI over the network.
4.
System IP address of the switch
An unused IP address from the office subnet.
Note: The 2350 does not support using DHCP to obtain its IP address.
5.
Gateway router IP address
IP address of the local access router. This is a router through which the 2350 can access the Internet and the VPN tunnel to the corporate office
6.
Time and date parameters
• Timezone (offset from UTC); for example, Pacific Standard Time is
-8
• Summertime (Daylight Savings
Time) offset
• Network Time Protocol (NTP) server IP address
IP address of an NTP server to provide time and date information to the switch. Using
NTP is an alternative to configuring the time and date locally on the 2350.
SSH? (Yes / No)
Telnet? (Yes / No)
Timezone:
Summertime offset?
Source for time and date information:
NTP server or
2350 onboard clock
If NTP, NTP server IP address:
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
132 Configuring a 2350 Switch for a Branch Office
Table 11: Configuration Parameter List (continued)
Configuration Parameters
7.
DNS server IP address
IP address of the DNS server used by the other devices in the LAN
8.
Default DNS domain name
Domain name the switch should append to a string when it makes a DNS query (such as example.com
). The 2350 appends the default domain name to hostnames you enter in commands.
9.
Certificates
Source and type of security certificates. You can install the following types of certificates:
• Administrative—Required to manage the 2350 using Web
View or WLAN Management
Software
• WebAAA—Required if you want users to be able to log in to the WLAN using a web page
• EAP—Required for clients that use 802.1X
The certificates can come from a certificate authority (CA) or the 2350 can generate its own self-signed certificates. Certificates from a CA are more secure, whereas self-signed certificates are easier to configure.
Values
Certificate types needed:
Admin (Yes / No)
WebAAA (Yes / No)
EAP (Yes / No)
If certificates will come from a CA, you also need to know the file type that will contain the certificate:
PKCS #7 or
PKCS #12
If the file type will be PKCS #12, you need to know the IP address of the TFTP server in the local network.
For either file type, you also need to know the
CA’s URL so you can access it to obtain the certificate file, but you do not need to enter the
URL in the 2350 configuration.
See
, and write down the two-letter country code:
10.
Country code
Two-letter code for the country in which you plan to operate wireless services
11.
Local user VLAN
Layer 2 broadcast domain of the local network. Configure the same VLAN on the
2350 to enable the 2350 to place wireless users in the VLAN when they log on.
320656-A
Configuring a 2350 Switch for a Branch Office 133
Table 11: Configuration Parameter List (continued)
Configuration Parameters
12.
Service Set Identifier (SSID) name
Name of the wireless network in your local
WLAN.
Each SSID’s parameters are controlled by a service profile. You also must enter a service profile name when you configure SSID parameters.
Note: If you have more than one SSID, write down this information for each SSID. An AP radio can support up to 32 SSIDs, and the encryption settings are not required to be the same on all SSIDs.
13.
Is the SSID encrypted?
For each SSID, also indicate whether you want the AP to encrypt the wireless traffic or send it in the clear.
14.
Encryption settings for the SSID
The following are supported:
• Static WEP
• Dynamic WEP (enabled by default)
• WPA with TKIP
• WPA with AES/CCMP
(An SSID on a Nortel radio can support both
WEP and WPA.)
Note: You must use 802.1X as the authentication type for accessing an encrypted
SSID. Other authentication types apply only to unencrypted (clear) SSIDs.
15.
AP model and serial numbers
• AP model number—Model number of the AP; for example,
2330. The model number is located on the sticker on the back of the AP.
Values
SSID name:
Service profile name (up to 16 alphanumeric characters with no spaces):
Encrypted? (Yes / No)
If encrypted, encryption type:
_____ Static WEP
_____ Dynamic WEP
_____ WPA with TKIP
_____ WPA with AES/CCMP
(also called WPA2 )
Will the encrypted SSID need to support both
WEP and WPA clients? (Yes / No)
Model number of directly connected AP:
Model number of 1st Distributed AP:
Model number of 2nd Distributed AP:
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
134 Configuring a 2350 Switch for a Branch Office
Table 11: Configuration Parameter List (continued)
Configuration Parameters
• AP serial number—Serial number of the AP, if you plan to attach the AP to the 2350 indirectly through the network.
(In this configuration, the AP is a
Distributed AP.
)
The serial number is required when you configure an AP that is indirectly connected to the 2350 through an intermediate network.
16.
Radio profile name
Radio parameters are controlled by a radio profile. You must enter the name when you configure and enable radios.
17.
RADIUS servers (if applicable)
Names and IP addresses of the RADIUS servers that provide AAA services in the corporate LAN. Providing this information allows visitors who are configured in the corporate office’s RADIUS servers to access the network, without the need to configure the users in the 2350’s local database.
If the local LAN also uses RADIUS, you can configure RADIUS information for your local users as well.
18.
RADIUS server group name
A name that refers to them. The server group name can be any string of up to 32 characters, with no spaces or tabs.
19.
Network user group name
Name for a group of local users.
Configuring user group enables you to easily assign all users in the group to a
VLAN, by assigning the group itself to the
VLAN.
20.
Network usernames and passwords
Usernames and passwords to add to the
2350’s local database.
For simplicity, these can be the same usernames and passwords used to access the wired LAN.
Values
Serial number of 1st Distributed AP:
Serial number of 2nd Distributed AP:
Radio profile name (up to 16 alphanumeric characters with no spaces):
RADIUS server names and IP addresses:
RADIUS server group name:
User group name:
CAUTION!
To maintain security, either do not write passwords on this document, or make sure this document is securely stored when you are not using it.
320656-A
Configuring a 2350 Switch for a Branch Office 135
Table 11: Configuration Parameter List (continued)
Configuration Parameters
21.
Authentication / authorization rules
Mechanism the 2350 uses to authenticate users before authorizing them to access the network. You can use configure rules that use the following authentication types:
• 802.1X—The most secure, but requires configuration of each wireless client’s network interface card (NIC).
Note: 802.1X authentication is required for encrypted SSIDs.
Clear (unencrypted) SSIDs can use any of the following authentication types.
• WebAAA—For wireless clients who do not have 802.1X.
• MAC—For wireless clients such as PDAs and cell phones that do not have usernames and passwords.
• Last-resort—For guest access by a user who is not configured in the RADIUS servers or 2350 local database.
(For more information about MAC and last-resort authentication, see the
“Configuring AAA for Network Users” chapter of the Nortel WLAN 2300 System
Software Configuration Guide .
Values
Authentication type(s):
_____ 802.1X
_____ WebAAA
_____ MAC
_____ Last-resort
Location of usernames and passwords:
2350’s local database? (Yes / No)
RADIUS server group? (Yes / No)
If Yes, server group name:
Configuring the 2350
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
136 Configuring a 2350 Switch for a Branch Office
Accessing the CLI
Initial configuration of the WSS requires a connection to the switch’s CLI through the serial console port.
To connect a PC to the serial console port:
1
Insert the serial cable into the PC port.
2
Insert the other end of the cable into the serial console port on the 2350 switch.
3
Start a standard VT100 terminal emulation application on the PC, and configure the following modem settings:
●
●
●
●
9600 bps
8 bits
1 stop
No parity
● Hardware flow control off or disabled
4
Open a connection on a serial port.
5
Press Enter three times to display a command prompt:
2350>
Note.
The default command prompt on your WSS shows your switch’s model number and also contains the last three octets of the switch’s MAC address. For example, the default command prompt on an 2350 switch with MAC address
00:0B:0E:00:04:0B is 2370-00040B> .
320656-A
Configuring a 2350 Switch for a Branch Office 137
Configuration Commands
Table 12 lists the CLI commands for configuring the parameters from Table 11 on page 131 . In some cases, command syntax has been simplified to show only the options related to a typical 2350 deployment. You can use the show commands listed in the table to verify the configuration changes.
For complete usage and syntax information about a command, see the following:
• Nortel WLAN 2300 System Software Configuration Guide
• Nortel WLAN 2300 System Software Command Reference
Configuration
Parameters
1.
Enable password
Table 12: Configuration Parameter List
2.
Administrator username and password
3.
CLI management access
CLI Commands set enablepass a Press Enter to display a username prompt.
Username: b Press Enter again to display a password prompt.
Username:
Password: c Press Enter a third time to display a command prompt.
Username:
Password:
2350> d Type the enable command and press Enter once more to display the prompt for the enabled access level.
Username:
Password:
2350> enable
2350# e At the enabled prompt, enter set enablepass .
set user username password string show aaa crypto generate key ssh
{
1024
|
2048
} set ip telnet server enable
Note: By default, SSH is enabled and Telnet is disabled. Although
SSH is enabled by default, you cannot use it until you generate an encryption key pair.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
138 Configuring a 2350 Switch for a Branch Office
Table 12: Configuration Parameter List (continued)
Configuration
Parameters
4.
System IP address of the switch
CLI Commands set vlan 1 po rt 1 set interface 1 ip
{ ip-addr mask
| ip-addr / mask-length
}
5.
Gateway router IP address
6.
Time and date parameters set system ip-address ip-addr show interface show system set ip route
{ default | ip-addr mask | ip-addr / mask-length } gateway metric show ip route set timezone zone-name
{
hours
[ minutes
]} set summertime summer-name
[ start week weekday month hour min end week weekday month hour min ] show timezone show summertime set timedate { date mmm dd yyyy [ time hh:mm:ss ]}
7.
DNS server IP address
8.
Default DNS domain name or set ntp server ip-addr set ntp enable show timedate show ntp set ip dns server ip-addr { primary | secondary } show ip dns set ip dns domain name show ip dns
320656-A
Configuring a 2350 Switch for a Branch Office 139
Table 12: Configuration Parameter List (continued)
Configuration
Parameters
9.
Certificates
CLI Commands
For certificates signed by a CA:
To install from PKCS #12 file: copy tftp:// ip-addr
/ [ subdirname
/ ] filename
[ destination-url
] crypto otp
{ admin
| eap
| webaaa
} one-time-password crypto pkcs12
{ admin
| eap
| webaaa
} file-location-url
Certificates (cont.)
10.
Country code
11.
Local user VLAN
To install from PKCS #7 file: crypto generate key
{ admin
| eap
| ssh
| webaaa
}
{
512
|
1024
|
2048
} crypto generate request
{ admin
| eap
| webaaa
} crypto certificate
{ admin
| eap
| webaaa
}
PEM-formatted-certificate crypto ca-certificate
{ admin
| eap
| webaaa
}
PEM-formatted-certificate
Note: After you generate or install a certificate, do not create the key pair again. If you do, the certificate might not work with the new key, in which case you will need to regenerate or reinstall the certificate.
For certificates signed by the 2350 itself: crypto generate key
{ admin
| eap
| ssh
| webaaa
}
{ 512 | 1024 | 2048 } crypto generate self-signed
{ admin
| eap
| webaaa
}
Note: After you generate or install a certificate, do not create the key pair again. If you do, the certificate might not work with the new key, in which case you will need to regenerate or reinstall the certificate.
set system countrycode code set vlan vlan-num name name set vlan
{ vlan-num
| name
} port 1 tag tag-num show vlan
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
140 Configuring a 2350 Switch for a Branch Office
Table 12: Configuration Parameter List (continued)
Configuration
Parameters
12.
Service Set Identifier
(SSID) name
CLI Commands set service-profile name ssid-name ssid-name
13.
Is the SSID encrypted? show service-profile name set service-profile name ssid-type
[ clear
| crypto
]
14.
Encryption settings for the SSID show service-profile name
To configure static WEP: set service-profile name wep key-index num key value set service-profile name wep active-multicast-index num set service-profile name wep active-unicast-index num
15.
AP model and serial numbers
To enable WPA with TKIP: set service-profile name wpa-ie enable
To enable WPA with AES/CCMP: set service-profile name cipher-ccmp enable
To enable WPA and WEP: set service-profile name cipher-wep104 enable or set service-profile name cipher-wep40 enable
Note: Microsoft Windows XP does not support WEP with WPA. To configure a service profile to provide WEP for XP clients, leave WPA disabled.
show service-profile name
For a directly connected AP: set port type ap port-list model model-num poe enable show ap config
For a Distributed AP: set dap dap-num serial-id serial-ID model model-num show dap config
320656-A
Configuring a 2350 Switch for a Branch Office 141
Table 12: Configuration Parameter List (continued)
Configuration
Parameters
16.
Radio profile name
CLI Commands set radio-profile name
17.
RADIUS servers
(if applicable)
18.
RADIUS server group name
19.
Network user group name
20.
Network usernames and passwords set radio-profile name service-profile name set { ap port-list | dap dap-num } radio { 1 | 2 } radio-profile name mode enable show radio-profile name set radius server server-name [ address ip-address ] show aaa set server group group-name members server-name1
[ server-name2
]
[ server-name3 ] [ server-name4 ] show aaa set usergroup group-name attr vlan-name vlan-name show aaa set user username password string set user username group group-name show aaa
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
142 Configuring a 2350 Switch for a Branch Office
Table 12: Configuration Parameter List (continued)
Configuration
Parameters
21.
Authentication \ authorization rules
CLI Commands
To use the local database to authenticate and authorize network access to an encrypted SSID by Microsoft 802.1X clients: set authentication dot1x ssid ssid-name **
[ bonded
] peap-mschapv2 local
To use the local database to authenticate and authorize network access to an unencrypted SSID by WebAAA clients: set authentication web ssid ssid-name ** local show aaa
The * and *.* values are wildcards that match on any username. (For information, see the “User Wildcards, MAC Address Wildcards, and
VLAN Wildcards” section in the “Using the Command-Line Interface” chapter of the Nortel WLAN 2300 System Software Configuration
Guide .)
Note: To use a RADIUS server group to authenticate access, specify the server group name instead of local . (You also can specify a server group name and local , in either order, to provide a backup method.)
(For the syntax to authenticate MAC or last-resort users, see the
“Configuring AAA for Network Users” chapter of the Nortel WLAN
2300 System Software Configuration Guide .
To configure authentication rules for administrative access, see the
“Configuring AAA for Administrative and Local Access” chapter of the same guide.)
Displaying and Saving the Configuration
The 2350 immediately implements configuration changes by updating the device’s running configuration.
However, the software does not automatically retain configuration changes after a software reboot or a power cycle. To review and save configuration changes, use the following commands: show config save config
Verifying Operation
The following sections describe how to verify IP connectivity between the 2350 and other devices in the network, and how to verify wireless user sessions.
320656-A
Configuring a 2350 Switch for a Branch Office 143
Verifying IP Connectivity
To verify IP connectivity between the 2350 and another device, use the following command: ping host
This command is supported on the 2350 and other Nortel switches, and is widely supported on third-party networking devices and clients.
The ping command sends an Internet Control Message Protocol (ICMP) echo packet to the specified device and listens for a reply packet. For host , specify the IP address of a host device on the network.
Enter this command from the 2350 to verify connection to other devices. Also enter this command on other devices such as the local access router to verify connection to the 2350.
The following command verifies IP connectivity to IP address 10.10.20.19:
2370# ping 10.10.20.19
PING 10.10.20.19 (10.10.20.19) from 10.10.20.2 : 56(84) bytes of data.
64 bytes from 10.10.20.19: icmp_seq=1 ttl=255 time=0.769 ms
64 bytes from 10.10.20.19: icmp_seq=2 ttl=255 time=0.628 ms
64 bytes from 10.10.20.19: icmp_seq=3 ttl=255 time=0.676 ms
64 bytes from 10.10.20.19: icmp_seq=4 ttl=255 time=0.619 ms
64 bytes from 10.10.20.19: icmp_seq=5 ttl=255 time=0.608 ms
--- 20.20.20.1 ping statistics ---
5 packets transmitted, 5 packets received, 0 errors, 0% packet loss
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
144 Configuring a 2350 Switch for a Branch Office
Verifying Wireless Access
To verify wireless access, attempt to access the SSID from a local wireless client. Some clients provide helpful messages and visual feedback to inform you of the status of the connection request.
On the 2350, use the following command to check for wireless client sessions: show sessions network [ user user-glob | mac-addr mac-addr-glob | ssid ssid-name
| vlan vlan-glob | session-id session-id | wired ] [ verbose ]
To check the session table for all network user sessions, type the following command:
2350# show sessions network
User Sess IP or MAC VLAN Port/
Name ID Address Name Radio
---------------------------- ---- ----------------- --------------- --------bob 12316* 10.10.20.145 branch1_vlan ap 2/2 alice 12672* 10.10.20.78 branch1_vlan dap 1/2
In this example, users bob and alice both have wireless sessions on the 2350. User bob is associated with radio
2 on the AP directly connected to port 2 on the 2350. User alice is associated with radio 2 on the Distributed
AP, indirectly connected to the 2350 through the network.
Note.
If a wireless user is unable to access the SSID, check the configuration of the wireless client (network adapter and driver software) on the user’s machine. The client must be configured to use the same encryption settings as the SSID, and the client must be enabled. For an example of how to configure a wireless client on a PC running Windows XP
Service Pack 2, to use dynamic WEP, see the Nortel WLAN 2300 System Software Quick
Start Guide.
Configuration Scenario
The commands in this example implement the branch office configuration shown in Figure 26 on page 126 .
320656-A
Configuring a 2350 Switch for a Branch Office 145
Configured Parameters
The following values are configured:
• Administrative access:
●
●
●
●
• IP parameters:
Enable password configaccess
Administrative username mxradmin with password letmein
SSH for CLI access through the network
Telnet is left disabled.
●
●
●
2350 system IP address 10.10.20.15
Default route to 10.10.20.1 (with 1 hop)
DNS server 192.168.4.69 and default DNS domain name example.com
• Time and date parameters:
●
●
●
Time and date set locally (using the onboard clock instead of an NTP server)
Timezone is Pacific Standard Time (PST).
Daylight Savings Time (DST) is enabled.
• Security certificates:
● Certificates issued by a Certificate Authority (CA) are installed for administrative access, for 802.1X (EAP) network user access, and for WebAAA user access.
● The certificates are installed from PKCS #12 object files supplied by the CA.
• Wireless access:
●
●
Country code US (United States)
2330 directly connected to 2350 port 2, with PoE enabled. An additional 2330 is added as a Distributed AP.
●
●
Encrypted SSID branch1_wlan , in service-profile branch1_srvcprof
Radio profile branch1_radprof containing the AP radios, and mapped to service profile branch1_srvcprof
●
●
●
Network user group branch1_users , which assigns users to VLAN branch1_vlan . The user group contains users alice with password alicepass and bob with password bobpass .
Authentication rule to allow users with wireless clients that support 802.1X to access the
SSID branch1_wlan
2350 added to local user VLAN branch1_vlan
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
146 Configuring a 2350 Switch for a Branch Office
Configuration Commands
To configure these parameters:
1
Access the enable (configuration) level of the CLI and configure an enable password:
2370> enable
2370# set enablepass
Enter old password: <CR>
Enter new password: configaccess
Retype new password: configaccess success: password changed
2
Configure a username and password for administrative access through SSH or Telnet, and verify the change:
2370# set user mxradmin password letmein success: change accepted.
2370# show aaa
Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server Addr Ports T/o Tries Dead
State
---------------------------------------------------------------
----
Server groups user mxradmin
Password = 011f0310560e0f01 (encrypted)
3
Create an encryption key pair for SSH:
2370# crypto generate key ssh 1024 key pair generated
4
Add the uplink port to the default VLAN, configure an IP interface on the VLAN, and designate the interface to be the 2350’s system IP address. Then verify the changes.
2370# set vlan
1 po rt 1 success: change accepted.
2370# set interface 1 ip 10.10.20.15/24 success: change accepted.
2370# set system ip-address 10.10.20.15
This will cause all APs to reboot. Are you sure? (y/n) [n] y success: change accepted.
320656-A
Configuring a 2350 Switch for a Branch Office 147
2370# show interface
VLAN Name Address Mask Enabled State RIB
---- --------------- --------------- --------------- ------- ----- ------------
1 default 10.10.20.15 255.255.0.0 YES Up ipv4
2370# show system
===============================================================================
Product Name: 2350
System Name: 2350
System Countrycode: US
System Location:
System Contact:
System IP: 10.10.20.15
System MAC: 00:0B:0E:00:04:0C
===============================================================================
Boot Time: 2004-12-15 14:18:41
Uptime: 0 days 00:05:07
===============================================================================
Fan status: fan1 OK
Temperature: temp1 ok
PSU Status: Power Supply DC ok
Memory: 144.06/465.03 (31%)
Total Power Over Ethernet : 6.000
===============================================================================
5
Configure a default route that uses the local access router at 10.10.20.1 as its gateway, and indicate that the gateway is one router hop away from the 2350. (One hop means the 2350 and the local access router are in the same IP subnet.)
2370# set ip route default 10.10.20.1 1 success: change accepted.
2370# show ip route
2370# show ip route
Router table for IPv4
Destination/Mask Proto Metric NH-Type Gateway VLAN:Interface
_________________ _______ ______ _______ _______________ _______________
0.0.0.0/ 0 Static 1 Router 10.10.20.1 vlan:1:ip
10.10.20.15/24 IP 0 Direct vlan:1:ip
10.10.20.15/32 IP 0 Local vlan:1:ip:10.10.20.15/24
10.10.20.255/32 IP 0 Local vlan:1:ip:10.10.20.15/24
224.0.0.0/ 4 IP 0 Local MULTICAST
Note.
The 0.0.0.0 route is the default route. The 10.10.20.x routes in this example are automatically added when you configure the corresponding IP interface. The 224.0.0.0 route is for the IGMP snooping feature and is also added automatically.
6
Set the timezone to Pacific Standard Time, enable Daylight Savings Time, and set the date and time on the 2350’s onboard clock.
2370# set timezone PST -8 success: change accepted.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
148 Configuring a 2350 Switch for a Branch Office
2370# show timezone
Timezone is set to 'PST', offset from UTC is -8:0 hours.
2370# set summertime PDT success: change accepted.
2370# show summertime
Summertime is enabled, and set to 'PDT'.
Start : Sun Apr 04 2004, 02:00:00
End : Sun Oct 31 2004, 02:00:00
Offset : 60 minutes
Recurring : yes, starting at 2:00 am of first Sunday of April
and ending at 2:00 am on last Sunday of October.
2370# set timedate date dec 15 2004 time 14:30:00 success: time set to: Dec 15 2004, 14:30:00 PDT
Time now is:
Wed Dec 15 2004, 13:30:00 PST
7
Configure the 2350 to use the DNS server at 192.168.4.69 as its primary (in this cae, its only) DNS server, and configure the 2350 to append the default domain name example.com to hostnames you enter at the command line. Enable DNS, then verify the changes.
2370# set ip dns server 192.168.4.69 primary success: change accepted.
2370# set ip dns domain example.com
success: change accepted.
2370# set ip dns enable success: change accepted.
2370# show ip dns
Domain Name: example.com
DNS Status: enabled
IP Address Type
-----------------------------------
192.168.4.69 PRIMARY
8
Install security certificates for administrative, EAP (802.1X), and WebAAA access. In this case, the certificates are delivered from the CA in PKCS #12 files. Also install the CA’s certificate, which is required in addition to the certificates created by the CA for the 2350.
2370# copy tftp://10.10.20.24/admin.pem
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
2370# crypto otp admin otp1
OTP set
2370# crypto pkcs12 admin admin.pem
Unwrapped from PKCS12 file: keypair device certificate
320656-A
Configuring a 2350 Switch for a Branch Office 149
CA certificate
2370# copy tftp://10.10.20.24/eap.pem
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
2370# crypto otp
eap
otp2
OTP set
2370# crypto pkcs12
eap eap.pem
Unwrapped from PKCS12 file: keypair device certificate
CA certificate
2370# copy tftp://10.10.20.24/webaaa.pem
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
2370# crypto otp
webaaa
otp3
OTP set
2370# crypto pkcs12
webaaa webaaa.pem
Unwrapped from PKCS12 file: keypair device certificate
CA certificate
Note.
After you generate or install a certificate, do not create the key pair again.
If you do, the certificate might not work with the new key, in which case you will need to regenerate or reinstall the certificate.
9
Set the country code to US :
2370# set system countrycode US success: change accepted.
10
Add the 2350 to the local user VLAN, branch1_vlan . (Because the uplink port is now in two VLANs, the default VLAN for 2350 management and a user VLAN, the port must be tagged.) Then verify the changes.
2370# set vlan 2 name branch1_vlan success: change accepted.
2370# set vlan branch1_vlan port 1 tag 1 success: change accepted.
2370# show vlan
Admin VLAN Tunl Port
VLAN Name Status State Affin Port Tag
State
---- ---------------- ------ ----- ----- ---------------- -----
-----
1 default Up Up 5
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
150 Configuring a 2350 Switch for a Branch Office
1 none Up
2 branch1_vlan Up Up 5
1 1 Up
11
Configure encrypted SSID branch1_wlan , and display the configuration changes.
(Dynamic WEP, which is enabled by default, will be used for traffic encryption.)
2370# set service-profile branch1_srvcprof ssid-name branch1_wlan success: change accepted.
2370# set service-profile branch1_srvcprof ssid-type crypto success: change accepted.
2370# show service-profile branch1_srvcprof ssid-name: branch1_wlan ssid-type: crypto beacon: yes auth-fallthru: web-auth
WEP Key 1 value: <none> WEP Key 2 value: <none>
WEP Key 3 value: <none> WEP Key 4 value: <none>
WEP Unicast Index: 1 WEP Multicast Index: 1
Shared Key Auth: NO
12
Configure port 2 for directly connected AP model 2330 and enable PoE on the port. Then verify the change.
2370# set port type ap 2 model 2330 poe enable
This may affect the power applied on the configured ports. Would you like to continue? (y/n) [n] y success: change accepted.
2370# show ap config
Port 2: AP model: 2330 , POE: enable , bias: high, name: AP02
boot-download-enable: YES
load balancing group: none
Radio 1: type: 802.11g, mode: disabled, channel: dynamic
tx pwr: 15, profile: default
auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10
Radio 2: type: 802.11a, mode: disabled, channel: dynamic
tx pwr: 11, profile: default
auto-tune max-power: default, min-client-rate: 24, max-retransmissions: 10
13
Configure an additional 2330 connected to the 2350 through the network. Then verify the change.
2370# set dap 1 serial-id 0123456789 model 2330 success: change accepted.
2370# show dap config
Dap 1: serial-id: 0123456789 , AP model: 2330 , bias: high, name: DAP01 fingerprint: boot-download-enable: YES load balancing group: none
Radio 1: type: 802.11g, mode: disabled, channel: dynamic
tx pwr: 15, profile: default
auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10
Radio 2: type: 802.11a, mode: disabled, channel: dynamic
tx pwr: 11, profile: default
320656-A
Configuring a 2350 Switch for a Branch Office 151
auto-tune max-power: default, min-client-rate: 24, max-retransmissions: 10
14
Create radio profile branch1_radprof , map service profile branch1_srvcprof to it, and assign the AP radios to the radio profile. Then verify the changes.
2370# set radio-profile branch1_radprof success: change accepted.
2370# set radio-profile branch1_radprof service-profile branch1_srvcprof success: change accepted.
2370# set ap 2 radio 1 radio-profile branch1_radprof success: change accepted.
2370# set ap 2 radio 2 radio-profile branch1_radprof success: change accepted.
2370# set dap 1 radio 1 radio-profile branch1_radprof success: change accepted.
2370# set dap 1 radio 2 radio-profile branch1_radprof success: change accepted.
2370# show radio-profile branch1_radprof
Beacon Interval: 100 DTIM Interval:
1
Max Tx Lifetime: 2000 Max Rx Lifetime:
2000
RTS Threshold: 2346 Frag Threshold:
2346
Short Retry Limit: 5 Long Retry Limit:
5
Long Preamble: NO Allow 802.11g clients only:
NO
Tune Channel: yes Tune Power: no
Tune Channel Interval: 3600 Tune Power Interval:
600
Power Backoff Timer: 10 Channel Holddown:
300
Countermeasures: none Active-Scan: yes
WMM enabled: yes
Service profiles: branch1_srvcprof
15
Enable the radios and verify the changes:
2370# set radio-profile branch1_radprof mode enable success: change accepted.
2370# show ap config
Port 2: AP model: 2330, POE: enable, bias: high, name: MP02
boot-download-enable: YES
load balancing group: none
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
152 Configuring a 2350 Switch for a Branch Office
Radio 1: type: 802.11g, mode: enabled , channel: dynamic
tx pwr: 15, profile: branch1_radprof
auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10
Radio 2: type: 802.11a, mode: enabled , channel: dynamic
tx pwr: 11, profile: branch1_radprof
auto-tune max-power: default, min-client-rate: 24, max-retransmissions: 10
2370# show dap config
Dap 1: serial-id: 0123456789, AP model: 2330, bias: high, name: DMP01 fingerprint: boot-download-enable: YES load balancing group: none
Radio 1: type: 802.11g, mode: enabled , channel: dynamic
tx pwr: 15, profile: branch1_radprof
auto-tune max-power: default, min-client-rate: 5.5, max-retransmissions: 10
Radio 2: type: 802.11a, mode: enabled , channel: dynamic
tx pwr: 11, profile: branch1_radprof
auto-tune max-power: default, min-client-rate: 24, max-retransmissions: 10
16
Configure user group branch1_users and assign the group to the user VLAN, branch1_vlan . Then add users to the branch1_users group and verify the changes:
2370# set usergroup branch1_users attr vlan-name branch1_vlan success: change accepted.
2370# set user alice password alicepass success: change accepted.
2370# set user alice group branch1_users success: change accepted.
2370# set user bob password bobpass success: change accepted.
2370# set user bob group branch1_users success: change accepted.
2370# show aaa
Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server Addr Ports T/o Tries Dead
State
---------------------------------------------------------------
----
Server groups usergroup branch1_users
vlan-name = branch1_vlan user mxradmin
320656-A
Configuring a 2350 Switch for a Branch Office 153
Password = 011f0310560e0f01 (encrypted) user alice
Password = 082040470a1c15160118 (encrypted)
Group = branch1_users user bob
Password = 0823434c19181604 (encrypted) press any key to continue, q to quit.<CR>
Group = branch1_users
17
Configure an authentication rule that allows users with wireless clients that support 802.1X to access the
SSID branch1_wlan . Then verify the change.
2370# set authentication dot1x ssid branch1_wlan ** peap-mschapv2 local
2370# show aaa
Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server Addr Ports T/o Tries Dead
State
---------------------------------------------------------------
----
Server groups set authentication dot1x ssid branch1_wlan ** peap-mschapv2 local usergroup branch1_users
vlan-name = branch1_vlan user mxradmin
Password = 011f0310560e0f01 (encrypted) user alice
Password = 082040470a1c15160118 (encrypted)
Group = branch1_users user bob press any key to continue, q to quit.<CR>
Password = 0823434c19181604 (encrypted)
Group = branch1_users
18
Display all the configuration changes:
2370# show config
# Configuration nvgen'd at 2005-05-02 11:29:21
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
154 Configuring a 2350 Switch for a Branch Office
# Image 4.0.1
# Model 2350
# Last change occurred at 2005-05-02 11:17:42 set ip route default 10.10.20.1 1 set ip dns domain example.com
set ip dns server 192.168.4.69 PRIMARY set system name 2350 set system ip-address 10.10.20.15
set system countrycode US set timezone PST -8 0 set summertime PDT start first sun apr 2 0 end last sun oct 2 0 set service-profile default-clear ssid-type clear set service-profile branch1_srvcprof ssid-name branch1_wlan set enablepass password
30a903bcd4d120f93a194f7e62a6e7b5dd52 set authentication dot1x ssid branch1_wlan ** peap-mschapv2 local set user mxradmin password encrypted 011f0310560e0f01 set user alice password encrypted 082040470a1c15160118 set user alice group branch1_users set user bob password encrypted 0823434c19181604 set user bob group branch1_users set usergroup branch1_users attr vlan-name branch1_vlan set radio-profile branch1_radprof service-profile branch1_srvcprof press any key to continue, q to quit. c set dap 1 serial-id 0123456789 model 2330 set dap 1 radio 1 radio-profile branch1_radprof mode enable set dap 1 radio 2 radio-profile branch1_radprof mode enable set port type ap 2 model 2330 poe enable set ap 2 radio 1 radio-profile branch1_radprof mode enable set ap 2 radio 2 radio-profile branch1_radprof mode enable set port poe 2 enable set vlan 1 port 1 set interface 1 ip 10.10.20.15 255.255.255.0
19
Save the configuration changes:
2370# save config
320656-A
155
Appendix A: WSS Technical
Specifications
Table 13 lists the technical specifications for Nortel WLAN—Security Switch (WSS) models 2370 and 2380. Table 14
compliance information, see the Nortel WLAN—2300 Series Regulatory Information document. For specifications for the AP access point, see the Nortel WLAN—Access Point 2330 Installation Guide .)
Table 13: 2370 and 2380 Mechanical and Compliance Specifications
Specification
Size
Weight
Operating Temperature
Storage Temperature
Humidity
Power supply
Power over Ethernet (PoE)
(2370 only)
Status indicators
Description
Width: 44.2 cm (17.4 inches)
Depth: 46.23 cm (18.2 inches)
Height: 8.81 cm (3.47 inches)
2370:
• With one power supply: 10.32 kg (22.75 pounds)
• With two power supplies: 11.79 kg (26.00 pounds)
2380:
• With one power supply: 9.75 kg (21.50 pounds)
• With two power supplies: 11.35 kg (25.00 pounds)
0° C to +50° C (32° F to 122° F)
-20° C to +70° C (-4° F to +158° F)
10% to 95% noncondensing
100-240 VAC
50 Hz to 60 Hz
Up to 350 W
8 A rms
at 120 V rms
and 3.5 A rms peak inrush current
at 230 V rms
, with 50-A
Hot-swappable
Load sharing with two supplies installed
41 VDC to 49 VDC (46 VDC nominal)
240 W (total budget for all ports)
12 W per port if all ports are used; otherwise, 15.3 W maximum on an individual port without exceeding 240 W total
Management CPU status LED
Power supply status LEDs
Port activity and link speed LEDs
(For descriptions of the LEDs, see “2360, 2380, and 2370
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
156 Appendix A:WSS Technical Specifications
Table 13: 2370 and 2380 Mechanical and Compliance Specifications (continued)
Specification
Wired network ports
Safety and electromagnetic compliance
Description
2370:
• Two gigabit interface converter (GBIC) slots for
1000BASE-SX or 1000BASE-LX gigabit Ethernet ports
• 20 RJ-45 po2380rts for 10/100BASE-T Ethernet and optional Power over Ethernet (PoE)
2380:
• Four dual-interface gigabit Ethernet ports. Each port has a 1000BASE-TX copper interface and a GBIC slot for insertion of a 1000BASE-SX or 1000BASE-LX fiber-optic interface.
FCC PART 15, UL 60950
ICES PART 15, CSA 22.2 NO. 60950
EN 55022, EN 55024
CISPR 22
TUV/GS (EN 60 950)
VCCI
Table 14: 2360 Mechanical and Compliance Specifications
Specification
Size
Weight
Operating Temperature
Storage Temperature
Humidity
Power supply
Power over Ethernet (PoE)
Description
Width: 44.2 cm (17.4 inches)
Depth: 25.6 cm (10.08 inches)
Height: 4.4 cm (1.72 inches)
Without a power supply: 3.40 kg (7.50 pounds)
With one power supply: 3.8 kg (8.50 pounds)
With two power supplies: 4.3 kg (9.50 pounds)
0° C to +50° C (32° F to +122° F)
-20° C to +70° C (-4° F to +158° F)
10% to 95% noncondensing
100-120 VAC / 200-240 VAC
47 Hz to 63 Hz
2.5 A rms
at 115 V rms
and 1.25 A rms
at 230 V rms
, with
70-A peak inrush current
48 VDC
91.8 W total budget for all ports (15.3 W * 6 ports)
15.3 W per port maximum
320656-A
Appendix A:WSS Technical Specifications 157
Table 14: 2360 Mechanical and Compliance Specifications (continued)
Specification
Status indicators
Wired network ports
Safety and electromagnetic compliance
Description
Power supply status LEDs
Port activity and link speed LEDs
(For descriptions of the LEDs, see “2360, 2380, and 2370
Six RJ-45 ports for 10/100BASE-T Ethernet and optional
Power over Ethernet (PoE)
Two RJ-45 ports for 10/100BASE-T Ethernet uplinks
(without PoE)
FCC PART 15, UL 60950
ICES PART 15, CSA 22.2 NO. 60950
EN 55022, EN 55024
CISPR 22
TUV/GS (EN 60 950)
VCCI
Table 15: 2350 Mechanical and Compliance Specifications
Specification
Size
Weight
Operating Temperature
Storage Temperature
Humidity
Power supply
Power over Ethernet (PoE)
Status indicators
Description
Width: 19.0 cm (7.5 inches)
Depth: 14.6 cm (5.75 inches)
Height: 3.18 cm (1.25 inches)
0.7 kg (1.5 pounds)
0° C to +50° C (32° F to +122° F)
-20° C to +70° C (-4° F to +158° F)
10% to 95% noncondensing
Input: 100-150 VAC, 47-63 Hz, auto-sensing
Output: 48 VDC, 0.75A
Amperage draw maximums:
At 115V (RMS): 0.8A
At 230V (RMS): 0.4A
48 VDC
Power supply status LED
Port activity and link speed LEDs
Factory reset LED
(For descriptions of the LEDs, see “2350 LEDs” on page 28.)
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
158 Appendix A:WSS Technical Specifications
Table 15: 2350 Mechanical and Compliance Specifications (continued)
Specification
Wired network ports
Safety and electromagnetic compliance
Description
One RJ-45 port for 10/100BASE-T Ethernet and optional
Power over Ethernet (PoE)
One RJ-45 10/100BASE-T Ethernet uplink (without PoE)
FCC PART 15, UL 60950
ICES PART 15, CSA 22.2 NO. 60950
EN 55022, EN 55024
CISPR 22
TUV/GS (EN 60 950)
VCCI
320656-A
Appendix B: WSS Troubleshooting
Table 16 contains remedies for some common problems that can occur during basic installation and setup of a WSS.
Table 16: WSS Setup Problems and Remedies
Symptom Diagnosis
WLAN Management
Software or a web browser (if you are using
Web View) warns that the
WSS’s certificate date is invalid.
The switch’s time and date are currently incorrect, or were incorrect when you generated the self-signed certificate or certificate request.
WSS does not accept configuration information for an AP access point or a radio.
The country code might not be set or might be set for another country.
Remedy
1. Use set timezone to set the time zone in which you are operating the switch. (See
“Configuring the Time and
Date” on page 83
.)
2. Use set timedate to configure the current time and date in that time zone. (See
“Configuring the Time and Date” on page 83
.)
3. Reconfigure the administrative
certificate(s). (See “Enabling
Secure Communication for
WLAN Management Software or Web View” on page 88 .)
4. If you have already configured a certificate on the switch for authentication by network users, you must recreate this certificate, too.
1. Type the show system command to display the country code configured on the switch.
2. If the value in the System
Countrycode field is NONE or is for a country other than the one in which you are operating the switch, use the set system countrycode command to configure the correct country
code. (See “Specifying the
Country of Operation” on page 98
.)
159
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
160 Appendix B:WSS Troubleshooting
Table 16: WSS Setup Problems and Remedies (continued)
Symptom Diagnosis Remedy
Client cannot access the network.
This symptom has more than one possible cause:
• The client might be failing authentication or might not be authorized for a VLAN.
• If the client and switch configurations are correct, a
VLAN might be disconnected.
A client connected to a VLAN that is disconnected is unable to access the network.
Configuration information disappears after a software reload.
The configuration changes were not saved.
1. Type the show aaa command to check the authentication rules on the WSS, to ensure that the client can be authenticated.
2. Check the authorization rules in the switch’s local database
( show aaa ) or on the RADIUS servers to ensure the client is authorized to join a VLAN that is configured on at least one of the WSSs in the Mobility
Domain.
1. Type the show vlan config command to check the status of each VLAN.
2. If a VLAN is disconnected
(VLAN state is Down), check the network cables for the
VLAN’s ports. At least one of the ports in a VLAN must have a physical link to the network for the VLAN to be connected.
1. Retype the commands for the missing configuration information.
2. Type the save config command to save the changes.
Mgmt LED is quickly blinking amber.
CLI stops at boot prompt
(boot>).
The WSS was unable to load the system image file.
Type the boot command at the boot prompt.
320656-A
Appendix C: Translated Warning
Conventions and Warnings
The following warning conventions and warnings apply to this manual.
Warning Conventions
Warning! This situation or condition can cause injury.
Warning! Deze situatie of omstandigheid kan letsel veroorzaken.
Warning! Diese Situation oder dieser Zustand kann zu Verletzungen führen.
Warning! Cette situation ou cette condition peuvent provoquer des blessures.
Warning! Esta situación o condición puede causar lesiones.
161
Warning! High voltage. This situation or condition can cause injury due to electric shock.
Warning! Hoog voltage. Deze situatie of omstandigheid kan letsel veroorzaken door elektrische schokken.
Warning! Hochspannung. Diese Situation oder dieser Zustand kann einen
Elektroschock verursachen.
Warning! Haute tension. Cette situation ou cette condition peuvent provoquer des blessures dues à des décharges électriques.
Warning! Alta tensión. Esta situación o condición puede causar lesiones por descarga eléctrica.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
162 Appendix C:Translated Warning Conventions and Warnings
Warning! Radiation. This situation or condition can cause injury due to improper handling of fiber-optic equipment.
Warning! Straling. Deze situatie of omstandigheid kan letsel veroorzaken door onjuist gebruik van glasvezelapparatuur.
Warning! Strahlung. Diese Situation oder dieser Zustand kann durch falschen Umgang mit glasfaserbasierten Geräten zu Verletzungen führen.
Warning! Radiation. Cette situation ou cette condition peuvent provoquer des blessures dues à une manipulation inappropriée d’appareils équipés de fibres optiques.
Warning! Radiación. Esta situación o condición puede causar lesiones debido a un manejo inadecuado del equipamiento de fibra óptica.
320656-A
Appendix C:Translated Warning Conventions and Warnings 163
Qualified Service Personnel Warning
Warning! Installation must be performed by qualified service personnel only.
Read and follow all warning notices and instructions marked on the product or included in the documentation. Before installing the product, read the Nortel
WLAN 2300 Series Regulatory Information document.
Warning! De installatie mag alleen worden uitgevoerd door bevoegd onderhoudspersoneel. Het is essentieel dat u kennis neemt van alle waarschuwingen en instructies aangebracht op het product zelf en/of opgenomen in de documentatie. Voordat u het product installeert, dient u
Nortel WLAN 2300 Series Regulatory Information in zijn geheel te hebben gelezen.
Warning! Die Installation darf nur von einem qualifizierten
Kundendienstmitarbeiter vorgenommen werden. Lesen Sie alle Warnhinweise und Anweisungen auf dem Produkt oder in der Dokumentation und befolgen Sie sie. Bevor Sie das Produkt installieren, sollten Sie Nortel WLAN 2300 Series
Regulatory Information vollständig lesen.
Warning! L’installation doit être effectuée uniquement par des techniciens qualifiés. Lisez et suivez toutes les notices d’avertissement et les instructions figurant sur le produit ou comprises dans la documentation. Lisez Nortel WLAN
2300 Series Regulatory Information avant d’installer ce produit.
Warning! Sólo puede realizar la instalación personal cualificado de asistencia técnica. Lea y siga todas las notas de advertencia e instrucciones indicadas en el producto o incluidas en la documentación. Antes de instalar el producto, lea
Nortel WLAN 2300 Series Regulatory Information .
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
164 Appendix C:Translated Warning Conventions and Warnings
Laser Warning
Warning! The gigabit Ethernet fiber-optic interfaces use Class 1 lasers. To reduce the risk of eye injury, do not stare into the interface or otherwise direct the laser beam into your eye.
Warning! De gigabit Ethernet glasvezel interfaces gebruiken Klasse 1 lasers.
Teneinde oogletsel te voorkomen, mag u nooit rechtstreeks in de interface kijken of een laserstraal op andere wijze op uw oog richten.
Warning! Für die Glasfaserschnittstellen werden bei Gigabit-Ethernet
Class 1-Laser verwendet. Vermeiden Sie Augenverletzungen, indem Sie nicht in die Schnittstelle schauen oder den Laserstrahl auf Ihr Auge richten.
Warning! Les interfaces Gigabit Ethernet à fibre optique utilisent des lasers de classe 1. Pour réduire le risque de blessure oculaire, ne regardez pas directement l’interface et ne dirigez pas le faisceau laser vers vos yeux.
Warning! Las interfaces de fibra óptica Gigabit Ethernet utilizan láseres de
Clase 1. Para reducir el riesgo de sufrir lesiones oculares, no mire fijamente la interfaz ni dirija el rayo láser hacia los ojos.
320656-A
Appendix C:Translated Warning Conventions and Warnings 165
Earth Ground Warning
Warning! Earth grounding is required for a WSS installed in a rack. If you are relying on the rack to provide ground, the rack itself must be grounded with a ground strap to the earth ground. Metal screws attaching the switch to the rack provide ground attachment to the rack.
Warning! Aarding aan de grond is vereist voor een WSS geïnstalleerd in een rek. Als u het rek gebruikt als massa, dan dient het rek zelf via een aardingsstrip verbonden te zijn met grondaarding. De metalen bouten waarmee de switch is bevestigd aan het rek zorgen voor aarding van het rek.
Warning! Für einen WSS-Switch, der in einem Rack installiert ist, ist eine
Erdung erforderlich. Wenn Sie die Erdung über das Rack vornehmen möchten, müssen Sie es über ein Masseband mit der Erde verbinden. Die Erdung zum
Rack erfolgt dann über die Metallschrauben, die den Schalter mit dem Rack verbinden.
Warning! La mise à la terre est requise pour un commutateur WSS installé dans un châssis. Si vous utilisez le châssis comme masse, celui-ci doit être mis
à la terre au moyen d’un câble de mise à la terre relié à la prise de terre. Les vis métalliques qui attachent le commutateur au châssis assurent une mise à la masse au châssis.
Warning! Un interruptor WSS instalado en un bastidor necesita una conexión a masa. Para utilizar el bastidor como conexión a masa debe conectar a masa dicho bastidor con una tira de conexión a masa. Los tornillos metálicos que fijan el interruptor al bastidor proporcionan conexión a masa al bastidor.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
166 Appendix C:Translated Warning Conventions and Warnings
Rack Installation Warnings
Warning! Nortel recommends that you ask someone to assist you with the remaining steps. If you accidentally drop the WSS, you can be injured and the switch can be damaged.
Warning! Nortel adviseert dat u bij het uitvoeren van de resterende stappen iemand ter assistentie vraagt. Als u de WSS per ongeluk laat vallen, kunt u letsel oplopen en kan de switch beschadigd raken.
Warning! Nortel empfiehlt, dass Sie jemanden bitten, Ihnen beim Ausführen der weiteren Schritte zu helfen. Wenn Sie den WSS-Switch versehentlich fallen lassen, könnten Sie dadurch verletzt werden und der Switch wird eventuell beschädigt.
Warning! Nortel vous conseille de demander l’assistance d’une autre personne pour les étapes restantes. Si vous laissez tomber le commutateur
WSS par accident, vous pouvez vous blesser et le commutateur risque d’être endommagé.
Warning! Nortel le recomienda que pida la ayuda de alguien para realizar los pasos restantes. Si el interruptor WSS se cae accidentalmente, usted puede sufrir lesiones y el interruptor puede sufrir daños.
320656-A
Appendix C:Translated Warning Conventions and Warnings 167
Warning! To prevent the WSS from slipping, do not release the switch until all the rack-mount screws are tight.
Warning! Laat de WSS niet los totdat alle bevestigingsbouten goed zijn vastgedraaid om te voorkomen dat de switch uit uw handen glijdt.
Warning! Sie vermeiden, dass der WSS abrutscht, indem Sie ihn festhalten, bis alle Rack-Befestigungsschrauben angezogen sind.
Warning! Pour éviter que le commutateur WSS ne tombe, ne le lâchez pas tant que les vis de montage du châssis ne sont pas fixées.
Warning! Para evitar que el interruptor WSS se caiga, no lo suelte hasta que todos los tornillos del bastidor estén bien apretados.
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
168 Appendix C:Translated Warning Conventions and Warnings
Overcurrent Warning
Warning! The WSS relies on the building’s installation for overcurrent protection. Ensure that a fuse or circuit breaker no larger than 120 VAC,
15A U.S. (240 VAC, 10 A international) is used on the phase conductors.
Warning! De WSS is afhankelijk van de in het gebouw geïnstalleerde beveiliging tegen overstroom. Op de fase-aders dient een zekering of circuitonderbreker te worden gebruikt van maximaal 240 V~, 10 A.
Warning! Der Lastschutz des WSS-Switch hängt vom Gesamtlastschutz des
Gebäudes ab. Sie sollten sicherstellen, dass die Phasen mit maximal 240 V~ /
10 A abgesichert sind.
Warning! La protection du commutateur WSS contre les surintensités dépend de l’installation électrique du bâtiment. Assurez-vous qu’un fusible ou un disjoncteur inférieur ou égal à 120 VCA, 15 A É.-U. (240 VCA, 10 A pour les autres pays) est utilisé sur les conducteurs de phase.
Warning! El interruptor WSS está protegido contra las sobrecargas de corriente mediante la instalación del edificio. Asegúrese de utilizar un fusible o un disyuntor que no supere los 120 VAC, 15A en EE.UU. (240 VAC, 10 A en el resto del mundo) en los conductores de fase.
320656-A
169
Index
Numerics
2360
2370
2380
802.1X
A
Access Point. See AP access points. See AP (Access Point)
advisory notices, explanations of 15
AP (Access Point)
denial of configuration information, troubleshooting
models
attributes, RADIUS
authentication
protocols, PEAP-MS-CHAP-V2 122
users, offload
C cables network
serial console
certificates displaying, administration
displaying, user
installing for administration, certificate authority assigned
installing for administration, self-signed
installing for users, certificate authority assigned
installing for users, self-signed
CLI (command-line interface), accessing
clients, no network access, troubleshooting
command-line interface, accessing 80
configuration
connections
AP, requirements
LEDs
serial console
verifying, IP
conventions, text and syntax 16
D date, configuring
documentation conventions
documentation, product
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
170
E
EAP (Extensible Authentication Protocol)
local
enable password
equipment rack installation 43
Ethernet connections, 10/100 Ethernet
connections, AP
connections, gigabit Ethernet
Ethernet ports
Extensible Authentication Protocol. See EAP
F fans
G
GBICs (gigabit interface converters) 26
gigabit interface converters. See GBICs
H hardware features
inventory
I installation
power supplies, 2370 or 2380 46
320656-A
requirements, AP connections 41
requirements, tools
warnings, earth grounding
warnings, gigabit Ethernet fiber
warnings, overcurrent
warnings, service
warnings, translations
invalid certificate, troubleshooting
IP addresses
verifying
VLANs, configuring
L
LEDs
2350
link, 10/100 Ethernet
link, AP
link, gigabit Ethernet
management CPU
links
LEDs
locally-connected AP, activating 105
logging in
M manuals, product
members, Mobility Domain
Microsoft Challenge Handshake Authentication
Protocol version 2 (MS-CHAP-V2) 122
Mobility Domain, configuring 114
MS-CHAP-V2 (Microsoft Challenge Handshake
Authentication Protocol version 2) 122
171
N
network plan, WMS
nonseed members, Mobility Domain
Nortel WLAN 2300 System
NTP (Network Time Protocol), configuring 83
O offload, EAP
P pass-through user authentication
password, enable
PEAP-MS-CHAP-V2 (Protected EAP with
Microsoft Challenge Handshake
Authentication Protocol version 2)
ping
ports
configuring, wired authentication user 101
configuring, wireless user
installation, 2370 or 2380
product documentation
Protected EAP with Microsoft Challenge
Handshake Authentication Protocol
Q
QuickStart
R
radio configuration, displaying 114
applying
radios denial of configuration information,
enabling
RADIUS attributes, for user VLANs
RADIUS servers, configuring
rear panel
restart switch
routes, configuring
S safety notices, explanations of
saving a configuration
serial console connection
settings
serial console cable
server groups, configuring 118
service profiles 108 service set identifier. See SSIDs
specifications
SSIDs (service set identifiers) assigning
StarterKit
static routes, configuring
status LEDs. See LEDs status lights. See LEDs
switch. See WSS (WLAN Security Switch)
syntax conventions
system configuration
saving 124 system defaults, displaying 124
system image file, incomplete load, troubleshooting
system IP address, configuring 100
WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide
172
T tabletop installation
terminal emulator settings
time, configuring
tools required for installation
translated warnings
transmit power, configuring
troubleshooting blinking amber Mgmt LED
denial of AP configuration
installation and setup
invalid certificate
missing configuration
Tunnel-Private-Group-ID attribute
U user authentication
users, no network access, troubleshooting
V vendor-specific attributes, VLAN-Name
VLANs (virtual LANs) assigning users
authorization failure, troubleshooting 160
disconnected, troubleshooting 160
VSAs (vendor-specific attributes), VLAN-Name
W warnings earth grounding
gigabit Ethernet fiber
overcurrent
320656-A
Web View browser configuration
securing communication
WLAN Management Software System country of operation and
securing communication
WMS network plan
WSS (WLAN Security Switch)
configuration, 2370, 2360, 2380 79
description of
model numbers
Stáhnout
Veřejný odkaz aktualizován
Veřejný odkaz na váš chat byl aktualizován. You may view and manage your chat links after registration here.
Veřejný odkaz na dokument
Reklama
