Motorola Solutions AP6532 Access Point System Reference Guide

Motorola Solutions
WiNG 5.5.3
ACCESS POINT
SYSTEM REFERENCE GUIDE
MOTOROLA SOLUTIONS WING 5.5.3
ACCESS POINT
SYSTEM REFERENCE GUIDE
MN000874A01
Revision A
June 2014
ii
WiNG 5.5.3 Access Point System Reference Guide
No part of this publication may be reproduced or used in any form, or by any electrical or mechanical means, without
permission in writing from Motorola Solutions. This includes electronic or mechanical means, such as photocopying,
recording, or information storage and retrieval systems. The material in this manual is subject to change without notice.
The software is provided strictly on an “as is” basis. All software, including firmware, furnished to the user is on a licensed
basis. Motorola Solutions grants to the user a non-transferable and non-exclusive license to use each software or firmware
program delivered hereunder (licensed program). Except as noted below, such license may not be assigned, sublicensed,
or otherwise transferred by the user without prior written consent of Motorola Solutions. No right to copy a licensed program
in whole or in part is granted, except as permitted under copyright law. The user shall not modify, merge, or incorporate any
form or portion of a licensed program with other program material, create a derivative work from a licensed program, or use
a licensed program in a network without written permission from Motorola Solutions. The user agrees to maintain Motorola
Solution’s copyright notice on the licensed programs delivered hereunder, and to include the same on any authorized copies
it makes, in whole or in part. The user agrees not to decompile, disassemble, decode, or reverse engineer any licensed
program delivered to the user or any portion thereof.
Motorola Solutions reserves the right to make changes to any software or product to improve reliability, function, or design.
Motorola Solutions does not assume any product liability arising out of, or in connection with, the application or use of any
product, circuit, or application described herein.
No license is granted, either expressly or by implication, estoppel, or otherwise under any Motorola Solutions, Inc.,
intellectual property rights. An implied license only exists for equipment, circuits, and subsystems contained in Motorola
Solutions products
TABLE OF CONTENTS
About this Guide
Chapter 1, Overview
1.1 About the Motorola Solutions WiNG 5 Software ........................................................................................................1-3
Chapter 2, Web User Interface Features
2.1 Accessing the Web UI ..................................................................................................................................................2-2
2.1.1 Browser and System Requirements ...................................................................................................................2-2
2.1.2 Connecting to the Web UI ..................................................................................................................................2-2
2.2 Icon Glossary ................................................................................................................................................................2-4
2.2.1 Global Icons ........................................................................................................................................................2-4
2.2.2 Dialog Box Icons .................................................................................................................................................2-5
2.2.3 Table Icons ..........................................................................................................................................................2-5
2.2.4 Status Icons ........................................................................................................................................................2-6
2.2.5 Configurable Objects ..........................................................................................................................................2-6
2.2.6 Configuration Objects .........................................................................................................................................2-9
2.2.7 Configuration Operation Icons ..........................................................................................................................2-10
2.2.8 Access Type Icons .............................................................................................................................................2-10
2.2.9 Administrative Role Icons .................................................................................................................................2-11
2.2.10 Device Icons ....................................................................................................................................................2-11
Chapter 3, Quick Start
3.1 Using the WiNG Initial Setup Wizard ..........................................................................................................................3-2
3.1.1 Typical Setup Wizard ..........................................................................................................................................3-5
3.1.1.1 Virtual Controller AP Mode .......................................................................................................................3-8
3.1.1.2 Standalone Mode ......................................................................................................................................3-9
3.1.1.3 Network Topology Selection ...................................................................................................................3-10
3.1.1.4 LAN Configuration ...................................................................................................................................3-11
3.1.1.5 WAN Configuration .................................................................................................................................3-13
ii
WiNG 5.5.3 Access Point System Reference Guide
3.1.1.6 Wireless LAN Setup ................................................................................................................................3-15
3.1.1.7 Summary And Commit Screen ................................................................................................................3-19
3.1.1.8 Adopt to a controller ...............................................................................................................................3-20
3.1.2 Advanced Setup Wizard ...................................................................................................................................3-21
3.1.2.1 Network Topology Selection ...................................................................................................................3-24
3.1.2.2 LAN Configuration ...................................................................................................................................3-25
3.1.2.3 WAN Configuration .................................................................................................................................3-27
3.1.2.4 Radio Configuration ................................................................................................................................3-29
3.1.2.5 Wireless LAN Setup ................................................................................................................................3-31
3.1.2.6 System Information .................................................................................................................................3-33
3.1.2.7 Summary And Commit Screen ................................................................................................................3-34
3.1.2.8 Adopt to a controller ...............................................................................................................................3-35
3.2 Using WiNG Express Quick Configuration .................................................................................................................3-36
Chapter 4, Dashboard
4.1 Dashboard .....................................................................................................................................................................4-2
4.1.1 Dashboard Conventions ......................................................................................................................................4-2
4.1.1.1 Health ........................................................................................................................................................4-3
4.1.1.2 Inventory ....................................................................................................................................................4-7
4.2 Network View .............................................................................................................................................................4-10
4.2.1 Network View Display Options ........................................................................................................................4-11
4.2.2 Device Specific Information ..............................................................................................................................4-12
Chapter 5, Device Configuration
5.1 RF Domain Configuration ..............................................................................................................................................5-2
5.1.1 RF Domain Sensor Configuration ........................................................................................................................5-4
5.1.2 RF Client Name Configuration ............................................................................................................................5-5
5.1.3 RF Domain Alias Configuration ...........................................................................................................................5-5
5.1.3.1 Network Basic Alias ..................................................................................................................................5-7
5.1.3.2 Network Group Alias ...............................................................................................................................5-10
5.1.3.3 Network Service Alias ............................................................................................................................5-12
5.2 System Profile Configuration ......................................................................................................................................5-14
5.2.1 General Profile Configuration ...........................................................................................................................5-15
5.2.2 Profile Radio Power ..........................................................................................................................................5-16
5.2.3 Profile Adoption (Auto Provisioning) Configuration ..........................................................................................5-18
5.2.4 Profile Wired 802.1X Configuration ..................................................................................................................5-20
5.2.5 Profile Interface Configuration .........................................................................................................................5-21
5.2.5.1 Ethernet Port Configuration ....................................................................................................................5-22
5.2.5.2 Virtual Interface Configuration ...............................................................................................................5-31
5.2.5.3 Port Channel Configuration .....................................................................................................................5-34
5.2.5.4 Access Point Radio Configuration ...........................................................................................................5-41
5.2.5.5 WAN Backhaul Configuration .................................................................................................................5-53
5.2.5.6 PPPoE Configuration ................................................................................................................................5-56
5.2.6 Profile Network Configuration ..........................................................................................................................5-59
5.2.6.1 DNS Configuration ..................................................................................................................................5-60
Table of Contents
iii
5.2.6.2 ARP ..........................................................................................................................................................5-61
5.2.6.3 L2TPv3 Profile Configuration ...................................................................................................................5-62
5.2.6.4 IGMP Snooping .......................................................................................................................................5-71
5.2.6.5 Quality of Service (QoS) ..........................................................................................................................5-73
5.2.6.6 Spanning Tree Configuration ..................................................................................................................5-74
5.2.6.7 Routing ....................................................................................................................................................5-77
5.2.6.8 Dynamic Routing (OSPF) ..........................................................................................................................5-79
5.2.6.9 Forwarding Database ..............................................................................................................................5-86
5.2.6.10 Bridge VLAN ..........................................................................................................................................5-87
5.2.6.11 Cisco Discovery Protocol Configuration ................................................................................................5-92
5.2.6.12 Link Layer Discovery Protocol Configuration ........................................................................................5-93
5.2.6.13 Miscellaneous Network Configuration .................................................................................................5-94
5.2.6.14 Alias ......................................................................................................................................................5-95
5.2.6.15 Profile Network Configuration and Deployment Considerations .......................................................5-103
5.2.7 Profile Security Configuration .........................................................................................................................5-104
5.2.7.1 Defining Profile VPN Settings ...............................................................................................................5-104
5.2.7.2 Auto IPSec Tunnel .................................................................................................................................5-120
5.2.7.3 Defining Profile Security Settings .........................................................................................................5-121
5.2.7.4 Setting the Certificate Revocation List (CRL) Configuration .................................................................5-122
5.2.7.5 Setting the Profile’s NAT Configuration ...............................................................................................5-123
5.2.7.6 Setting the Profile’s Bridge NAT Configuration ....................................................................................5-132
5.2.7.7 Profile Security Configuration and Deployment Considerations ..........................................................5-134
5.2.8 Virtual Router Redundancy Protocol (VRRP) Configuration ............................................................................5-135
5.2.9 Profile Critical Resources ................................................................................................................................5-139
5.2.10 Profile Services Configuration ......................................................................................................................5-142
5.2.10.1 Profile Services Configuration and Deployment Considerations ........................................................5-143
5.2.11 Profile Management Configuration ..............................................................................................................5-144
5.2.11.1 Upgrading AP6532 Firmware from 5.1 ................................................................................................5-149
5.2.11.2 Profile Management Configuration and Deployment Considerations ................................................5-149
5.2.12 Mesh Point Configuration .............................................................................................................................5-150
5.2.12.1 Vehicle Mounted Modem (VMM) Deployment Consideration ...........................................................5-158
5.2.13 Advanced Profile Configuration ....................................................................................................................5-159
5.2.13.1 Advanced Profile Client Load Balancing .............................................................................................5-160
5.2.13.2 Configuring MINT Protocol .................................................................................................................5-164
5.2.13.3 Advanced Profile Miscellaneous Configuration .................................................................................5-169
5.2.14 Environmental Sensor Configuration ............................................................................................................5-170
5.3 Managing Virtual Controllers ...................................................................................................................................5-173
5.4 Overriding a Device Configuration ...........................................................................................................................5-175
5.4.1 Basic Configuration .........................................................................................................................................5-175
5.4.2 Certificate Management .................................................................................................................................5-177
5.4.2.1 Manage Certificates .............................................................................................................................5-179
5.4.3 RF Domain Overrides ......................................................................................................................................5-192
5.4.4 Wired 802.1X Overrides ..................................................................................................................................5-194
5.4.5 Device Overrides .............................................................................................................................................5-195
5.4.5.1 Radio Power Overrides ..........................................................................................................................5-197
5.4.5.2 Adoption Overrides ...............................................................................................................................5-199
5.4.5.3 Profile Interface Override Configuration ...............................................................................................5-202
iv
WiNG 5.5.3 Access Point System Reference Guide
5.4.5.4 Overriding the Network Configuration ..................................................................................................5-236
5.4.5.5 Overriding a Security Configuration ......................................................................................................5-281
5.4.5.6 Overriding the Virtual Router Redundancy Protocol (VRRP) Configuration ..........................................5-304
5.4.5.7 Profile Critical Resources ......................................................................................................................5-309
5.4.5.8 Overriding a Services Configuration .....................................................................................................5-312
5.4.5.9 Overriding a Management Configuration .............................................................................................5-313
5.4.5.10 Overriding Mesh Point Configuration .................................................................................................5-317
5.4.5.11 Overriding an Advanced Configuration ...............................................................................................5-326
5.4.5.12 Overriding Environmental Sensor Configuration ................................................................................5-336
5.5 Managing an Event Policy ........................................................................................................................................5-338
Chapter 6, Wireless Configuration
6.1 Wireless LANs ..............................................................................................................................................................6-3
6.1.1 Basic WLAN Configuration................................................................................................................................. 6-5
6.1.1.1 WLAN Basic Configuration Deployment Considerations .........................................................................6-7
6.1.2 Configuring WLAN Security ................................................................................................................................6-7
6.1.2.1 802.1x EAP, EAP-PSK and EAP MAC ........................................................................................................6-8
6.1.2.2 MAC Authentication ...............................................................................................................................6-10
6.1.2.3 PSK / None ..............................................................................................................................................6-11
6.1.2.4 Captive Portal ..........................................................................................................................................6-11
6.1.2.5 Passpoint Policy ......................................................................................................................................6-12
6.1.2.6 MAC Registration ....................................................................................................................................6-12
6.1.2.7 External Controller ..................................................................................................................................6-13
6.1.2.8 WPA/WPA2-TKIP ....................................................................................................................................6-13
6.1.2.9 WPA2-CCMP ...........................................................................................................................................6-16
6.1.2.10 WEP 64 ..................................................................................................................................................6-19
6.1.2.11 WEP 128 and KeyGuard ........................................................................................................................ 6-21
6.1.3 Configuring WLAN Firewall Support ................................................................................................................6-23
6.1.4 Configuring Client Settings ...............................................................................................................................6-31
6.1.5 Configuring WLAN Accounting Settings ..........................................................................................................6-33
6.1.6 Configuring Service Monitoring Settings .........................................................................................................6-35
6.1.7 Configuring Client Load Balancing ...................................................................................................................6-37
6.1.8 Configuring Advanced WLAN Settings ............................................................................................................6-38
6.1.9 Configuring Auto Shutdown Settings ...............................................................................................................6-44
6.2 WLAN QoS Policy .......................................................................................................................................................6-46
6.2.1 Configuring QoS WMM Settings ......................................................................................................................6-48
6.2.2 Configuring a WLAN’s QoS Rate Limit Settings ..............................................................................................6-52
6.2.3 Configuring Multimedia Optimizations ............................................................................................................6-57
6.2.3.1 WLAN QoS Deployment Considerations ................................................................................................6-59
6.3 Radio QoS Policy .........................................................................................................................................................6-60
6.3.1 Configuring a Radio’s QoS Policy .....................................................................................................................6-61
6.4 Association ACL ..........................................................................................................................................................6-71
6.4.1 Association ACL Deployment Considerations ..................................................................................................6-73
6.5 SMART RF ...................................................................................................................................................................6-74
6.5.1 Smart RF Configuration and Deployment Considerations ................................................................................6-84
6.6 MeshConnex Policy ....................................................................................................................................................6-85
Table of Contents
v
6.7 Mesh QoS Policy .........................................................................................................................................................6-91
6.8 Passpoint Policy ..........................................................................................................................................................6-98
Chapter 7, Network Configuration
7.1
7.2
7.3
7.4
7.5
Policy Based Routing (PBR) ...........................................................................................................................................7-2
L2TP V3 Configuration ..................................................................................................................................................7-8
AAA Policy ..................................................................................................................................................................7-12
AAA TACACS Policy ...................................................................................................................................................7-22
Alias ............................................................................................................................................................................7-34
7.5.1 Network Basic Alias .........................................................................................................................................7-34
7.5.2 Network Group Alias ........................................................................................................................................7-37
7.5.3 Network Service Alias ......................................................................................................................................7-40
7.6 Network Deployment Considerations ........................................................................................................................7-42
Chapter 8, Security Configuration
8.1 Wireless Firewall ..........................................................................................................................................................8-2
8.1.1 Defining a Firewall Configuration .......................................................................................................................8-2
8.2 Configuring IP Firewall Rules .....................................................................................................................................8-13
8.3 Device Fingerprinting ..................................................................................................................................................8-18
8.4 Configuring MAC Firewall Rules ................................................................................................................................8-25
8.5 Wireless IPS (WIPS) ...................................................................................................................................................8-28
8.6 Device Categorization .................................................................................................................................................8-37
8.7 Security Deployment Considerations .........................................................................................................................8-39
Chapter 9, Security Configuration
9.1 Configuring Captive Portal Policies ..............................................................................................................................9-2
9.1.1 Configuring a Captive Portal Policy ....................................................................................................................9-2
9.2 Setting the DNS Whitelist Configuration ...................................................................................................................9-14
9.3 Setting the DHCP Server Configuration .....................................................................................................................9-15
9.3.1 Defining DHCP Pools .........................................................................................................................................9-15
9.3.2 Defining DHCP Server Global Settings .............................................................................................................9-23
9.3.3 DHCP Class Policy Configuration ......................................................................................................................9-25
9.4 Setting the Bonjour Gateway Configuration ..............................................................................................................9-28
9.4.1 Configuring the Bonjour Discovery Policy .........................................................................................................9-28
9.4.2 Configuring the Bonjour Forwarding Policy ......................................................................................................9-30
9.5 Setting the RADIUS Configuration .............................................................................................................................9-33
9.5.1 Creating RADIUS Groups ..................................................................................................................................9-33
9.5.1.1 Creating RADIUS Groups ........................................................................................................................9-36
9.5.2 Defining User Pools ..........................................................................................................................................9-38
9.5.3 Configuring the RADIUS Server ........................................................................................................................9-41
9.6 Services Deployment Considerations .........................................................................................................................9-51
Chapter 10, Security Configuration
10.1 Creating Administrators and Roles .........................................................................................................................10-2
vi
WiNG 5.5.3 Access Point System Reference Guide
10.2
10.3
10.4
10.5
10.6
Setting the Access Control Configuration ................................................................................................................10-5
Setting the Authentication Configuration ................................................................................................................10-8
Setting the SNMP Configuration ............................................................................................................................10-10
SNMP Trap Configuration ......................................................................................................................................10-12
Management Access Deployment Considerations ................................................................................................10-13
Chapter 11, Diagnostics
11.1 Fault Management ...................................................................................................................................................11-2
11.2 Crash Files ................................................................................................................................................................11-6
11.3 Advanced ..................................................................................................................................................................11-7
11.3.1 UI Debugging ..................................................................................................................................................11-7
11.3.1.1 Schema Browser ...................................................................................................................................11-8
11.3.2 View UI Logs ...................................................................................................................................................11-9
11.3.3 View Sessions ...............................................................................................................................................11-10
Chapter 12, Security Configuration
12.1 Devices .....................................................................................................................................................................12-2
12.1.1 Managing Firmware and Configuration Files .................................................................................................12-2
12.1.1.1 Managing Running Configuration .........................................................................................................12-3
12.1.1.2 Managing Startup Configuration ..........................................................................................................12-6
12.1.1.3 Managing Crash Dump Files .................................................................................................................12-9
12.1.2 Rebooting the Device ....................................................................................................................................12-10
12.1.3 Locating a Device ..........................................................................................................................................12-11
12.1.4 Upgrading Device Firmware .........................................................................................................................12-12
12.1.5 Viewing Device Summary Information .........................................................................................................12-14
12.1.6 Adopted Device Upgrades ............................................................................................................................12-16
12.1.7 File Management ..........................................................................................................................................12-23
12.1.8 Adopted Device Restart ................................................................................................................................12-29
12.1.9 Captive Portal Pages .....................................................................................................................................12-30
12.1.10 Re-elect Controller ......................................................................................................................................12-35
12.2 Certificates .............................................................................................................................................................12-37
12.2.1 Certificate Management ...............................................................................................................................12-37
12.2.2 RSA Key Management ..................................................................................................................................12-42
12.2.3 Certificate Creation .......................................................................................................................................12-47
12.2.4 Generating a Certificate Signing Request (CSR) ..........................................................................................12-49
12.3 Smart RF .................................................................................................................................................................12-52
12.3.1 Managing Smart RF for a RF Domain ...........................................................................................................12-52
12.4 Operations Deployment Considerations .................................................................................................................12-55
Chapter 13, Statistics
13.1 System Statistics .....................................................................................................................................................13-2
13.1.1 Health ..............................................................................................................................................................13-2
13.1.2 Inventory .........................................................................................................................................................13-4
13.1.3 Adopted Devices .............................................................................................................................................13-5
Table of Contents
vii
13.1.4 Pending Adoptions ..........................................................................................................................................13-7
13.1.5 Offline Devices ................................................................................................................................................13-8
13.1.6 Device Upgrade ...............................................................................................................................................13-9
13.1.7 Licenses ........................................................................................................................................................13-10
13.2 RF Domain Statistics ..............................................................................................................................................13-14
13.2.1 Health ............................................................................................................................................................13-14
13.2.2 Inventory .......................................................................................................................................................13-17
13.2.3 Devices ..........................................................................................................................................................13-19
13.2.4 AP Detection .................................................................................................................................................13-20
13.2.5 Wireless Clients ............................................................................................................................................13-21
13.2.6 Device Upgrade .............................................................................................................................................13-22
13.2.7 Wireless LANs ..............................................................................................................................................13-24
13.2.8 Radios ...........................................................................................................................................................13-25
13.2.8.1 Status ..................................................................................................................................................13-25
13.2.8.2 RF Statistics ........................................................................................................................................13-27
13.2.8.3 Traffic Statistics ..................................................................................................................................13-28
13.2.9 Mesh .............................................................................................................................................................13-29
13.2.10 Mesh Point ..................................................................................................................................................13-30
13.2.11 SMART RF ...................................................................................................................................................13-45
13.2.12 WIPS ...........................................................................................................................................................13-50
13.2.12.1 WIPS Client Blacklist ........................................................................................................................13-50
13.2.12.2 WIPS Events ......................................................................................................................................13-51
13.2.13 Captive Portal ..............................................................................................................................................13-52
13.3 Access Point Statistics ...........................................................................................................................................13-54
13.3.1 Health ............................................................................................................................................................13-55
13.3.2 Device ...........................................................................................................................................................13-57
13.3.3 Device Upgrade .............................................................................................................................................13-59
13.3.4 Adoption ........................................................................................................................................................13-60
13.3.4.1 Adopted APs ........................................................................................................................................13-61
13.3.4.2 AP Adoption History ............................................................................................................................13-62
13.3.4.3 AP Self Adoption History ....................................................................................................................13-63
13.3.4.4 Pending Adoptions ..............................................................................................................................13-63
13.3.5 AP Detection .................................................................................................................................................13-64
13.3.6 Wireless Clients ............................................................................................................................................13-66
13.3.7 Wireless LANs ..............................................................................................................................................13-67
13.3.8 Policy Based Routing ....................................................................................................................................13-69
13.3.9 Radios ...........................................................................................................................................................13-70
13.3.9.1 Status ..................................................................................................................................................13-71
13.3.9.2 RF Statistics ........................................................................................................................................13-72
13.3.9.3 Traffic Statistics ..................................................................................................................................13-73
13.3.10 Mesh ...........................................................................................................................................................13-74
13.3.11 Interfaces ....................................................................................................................................................13-75
13.3.11.1 General Interface Details ..................................................................................................................13-76
13.3.11.2 Network Graph ..................................................................................................................................13-78
13.3.12 RTLS ............................................................................................................................................................13-79
13.3.13 PPPoE ..........................................................................................................................................................13-81
13.3.14 OSPF ............................................................................................................................................................13-82
viii
WiNG 5.5.3 Access Point System Reference Guide
13.3.14.1 OSPF Summary ..................................................................................................................................13-83
13.3.14.2 OSPF Neighbors ................................................................................................................................13-85
13.3.14.3 OSPF Area Details .............................................................................................................................13-86
13.3.14.4 OSPF Route Statistics .......................................................................................................................13-88
13.3.14.5 OSPF Interface ...................................................................................................................................13-91
13.3.14.6 OSPF State ........................................................................................................................................13-92
13.3.15 L2TPv3 Tunnels ...........................................................................................................................................13-93
13.3.16 VRRP ............................................................................................................................................................13-95
13.3.17 Critical Resources .......................................................................................................................................13-96
13.3.18 LDAP Agent Status .....................................................................................................................................13-97
13.3.19 GRE Tunnels ................................................................................................................................................13-98
13.3.20 Dot1x ...........................................................................................................................................................13-99
13.3.21 Network ....................................................................................................................................................13-101
13.3.21.1 ARP Entries ......................................................................................................................................13-101
13.3.21.2 Route Entries ...................................................................................................................................13-102
13.3.21.3 Bridge ..............................................................................................................................................13-103
13.3.21.4 IGMP ................................................................................................................................................13-104
13.3.21.5 DHCP Options .................................................................................................................................13-106
13.3.21.6 Cisco Discovery Protocol ................................................................................................................13-108
13.3.21.7 Link Layer Discovery Protocol ........................................................................................................13-109
13.3.22 DHCP Server ..............................................................................................................................................13-110
13.3.22.1 DHCP Bindings ................................................................................................................................13-112
13.3.22.2 DHCP Networks ...............................................................................................................................13-113
13.3.23 Firewall .....................................................................................................................................................13-114
13.3.23.1 Packet Flows ...................................................................................................................................13-115
13.3.23.2 Denial of Service .............................................................................................................................13-116
13.3.23.3 IP Firewall Rules .............................................................................................................................13-117
13.3.23.4 MAC Firewall Rules .......................................................................................................................13-118
13.3.23.5 NAT Translations ............................................................................................................................13-119
13.3.23.6 DHCP Snooping ...............................................................................................................................13-120
13.3.24 VPN ...........................................................................................................................................................13-122
13.3.24.1 IKESA ...............................................................................................................................................13-122
13.3.24.2 IPSec ................................................................................................................................................13-123
13.3.25 Certificates ................................................................................................................................................13-124
13.3.25.1 Trustpoints ......................................................................................................................................13-124
13.3.25.2 RSA Keys ........................................................................................................................................13-126
13.3.26 WIPS .........................................................................................................................................................13-127
13.3.26.1 WIPS Client Blacklist ......................................................................................................................13-127
13.3.26.2 WIPS Events ....................................................................................................................................13-128
13.3.27 Sensor Servers ..........................................................................................................................................13-129
13.3.28 Bonjour Services .......................................................................................................................................13-130
13.3.29 Captive Portal ............................................................................................................................................13-131
13.3.30 Network Time ...........................................................................................................................................13-133
13.3.30.1 NTP Status ......................................................................................................................................13-133
13.3.30.2 NTP Association ..............................................................................................................................13-134
13.3.31 Load Balancing ..........................................................................................................................................13-135
13.3.32 Environmental Sensors (AP8132 Models Only) ........................................................................................13-137
Table of Contents
ix
13.4 Wireless Client Statistics .....................................................................................................................................13-141
13.4.1 Health ..........................................................................................................................................................13-141
13.4.2 Details .........................................................................................................................................................13-144
13.4.3 Traffic ..........................................................................................................................................................13-148
13.4.4 WMM TSPEC ..............................................................................................................................................13-150
13.4.5 Association History .....................................................................................................................................13-151
13.4.6 Graph ...........................................................................................................................................................13-152
Appendix A, Using WiNG Express
A.1 Dashboard ................................................................................................................................................................... A-2
A.2 Monitor ........................................................................................................................................................................ A-4
A.2.1 Radios ................................................................................................................................................................ A-5
A.2.2 WLANs .............................................................................................................................................................. A-8
A.2.3 Clients .............................................................................................................................................................. A-11
A.3 Configuration ............................................................................................................................................................. A-14
A.3.1 Basic ................................................................................................................................................................ A-15
A.3.2 LAN .................................................................................................................................................................. A-17
A.3.3 WAN ................................................................................................................................................................ A-19
A.3.4 Wireless .......................................................................................................................................................... A-21
A.3.5 Security ............................................................................................................................................................ A-24
A.3.5.1 Firewall .................................................................................................................................................. A-24
A.3.5.2 WIPS ...................................................................................................................................................... A-26
A.3.6 Services ........................................................................................................................................................... A-29
A.3.7 Management ................................................................................................................................................... A-30
A.4 Access Points ............................................................................................................................................................ A-33
A.5 Event History ............................................................................................................................................................. A-37
Appendix B, Customer Support
Appendix C, Publicly Available Software
C.1 General Information .................................................................................................................................................... C-1
C.2 Open Source Software Used ....................................................................................................................................... C-2
C.3 OSS Licenses ............................................................................................................................................................ C-11
C.3.1 Apache License, Version 2.0 ........................................................................................................................... C-11
C.3.2 The BSD License .............................................................................................................................................. C-13
C.3.3 Creative Commons Attribution-ShareAlike License, version 3.0 .................................................................... C-13
C.3.4 DropBear License ............................................................................................................................................. C-18
C.3.5 GNU General Public License, version 2 ........................................................................................................... C-19
C.3.6 GNU Lesser General Public License 2.1 .......................................................................................................... C-23
C.3.7 GNU General Public License, version 3 ........................................................................................................... C-28
C.3.8 ISC License ...................................................................................................................................................... C-36
C.3.9 GNU Lesser General Public License, version 3.0 ............................................................................................ C-36
C.3.10 GNU General Public License 2.0 .................................................................................................................... C-38
C.3.11 GNU Lesser General Public License, version 2.0 .......................................................................................... C-43
x
WiNG 5.5.3 Access Point System Reference Guide
C.3.12
C.3.13
C.3.14
C.3.15
C.3.16
C.3.17
C.3.18
GNU Lesser General Public License, version 2.1 .......................................................................................... C-48
MIT License ................................................................................................................................................... C-53
Mozilla Public License, version 2 .................................................................................................................. C-54
The Open LDAP Public License ...................................................................................................................... C-58
OpenSSL License ........................................................................................................................................... C-58
WU-FTPD Software License .......................................................................................................................... C-59
zlib License .................................................................................................................................................... C-60
ABOUT THIS GUIDE
This manual supports the following access points:
• Access Points – AP300, AP621, AP622, AP650, AP6511, AP6511E, AP6521, AP6521E, AP6522, AP6522E, AP6522M,
AP6532, AP6562, AP7131, AP7161, AP7181, AP7522, AP7522E, AP7532, AP7522E, AP8122, AP8132, AP8222, AP8232 and
ES6510.
NOTE: In this guide, AP7131, AP7161, and AP7181 are collectively represented as AP71XX. Similarly,
AP8122 and AP8132 are collectively represented as AP81XX. Also, the APs AP8222 and AP8232 are
collectively represented as AP82XX. AP7522 and AP7532 are collectively represented as AP75XX.
AP6511, AP6521, AP6522, AP6532, AP6562 are collectively represented as AP65XX.
NOTE: ES6510 is an Ethernet Switch managed by a wireless controller such as RFS4000/RFS6000/
RFS7000/NX4500/NX4524/NX6500/NX6524/NX7500/NX9000/NX9500/NX9510. ES6510 does not have
radios and does not provide WLAN support.
NOTE: Access points with ‘E” appended to their names exclusively support WiNG Express.
This section is organized into the following:
• Document Convention
• Notational Conventions
• Motorola Solutions Enterprise Mobility Support Center
• Motorola Solutions End-User Software License Agreement
2
WiNG 5.5.3 Access Point System Reference Guide
Document Convention
The following conventions are used in this document to draw your attention to important information:
NOTE: Indicates tips or special requirements.
!
CAUTION: Indicates conditions that can cause equipment damage or data loss.
WARNING! Indicates a condition or procedure that could result in personal
injury or equipment damage.
Switch Note: Indicates caveats unique to a RFS4000, RFS6000, RFS7000, NX4500,
NX4524, NX6500, NX6524, NX7500, NX9000, NX9500 or NX9510 model controller or
service platform.
Notational Conventions
The following notational conventions are used in this document:
• Italics are used to highlight specific items in the general text, and to identify chapters and sections in this and related
documents
• Bullets (•) indicate:
• lists of alternatives
• lists of required steps that are not necessarily sequential
• action items
• Sequential lists (those describing step-by-step procedures) appear as numbered lists
About this Guide
3
Motorola Solutions Enterprise Mobility Support Center
If you have a problem with your equipment, contact Motorola Solutions Enterprise Mobility Support for your region.
Contact information is available by visiting the URL:
http://www.motorolasolutions.com/Business/XP-EN/Pages/Contact_Us
Customer Support Web Site
Motorola Solutions' Support Central Web site, accessed via the Symbol-branded products link under Support for Business,
provides information and online assistance including developer tools, software downloads, product manuals and online repair
requests. Product support can be found at:
https://portal.motorolasolutions.com/Support/US-EN
When contacting Enterprise Mobility support, please provide the following information:
• Serial number of the unit
• Model number or product name
• Software type and version number
Motorola Solutions responds to calls by e-mail, telephone or fax within the time limits set forth in support agreements. If you
purchased your Enterprise Mobility business product from a Motorola Solutions business partner, contact that business partner
for support.
Product Manuals
https://portal.motorolasolutions.com/Support/US-EN/Wireless+Networks
Product Sales and Product Information
Motorola Solutions, Inc.
One Motorola Plaza
Holtsville, New York 11742-1300
Tel: 1-631-738-2400 or 1-800-722-6234
Fax: 1-631-738-5990
General Information
For general information, contact Motorola Solutions at:
Telephone (North America): 1-800-722-6234
Telephone (International): +1-631-738-5200
Website: http://www.motorolasolutions.com
4
WiNG 5.5.3 Access Point System Reference Guide
Motorola Solutions
End-User Software License Agreement
THIS MOTOROLA SOLUTIONS END-USER SOFTWARE LICENSE AGREEMENT (“END-USER LICENSE AGREEMENT”) IS
BETWEEN MOTOROLA SOLUTIONS INC. (HEREIN “MOTOROLA SOLUTIONS”) AND END-USER CUSTOMER TO WHOM
MOTOROLA SOLUTIONS’ PROPRIETARY SOFTWARE OR MOTOROLA SOLUTIONS PRODUCTS CONTAINING EMBEDDED, PRELOADED, OR INSTALLED SOFTWARE (“PRODUCTS”) IS MADE AVAILABLE. THIS END-USER LICENSE AGREEMENT CONTAINS
THE TERMS AND CONDITIONS OF THE LICENSE MOTOROLA SOLUTIONS IS PROVIDING TO END-USER CUSTOMER, AND ENDUSER CUSTOMER’S USE OF THE SOFTWARE AND DOCUMENTATION. BY USING, DOWNLOADING OR INSTALLING THIS
SOFTWARE, YOU OR THE ENTITY THAT YOU REPRESENT (“END-USER CUSTOMER”) ARE CONSENTING TO BE BOUND BY AND
ARE BECOMING A PARTY TO THIS END-USER LICENSE AGREEMENT.
1. DEFINITIONS
“Documentation” means product and software documentation that specifies technical and performance features and
capabilities, and the user, operation and training manuals for the Software (including all physical or electronic media upon
which such information is provided).
“Open Source Software” means software with either freely obtainable source code license for modification, or permission
for free distribution.
“Open Source Software License” means the terms or conditions under which the Open Source Software is licensed.
“Software” (i) means proprietary software in object code format, and adaptations, translations, decompilations,
disassemblies, emulations, or derivative works of such software; (ii) means any modifications, enhancements, new versions
and new releases of the software provided by Motorola Solutions; and (iii) may contain items of software owned by a third
party supplier. The term “Software” does not include any third party software provided under separate license or third party
software not licensable under the terms of this Agreement. To the extent, if any, that there is a separate license agreement
packaged with, or provided electronically with, a particular Product that becomes effective on an act of acceptance by the
end user, then that agreement supersedes this End-User License Agreement as to the end use of that particular Product.
2. GRANT OF LICENSE
2.1 Subject to the provisions of this End-User License Agreement, Motorola Solutions grants to End-User Customer a
personal, limited, non-transferable (except as provided in Section 4), and non-exclusive license under Motorola
Solutions’ copyrights and confidential information embodied in the Software to use the Software, in object code form,
and the Documentation solely in connection with End-User Customer’s use of the Products. This End-User License
Agreement does not grant any rights to source code.
2.2 If the Software licensed under this End-User License Agreement contains or is derived from Open Source Software, the
terms and conditions governing the use of such Open Source Software are in the Open Source Software Licenses of the
copyright owner and not this End-User License Agreement. If there is a conflict between the terms and conditions of
this End-User License Agreement and the terms and conditions of the Open Source Software Licenses governing EndUser Customer’s use of the Open Source Software, the terms and conditions of the license grant of the applicable Open
Source Software Licenses will take precedence over the license grants in this End-User License Agreement. If requested
by End-User Customer, Motorola Solutions will use commercially reasonable efforts to: (i) determine whether any Open
source Software is provided under this End-User License Agreement; (ii) identify the Open Source Software and provide
End-User Customer a copy of the applicable Open Source Software License (or specify where that license may be found);
and, (iii) provide End-User Customer a copy of the Open Source Software source code, without charge, if it is publicly
available (although distribution fees may be applicable).
3. LIMITATIONS ON USE
3.1 End-User Customer may use the Software only for End-User Customer’s internal business purposes and only in
accordance with the Documentation. Any other use of the Software is strictly prohibited and will be deemed a breach
of this End-User License Agreement. Without limiting the general nature of these restrictions, End-User Customer will
About this Guide
5
not make the Software available for use by third parties on a “time sharing,” “application service provider,” or “service
bureau” basis or for any other similar commercial rental or sharing arrangement.
3.2 End-User Customer will not, and will not allow or enable any third party to: (i) reverse engineer, disassemble, peel
components, decompile, reprogram or otherwise reduce the Software or any portion to a human perceptible form or
otherwise attempt to recreate the source code; (ii) modify, adapt, create derivative works of, or merge the Software with
other software; (iii) copy, reproduce, distribute, lend, or lease the Software or Documentation to any third party, grant
any sublicense or other rights in the Software or Documentation to any third party, or take any action that would cause
the Software or Documentation to be placed in the public domain; (iv) remove, or in any way alter or obscure, any
copyright notice or other notice of Motorola Solutions’ proprietary rights; (v) provide, copy, transmit, disclose, divulge
or make the Software or Documentation available to, or permit the use of the Software by any third party or on any
machine except as expressly authorized by this Agreement; or (vi) use, or permit the use of, the Software in a manner
that would result in the production of a copy of the Software solely by activating a machine containing the Software.
End-User Customer may make one copy of Software to be used solely for archival, back-up, or disaster recovery
purposes; provided that End-User Customer may not operate that copy of the Software at the same time as the original
Software is being operated. End-User Customer may make as many copies of the Documentation as it may reasonably
require for the internal use of the Software.
3.3 Unless otherwise authorized by Motorola Solutions in writing, End-User Customer will not, and will not enable or allow
any third party to: (i) install a licensed copy of the Software on more than one unit of a Product; or (ii) copy onto or
transfer Software installed in one unit of a Product onto another device.
3.4 If End-User Customer is purchasing Products that require a site license, End-User Customer must purchase a copy of the
applicable Software for each site at which End-User Customer uses such Software. End-User Customer may make one
additional copy for each computer owned or controlled by End-User Customer at each such site. End-User Customer may
temporarily use the Software on portable or laptop computers at other sites. End-User Customer must provide a written
list of all sites where End-User Customer uses or intends to use the Software.
4. TRANSFERS
4.1 End-User Customer will not transfer the Software or Documentation to any third party without Motorola Solutions’ prior
written consent. Motorola Solutions’ consent may be withheld at its discretion and may be conditioned upon transferee
paying all applicable license fees and agreeing to be bound by this End-User License Agreement.
5. OWNERSHIP AND TITLE
5.1 Motorola Solutions, its licensors, and its suppliers retain all of their proprietary rights in any form in and to the Software
and Documentation, including, but not limited to, all rights in patents, patent applications, inventions, copyrights,
trademarks, trade secrets, trade names, and other proprietary rights in or relating to the Software and Documentation.
No rights are granted to End-User Customer under this Agreement by implication, estoppel or otherwise, except for
those rights which are expressly granted to End-User Customer in this End-User License Agreement. All intellectual
property developed, originated, or prepared by Motorola Solutions in connection with providing the Software, Products,
Documentation or related services remains vested exclusively in Motorola Solutions, and End-User Customer will not
have any shared development or other intellectual property rights.
6. CONFIDENTIALITY
6.1 End-User Customer acknowledges that the Software contains valuable proprietary information and trade secrets and
that unauthorized dissemination, distribution, modification, reverse engineering, disassembly or other improper use of
the Software will result in irreparable harm to Motorola Solutions for which monetary damages would be inadequate.
Accordingly, End-User Customer will limit access to the Software to those of its employees and agents who need to use
the Software for End-User Customer’s internal business.
7. MAINTENANCE AND SUPPORT
7.1 No maintenance or support is provided under this End-User License Agreement. Maintenance or support, if available,
will be provided under a separate Motorola Solutions Software maintenance and support agreement.
6
WiNG 5.5.3 Access Point System Reference Guide
8. LIMITED WARRANTY AND LIMITATION OF LIABILITY
8.1 Unless otherwise specified in the applicable warranty statement, the Documentation or in any other media at the time
of shipment of the Software by Motorola Solutions, and for the warranty period specified therein, for the first 120 days
after initial shipment of the Software to the End-User Customer, Motorola Solutions warrants that the Software, when
installed and/or used properly, will be free from reproducible defects that materially vary from its published
specifications. Motorola Solutions does not warrant that End-User Customer’s use of the Software or the Products will
be uninterrupted or error-free or that the Software or the Products will meet End-User Customer’s particular
requirements.
8.2 MOTOROLA SOLUTIONS’ TOTAL LIABILITY, AND END-USER CUSTOMER’S SOLE REMEDY, FOR ANY BREACH OF THIS
WARRANTY WILL BE LIMITED TO, AT MOTOROLA SOLUTIONS’ OPTION, REPAIR OR REPLACEMENT OF THE SOFTWARE
OR PAYMENT OF END-USER CUSTOMER’S ACTUAL DAMAGES UP TO THE AMOUNT PAID TO MOTOROLA SOLUTIONS
FOR THE SOFTWARE OR THE INDIVIDUAL PRODUCT IN WHICH THE SOFTWARE IS EMBEDDED OR FOR WHICH IT WAS
PROVIDED. THIS WARRANTY EXTENDS ONLY TO THE FIRST END-USER CUSTOMER; SUBSEQUENT TRANSFEREES
MUST ACCEPT THE SOFTWARE “AS IS” AND WITH NO WARRANTIES OF ANY KIND. MOTOROLA SOLUTIONS
DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF
MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE.
8.3 IN NO EVENT WILL MOTOROLA SOLUTIONS BE LIABLE FOR SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
INCLUDING, BUT NOT LIMITED TO, LOSS OF USE, TIME OR DATA, INCONVENIENCE, COMMERCIAL LOSS, LOST
PROFITS, OR SAVINGS, TO THE FULL EXTENT SUCH MAY BE DISCLAIMED BY LAW, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. THE LIMITATIONS IN THIS PARAGRAPH WILL APPLY NOTWITHSTANDING ANY
FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.
9. TERM AND TERMINATION
9.1 Any use of the Software, including but not limited to use on the Products, will constitute End-User Customer’s
agreement to this End-User License Agreement. End-User Customer’s right to use the Software will continue for the life
of the Products with which or for which the Software and Documentation have been provided by Motorola Solutions,
unless End-User Customer breaches this End-User License Agreement, in which case this End-User License Agreement
and End-User Customer’s right to use the Software and Documentation may be terminated immediately by Motorola
Solutions. In addition, if Motorola Solutions reasonably believes that End-User Customer intends to breach this EndUser License Agreement Motorola Solutions may, by notice to End-User Customer, terminate End-User Customer’s right
to use the Software.
9.2 Upon termination, Motorola Solutions will be entitled to immediate injunctive relief without proving damages and,
unless End-User Customer is a sovereign government entity, Motorola Solutions will have the right to repossess all
copies of the Software in End-User Customer’s possession. Within thirty (30) days after termination of End-User
Customer’s right to use the Software, End-User Customer must certify in writing to Motorola Solutions that all copies
of such Software have been returned to Motorola Solutions or destroyed.
10. UNITED STATES GOVERNMENT LICENSING PROVISIONS
10.1This Section applies if End-User Customer is the United States Government or a United States Government agency.
End-User Customer’s use, duplication or disclosure of the Software and Documentation under Motorola Solutions’
copyrights or trade secret rights is subject to the restrictions set forth in subparagraphs (c)(1) and (2) of the Commercial
Computer Software-Restricted Rights clause at FAR 52.227-19 (JUNE 1987), if applicable, unless they are being
provided to the Department of Defense. If the Software and Documentation are being provided to the Department of
Defense, End-User Customer’s use, duplication, or disclosure of the Software and Documentation is subject to the
restricted rights set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at
DFARS 252.227-7013 (OCT 1988), if applicable. The Software and Documentation may or may not include a Restricted
Rights notice, or other notice referring to this End-User License Agreement. The provisions of this End-User License
Agreement will continue to apply, but only to the extent that they are consistent with the rights provided to the
End-User Customer under the provisions of the FAR and DFARS mentioned above, as applicable to the particular
procuring agency and procurement transaction.
About this Guide
7
11. GENERAL
11.1 Copyright Notices. The existence of a copyright notice on the Software will not be construed as an admission or
presumption that public disclosure of the Software or any trade secrets associated with the Software has occurred.
11.2 Compliance with Laws. End-User Customer acknowledges that the Software is subject to the laws and regulations of
the United States and End-User Customer will comply with all applicable laws and regulations, including export laws
and regulations of the United States. End-User Customer will not, without the prior authorization of Motorola Solutions
and the appropriate governmental authority of the United States, in any form export or re-export, sell or resell, ship or
reship, or divert, through direct or indirect means, any item or technical data or direct of indirect products sold or
otherwise furnished to any person within any territory for which the United States Government or any of its agencies
at the time of the action, requires an export license or other governmental approval. Violation of this provision is a
material breach of this Agreement.
11.3 Third Party Beneficiaries. This End-User License Agreement is entered into solely for the benefit of Motorola Solutions
and End-User Customer. No third party has the right to make any claim or assert any right under this Agreement, and no
third party is deemed a beneficiary of this End-User License Agreement. Notwithstanding the foregoing, any licensor or
supplier of third party software included in the Software will be a direct and intended third party beneficiary of this EndUser License Agreement.
11.4 Waiver. No waiver of a right or remedy of a Party will constitute a waiver of another right or remedy of that Party.
11.5 Assignments. Motorola Solutions may assign any of its rights or sub-contract any of its obligations under this End-User
License Agreement or encumber or sell any of its rights in any Software, without prior notice to or consent of End-User
Customer.
11.6 Causes of Action. End-User Customer must bring any action under this End-User License Agreement within one year
after the cause of action arises except that warranty claims must be brought within the applicable warranty period.
11.7 Entire Agreement and Amendment. This End-User License Agreement contains the parties’ entire agreement regarding
End-User Customer’s use of the Software and may be amended only in a writing signed by both parties, except that
Motorola Solutions may modify this End-User License Agreement as necessary to comply with applicable laws and
regulations.
11.8 Governing Law. This End-User License Agreement is governed by the laws of the State of Delaware in the United States
to the extent that they apply and otherwise by the internal substantive laws of the country to which the Software is
shipped if End-User Customer is a sovereign governmental entity. The terms of the U.N. Convention on Contracts for the
International Sale of Goods do not apply. In the event that the Uniform Computer information Transaction Act, any
version of this Act, or a substantially similar law (collectively “UCITA”) becomes applicable to a Party’s performance
under this Agreement, UCITA does not govern any aspect of this End-User License Agreement or any license granted
under this End-User License Agreement, or any of the parties’ rights or obligations under this End-User License
Agreement. The governing law will be that in effect prior to the applicability of UCITA.
11.9 Dispute Resolution. Unless End-User Customer is a sovereign governmental entity, any dispute arising from or in
connection with this End-User License Agreement shall be submitted to the sole and exclusive forum of the state and
federal courts sitting in New Castle County, Delaware (the "Delaware Courts"), and each Party irrevocably submits to
the jurisdiction of the Delaware Courts for the litigation of such disputes. Each Party hereby irrevocably waives, and
agrees not to assert in any suit, action or proceeding brought in the Delaware Courts, any claim or defense that the Party
is not subject to the jurisdiction of the Delaware Courts, that the Delaware Courts are an inconvenient forum, or that
the Delaware Courts are an improper venue.
8
WiNG 5.5.3 Access Point System Reference Guide
CHAPTER 1
OVERVIEW
Motorola Solutions’ family of access points enable high performance with secure and resilient wireless voice and data services
to remote locations with the scalability required to meet the needs of large distributed enterprises.
The unique WiNG 5 software enables the access point to function as a Standalone “thick” access point, or a Virtual Controller
AP capable of adopting and managing up to 24 access points of the same model. For a complete list of access points supporting
WiNG 5 software, see About this Guide on page 1.
NOTE: ES6510 is an Ethernet Switch managed by a wireless controller such as RFS4000/RFS6000/
RFS7000/NX4500/NX4524/NX6500/NX6524/NX7500/NX9000/NX9500/NX9510s. ES6510 does not
have radios and does not provide WLAN support.
When deploying an access point as a pure Virtual Controller AP, with no RFS Series controllers available anywhere on the
network, the access point itself is a controller supporting other access points of the same model. The Virtual Controller AP can:
• Provide firmware upgrades for connected access point
• Aggregate statistics for the group of access points the Virtual Controller is managing
• Be the single point of configuration for that deployment location
NOTE: The recommended way to administer a network populated by numerous access points is to
configure them directly from the Virtual Controller AP. If a single access point configuration requires an
update from the Virtual Controller AP’s assigned profile configuration, the administrator should apply a
Device Override to change just that access point’s configuration. For more information on applying an
override to an access point’s Virtual Controller AP assigned configuration and profile, see
Device Overrides on page 5-195.
The WiNG 5 architecture is a solution designed for 802.11n networking. It leverages the best aspects of independent and
dependent architectures to create a smart network that meets the connectivity, quality and security needs of each user and
their applications, based on the availability of network resources including wired networks. By distributing intelligence and
control amongst access points, a WiNG 5 network can route directly via the best path, as determined by factors including the
user, location, the application and available wireless and wired resources. WiNG 5 extends the differentiation Motorola
Solutions s offer to the next level, by making available services and security at every point in the network. managed traffic flow
1-2
WiNG 5.5.3 Access Point System Reference Guide
is optimized to prevent wired congestion and wireless congestion. Traffic flows dynamically, based on user and application,
and finds alternate routes to work around network choke points.
NOTE: This guide describes the installation and use of the WiNG 5 software designed specifically for
access points that support this release and ES6510 model ethernet switch. It does not describe the
version of the WiNG 5 software designed for use with the RFS4000, RFS6000, RFS7000, NX4500,
NX4524, NX6500, NX6524, NX7500, NX9000, NX9500 and NX9510. For information on using WiNG 5 in
a controller managed network, go to:
https://portal.motorolasolutions.com/Support/US-EN/Wireless+Networks
For a complete list of supported access points, see About this Guide on page 1.
WiNG Express is a minimal version of the WiNG 5 user interface for use on AP6511, AP6521, AP6522 and AP75XX access
points. WiNG Express presents a minimum set of configuration options for each of the above access points enabling quick
deployment with a large set of default values.
Overview
1-3
1.1 About the Motorola Solutions WiNG 5 Software
The WiNG 5 architecture is a solution designed for 802.11n networking. It leverages the best aspects of independent and
dependent architectures to create a smart network that meets the connectivity, quality and security needs of each user and
their applications, based on the availability of network resources including wired networks. By distributing intelligence and
control amongst access points, a WiNG 5 network can route directly via the best path, as determined by factors including the
user, location, the application and available wireless and wired resources. WiNG 5 extends the differentiation Motorola
Solutions offer to the next level, by making available services and security at every point in the network. Access point managed
traffic flow is optimized to prevent wired congestion and wireless congestion. Traffic flows dynamically, based on user and
application, and finds alternate routes to work around network choke points.
With this latest WiNG 5 release, the network can use access points to adapt to the dynamic circumstances of their deployment
environment. The WiNG 5 architecture provides a customized site-specific deployment, supporting the best path and routes
based on the user, location, application and the best route available (both wireless and wired). A WiNG 5 access point managed
network assures end-to-end quality, reliability and security without latency and performance degradation. A WiNG 5 access
point managed network supports rapid application delivery, mixed-media application optimization and quality assurance.
Deploying a new WiNG 5 access point managed network does not require the replacement of existing Motorola Solutions
access points. WiNG 5 enables the simultaneous use of existing architectures from Motorola Solutions and other vendors, even
if those other architectures are centralized models. A wireless network administrator can retain and optimize legacy
infrastructure while evolving to WiNG 5 as needed.
By distributing intelligence and control amongst access points, a WiNG 5 network can route data directly using the best path.
As a result, the additional load placed on the wired network from 802.11n support is significantly reduced, as traffic does not
require an unnecessary backhaul.
Within a WiNG 5 network, up to 80% of the network traffic can remain on the wireless mesh, and never touch the wired
network, so the 802.11n load impact on the wired network is negligible. In addition, latency and associated costs are reduced
while reliability and scalability are increased. A WiNG 5 network enables the creation of dynamic wireless traffic flows, so
bottlenecks can be avoided, and the destination is reached without latency or performance degradation. This behavior delivers
a significantly better quality of experience for the end user.
The same distributed intelligence enables more resilience and survivability, since access points keep users connected and
traffic flowing with full QoS, security and mobility even if a connection is interrupted due to a wired network or backhaul
problem.
When the network is fully operational, sources of interference or unbalanced wireless network loading can be automatically
corrected by the access point’s Smart RF functionality. Smart RF senses interference or potential client connectivity problems
and makes the required changes to the channel and access point radio power while minimizing the impact to latency sensitive
applications like VoIP. Using Smart RF, the network can continuously adjust power and channel assignments for self-recovery
if an access point radio fails or a coverage hole is detected.
Additionally, integrated access point sensors, in conjunction with AirDefense Network Assurance, alerts administrators of
interference and network coverage problems, which shortens response times and boosts overall reliability and availability of
the access point managed network.
Network traffic optimization protects the network from broadcast storms and minimizes congestion on the wired network. The
access point managed network provides VLAN load balancing, WAN traffic shaping and optimizations in dynamic host
configuration protocol (DHCP) responses and Internet group management protocol (IGMP) snooping for multicast traffic flows
in wired and wireless networks. Thus, users benefit from an extremely reliable network that adapts to meet their needs and
delivers mixed-media applications.
Firmware and configuration updates are supported from one access point to another, over the air or wire, and can be centrally
managed by an access point in Virtual Controller AP mode. Controllers no longer need to push firmware and configurations to
individual access point, thus reducing unnecessary network congestion.
1-4
WiNG 5.5.3 Access Point System Reference Guide
CHAPTER 2
WEB USER INTERFACE FEATURES
The access point’s resident user interface contains a set of features specifically designed to enable either Virtual Controller AP,
Standalone AP or Adopt to Controller functionality. In Virtual Controller AP mode, an access point can manage up to 24 other
access points of the same model and share data amongst managed access points. In Standalone mode, an access point
functions as an autonomous, non adopted, access point servicing wireless clients. If adopted to controller, an access point is
reliant on its connected controller for its configuration and management.
For information on how to access and use the access point’s Web UI, see:
• Accessing the Web UI
• Icon Glossary
2-2
WiNG 5.5.3 Access Point System Reference Guide
2.1 Accessing the Web UI
The access point uses a Graphical User Interface (GUI) which can be accessed using any supported Web browser on a client
connected to the subnet the Web UI is configured on.
2.1.1 Browser and System Requirements
To access the GUI, a browser supporting Flash Player 11 is recommended. The system accessing the GUI should have a
minimum of 1 GB of RAM for the UI to display and function properly. The Web UI is based on Flex, and does not use Java as
the underlying UI framework. Motorola Solutions recommends using a resolution of 1280 x 1024 pixels for using the GUI.
The following browsers have been validated with the Web UI:
• Firefox 3.0 or higher
• Internet Explorer 7 or higher
• Google Chrome 2.0 or higher
• Safari 3 and higher
• Opera 9.5 and higher
2.1.2 Connecting to the Web UI
1. Connect one end of an Ethernet cable to an access point LAN port and connect the other end to a computer with a working
Web browser.
2. Set the computer to use an IP address between 192.168.0.10 and 192.168.0.250 on the connected port. Set a subnet/
network mask of 255.255.255.0.
NOTE: The access point’s IP address is optimally provided using DHCP. A zero config IP
address can also be derived if DHCP resources are unavailable. Using zero config, the
last two octets in the IP address are the decimal equivalent of the last two bytes in the
access point’s hardcoded MAC address.
For example:
MAC address - 00:C0:23:00:F0:0A
Zero-config IP address - 169.254.240.10
3. To derive the access point’s IP address using its MAC address:
4. Open the Windows calculator be selecting Start > All Programs > Accessories > Calculator. This menu path may vary
slightly depending on your version of Windows.
5. With the Calculator displayed, select View > Scientific. Select the Hex radio button.
6. Enter a hex byte of the access point’s MAC address. For example, F0.
7. Select the Dec radio button. The calculator converts F0 into 240. Repeat this process for the last access point MAC address
octet.
8. Once obtained, point the Web browser to the access point’s IP address. The following login screen displays:
Web User Interface Features
2-3
Figure 2-1 Access Point Web UI Login screen
9. Enter the default username admin in the Username field.
10. Enter the default password motorola in the Password field.
11. Select the Login button to load the management interface.
If this is the first time the management interface has been accessed, the first screen to display will prompt for a change of
the default access point password. Then, a dialogue displays to start the initial setup wizard. For more information on using
the initial setup wizard see Using the WiNG Initial Setup Wizard on page 3-2.
2-4
WiNG 5.5.3 Access Point System Reference Guide
2.2 Icon Glossary
The access point interface utilizes a number of icons designed to interact with the system, gather information from managed
devices and obtain status. This chapter is a compendium of the icons used, and is organized as follows:
• Global Icons
• Dialog Box Icons
• Table Icons
• Status Icons
• Configurable Objects
• Configuration Objects
• Configuration Operation Icons
• Access Type Icons
• Administrative Role Icons
• Device Icons
2.2.1 Global Icons
Icon Glossary
This section lists global icons available throughout the interface.
Logout – Select this icon to log out of the system. This icon is always available and
is located at the top right-hand corner of the UI.
Add – Select this icon to add a row in a table. When this icon is selected, a new
row is created in the table, or a dialog box opens where you can enter values for
that particular list.
Delete – Select this icon to remove a row from a table. When this icon is clicked,
the selected row is immediately deleted.
More Information – Select this icon to display a pop-up with supplementary
information that may be available for an item.
Trash – Select this icon to remove a row from a table. When this icon is clicked,
the selected row is immediately deleted.
Web User Interface Features
2-5
Create new policy – Select this icon to create a new policy. Policies define
different configuration parameters that can be applied to device configurations,
and device profiles.
Edit policy – Select this icon to edit an existing configuration item or policy. To edit
a policy, select the policy and this icon.
2.2.2 Dialog Box Icons
Icon Glossary
These icons indicate the current state of various controls in a dialog. These icons enables you to gather, at a glance, the status
of all the controls in a dialog. The absence of any of these icons next to a control indicates the value in that control has not
been modified from its last saved configuration.
Entry Updated – Indicates a value has been modified from its last saved
configuration.
Entry Update – States that an override has been applied to a device’s profile
configuration.
Mandatory Field – Indicates the control’s value is a mandatory configuration
item. You will not be allowed to proceed further without providing all
mandatory values in the dialog or the screen.
Error in Entry – Indicates there is an error in a supplied value. A small red
popup provides a likely cause of the error.
2.2.3 Table Icons
Icon Glossary
The following two override icons are status indicators for transactions that need to be committed.
Table Row Overridden – Indicates a change (profile configuration override)
has been made to a table row, and the change will not be implemented until
saved. This icon represents a change from this device’s profile assigned
configuration.
Table Row Added – Indicates a new row has been added to a table, and the
change will not be implemented until saved. This icon represents a change
from this device’s profile assigned configuration.
2-6
WiNG 5.5.3 Access Point System Reference Guide
2.2.4 Status Icons
Icon Glossary
These icons define device status, operations on the wireless controller, or any other action that requires a status being returned
to the user.
Fatal Error – States there is an error causing a managed device to stop
functioning.
Error – Indicates an error exits requiring intervention. An action has failed, but
the error is not system wide.
Warning – States a particular action has completed, but some errors were
detected that did not stop the process from completing. Intervention might
still be required to resolve subsequent warnings.
Success – Indicates everything is well within the network or a process has
completed successfully without error.
Information – This icon always precedes information displayed to the user.
This may either be a message displaying progress for a particular process, or
may just be a message from the system.
2.2.5 Configurable Objects
Icon Glossary
These icons define configurable items within the UI.
Device Configuration – Represents a configuration file applicable to a device
category.
Auto Provisioning Policy – Represents a provisioning policy. Provisioning
policies are a set of configuration parameters that define how Access Points
and wireless clients are adopted and their management configuration
supplied.
Wireless LANs – States an action impacting a WLAN has occurred.
WLAN QoS Policy – States a Quality of Service (QoS) policy configuration has
been impacted.
Web User Interface Features
Radio QoS Policy – Indicates a QoS policy configuration has been impacted.
AAA Policy – Indicates an Authentication, Authorization and Accounting
(AAA) policy has been impacted. AAA policies define RADIUS authentication
and accounting parameters.
Association ACL – Indicates an Association Access Control List (ACL)
configuration has been impacted. An ACL is a set of configuration parameters
used to set access to managed resources. The association ACL configures the
parameters for controlling device associations.
Smart RF Policy – States a Smart RF policy has been impacted. Smart RF
enables neighboring APs to take over for an AP that suddenly becomes
unavailable. This is accomplished by increasing the power of radios on nearby
APs to cover the hole created by the non-functioning AP.
Profile – States a device profile configuration has been impacted. A profile is
a collection of configuration parameters used to configure a device or a
feature.
Bridging Policy – Indicates a bridging policy configuration has been impacted.
A bridging policy defines which VLANs are bridged and how local VLANs are
bridged between the wired and wireless sides of the network.
RF Domain – States an RF Domain configuration has been impacted. RF
Domain implement location based security restrictions applicable to all
VLANs in a particular physical location.
Firewall Policy – Indicates a Firewall policy has been impacted. Firewalls
provide a barrier that prevent unauthorized access to secure resources while
allowing authorized access to external and internal resources.
IP Firewall Rules – Indicates an IP Firewall rule has been applied. An IP based
firewall rule implements firewall restrictions based on the IP address in a
received packet.
MAC Firewall Rules – States a MAC based Firewall Rule has been applied. A
MAC based firewall rule implements firewall restrictions based on the MAC
address in a received packet.
Wireless Client Role – Indicates a wireless client role has been applied to a
managed client. The role could be either sensor or client.
WIPS Policy – States the conditions of a WIPS policy have been invoked.
WIPS prevents unauthorized access to the network by checking for (and
removing) rogue APs and wireless clients.
2-7
2-8
WiNG 5.5.3 Access Point System Reference Guide
Advanced WIPS Policy – States the conditions of an advanced WIPS policy
have been invoked. WIPS prevents unauthorized access to the system by
checking for and removing rogue access points and wireless clients.
Device Categorization – Indicates a device categorization policy is being
applied. This is used by the intrusion prevention system to categorize APs or
wireless clients as either neighbors or sanctioned devices. This enables these
devices to bypass the intrusion prevention system.
Captive Portal – States a captive portal is being applied. Captive portal is
used to provide temporary controller, service platform, or access point access
to requesting wireless clients.
DNS Whitelist – A DNS whitelist is used in conjunction with captive portal to
provide captive portal services to wireless clients.
DHCP Server Policy – Indicates a DHCP server policy is being applied. DHCP
provides IP addresses to wireless clients. A DHCP server policy configures
how DHCP provides these IP addresses.
RADIUS Group – Indicates the configuration of RADIUS Group is being
defined and applied. A RADIUS group is a collection of RADIUS users with the
same set of permissions.
RADIUS User Pools – States a RADIUS user pool is being applied. RADIUS
user pools are a set of IP addresses that can be assigned to an authenticated
RADIUS user.
RADIUS Server Policy – Indicates a RADIUS server policy is being applied.
RADIUS server policy is a set of configuration attributes used when a RADIUS
server is configured for AAA.
Smart Caching Policy – Smart Caching enables NX4500 and NX6500 series
service platforms to temporarily store frequently accessed Web content on
network infrastructure devices.
Management Policy – Indicates a management policy is being applied.
Management policies are used to configure access control, authentication,
traps and administrator permissions.
MeshConnex Policy – Indicates a mesh connex policy is being applied.
MeshConnex is a hybrid proactive/on-demand path selection protocol to form
efficient mesh paths.
Web User Interface Features
Mesh QoS Policy – Indicates a mesh quality of service policy is being applied.
This policy ensures that each mesh point in the network receives a fair share
of overall bandwidth for its use.
Virtual Controller APs – Indicates an AP is configured as a Virtual Controller
access point. A Virtual Controller access point can manage up to 24 access
points of similar type deployed in a network.
2.2.6 Configuration Objects
Icon Glossary
Configuration icons are used to define the following:
Configuration – Indicates an item capable of being configured by the access
point’s interface.
View Events / Event History – Defines a list of events. Select this icon to view
events or view the event history.
Core Snapshots – Indicates a core snapshot has been generated. A core
snapshot is a file that records the status of all the processes and memory
when a process fails.
Panic Snapshots – Indicates a panic snapshot has been generated. A panic
snapshot is a file that records the status of all the processes and memory
when a failure occurs.
UI Debugging – Select this icon/link to view current NETCONF messages.
View UI Logs – Select this icon/link to view the different logs generated by
the user interface, FLEX and the error logs.
2-9
2 - 10 WiNG 5.5.3 Access Point System Reference Guide
2.2.7 Configuration Operation Icons
Icon Glossary
The following icons are used to define configuration operations:
Revert – When selected, any unsaved changes are reverted back to their last
saved configuration.
Commit – When selected, all changes made to the configuration are written
to the access point. Once committed, changes cannot be reverted.
Commit and Save – When selected, changes are saved to the access point’s
configuration.
2.2.8 Access Type Icons
Icon Glossary
The following icons display a user access type:
Web UI – Defines a Web UI access permission. A user with this permission
is permitted to access an associated device’s Web UI.
Telnet – Defines a TELNET access permission. A user with this permission is
permitted to access an access point using TELNET.
SSH – Indicates a SSH access permission. A user with this permission is
permitted to access an access point using SSH.
Console – Indicates a console access permission. A user with this permission
is permitted to access the access point using the device’s serial console.
Web User Interface Features 2 - 11
2.2.9 Administrative Role Icons
Icon Glossary
The following icons identify the different administrative roles allowed on the system:
Superuser – Indicates superuser privileges. A superuser has complete access
to all configuration aspects of the access point to which they are connected.
System – Indicates system user privileges. A system user is allowed to
configure some general settings like boot parameters, licenses, auto install,
image upgrades etc.
Network – Indicates network user privileges. A network user is allowed to
configure all wired and wireless parameters, like IP configuration, VLANs,
L2/L3 security, WLANs, radios etc.
Security – Indicates security user privileges. A security level user is allowed
to configure all security related parameters.
Monitor – Indicates a monitor role. This role provides no configuration
privileges. A user with this role can view all system configuration but cannot
modify them.
Help Desk – Indicates help desk privileges. A help desk user is allowed to use
troubleshooting tools like sniffers, execute service commands, view or
retrieve logs and reboot an access point.
Web User – Indicates a Web user privilege. A Web user is allowed accessing
the access point’s Web user interface.
2.2.10 Device Icons
Icon Glossary
The following icons indicate the different device types managed by the system:
System – This icon indicates the entire WiNG supported system and all of its
members including wireless controller, service platforms, and access points
that may be interacting at any one time.
Cluster – This icon indicates a cluster. A cluster is a set of access points that
work collectively to provide redundancy and load sharing amongst its
members.
Service Platform – This icon indicates an NX45xx, NX65xx, NX7500 or
NX9000 series service platform that’s part of the managed network
2 - 12 WiNG 5.5.3 Access Point System Reference Guide
RF Domain - This icon indicates a RF Domain. RF Domains allow
administrators to assign configuration data to multiple devices deployed in a
common coverage area, such as in a floor, a building or a site. Each RF Domain
also contains policies that can determine a Smart RF or WIPS configuration.
Access Point – This icon indicates any access point that is a part of the
network.
Wireless Client – This icon indicates any wireless client connected within the
access point managed network.
CHAPTER 3
QUICK START
Access points can utilize an initial setup wizard to streamline the process of initially accessing the wireless network. The
wizard defines the access point’s operational mode, deployment location, basic security, network and WLAN settings. For
instructions on how to use the initial setup wizard, see Using the WiNG Initial Setup Wizard on page 3-2.
This section describes, in detail, the initial setup steps for the AP SKUs running the standard WiNG build as well for those SKUs
running the WiNG Express build. For more information see:
• Using the WiNG Initial Setup Wizard
• Using WiNG Express Quick Configuration
3-2
WiNG 5.5.3 Access Point System Reference Guide
3.1 Using the WiNG Initial Setup Wizard
Quick Start
Once the access point is installed and powered on, complete the following steps to get the access point up and running and
access management functions:
1. Point the Web browser to the access point’s IP address. The following login screen displays:
Figure 3-1 Web UI Login screen
2. Enter the default username admin in the Username field.
3. Enter the default password motorola in the Password field.
4. Select the Login button to load the management interface.
NOTE: When logging in for the first time, you are prompted to change the password to
enhance device security in subsequent logins.
NOTE: If you get disconnected when running the wizard, you can connect again with the
access point’s actual IP address (once obtained) and resume the wizard.
5. If this is the first time the access point’s management interface has been accessed, the Initial Setup Wizard automatically
displays.
Quick Start
3-3
Figure 3-2 Initial Setup Wizard
NOTE: The Initial Setup Wizard displays the same pages and content for each access
point model supported. The only difference being the number of radios configurable by
model, as an AP7131 model can support up to three radios, AP6522, AP6532, AP6562,
AP7522, AP7532, AP8122, AP8132, AP8222, AP8232, AP7161 and AP7181 models
support two radios and AP6511 and AP6521 models support a single radio.
The Introduction screen displays the various actions that can be performed using the wizard under the Function
Highlight field.
Use the Choose One type to Setup the Access Point field options to select the type of wizard to run. The Typical Setup
is the recommended wizard. This wizard uses the default parameters for most of the configuration parameters and sets up
a working network with the least amount of manual configuration.
The Advanced Setup wizard is for administrators who prefer more control over the different configuration parameters. A
few more configuration screens are available for customization when the Advanced Setup wizard is used.
The first page of the Initial Setup Wizard displays the Navigation Panel and Function Highlights for the configuration
activities comprising the access point's initial setup. This page also displays options to select the typical or advanced mode
for the wizard.
3-4
WiNG 5.5.3 Access Point System Reference Guide
Figure 3-3 Initial Setup Wizard - Navigation Panel - Typical Setup Wizard
A green check mark to the left of an item in the Navigation Panel defines the listed task as having its minimum required
configuration parameters set correctly. A red X defines the task as still requiring at least one parameter be defined correctly.
Figure 3-3 displays the navigation panel for the Typical Setup Wizard.
Figure 3-4 Initial Setup Wizard - Navigation Panel - Advanced Setup Wizard
Figure 3-4 displays the navigation panel for the Advanced Setup Wizard.
NOTE: Note the difference in the number of steps between the Typical Setup and
Advanced Setup Wizards.
Quick Start
3-5
6. Select Save/Commit within each page to save the updates made to that page's configuration. Select Next to proceed to
the next page listed in the Navigation Panel. Select Back to revert to the previous screen without saving your updates.
NOTE: While you can navigate to any page in the navigation panel, you cannot complete
the Initial Setup Wizard until each task in the Navigation Panel has a green check mark.
The following sections describe the two different wizards and their parameters. The available wizards are:
• Typical Setup Wizard
• Advanced Setup Wizard
3.1.1 Typical Setup Wizard
Using the WiNG Initial Setup Wizard
The Typical Setup is the recommended wizard. This wizard uses default parameters for most of the configuration parameters
and creates a working network with the fewest steps.
The Typical Setup wizard consists of the following:
• Network Topology Selection
• LAN Configuration
• WAN Configuration
• Wireless LAN Setup
• Summary And Commit Screen
To configure the access point using the Typical Setup Wizard:
1. Select Typical Setup from the Choose One type to Setup the Access Point field.
2. Select Next.
The Initial Setup Wizard displays the Access Point Settings screen to define the access point's Standalone versus Virtual
Controller AP functionality. This screen also enables selection of the country of operation for the access point.
3-6
WiNG 5.5.3 Access Point System Reference Guide
Figure 3-5 Initial Setup Wizard - Access Point Settings screen for Typical Setup Wizard
3. Select an Access Point Type from the following options:
• Virtual Controller AP - When more than one access points are deployed, a single access point can function as a Virtual
Controller AP. Up to 24 access points can be connected to, and managed by a single Virtual Controller AP. These
connected access points must be the same model as the Virtual Controller AP. For more information, see
Virtual Controller AP Mode on page 3-8.
• Standalone AP - Select this option to deploy this access point as an autonomous access point. A standalone AP is not
managed by a Virtual Controller AP, or adopted by a RFS series wireless controller. For more information, see
Standalone Mode on page 3-9.
NOTE: If designating the access point as a Standalone AP, Motorola Solutions
recommends the access point’s UI be used exclusively to define its device configuration,
and not the CLI. The CLI provides the ability to define more than one profile and the UI
does not. Consequently, the two interfaces cannot be used collectively to manage
profiles without an administrator encountering problems.
Quick Start
3-7
• Adopted to Controller - Select this option when deploying the access point as a controller managed (Dependent mode)
access point. Selecting this option closes the Initial AP Setup Wizard. An adopted access point obtains its configuration
from a profile stored on its managing controller. Any manual configuration changes are overwritten by the controller upon
reboot. For more information on configuring the access point in the Adopted to Controller mode, see
Adopt to a controller on page 3-35.
NOTE: The option Adopted to Controller is only available for the Advanced Setup
Wizard.
4. Select the Country Code where the access point is deployed. Selecting a proper country of operation is a very critical task
while configuring the access point as it defines the correct channels of operations and ensures compliance to the
regulations for the selected country. This field is only available for the Typical Setup Wizard.
NOTE: The professional installer should refer to the Motorola Solutions WiNG Access
Point System Reference Guide available at
https://portal.motorolasolutions.com/Support/US-EN/Wireless+Networks
for detailed information on how to set the access point's transmit power, antenna gain
and channel in respect to the deployment country's unique regulatory requirements.
5. Select the Next button to start configuring the access point in the selected mode.
3-8
WiNG 5.5.3 Access Point System Reference Guide
3.1.1.1 Virtual Controller AP Mode
Using the WiNG Initial Setup Wizard
When more than one access point is deployed, a single access point can function as a Virtual Controller AP. Up to 24 access
points can be connected to, and managed by a single Virtual Controller AP of the same access point model. These connected
access points must be of the same model as the Virtual Controller AP.
To designate an access point as a Virtual Controller AP:
1. From the Access Point Settings screen, select Virtual Controller AP.
2. Select Next.
The remainder of a Virtual Controller AP configuration is the same as a Standalone Access Point.
Quick Start
3-9
3.1.1.2 Standalone Mode
Using the WiNG Initial Setup Wizard
In the Standalone mode, the access point is not adopted to a wireless controller. Select this option to deploy this access point
as an autonomous fat access point.
!
CAUTION: If designating the access point as a Standalone AP, Motorola Solutions
recommends the access point’s UI be used exclusively to define its device configuration,
and not the CLI. The CLI provides the ability to define more than one profile and the UI
does not. Consequently, the two interfaces cannot be used collectively to manage
profiles without an administrator encountering problems.
To configure the access point to work in the Standalone mode:
1. From the Access Point Settings screen, select Standalone AP.
2. Select Next.
The remainder of a Standalone AP configuration is the same as a Virtual Controller Access Point.
3 - 10 WiNG 5.5.3 Access Point System Reference Guide
3.1.1.3 Network Topology Selection
Typical Setup Wizard
Use the Network Topology screen to define how the access point manages network traffic. The available modes are:
Figure 3-6 Initial Setup Wizard - Network Topology screen for Typical Setup Wizard
• Router Mode - In Router Mode, the access point routes traffic between the local network (LAN) and the Internet or
external network (WAN). Router mode is recommended in a deployment supported by just a single access point.
• Bridge Mode - In Bridge Mode, the access point depends on an external router for routing LAN and WAN traffic.
Routing is generally used on one device, whereas bridging is typically used in a larger density network. Select Bridge
Mode when deploying this access point with numerous peer access points supporting clients on both the 2.4 GHz and
5.0 GHz radio bands.
NOTE: When Bridge Mode is selected, WAN configuration cannot be performed and the
Initial Setup Wizard does not display the WAN configuration screen.
1. Select Next. The Typical Setup Wizard displays the LAN Configuration screen to set the access point's LAN interface
configuration. For more information, see LAN Configuration on page 3-11.
Quick Start 3 - 11
3.1.1.4 LAN Configuration
Typical Setup Wizard
Use the LAN Configuration screen to set the access point's DHCP and LAN network address configuration.
Figure 3-7 Initial Setup Wizard - LAN Configuration screen for Typical Setup Wizard
1. Set the following DHCP and Static IP Address/Subnet information:
• Use DHCP - Select the option to enable an automatic network address configuration using DHCP server.
• Static IP Address/Subnet - Enter an IP Address and a subnet for the access point's LAN interface. If Use DHCP is
selected, this field is not available. When selecting this option, define the following DHCP Server and Domain Name
Server (DNS) resources, as those fields will become enabled on the bottom portion of the screen.
• Use on-board DHCP server to assign IP addresses to wireless clients - Select the check box to enable the
access point’s DHCP server to provide IP and DNS information to clients on the LAN interface.
• Range - Enter a starting and ending IP Address range for client assignments on the access point's LAN interface.
Avoid assigning IP addresses from x.x.x.1 - x.x.x.10 and x.x.x.255, as they are often reserved for standard network
services. This is a required parameter.
• Default Gateway - Define a default gateway address for use with the default gateway. This is a required parameter.
• DNS Forwarding - Select this option to allow a DNS server to translate domain names into IP addresses. If this
3 - 12 WiNG 5.5.3 Access Point System Reference Guide
option is not selected, a primary and secondary DNS resource must be specified. DNS forwarding is useful when a
request for a domain name is made but the DNS server, responsible for converting the name into its corresponding
IP address, cannot locate the matching IP address.
• Primary DNS - Enter an IP Address for the main Domain Name Server providing DNS services for the access point's
LAN interface.
• Secondary DNS - Enter an IP Address for the backup Domain Name Server providing DNS services for the access
point's LAN interface
2. Select Next. The Typical Setup Wizard displays the Wireless LAN Setup screen to set the access point's Wireless LAN
interface configuration. For more information see Wireless LAN Setup on page 3-15.
If Router Mode is selected as the Network Topology, the Typical Setup Wizard displays the WAN configuration screen.
For more information, see WAN Configuration on page 3-13.
Quick Start 3 - 13
3.1.1.5 WAN Configuration
Typical Setup Wizard
NOTE: This option is only available when Router Mode is selected in the Network
Topology screen.
Use the WAN Setting screen to define network address settings for the WAN interface. The WAN interface connects the
access point to a wired local area network or backhaul.
Figure 3-8 Initial Setup Wizard - WAN Configuration screen of the Typical Setup Wizard
1. Set the following WAN parameters:
• Use DHCP - Select the radio control to enable an automatic network address configuration using external DHCP servers.
An automatic IP address is configured to the access point’s WAN port using DHCP servers located on the WAN side of
the network.
• Static IP Address/Subnet - Enter an IP Address and a subnet for the access point's WAN interface. If Use DHCP is
selected, this field is not available. When selecting this option, define Default Gateway information, as the field will
become enabled on the bottom portion of the screen. The provided IP address is assigned to the WAN interface of the
access point. The Default Gateway is a router that serves as a access to other networks.
• Select the port that is connected to the WAN – Select the port connected to the WAN.
3 - 14 WiNG 5.5.3 Access Point System Reference Guide
• Enable NAT on the WAN Interface – Select the option to enable Network Address Translation on the selected GE
interface.
2. Select Next. The Typical Setup Wizard displays the Wireless LAN Setup screen to set the access point's wireless LAN
configuration. For more information, see Wireless LAN Setup on page 3-15.
Quick Start 3 - 15
3.1.1.6 Wireless LAN Setup
Typical Setup Wizard
A Wireless Local Area Network (WLAN) is a data-communications system and local area network that flexibly extends the
functionality of a wired LAN. A WLAN links two or more computers or devices using spread-spectrum or OFDM modulation
based technology. WLANs do not require lining up devices for line-of-sight transmission, and are thus, desirable for wireless
networking. Roaming users can be handed off from one access point to another, like a cellular phone system. WLANs can
therefore be configured around the needs of specific user groups, even when they are not in physical proximity.
Up to two (2) WLANs can be configured for the access point using the wizard.
Figure 3-9 Initial Setup Wizard - Wireless LAN Setup screen for Typical Setup Wizard
1. Set the following WLAN1 configuration parameters:
• SSID – Configure the SSID for the WLAN.
• WLAN Type – Configure the encryption and authentication to use with this WLAN.
• No Authentication and No Encryption – Configures a network without any authentication. This means any device
can access the network. This option also configures the network without encryption. This means any data transmitted
through the network is in plain text.
3 - 16 WiNG 5.5.3 Access Point System Reference Guide
• Captive Portal Authentication and No Encryption – Configures a network that uses a RADIUS server to authenticate
users before allowing them on to the network. Once on the network, no encryption is used for the data being transmitted
through the network. Select this option to use a Web page (either internally or externally hosted) to authenticate users
before access is granted to the network
• External RADIUS Server – When this option is selected, provide the IP address of the external RADIUS server used
for user authentication. Also provide the shared secret in the RADIUS Shared Secret field.
• Onboard RADIUS Server – When this option is selected, a new screen is displayed where additional updates can
be made. For more information on configuring the onboard RADIUS server, see RADIUS Server Configuration on page
3-17.
• PSK authentication, WPA2 encryption – Configures a network that uses PSK authentication and WPA2 encryption.
Select this option to implement a pre-shared key that must be correctly shared between the access point and requesting
clients using this WLAN
• WPA Key – Provide a 64 character HEX key or 8-63 character ASCII key. Use the drop-down to specify the type of
key being provided. Select ASCII or HEX to specify the key type being provided in the WPA Key field.
2. Select Next. The Typical Setup Wizard displays the RADIUS Server Configuration screen if required. For more
information, see RADIUS Server Configuration on page 3-17
Otherwise, the Typical Setup Wizard displays the Summary and Commit screen. For more information, see Summary And
Commit Screen on page 3-19.
Quick Start 3 - 17
3.1.1.6.1 RADIUS Server Configuration
Wireless LAN Setup
Use the RADIUS Server Configuration screen to configure the users for the onboard RADIUS server. Use the screen to add,
modify and remove RADIUS users.
Figure 3-10 Initial Setup Wizard - RADIUS Server Configuration screen for Typical Setup Wizard
Use the Add User button to add a new RADIUS user. A dialog displays where details about the user is entered.
3 - 18 WiNG 5.5.3 Access Point System Reference Guide
Figure 3-11 Initial Setup Wizard - RADIUS Server Configuration - Add User screen for Typical Setup Wizard
1. Use the Add User dialog to provide user information to add to the RADIUS server user database.
• Username – Provide a user name to authenticate the user
• Password – Provide a password to authenticate the user
• Confirm Password – Confirm the password by entering the same password entered in the Password field
• Description – Provide a description for the user created in the RADIUS server user database
2. To create the user and continue with creating another user, select Create. To create the user and close this dialog, click
Create & Close. To close the dialog and abandon the operation, select Cancel.
Use the Modify User button to modify the details for an existing user in the RADIUS user database. Select the user to
modify details for and then click Modify User. The username for the user cannot be modified using this dialog.
Use the Delete User button to remove the details of an existing user from the RADIUS user database. Select the user to
remove and then click Delete User. A confirmation dialog appears. Once confirmed, the user is removed from the RADIUS
user database.
3. Click Next The Typical Setup Wizard displays the Summary and Commit screen. For more information, see Summary And
Commit Screen on page 3-19.
Quick Start 3 - 19
3.1.1.7 Summary And Commit Screen
Typical Setup Wizard
The Summary And Commit screen displays a complete overview of the configurations made in the previous screens.
There is no user intervention or additional settings required. The Summary and Commit screen is an additional means of
validating the configuration before it is deployed.
Figure 3-12 Initial Setup Wizard - Summary And Commit Screen of the Typical Setup Wizard
If the configuration displays as intended, select the Save/Commit button to implement these settings to the access point’s
configuration. If additional changes are warranted based on the summary, either select the target page from the Navigation
Panel, or use the Back button.
3 - 20 WiNG 5.5.3 Access Point System Reference Guide
3.1.1.8 Adopt to a controller
Using the WiNG Initial Setup Wizard
Adopted to Controller is the default behavior of the access point. When the access point is switched on for the first time, it
looks for a wireless controller on the default subnet and that runs the same WiNG firmware version and automatically adopts
to it. Use the Initial Setup Wizard to configure the preferred wireless controller that the access point must adopt to.
When Adopted to Controller is selected, further configuration settings are displayed in the same screen. Select the Automatic
controller discovery option to enable the access point to be discovered and adopted using layer 2 settings.
If preferring layer 3 adoption, select the Static Controller Configuration option, and define the addresses of the preferred
controllers. When using the static method, define whether the access point receives an IP address using DHCP or if IP resources
are provided statically. Up to two (2) controllers can be defined. The access point will try to adopt to the controller defined in
the Controller 1 field first. Should the controller not be found, then the access point tries to adopt to the controller defined in
Controller 2 field.
When preferring layer 3 adoption, configure how an IP is assigned to this access point. Select Use DHCP to use DHCP to assign
an IP address to this access point. If this access point requires a static IP to be assigned, select Static IP Address/Subnet
and provide the appropriate IP address and net mask. For your convenience, the netmask is automatically set to 24. Also assign
the Default Gateway to forward traffic.
Figure 3-13 Initial Setup Wizard - Adoption Settings
Select the Save/Commit button to save the current configuration. Select the Cancel button to exit the Initial Setup Wizard
without making any changes. Select the Back button to go back to the previous screen of the Initial Setup Wizard.
Quick Start 3 - 21
3.1.2 Advanced Setup Wizard
Using the WiNG Initial Setup Wizard
The Advanced Setup is the recommended wizard for users who want more control on how the access point is configured
beyond minimum default settings. This wizard provides additional radio and system information settings.
The Advanced Setup wizard consists of the following:
• Network Topology Selection
• LAN Configuration
• WAN Configuration
• Radio Configuration
• Wireless LAN Setup
• System Information
• Summary And Commit Screen
To configure the access point using the Advanced Setup Wizard:
1. Select Advanced Setup from the Choose One type to Setup the Access Point field.
2. Select Next.
The Advanced Setup Wizard displays the Access Point Settings screen to define the access point's Standalone versus
Virtual Controller AP versus functionality. This screen also enables selection of the country of operation.
3 - 22 WiNG 5.5.3 Access Point System Reference Guide
Figure 3-14 Initial Setup Wizard - Access Point Settings screen for Advanced Setup Wizard
3. Select an Access Point Type from the following options:
• Virtual Controller AP - When more than one access point is deployed, a single access point can function as a Virtual
Controller AP. Up to 24 access points can be connected to, and managed by, a single Virtual Controller AP. These
connected access points must be the same model as the Virtual Controller AP. For more information, see Virtual Controller
AP Mode on page 3-8.
• Standalone AP - Select this option to deploy this access point as an autonomous fat access point. A standalone AP is
not managed by a Virtual Controller AP, or adopted by a RFS series wireless controller. For more information see
Standalone Mode on page 3-9.
NOTE: If designating the access point as a Standalone AP, Motorola Solutions
recommends the access point’s UI be used exclusively to define its device configuration,
and not the CLI. The CLI provides the ability to define more than one profile and the UI
does not. Consequently, the two interfaces cannot be used collectively to manage
profiles without an administrator encountering problems.
• Adopted to Controller - Select this option when deploying the access point as a controller managed (Dependent mode)
access point. Selecting this option closes the Initial AP Setup Wizard. An adopted access point obtains its configuration
from a profile stored on its managing controller. Any manual configuration changes are overwritten by the controller upon
reboot. For more information on configuring the access point in the Adopted to Controller mode, see Adopt to a controller
on page 3-35.
Quick Start 3 - 23
4. Select the Next button to start configuring the access point in the selected mode. If the Access Point Type is Virtual
Controller AP or Standard AP, see Network Topology Selection on page 3-24.
If the Access Point Type is Adopted to Controller, see Adopt to a controller on page 3-35.
3 - 24 WiNG 5.5.3 Access Point System Reference Guide
3.1.2.1 Network Topology Selection
Advanced Setup Wizard
Use the Network Topology screen to define how the access point manages network traffic. The available modes are:
Figure 3-15 Initial Setup Wizard - Access Point Mode screen for Advanced Setup Wizard
• Router Mode - In Router Mode, the access point routes traffic between the local network (LAN) and the Internet or
external network (WAN). Router mode is recommended in a deployment supported by just a single access point.
• Bridge Mode - In Bridge Mode, the access point depends on an external router for routing LAN and WAN traffic.
Routing is generally used on one device, whereas bridging is typically used in a larger density network. Select Bridge
Mode when deploying this access point with numerous peer access points supporting clients on both the 2.4 GHz and
5.0 GHz radio bands.
NOTE: When Bridge Mode is selected, WAN configuration cannot be performed and the
Initial Setup Wizard does not display the WAN configuration screen.
1. Select Next. The Advanced Setup Wizard displays the LAN Configuration screen to set the access point's LAN interface.
For more information, see LAN Configuration on page 3-25.
Quick Start 3 - 25
3.1.2.2 LAN Configuration
Advanced Setup Wizard
Use the LAN Configuration screen to configure the parameters required for setting a Local Area Network (LAN) on the access
point.
Figure 3-16 Initial Setup Wizard - LAN Configuration screen for Advanced Setup Wizard
1. Set the following DHCP and Static IP Address/Subnet information for the LAN interface:
• Use DHCP - Select the option to enable an automatic network address configuration using DHCP server.
• Static IP Address/Subnet - Enter an IP Address and a subnet for the access point's LAN interface. If Use DHCP is
selected, this field is not available. When selecting this option, define the following DHCP Server and Domain Name
Server (DNS) resources, as those fields will become enabled on the bottom portion of the screen.
• Use on-board DHCP server to assign IP addresses to wireless clients - Select the check box to enable the
access point’s DHCP server to provide IP and DNS information to clients on the LAN interface.
• Range - Enter a starting and ending IP Address range for client assignments on the access point's LAN interface.
Avoid assigning IP addresses from x.x.x.1 - x.x.x.10 and x.x.x.255, as they are often reserved for standard network
services. This is a required parameter.
• Default Gateway - Define a default gateway address for use with the default gateway. This is a required parameter.
3 - 26 WiNG 5.5.3 Access Point System Reference Guide
• DNS Forwarding - Select this option to allow a DNS server to translate domain names into IP addresses. If this
option is not selected, a primary and secondary DNS resource must be specified. DNS forwarding is useful when a
request for a domain name is made but the DNS server, responsible for converting the name into its corresponding
IP address, cannot locate the matching IP address.
• Primary DNS - Enter an IP Address for the main Domain Name Server providing DNS services for the access point's
LAN interface.
• Secondary DNS - Enter an IP Address for the backup Domain Name Server providing DNS services for the access
point's LAN interface
2. Select Next. The Advanced Setup Wizard displays the Radio Configuration screen to set the access point's radios. For more
information, see Radio Configuration on page 3-29.
If Router Mode is selected as the Network Topology, then the Advanced Setup Wizard displays the WAN configuration
screen. For more information, see WAN Configuration on page 3-13.
Quick Start 3 - 27
3.1.2.3 WAN Configuration
Advanced Setup Wizard
NOTE: This option is only available when Router Mode is selected in the Network
Topology screen of the Advanced Setup Wizard.
The Advanced Setup Wizard displays the WAN Setting screen to define DHCP and network address information for the WAN
interface. The WAN interface is used to connect the access point to a wired local area network or backhaul.
Figure 3-17 Initial Setup Wizard - WAN Configuration screen of the Advanced Setup Wizard
1. Set the following WAN parameters:
• Use DHCP - Select the radio control to enable an automatic network address configuration using external DHCP servers.
An automatic IP address is configured to the access point’s WAN port using DHCP servers located on the WAN side of
the network.
• Static IP Address/Subnet - Enter an IP Address and a subnet for the access point's WAN interface. If Use DHCP is
selected, this field is not available. When selecting this option, define the following Default Gateway information as
the field will become enabled on the bottom portion of the screen. The IP address defined in this field is assigned to the
WAN interface. The Default Gateway is a router that serves as a access to other networks.
• Select the port that’s connected to the WAN – Select the port that is connected to the WAN.
3 - 28 WiNG 5.5.3 Access Point System Reference Guide
• Enable NAT on the WAN Interface – Select the option to enable Network Address Translation on the selected GE
interface.
2. Select Next. The Advanced Setup Wizard displays the Radio Configuration screen to set the access point's radios. For
more information, see Radio Configuration on page 3-29.
Quick Start 3 - 29
3.1.2.4 Radio Configuration
Advanced Setup Wizard
Use the Radio Configuration screen to define radio support for the 2.4 GHz radio band, 5.0 GHz radio band or set the radio
as a dedicated sensor.
NOTE: The Radio Configuration screen displays separate configurable fields for each
access point radio. Supported access point models can have from one to three (AP7131)
radios. The ADSP Sensor Server field displays at the bottom of the screen only if one
of the radios has been dedicated as a sensor.
Figure 3-18 Initial Setup Wizard - Radio Configuration screen of the Advanced Setup Wizard
1. Set the following for each radio:
• Configure as a Data Radio - Select this option to dedicate this radio to WLAN client support in the selected 2.4 GHz
or 5.0 GHz radio band.
• Radio Frequency Band - Select the 2.4 GHz or 5.0 GHz radio band to use with the radio when selected as a Data Radio.
The selected band is used for WLAN client support. Consider selecting one radio for 2.4 GHz and another for
5.0 GHz support (if using a dual or three radio model) when supporting clients in both the 802.11bg and 802.11n bands.
• Power Level - Use the spinner control to select a 1 - 23 dBm minimum power level to assign to this radio in selected
3 - 30 WiNG 5.5.3 Access Point System Reference Guide
2.4 GHz or 5.0 GHz band. 1 dBm is the default setting.
• Channel Mode - Select either Random, Best or Static. Select Random for use with a 802.11a/n radio. To comply with
Dynamic Frequency Selection (DFS) requirements in the European Union, the 802.11a/n radio uses a randomly selected
channel each time the access point is powered on. Select Best to enable the access point to scan non-overlapping
channels and listen for beacons from other access points. After the channels are scanned, it will select the channel with
the fewest access points. In the case of multiple access points on the same channel, it will select the channel with the
lowest average power level. When Constantly Monitor is selected, the access point will continuously scan the network
for excessive noise and sources of interference. Select Static to assign the access point a permanent channel and scan
for noise and interference only when initialized.
• Configure as a Sensor Radio - Select this option to dedicate the radio to sensor support exclusively. When functioning
as a sensor, the radio scans in sensor mode across all channels within the 2.4 and 5.0 GHz bands to identify potential
threats. If dedicating a radio as a sensor resource, a primary and secondary ADSP server must be specified as an ADSP
management resource.
NOTE: If configuring an AP6511 or AP6521 model access point as a sensor, the access
point will require a reboot before its sensor functionality is invoked. The reboot can take
place at the completion of the Initial Setup Wizard.
• Disable the Radio - Select this option to disable this radio, thus prohibiting it from either providing WLAN or sensor
support. Verify this course action with your network administrator before rendering the radio offline.
2. Select Next. The Advanced Setup Wizard displays the Wireless LAN Setup screen to set the access point's Wireless LAN
interface configuration. For more information, see Wireless LAN Setup on page 3-31.
Quick Start 3 - 31
3.1.2.5 Wireless LAN Setup
Advanced Setup Wizard
A Wireless Local Area Network (WLAN) is a data-communications system and wireless local area network that flexibly extends
the functionality of a wired LAN. A WLAN links two or more computers or devices using spread-spectrum or OFDM modulation
based technology. WLANs do not require lining up devices for line-of-sight transmission, and are thus, desirable for wireless
networking. Roaming users can be handed off from one access point to another, like a cellular phone system. WLANs can
therefore be configured around the needs of specific user groups, even when they are not in physical proximity.
Use the Wireless LAN Setup screen to configure the WLAN parameters. Up to two (2) WLANs can be configured for the access
point.
Figure 3-19 Initial Setup Wizard - WAN Configuration screen for Advanced Setup Wizard
1. Set the following WLAN1 Configuration parameters:
• SSID – Configure the SSID for the WLAN.
• WLAN Type – Configure the encryption and authentication to use with this WLAN.
• No Authentication and No Encryption – Configures a network without any authentication. This means any device
can access the network. This option also configures the network without encryption. This means any data transmitted
through the network is in plain text.
• Captive Portal Authentication and No Encryption – Configures a network using a RADIUS server to authenticate
3 - 32 WiNG 5.5.3 Access Point System Reference Guide
users before allowing them on to the network. Once on the network, no encryption is used for the data transmitted
through the network. Select this option to use a Web page (either internally or externally hosted) to authenticate users
before access is granted to the network.
• External RADIUS Server – When selected, provide the IP address of the external RADIUS server used for user authentication. Also enter the shared secret in the RADIUS Shared Secret field.
• Onboard RADIUS Server – When selected, a new screen displays where further configuration can be performed.
For more information, see RADIUS Server Configuration on page 3-17.
• PSK authentication, WPA2 encryption – Configures a network that uses PSK authentication and WPA2 encryption.
Select this option to implement a pre-shared key that must be correctly shared between the access point and requesting
clients on the WLAN.
• WPA Key – Provide a 64 character HEX key or 8-63 character ASCII key. Use the drop-down to specify the type of
key provided. Select ASCII or HEX to specify the key type provided in the WPA Key field.
• EAP Authentication and WPA2 Encryption – Configures a network that uses EAP authentication and WPA2
encryption.Select this option to authenticate clients within this WLAN through the exchange and verification of
certificates.
• External RADIUS Server – When selected, provide the IP address of the external RADIUS server used for user authentication. Also provide the shared secret in the RADIUS Shared Secret field.
• Onboard RADIUS Server – When selected, a new screen is displayed where further configuration can be performed. For more information, see RADIUS Server Configuration on page 3-17.
2. Select Next. The Advanced Setup Wizard displays the RADIUS Server Configuration screen if required. This screen is only
displayed when Onboard RADIUS Server is selected for either Captive Portal Authentication And No Encryption or
for EAP Authentication and WPA2 Encryption fields. For more information, see RADIUS Server Configuration on page
3-17.
Otherwise, the Advanced Setup Wizard displays the System Information screen. For more information, see System
Information on page 3-33.
Quick Start 3 - 33
3.1.2.6 System Information
Advanced Setup Wizard
Use the System Information screen to define the device’s location, contact information for an administrator, and the country
where this access point is deployed.
Figure 3-20 Initial Setup Wizard - System Information screen for the Advanced Setup Wizard
• Location - Provide the location of the access point.
• Contact - Specify the contact information for the administrator. The credentials provided should accurately reflect the
individual responding to service queries.
• Country - Select the country where the access point is deployed. The access point prompts for the correct country code
on the first login. A warning message also displays stating an incorrect country setting may result in illegal radio
operation. Selecting the correct country is central to legal operation. Each country has its own regulatory restrictions
concerning electromagnetic emissions and the maximum RF signal strength that can be transmitted. This is a required
parameter.
• Time Zone - Set the time zone where the access point is deployed. This is a required parameter. The setting should be
complimentary with the selected deployment country.
1. Select Next. The Advanced Setup Wizard displays the Summary and Commit screen to summarize the screens (pages) and
settings updated using the Initial AP Setup Wizard. For more information, see Summary And Commit Screen on page 3-34.
3 - 34 WiNG 5.5.3 Access Point System Reference Guide
3.1.2.7 Summary And Commit Screen
Advanced Setup Wizard
The Summary And Commit screen displays an overview of the updates made using the Advanced Setup Wizard.
There is no user intervention or additional settings required. This screen is an additional means of validating the configuration
before it is deployed. However, if a screen displays settings not intended as part of the initial configuration, the screen can be
selected from within the Navigation Panel and its settings modified accordingly.
Figure 3-21 Initial Setup Wizard - Summary and Commit screen for the Advanced Setup Wizard
If the configuration displays as intended, select Save/Commit to implement these settings to the access point. If additional
changes are warranted, either select the target page from the Navigational Panel, or use the Back button.
Quick Start 3 - 35
3.1.2.8 Adopt to a controller
Advanced Setup Wizard
When the access point is powered on for the first time, it looks for a wireless controller on the default subnet running the same
firmware version and automatically adopts to it.
When Adopted to Controller is selected, further configuration settings are displayed in the same screen. Select Automatic
controller discovery to enable the access point to be discovered and adopted using layer 2 settings.
If preferring layer 3 adoption, select Static Controller Configuration, and define the addresses of the preferred controllers.
When using the static method, define whether the access point receives an IP address using DHCP or if IP resources are
provided statically. Up to two (2) controllers can be defined. The access point will try to adopt to the controller defined in the
Controller 1 field first. Should the controller not be found, the access point tries to adopt to the controller defined in
Controller 2 field.
When preferring layer 3 adoption, configure how an IP is assigned to this access point. Select Use DHCP to use DHCP to assign
an IP address to this access point. If this access point requires a static IP, select Static IP Address/Subnet and provide the
appropriate IP address and net mask. For your convenience, the netmask is automatically set to 24. Also assign the Default
Gateway for forwarding traffic.
Figure 3-22 Initial Setup Wizard - Adoption Settings
NOTE: The best way to administer a network populated by numerous access points is to
configure them directly from their managing controller or Virtual Controller AP. If an
access point’s configuration requires an exception from the wireless controller or Virtual
Controller AP’s assigned profile configuration, the administrator should apply a Device
Override to change just that access point’s configuration.
1. Select the Save/Commit button to save the current configuration. Select the Cancel button to exit the Initial Setup Wizard
without making any changes. Select the Back button to go back to the previous screen of the Initial Setup Wizard.
3 - 36 WiNG 5.5.3 Access Point System Reference Guide
3.2 Using WiNG Express Quick Configuration
Quick Start
NOTE: This section describes the configuration of the following APs running WiNG
Express.
• AP6511E, AP6521E, AP6522E
• AP6562E
• AP7522E, AP7532E
The above access points can also run standard WiNG. For more information on configuring
standard WiNG, see Using the WiNG Initial Setup Wizard on page 3-2. For a complete list
of access points supporting WiNG 5, see About this Guide on page 1.
For an access point running WiNG Express, both the WiNG Express UI and an over the air (OTA) provisioning configuration are
required for a basic setup and network connection. For a non WiNG Express SKUs there is no OTA support, and the access point
utilizes just the UI for its basic setup.
NOTE: For information on using WiNG Express beyond this initial setup, refer to the
Motorola Solutions WiNG Express Users Guide to familiarize yourself with the WiNG
Express Access Point operating system. The guide is available at
https://portal.motorolasolutions.com/Support/US-EN.
To provide the access point a basic configuration and access WiNG Express management functions:
1. Power up the access point.
The access point can be powered using an appropriately rated power adapter, POE injector or POE switch resource.
2. Connect to the access point.
By default, an access point running WiNG Express is preconfigured to broadcast with an SSID WiNGExpress. Connect to
the WiNG Express SSID. For Windows systems, locate the SSID by selecting the network icon on the bottom right corner
of the screen. For MAC systems, locate the SSID by selecting the network icon on the top right corner of the screen.
Figure 3-23 WiNG Express SSID
3. Open a browser (Chrome, Firefox or Internet Explorer) and enter http://express.motorolasolutions.com. The login screen
displays.
Quick Start 3 - 37
Figure 3-24 WiNG Express Login screen
4. Enter the default username admin in the Username field.
5. Enter the default password motorola in the Password field.
6. Select the Login button to load the management interface.
If this is the first time the WiNG Express interface has been accessed, a screen displays prompting for the access point’s
country code.
Figure 3-25 WiNG Express - Select Country Code screen
7. Select the Country Code specific to this access point’s deployment location.
Selecting the correct country is central to legal operation. Each country has its own regulatory restrictions concerning
electromagnetic emissions and the maximum RF signal strength that can be transmitted. Select Apply to implement the
selected Country Code. SKUs only support certain countries (for example: a US SKU only includes US, Guam, Puerto Rico,
American Samoa, US Virgin Islands and Mariana Island).
The access point automatically displays a Dashboard where users can assess network health and conduct a diagnostic
review of access point performance.
NOTE At some point in the access point’s initial setup, the default password should
be changed to enhance the security of the access point and WiNG Express
managed network. Refer to the Configuration > Management screen to
change the default password to a more secure password.
8. Expand the Configuration menu item and select Basic.
3 - 38 WiNG 5.5.3 Access Point System Reference Guide
Figure 3-26 WiNG Express - Basic Configuration Settings screen
9. Set the following Basic Configuration Settings for the access point.
AP Name
Provide a name to be used as this access point’s WiNG Express network identifier. If setting this
access point as a Virtual Controller, each access point managed by this Virtual Controller lists this
access point’s AP Name as its own. This is a required parameter.
Country Code
If country code was not set when the access point was initially powered on, set the country now
to ensure the access point’s legal operation. The access point’s wireless capabilities are disabled
until the country code is set. This is a required parameter.
Virtual Controller
Select this option to define this access point as a Virtual Controller capable of managing and
provisioning up to 24 access points of the same model. If selecting this access point as a Virtual
Controller, those access point managed by this Virtual Controller will list this access point’s AP
Name as its own. Only one access point can be designated as a Virtual Controller.
Timezone
Use the drop-down menu to specify the geographic timezone where the access point is deployed.
Different geographic time zones have daylight savings clock adjustments, so specifying the
timezone correctly is important to account for geographic time changes.
Date & Time
Set the date, hour and minute for the access point’s current system time. Specify whether the
current time is in the AM or PM.
NTP Server
Optionally provide the IP address of a NTP server resource. Network Time Protocol (NTP)
manages time and/or network clock synchronization within the WiNG Express network. NTP is a
client/server implementation. Access points (NTP clients) periodically synchronize their clock
with a master clock (an NTP server). For example, an access point resets its clock to 07:04:59
upon reading a time of 07:04:59 from its designated NTP server.
10. Select Apply to implement the updates.
11. Expand the Configuration menu item and select WAN.
Quick Start 3 - 39
Figure 3-27 WiNG Express - Configuration - WAN Settings screen
12. Refer to the WAN Settings field and set the following:
Enable
Select Enable to allow a connection between the access point and a larger network or outside world
through the WAN port. Disable this option to effectively isolate the access point’s WAN connection.
No connections to a larger network or the Internet will be possible. Clients cannot communicate
beyond the configured subnets.
Port
The default Gigabit Ethernet (GE) port GE1 is used when connecting to the WAN. Supported access
point models have different physical port configurations.
Interface
The default interface is VLAN1.
DHCP Client
Select this option to enable DHCP for the access point WAN connection.1 This is useful, if the target
network or Internet Service Provider (ISP) uses DHCP. DHCP is a protocol that includes mechanisms
for IP address allocation and delivery of host-specific configuration parameters from a DHCP server
to a host. Some of these parameters are IP address, network mask, and gateway. Motorola Solutions
recommends the WAN and LAN ports should not both be configured as DHCP clients.
Static IP
Select this option to bypass DHCP address allocation resources and manually set the IP address for
the access point’s WAN connection. Manually provide the access point’s Static IP/Mask and Default
Gateway.
PPPoE Settings
Optionally enable Point-to-Point Protocol over Ethernet (PPPoE) on the WAN network. If PPPoE is
enabled, provide the required Auth Type, Login Name and Login Password. Server Name and Default
Gateway are optional settings. PPP is a data-link protocol for dialup connections allowing an access
point to use a broadband modem (DSL, cable modem, etc.) for access to high-speed data and
broadband networks. Most DSL providers support (or deploy) the PPPoE protocol. PPPoE uses
standard encryption, authentication, and compression as specified by the PPPoE protocol. PPPoE
enables the access point to establish a point-to-point connection to an ISP over an existing Ethernet
interface.
Static IP / Mask
Specify an IP address for the WAN connection if using static address assignment for the WAN port.
An IP address uses a series of four numbers expressed in dot notation, for example, 190.188.12.1.
Additionally, specify a Mask for the access point’s WAN connection. This number is available from
the ISP for a DSL or cable-modem connection, or from an administrator if the access point connects
to a larger network.
3 - 40 WiNG 5.5.3 Access Point System Reference Guide
Primary/
Secondary DNS/
Default Gateway
If using a static IP or DHCP, enter the Primary and Secondary DNS server resource’s numerical IP
address and Default Gateway.
NOTE: If segmenting traffic between the access point’s WAN and LAN, you’ll need to
create a VLAN. Complete steps 14 and 15 to define the required VLAN. Otherwise,
proceed to step 16.
13. Select Apply to implement the updates.
14. Expand the Configuration menu item and select Access Points. Each AP Name displays as a link that can be selected
to update the configuration of that specific access point. Select a target AP Name link from amongst those displayed in the
Access Points screen.
Figure 3-28 WiNG Express - Access Point Edit screen
Refer to the LAN IP Interface Settings field, and add a VLAN and Static IP as required for enabling DHCP (within the
Configuration > Services screen) for client IP address requests and ensuring routable traffic.
15. Select Apply to commit the updates to the selected access point’s configuration.
16. Expand the Configuration menu item and select Wireless.
The Wireless screen displays fields where Radio Settings and Wireless LAN settings can be defined. Motorola Solutions
recommends default radio settings remain as is for the access point’s basic setup. For information on using WiNG Express
beyond this initial setup, refer to the Motorola Solutions WiNG Express Users Guide. The guide is available at
https://portal.motorolasolutions.com/Support/US-EN.
Quick Start 3 - 41
In respect to the Radio Settings, the professional installer should be aware of the following:
Figure 3-29 WiNG Express - Wireless Screen - Radio Settings
NOTE: The above example includes a field for setting the antenna gain. This setting is
only available for external antenna model access points and does not display for internal
antenna model access points.
• The Channels available for configuration are channels for which the product is approved in its selected country. The
professional installer must ensure the product is set to operate under conditions, and on channels, approved by country
regulations.
• Selecting Smart as the Power setting automatically configures radio power to not exceed the maximum power allowed
by the defined country. For static power settings, the professional installer must ensure the configured power levels are
compliant with local and regional regulations. The county selected automatically limits the maximum output power that
can be set.
• For external antenna model access points, configure the Antenna Gain based on the antenna used in the deployment.
The set gain value should include the antenna gain, along with any additional components, such as extension cables
used between the access point and the antenna.
In respect to the Wireless LAN settings, the professional installer should be aware WiNG Express access points ship with
a default WLAN (WINGExpress). However, this WLAN does not provide adequate authentication to protect from
unauthorized user access. Motorola Solutions recommends an additional WLAN configuration be created and validated
before deleting default WLAN.
Figure 3-30 WiNG Express - Wireless Screen - Wireless LAN
3 - 42 WiNG 5.5.3 Access Point System Reference Guide
17. To create a new WLAN, select + Add from the upper, left-hand side of the Wireless LAN field.
Figure 3-31 WiNG Express - Wireless LAN - Add screen
18. Set the following configuration attributes for the new WLAN:
Name
Provide a unique name for the WLAN as its WiNG Express network identifier. This is a required
setting.
Enable
Select this setting to enable this WLAN within the WiNG Express managed access point network
and to provide some measure of data protection not available in the default WLAN.
SSID
Specify the WLAN's SSID. The WLAN SSID is case sensitive and alphanumeric. SSID length
should not exceed 32 characters. This is a required setting. Select Client-To-Client
Communication to enable client interoperability within this WLAN. The default is disabled,
meaning clients are not allowed to exchange packets with other clients. It does not necessarily
prevent clients on other WLANs from sending packets to this WLAN, but if this setting is disabled
on the other WLAN, clients are not permitted to interoperate at all.
WLAN Type
The screen displays with the Open option selected. Naming and saving such a policy (as is) would
provide no security and might only make sense in a network wherein no sensitive data is either
transmitted or received. This default setting is not recommended.
If selecting Secure-PSK, enter a WPA2 Key to password protect the WLAN. Define whether the
key is entered in ASCII or HEX characters. Selecting Show to expose the key is not recommended.
If selecting Secure-802.1x, provide an IP address (or hostname) and a shared secret (password)
used to access an external RADIUS server resource designated to validate user requests to the
access point’s WLAN resources.
Selecting Guest displays fields for captive portal Web page creation, and is beyond the scope of
this basic WiNG Express access point configuration.
Band
Select the 2.4 GHz and/or 5 GHz radio bands supports by the WiNG Express managed access point
and its connected client traffic. If this access point is designated as a Virtual Controller AP, both
radio bands should be enabled.
Quick Start 3 - 43
VLAN
Use the spinner control to specify a VLAN from 1 - 4,094 for this WLAN. When a client associates
with a WLAN, the client is assigned a VLAN by load balance distribution. Motorola Solutions
recommends you do not use VLAN 1 with the WLAN configuration if the WAN port has been
enabled.
Description
Optionally enter a WLAN description to further describe the WLAN’s deployment objective within
the WiNG Express managed network.
19. Select Apply to commit the updates to the access point’s WLAN configuration.
20. Expand the Configuration menu item and select Services.
Figure 3-32 WiNG Express - Services screen
21. Select Enable DHCP Server to ensure the access point can provision IP addresses to requesting clients over the specified
interface.
NOTE: A VLAN must be already configured and available to the DHCP server as a viable
interface between the access point and requesting client. Refer to the LAN IP Interface
Settings field (within the Edit Access Point screen), and add a VLAN.
Select + Add and provide a starting and ending IP range of addresses that constitute a pool of addresses available to
requesting clients.
22. Select Apply to commit the updates to the access point’s DHCP configuration.
23. At this point, you are ready to connect to the WiNG Express managed network using the security restrictions applied to the
newly created WLAN. Ensure the new secure WLAN has been enabled, and check whether a client is able to access the
WiNG Express network.
3 - 44 WiNG 5.5.3 Access Point System Reference Guide
Figure 3-33 WiNG Express Secure SSID
NOTE: Only when the new WLAN configuration is validated as accessible should the
existing WiNG Express default WLAN be deleted.
CHAPTER 4
DASHBOARD
The dashboard allows network administrators to review and troubleshoot the operation of the devices comprising the access
point managed network. Use the dashboard to review the current network topology, assess the network’s component health
and diagnose problematic device behavior.
By default, the Dashboard screen displays the System Dashboard, which is the top level in the device hierarchy.
The dashboard provides the following tools and diagnostics:
• Dashboard
• Network View
4-2
WiNG 5.5.3 Access Point System Reference Guide
4.1 Dashboard
Dashboard
The Dashboard screen displays device information organized by device association and inter-connectivity between an access
point and connected wireless clients.
To review dashboard information:
1. Select Dashboard. Expand the System menu item on the upper, left-hand, side of the UI and select either an access point
or connected client.
The Dashboard screen displays the Health tab by default.
Figure 4-1 Dashboard - Health tab
4.1.1 Dashboard Conventions
The Dashboard screen displays device information using the following conventions:
• Health – Displays the state of the access point managed network.
• Inventory – Displays the physical devices managed by the access point.
Dashboard
4.1.1.1 Health
Dashboard Conventions
The Health tab displays performance and utilization data for the access point managed network.
Figure 4-2 Dashboard - Health tab
For more information see:
• Device Details
• Radio RF Quality Index
• Radio Utilization Index
• Client RF Quality Index
4.1.1.1.1 Device Details
Health
The Device Details field displays model and version information.
4-3
4-4
WiNG 5.5.3 Access Point System Reference Guide
Figure 4-3 Dashboard - Health tab - Device Details field
The Device Details field displays the name assigned to the selected access point, factory encoded MAC address, primary IP
address, model type, RF Domain, software version, uptime, CPU and RAM information and system clock. Use this data to
determine whether a software upgrade is warranted, or if the system clock needs adjustment.
Periodically select Refresh (at the bottom of the screen) to update the data displayed.
4.1.1.1.2 Radio RF Quality Index
Dashboard Conventions
The Radio RF Quality Index displays a RF quality table for the access point’s single default RF Domain. It is a percentage of
the overall effectiveness of the RF environment. It is a function of the data rate in both directions, the retry rate and the error
rate.
Figure 4-4 Dashboard - Health tab - Radio RF Quality Index field
RF Quality displays as the average quality index for the single RF Domain utilized by the access point. The table lists the bottom
five (5) RF quality values for the RF Domain.
The quality is measured as:
• 0-20 – Very poor quality
• 20-40 – Poor quality
• 40-60 – Average quality
• 60-100 – Good quality
The access point’s RF Domain allows an administrator to assign configuration data to multiple devices deployed in a common
coverage area, such as in a floor, building or site. The RF Domain contains policies that can determine a Smart RF or WIPS
configuration.
Use this diagnostic information to define measures to improve radio performance in respect to wireless client load and radio
band.
Dashboard
4-5
Periodically select Refresh (at the bottom of the screen) to update the RF quality data.
4.1.1.1.3 Radio Utilization Index
Dashboard Conventions
The Radio Utilization Index displays how efficiently the RF medium is used by the access point. Traffic utilization is defined
as the percentage of throughput relative to the maximum possible throughput.
Refer to the number or errors and dropped packets to assess radio performance relative to the number of packets both
transmitted and received.
Periodically select Refresh (at the bottom of the screen) to update the radio utilization information displayed.
Figure 4-5 Dashboard - Health tab - Radio Utilization Index field
4.1.1.1.4 Client RF Quality Index
Dashboard Conventions
The Client RF Quality Index displays a list of the worst 5 performing clients managed by the selected access point.
Figure 4-6 Dashboard - Health tab - Client RF Quality Index field
4-6
WiNG 5.5.3 Access Point System Reference Guide
1. The Client RF Quality Index displays the following:
Worst 5
Lists the worst 5 performing client radios connected to the access point. The RF Quality
Index measures the overall effectiveness of the RF environment as a percentage. Its a
function of the connect rate in both directions, as well as the retry rate and the error rate.
The quality is measured as:
• 0-20 – Very poor quality
• 20-40 – Poor quality
• 40-60 – Average quality
• 60-100 – Good quality
Client MAC
Displays the factory encoded MAC address assigned to each connected radio listed. Use
this information to assist in the identification of poorly performing radios.
Retry Rate
Lists the number of retries attempted to re-connect with the listed radio.
2. Periodically select Refresh (at the bottom of the screen) to update client RF quality.
Dashboard
4-7
4.1.1.2 Inventory
Dashboard Conventions
The Inventory tab displays information relative to the devices managed by the selected access point. The Inventory screen
affords a system administrator an overview of the number and state of managed devices. The screen contains links to display
more granular data specific to a radio.
Figure 4-7 Dashboard - Inventory tab
The Inventory tab is partitioned into the following fields:
• Radio Types
• WLAN Utilization
• Wireless Clients
• Clients by Radio Type
4-8
WiNG 5.5.3 Access Point System Reference Guide
4.1.1.2.1 Radio Types
Inventory
The Radio Types field displays the total number and types of radios managed by the selected access point.
Figure 4-8 Dashboard - Inventory tab - Radio Types field
Refer to the Total Radios column to review the number of managed radios. Additionally, use the bar graphs to assess the
number WLANs utilized by supported radio bands.
Periodically select Refresh (at the bottom of the screen) to update the radio information.
4.1.1.2.2 WLAN Utilization
Inventory
The WLAN Utilization field displays the top 5 WLANs utilized by this access point in respect to client support. The index
measures how efficiently the RF medium is utilized. It is defined as a percentage of the current throughput relative to the
maximum throughput possible.
The quality is measured as:
• 0-20 – Very low utilization
• 20-40 – Low utilization
• 40-60 – Moderate utilization
• 60 and above – High utilization
Figure 4-9 Dashboard - Inventory tab - WLAN Utilization field
Periodically select Refresh (at the bottom of the screen) to update WLAN utilization information.
4.1.1.2.3 Wireless Clients
Inventory
The Wireless Clients field displays information about the wireless clients managed by the selected access point.
Dashboard
4-9
Figure 4-10 Dashboard - Inventory tab - Wireless Clients field
Information within the Wireless Clients field is presented in two tables. The first table lists the total number of wireless
clients managed by this access point. The second table lists an ordered ranking of radios based on their supported client count.
Use this information to assess if an access point managed radio is optimally deployed in respect to its radio type and intended
client support requirements.
NOTE: AP6522, AP6522M, AP6532, AP6562, AP71XX, AP75XX, AP81XX and AP82XX
model access points can support up to 256 client connections to a single access point.
AP6511 and AP6521 model access points (both single radio models) can support up to
128 client connections per access point.
4.1.1.2.4 Clients by Radio Type
Inventory
The Clients by Radio Type field displays a bar graph illustrating the number of connected clients currently operating on
supported radio bands.
Figure 4-11 Dashboard - Inventory tab - Clients by Radio Type field
For 5.0 GHz, clients are displayed supporting the 802.11a, 802.11an and 802.11ac radio bands. For 2.4 GHz, clients are displayed
supporting the 802.11b, 802.11bg, and 802.11bgn radio bands. Use this information to determine if all the access point’s client
radio bands are optimally supported for the access point’s radio coverage area.
4 - 10 WiNG 5.5.3 Access Point System Reference Guide
4.2 Network View
Dashboard
The Network View displays device topology association between a selected access point, its RF Domain and its connected
clients.
Access points and clients can be selected and viewed using various color schemes in respect to neighboring access points,
connected devices and performance criteria. Display options can be utilized to review device performance and utilization, as
well as the RF band, channel and vendor. For more information, see Network View Display Options on page 4-11.
To review a device’s Network Topology, select Dashboard > Network View.
Figure 4-12 Network View Topology
The left-hand side of the Network View screen contains an expandable System Browser where access points can be selected
and expanded to display connected clients. Navigate the System Browser to review device connections within the access point
managed network. Many of these peer access points are available for connection to access points in Virtual Controller AP
mode.
Dashboard 4 - 11
Figure 4-13 Network View - System Browser
4.2.1 Network View Display Options
Network View
1. Select the blue Options link right under the Network View banner to display a menu for different device interaction display
options.
Figure 4-14 Network View - Display Options
2. The following display filter options are available:
• None - Select this option to keep the Network View display as it currently appears, without any additional color or device
interaction adjustments.
• Utilization – Select this option to filter based on the percentage of current throughput relative to maximum throughput.
Utilization results include: Red (Bad Utilization), Orange (Poor Utilization), Yellow (Fair Utilization) and Green (Good
Utilization).
• Quality – Select this option to filter based on the overall RF health. RF health is a ratio of connection rate, retry rates,
4 - 12 WiNG 5.5.3 Access Point System Reference Guide
and error rates. Quality results include: Red (Bad Quality), Orange (Poor Quality), Yellow (Fair Quality) and Green (Good
Quality).
• Vendor – Displays the device manufacturer.
• Band – Select this option to filter based on the 2.4 or 5.0 GHz radio band of connected clients. Results include: Yellow
(2.4 GHz radio band) and Blue (5.0 GHz radio band). Selecting Band is a good way to determine whether 2.4 and 5.0 GHz
radios are optimally deployed in respect to the access point client loads on both bands.
• Channel - Use the drop-down menu to filter whether device connections should be displayed in either the 2.4 or 5.0 GHz
band.
• Search - Enter search criteria in the provided text field and select the Update button to isolate located variables in blue
within the Network View display.
3. Select the Update button to update the display with the changes made to the filter options. Select Close to close the
options field and remove it from the Network View.
4.2.2 Device Specific Information
Network View
A device specific information screen is available for individual devices selected from within the Network View (not the System
Browser). The screen displays the name assigned to the device, its model, factory encoded MAC address, number of radios
within the device, number of connected clients, as well as the highest and lowest reported quality, utilization and Signal to
Noise Ratio (SNR). This information cannot be modified by the administrator.
Figure 4-15 Network View - Device Specific Information
Optionally select the Statistics link at the bottom of the display to open a screen where access point device data can be
reviewed on a much more granular level. For more information, see Health on page 4-3.
CHAPTER 5
DEVICE CONFIGURATION
Access points can either be assigned unique configurations to support a particular deployment objective or have an existing RF
Domain or profile configuration modified (overridden) to support a requirement that deviates its configuration from the
configuration shared by its peer access points.
Refer to the following to set an access point’s sensor functionality, Virtual Controller AP designation, and license and certificate
usage configuration:
• RF Domain Configuration
• System Profile Configuration
• Managing Virtual Controllers
• Overriding a Device Configuration
• Managing an Event Policy
An RF Domain allows an administrator to assign comparable configuration data to multiple access points deployed in a common
coverage area (floor, building or site). In such instances, there are many configuration attributes these devices share, as their
general client support roles are quite similar. However, access point configurations may need periodic refinement and overrides
from their original RF Domain administered design. For more information, see RF Domain Overrides on page 5-192.
Profiles enable administrators to assign a common set of configuration parameters and policies to access points of the same
model. Profiles assign shared network, wireless and security parameters to access points across a large, multi segment, site.
The configuration parameters within a profile are based on the hardware model the profile was created to support. To define
a configuration profile for a specific access point model, refer to System Profile Configuration on page 5-14.
However, device Profile configurations may need periodic refinement from their original administered design. Consequently, a
device profile could be applied an override from a configuration shared amongst numerous peer devices deployed within a
particular site. For more information, see Device Overrides on page 5-195.
5-2
WiNG 5.5.3 Access Point System Reference Guide
5.1 RF Domain Configuration
Device Configuration
An access point’s configuration consists of numerous elements including a RF Domain, WLAN and device specific settings. RF
Domains are used to assign regulatory, location and relevant policies to access points of the same model. For example, an
AP6532 RF Domain can only be applied to another AP6532 model.
An access point RF Domain allows an administrator to assign configuration data to multiple access points deployed in a
common coverage area (floor, building or site). In such instances, there are many configuration attributes these access points
share, as their general client support roles are quite similar.
However, an access point’s RF Domain configuration may need periodic refinement from its original RF Domain designation.
Unlike a RFS series wireless controller, an access point supports just a single RF domain. Thus, administrators should be aware
that overriding an access point’s RF Domain configuration results in a separate configuration that must be managed in addition
to the RF Domain configuration. Thus, a configuration should only be overridden when needed. For more information, see RF
Domain Overrides on page 5-192.
The access point’s RF Domain can have a WIPS sensor configuration applied. For more information on defining a WIPS sensor
configuration for use with the access point’s RF Domain, see RF Domain Sensor Configuration on page 5-4.
To set a RF Domain configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select RF Domains from the options on left-hand side of the UI.
The RF Domain Basic Configuration tab displays by default with the access point RF Domain activated.
Figure 5-1 RF Domain - Basic Configuration tab
Device Configuration
5-3
4. Define the following Basic Configuration values for the access point RF Domain:
Location
Assign the physical location of the RF Domain. This name could be as specific as the floor
of a building, or as generic as an entire site. The location defines the physical area where
a common set of access point configurations are deployed and managed by the RF Domain
policy.
Contact
Provide the name of the contact E-mail (or administrator) assigned to respond to events
created by or impacting the RF Domain.
Time Zone
Set the geographic time zone for the RF Domain. The RF Domain can contain unique
country codes and time zone information to access points deployed across different states
or countries, thus making them ideal for managing device configurations across different
geographical deployments.
Country
Define the two-digit country code set for the RF Domain. The country code must be set
accurately to avoid the policy’s illegal operation, as device radios transmit in specific
channels unique to the country of operation.
Controller Managed
Select the option to indicate this RF Domain is managed by adopting controllers or service
platforms. This option is disabled by default.
5. Refer to the Smart Scan field to define the channels for smart scan.
Enable Dynamic Channel Select the option to enable dynamic channel scan.
2.4 GHz Channels
Use the Select drop-down menu to select channels to scan in the 2.4 GHz band. Selected
channels are highlighted with a grey background. Unselected channels are highlighted
with a white background. Multiple channels can be selected at the same time.
5.0 GHz Channels
Use the Select drop-down menu to select channels to scan in the 5.0 GHz band. Selected
channels are highlighted with a grey background. Unselected channels are highlighted
with a white background. Multiple channels can be selected at the same time.
6. Refer to the Statistics field to define how RF Domain statistics are updated.
Update Interval
Set a statistics update interval of 0 or 5-3600 seconds for updates retrieved from the
access point.
7. Select the Add Row button to add a new row to the Statistics update table.
Window Index
Use the spinner control to set a numerical index used as an identifier for each RF Domain
statistic defined.
Sample Interval
Use the spinner control to define the interval (in seconds) used by the access point to
capture windowed statistics supporting the RF Domain configuration. The default is 5
seconds.
Window Size
Use the spinner control to set the number of samples used by the controller to define RF
Domain statistics. The default value is 3.
To delete a row in the Statistics update table, select the Delete icon next to the row in the table.
8. Use the Initial Setup Wizard to configure the device. For more information on using the Initial Setup Wizard, see Using
the WiNG Initial Setup Wizard on page 3-2.
9. Select OK to save the changes to the Basic Configuration, or select Reset to revert to the last saved configuration.
5-4
WiNG 5.5.3 Access Point System Reference Guide
5.1.1 RF Domain Sensor Configuration
RF Domain Configuration
The Motorola Solutions’ Wireless Intrusion Protection System (WIPS) protects wireless client and access point radio traffic
from attacks and unauthorized access. WIPS provides tools for standards compliance and around-the-clock wireless network
security in a distributed environment. WIPS allows administrators to identify and accurately locate attacks, rogue devices and
network vulnerabilities in real time and permits both a wired and wireless lockdown of wireless device connections upon
acknowledgement of a threat.
In addition to dedicated Motorola Solutions AirDefense sensors, an access point radio can function as a sensor and upload
information to a dedicated WIPS server (external to the access point). Unique WIPS server configurations can be used to ensure
a WIPS server configuration is available to support the unique data protection needs of a RF Domain.
WIPS is not supported on a WLAN basis, rather, sensor functionality is supported on the access point radio(s) available to each
managed WLAN. When an access point radio is functioning as a WIPS sensor, it is able to scan in sensor mode across all legal
channels within the 2.4 and 5.0 GHz band. Sensor functionality is not provided by the access point alone. The access point
works in conjunction with a dedicated WIPS server.
To define a WIPS server configuration used with the access point’s RF Domain:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select RF Domains from the options on left-hand side of the UI.
4. Select the Sensor Configuration tab.
Figure 5-2 RF Domain - Sensor Configuration tab
5. Either select the + Add Row button to create a new WIPS server configuration or highlight an existing Sensor Server
Configuration and select the Delete icon to remove it.
6. Use the spinner control to assign a numerical Server ID to each WIPS server defined. The server with the lowest defined
ID is the first reached by the access point. The default ID is 1.
7. Provide the numerical (non DNS) IP Address of each server used as a WIPS sensor server by the RF Domain.
8. Use the spinner control to specify the Port of each WIPS server. The default port is 443.
Device Configuration
5-5
9. Select OK to save the changes to the AirDefense WIPS configuration, or select Reset to revert to the last saved
configuration.
5.1.2 RF Client Name Configuration
The Client Name Configuration screen displays clients connected to RF Domain member access point adopted by networked
controllers or service platforms. Use the screen to associate administrator assigned client names to specific connected client
MAC addresses for improved client management.
To define a client name configuration used with RF Domain member devices:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select RF Domains from the options on left-hand side of the UI.
4. Select the Client Name tab.
Figure 5-3 RF Domain Client Configuration screen
5. Either select the + Add Row button to create a new client configuration or highlight an existing configuration and select
the Delete icon to remove it.
6. Enter the client’s factory coded MAC address.
7. Assign a Name to the RF Domain member access point’s connected client to assist in its easy recognition.
8. Select OK to save the changes to the configuration, or select Reset to revert to the last saved configuration.
5.1.3 RF Domain Alias Configuration
RF Domain Configuration
With large deployments, the configuration of remote sites utilizes a set of shared attributes, of which a small set of attributes
are unique for each location. For such deployments, maintaining separate configuration (WLANs, profiles, policies and ACLs)
for each remote site is complex. Migrating any global change to a particular configuration item to all the remote sites is a
complex and time consuming operation.
Also, this practice does not scale gracefully for quick growing deployments.
5-6
WiNG 5.5.3 Access Point System Reference Guide
An alias enables an administrator to define a configuration item, such as a hostname, as an alias once and use the defined
alias across different configuration items such as multiple ACLs.
Once a configuration item, such as an ACL, is utilized across remote locations, the alias used in the configuration item (ACL) is
modified to meet local deployment requirement. Any other ACL or other configuration items using the modified alias also get
modified, simplifying maintenance at the remote deployment.
Aliases have scope depending on where the alias is defined. Alias are defined with the following scopes:
• Global aliases are defined from the Configuration > Network > Alias screen. Global aliases are available for use globally
across all devices, profiles and RF Domains in the system.
• Profiles aliases are defined from Configuration > Devices > System Profile > Network > Alias screen. These aliases
are available for use to a specific group of wireless controllers or access points. Alias values defined in this profile override
alias values defined within global aliases.
• RF Domain aliases are defined from Configuration > Devices > RF Domain > Alias screen. These aliases are available
for use for a site as a RF Domain is site specific. RF Domain alias values override alias values defined in a global alias or a
profile alias configuration.
• Device aliases are defined from Configuration > Devices > Device Overrides > Network > Alias screen. Device alias
are utilized by a single device only. Device alias values override alias values defined in a global alias, profiles alias or RF
Domain alias configuration.
Using an alias, configuration changes made at a remote location override any updates at the management center. For example,
if an Network Alias defines a network range as 192.168.10.0/24 for the entire network, and at a remote deployment location,
the local network range is 172.16.10.0/24, the network alias can be overridden at the deployment location to suit the local
requirement. For the remote deployment location, the network alias works with the 172.16.10.0/24 network. Existing ACLs
using this network alias need not be modified and will work with the local network for the deployment location. This simplifies
ACL definition and management while taking care of specific local deployment requirements.
Alias can be classified as:
• Network Basic Alias
• Network Group Alias
• Network Service Alias
Device Configuration
5-7
5.1.3.1 Network Basic Alias
RF Domain Configuration
A basic alias is a set of configurations that consist of VLAN, Host, Network and Address Range alias configurations. VLAN
configuration is a configuration for optimal VLAN re-use and management for local and remote deployments. A host alias
configuration is for a particular host device’s IP address. A network alias configuration is utilized for an IP address on a
particular network. An address range alias is a configuration for a range of IP addresses.
A basic alias configuration can contain multiple instances for each of the five (5) alias types.
To edit or delete a basic alias configuration:
1. Select Configuration tab from the Web user interface.
2. Select Devices.
3. Select RF Domain.
4. Select the Basic Alias tab.
Figure 5-4 RF Domain - Basic Alias screen
5. Select + Add Row to define VLAN Alias settings:
5-8
WiNG 5.5.3 Access Point System Reference Guide
Use the VLAN Alias field to create unique aliases for VLANs that can be used at different deployments. For example, if a
named VLAN is defined as 10 for the central network, and the VLAN is set at 26 at a remote location, the VLAN can be
overridden at the deployment location with an alias. At the remote deployment location, the network is functional with a
VLAN ID of 26 but utilizes the name defined at the centrally managed network. A new VLAN need not be created specifically
for the remote deployment.
Name
If adding a new VLAN Alias, provide it a distinguishing name up to 32 characters. The alias
name always starts with a dollar sign ($).
VLAN
Use the spinner control to set a numeric VLAN from 1 - 4094.
A VLAN alias can be used to replace VLANs in the following locations:
• Bridge VLAN
• IP Firewall Rules
• L2TPv3
• Switchport
• Wireless LANs
6. Select + Add Row to define Address Range Alias settings:
Use the Address Range Alias field to create aliases for IP address ranges that can be utilized at different deployments.
For example, if an ACL defines a pool of network addresses as 192.168.10.10 through 192.168.10.100 for an entire network,
and a remote location’s network range is 172.16.13.20 through 172.16.13.110, the remote location’s ACL can be overridden
using an alias. At the remote location, the ACL works with the 172.16.13.20-110 address range. A new ACL need not be
created specifically for the remote deployment location.
Name
If adding a new Address Alias, provide it a distinguishing name up to 32 characters. The
alias name always starts with a dollar sign ($).
Start IP
Set a starting IP address used with a range of addresses utilized with the address range
alias.
End IP
Set a ending IP address used with a range of addresses utilized with the address range
alias.
An address range alias can be used to replace an IP address range in IP firewall rules.
7. Select + Add Row to define Host Alias settings:
Use the Host Alias field to create aliases for hosts that can be utilized at different deployments. For example, if a central
network DNS server is set a static IP address, and a remote location’s local DNS server is defined, this host can be
overridden at the remote location. At the remote location, the network is functional with a local DNS server, but uses the
name set at the central network. A new host need not be created at the remote location. This simplifies creating and
managing hosts and allows an administrator to better manage specific local requirements
Name
If adding a new Host Alias, provide it a distinguishing name up to 32 characters. The alias name
always starts with a dollar sign ($).
Host
Set the IP address of the host machine.
A host alias can be used to replace hostnames in the following locations:
• IP Firewall Rules
• DHCP
Device Configuration
5-9
8. Select + Add Row to define Network Alias settings:
Use the Network Alias field to create aliases for IP networks that can be utilized at different deployments. For example,
if a central network ACL defines a network as 192.168.10.0/24, and a remote location’s network range is 172.16.10.0/24,
the ACL can be overridden at the remote location to suit their local (but remote) requirement. At the remote location, the
ACL functions with the 172.16.10.0/24 network. A new ACL need not be created specifically for the remote deployment.
This simplifies ACL definition and allows an administrator to better manage specific local requirements.
Name
If adding a new Network Alias, provide it a distinguishing name up to 32 characters. The alias
name always starts with a dollar sign ($).
Network
Provide a network address in the form of host/mask.
A network alias can be used to replace network declarations in the following locations:
• IP Firewall Rules
• DHCP
9. Select + Add Row to define String Alias settings:
Use the String Alias field to create aliases for strings that can be utilized at different deployments. For example, if the
main domain at a remote location is called loc1.domain.com and at another deployment location it is called
loc2.domain.com, the alias can be overridden at the remote location to suit the local (but remote) requirement. At one
remote location, the alias functions with the loc1.domain.com domain and at the other with the loc2.domain.com domain.
Name
If adding a new String Alias, provide it a distinguishing name up to 32 characters. The alias
name always starts with a dollar sign ($).
Value
Provide a string value to use in the alias.
A string alias can be used to replace a domain name string in DHCP.
10. Select OK when completed to update the basic alias rules. Select Reset to revert the screen back to its last saved
configuration.
5 - 10 WiNG 5.5.3 Access Point System Reference Guide
5.1.3.2 Network Group Alias
RF Domain Configuration
A network group alias is a set of configurations that consist of host and network configurations. Network configurations are
complete networks in the form 192.168.10.0/24 or IP address range in the form 192.168.10.10-192.168.10.20. Host
configuration is in the form of single IP address, 192.168.10.23.
A network group alias can contain multiple definitions for host, network, and IP address range. A maximum of eight (8) host
entries, eight (8) network entries and eight (8) IP addresses range entries can be configured inside a network group alias. A
maximum of 32 network group alias entries can be created.
A network group alias is used in IP firewall rules to substitute hosts, subnets and IP address ranges:
To edit or delete a network alias configuration:
1. Select Configuration tab from the Web user interface.
2. Select Devices.
3. Select RF Domain.
4. Select the Network Group Alias tab.
Figure 5-5 RF Domain - Network Group Alias screen
Name
Displays the administrator assigned name of the network group alias.
Host
Displays all host aliases configured in this network group alias. Displays a blank column if no
host alias is defined.
Network
Displays all network aliases configured in this network group alias. Displays a blank column if
no network alias is defined.
Device Configuration 5 - 11
5. Select Edit to modify the attributes of an existing policy or Delete to remove obsolete policies from the list of those
available. Select Add to create a new Network Group Alias. Copy to copy an existing policy or Rename to rename an
existing policy.
Figure 5-6 RF Domain - Network Group Alias Add screen
6. If adding a new Network Group Alias, provide it a name of up to 32 characters.
NOTE: The Network Group Alias Name always starts with a dollar sign ($).
7. Define the following network group alias parameters:
Host
Specify the Host IP address for up to eight IP addresses supporting network aliasing. Select the
down arrow to add the IP address to the table.
Network
Specify the netmask for up to eight IP addresses supporting network aliasing. Subnets can
improve network security and performance by organizing hosts into logical groups. Applying the
subnet mask to an IP address separates the address into a host address and an extended
network address. Select the down arrow to add the mask to the table.
8. Within the Range table, use the + Add Row button to specify the Start IP address and End IP address for the alias range
or double-click on an existing an alias range entry to edit it.
5 - 12 WiNG 5.5.3 Access Point System Reference Guide
9. Select OK when completed to update the network group alias rules. Select Reset to revert the screen back to its last saved
configuration.
5.1.3.3 Network Service Alias
RF Domain Configuration
A network service alias is a set of configurations that consist of protocol and port mappings. Both source and destination ports
are configurable. For each protocol, up to 2 source port ranges and up to 2 destination port ranges can be configured. A
maximum of 4 protocol entries can be configured per network service alias.
Use a service alias to associate more than one IP address to a network interface, providing multiple connections to a network
from a single IP node.
Network Service Alias can be used in the following location to substitute protocols and ports:
• IP Firewall Rules
To edit or delete a service alias configuration:
1. Select Configuration tab from the Web user interface.
2. Select Devices.
3. Select RF Domain.
4. Select the Network Service Alias tab.
Figure 5-7 RF Domain - Network Service Alias screen
5. Select Edit to modify the attributes of an existing policy or Delete to remove obsolete policies from the list of those
available. Select Add to create a new Network Service Alias.
Device Configuration 5 - 13
Figure 5-8 RF Domain - Network Service Alias Add screen
6. If adding a new Network Service Alias, provide it a name up to 32 characters.
NOTE: The Network Service Alias Name always starts with a dollar sign ($).
7. Within the Range field, use the + Add Row button to specify the Start IP address and End IP address for the service alias
range or double-click on an existing service alias range entry to edit it.
Protocol
Specify the protocol for which the alias has to be created. Use the drop-down menu to select
the protocol (eigrp, gre, icmp, igmp, ip, vrrp, igp, ospf, tcp and udp). Select other if the protocol
is not listed. When a protocol is selected, its protocol number is automatically selected.
Source Port
(Low and High)
Note: Use this field only if the protocol is tcp or udp.
Specify the source ports for this protocol entry. A range of ports can be specified. Select the
Enter Range button next to the field to enter a lower and higher port range value. Up to eight
(8) such ranges can be specified.
Destination Port
(Low and High)
Note: Use this field only if the protocol is tcp or udp.
Specify the destination ports for this protocol entry. A range of ports can be specified. Select
the Enter Range button next to the field to enter a lower and higher port range value. Up to eight
(8) such ranges can be specified.
8. Select OK when completed to update the network service alias rules. Select Reset to revert the screen back to its last
saved configuration.
5 - 14 WiNG 5.5.3 Access Point System Reference Guide
5.2 System Profile Configuration
Device Configuration
An access point profile enables an administrator to assign a common set of configuration parameters and policies to access
points of the same model. Profiles can be used to assign common or unique network, wireless and security parameters to
across a large, multi segment, site. The configuration parameters within a profile are based on the hardware model the profile
was created to support. All WING 5 supported access point models supported a single profile that is either shared amongst
multiple access point or not. The central benefit of a profile is its ability to update access points collectively without having to
modify individual configurations.
A profile allows access point administration across large wireless network segments. However, an administrator cannot
manage more than one model’s profile and its set configuration policies at any one time. Therefore, an administrator should
manage multiple access points directly from the Virtual Controller AP. As individual access point updates are made, the access
point no longer shares the profile based configuration it previously deployed. Changes made to the profile are automatically
inherited by all member access points, but not those who have had their configuration overridden from their previous profile
designation. These devices require careful administration, as they no longer can be tracked and as profile members. Their
customized configurations overwrite their profile assignments until the profile can be re-applied to the access point.
Each access point model is automatically assigned a default profile. The default profile is available within the access point’s
configuration file. Default profiles are ideal for single site deployments where several access points may need to share a
common configuration.
NOTE: A central difference compared to the default-radio configurations in previous
releases is default profiles are used as pointers for an access point’s configuration, not
just templates from which the configuration is copied. Therefore, if a change is made in
one of the parameters in a profile, the change is reflected across all access points using
that profile.
For more information, refer to the following:
• General Profile Configuration
• Profile Radio Power
• Profile Adoption (Auto Provisioning) Configuration
• Profile Wired 802.1X Configuration
• Profile Interface Configuration
• Profile Network Configuration
• Profile Security Configuration
• Virtual Router Redundancy Protocol (VRRP) Configuration
• Profile Critical Resources
• Profile Services Configuration
• Profile Management Configuration
• Mesh Point Configuration
• Advanced Profile Configuration
• Environmental Sensor Configuration
Device Configuration 5 - 15
5.2.1 General Profile Configuration
System Profile Configuration
An access point profile requires unique clock synchronization settings as part of its general configuration.
Network time protocol (NTP) manages time and/or network clock synchronization within the access point managed network.
NTP is a client/server implementation. The access point periodically synchronizes its clock with a master clock (an NTP server).
For example, the access point resets its clock to 07:04:59 upon reading a time of 07:04:59 from its designated NTP server.
Use the General screen of System Profile configuration screen to define whether the access point can act as a RF Domain
manager for its RF Domain.
To define a profile’s general configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
General configuration options display by default, with the profile activated for use with this access point model.
Figure 5-9 General Profile screen
4. Select + Add Row below the Network Time Protocol (NTP) table to define the configurations of NTP server resources used
to obtain system time. Up to 3 NTP servers can be configured. Set the following parameters to define the NTP configuration:
AutoKey
Select this option to enable an autokey configuration for the NTP resource. The default
setting is disabled.
Key
If an autokey is not being used, manually enter a 64 character maximum key the access
point and NTP resource share to securely interoperate.
Preferred
Select this option designate this particular NTP resource as preferred. If designating
multiple NTP resources, preferred resources are given first opportunity to connect and
provide NTP calibration.
Server IP
Set the IP address of each server added as a potential NTP resource.
5 - 16 WiNG 5.5.3 Access Point System Reference Guide
Version
Use the spinner control to specify the version number used by this NTP server resource.
The default setting is 0.
5. Use the RF Domain Manager field to configure how this access point behaves in standalone mode. Set the following
parameters:
Capable
Select to enable this access point to act as a RF Domain Manager in a particular RF
Domain.
Priority
Select to prioritize this access point in becoming a RF Domain Manager in its; particular
RF Domain. The higher the value, the more likely the device becomes the RF Domain
Manager for the domain.
6. Select OK to save the changes made to the general profile configuration. Select Reset to revert to the last saved
configuration.
5.2.2 Profile Radio Power
System Profile Configuration
Use the Power screen to set one of two power modes (3af or Auto) for the access point profile. When Automatic is selected,
the access point safely operates within available power. Once the power configuration is determined, the access point
configures its operating power characteristics based on its model and power configuration.
An access point uses a complex programmable logic device (CPLD) to manage power. The CPLD determines proper supply
sequencing, the maximum power available and other status information. One of the primary functions of the CPLD is to
determine the maximum power budget. When an access point is powered on (or performing a cold reset), the CPLD determines
the maximum power provided by the POE device and the budget available to the access point. The CPLD also determines the
access point hardware SKU (model) and the number of radios.
If the access point’s POE resource cannot provide sufficient power to run the access point (with all intended interfaces enabled),
some of the following interfaces could be disabled or modified:
• The access point’s transmit and receive algorithms could be negatively impacted
• The access point’s transmit power could be reduced due to insufficient power
• The access point’s WAN port configuration could be changed (either enabled or disabled)
To define an access point’s power configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Select Power.
A screen displays where the access point profile’s power mode can be defined.
Device Configuration 5 - 17
Figure 5-10 Profile - Power screen
5. Use the Power Mode drop-down menu to set the Power Mode Configuration on this AP.
NOTE: Single radio model access points always operate using a full power
configuration. The power management configurations described in this section do not
apply to single radio access point models.
When an access point is powered on for the first time, it determines the power budget available. Using the Automatic
setting, the access point automatically determines the best power configuration based on the available power budget.
Automatic is the default setting.
If 802.3af is selected, the access point assumes 12.95 watts are available. If the mode is changed, the access point requires
a reset to implement the change. If 802.3at is selected, the access point assumes 23 - 26 watts are available.
6. Set the access point radio’s 802.3af Power Mode and the radio’s 802.3at Power Mode.
Use the drop-down menu for each power mode to define a mode of either Range or Throughput.
Select Throughput to transmit packets at the radio’s highest defined basic rate (based on the radio’s current basic rate
settings). This option is optimal in environments where the transmission range is secondary to broadcast/multicast
transmission performance.
Select Range when range is preferred over performance for broadcast/multicast (group) traffic. The data rates used for
range are the lowest defined basic rates. Throughput is the default setting for both 802.3af and 802.3at.
7. Select OK to save the changes made to the access point power configuration. Select Reset to revert to the last saved
configuration
5 - 18 WiNG 5.5.3 Access Point System Reference Guide
5.2.3 Profile Adoption (Auto Provisioning) Configuration
System Profile Configuration
Adoption is the process an access point uses to discover Virtual Controller APs available in the network, pick the most desirable
Virtual Controller, establish an association with the Virtual Controller and optionally obtain an image upgrade, obtains its
configuration and considers itself provisioned. This is a configurable activity that can be supported within an access point
profile and applied to other access points (of the same model) supported by the profile.
At adoption, an access point solicits and receives multiple adoption responses from Virtual Controller APs available on the
network. These adoption responses contain loading policy information the access point uses to select the optimum Virtual
Controller AP for adoption.
NOTE: An access point configuration does not need to be present for an auto
provisioning (adoption) policy to take effect. Once adopted, and the access point’s
configuration is defined and applied by the Virtual Controller. The auto provisioning
policy mapping does not have impact on subsequent adoptions by the same device.
To define the access point profile’s adoption configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Select Adoption.
Device Configuration 5 - 19
Figure 5-11 Profile Adoption screen
5. Define the Preferred Group used as optimal group of Virtual Controller for adoption. The name of the preferred group
cannot exceed 64 characters.
6. Select the VLAN option to define a VLAN the access point’s associating Virtual Controller AP is reachable on. VLANs 0 and
4,095 are reserved and cannot be used. This setting is disabled by default.
7. Define the Auto-Provisioning Policy configuration. Set the following parameters:
Auto-Provisioning Policy Use the drop-down menu to specify the Auto-Provisioning policy to use while adopting. If
a suitable Auto-Provisioning policy does not exist, click the Create icon to create a new
policy or the Edit icon to modify an existing policy.
Learn and Save Network
Configuration
Select this option to enable the access point to learn and save the configuration for any
device it has adopted. Default is Enabled.
Rerun Policy Rules
Everytime AP Adopts
Select this option to enable an Auto-Provisioning policy to run every time an access point
adopts a client. Default is Disabled.
8. Define the Hello Interval value in seconds.
5 - 20 WiNG 5.5.3 Access Point System Reference Guide
The Hello interval is the interval between two consecutive hello keep alive messages exchanged between the access point
and the adopting wireless controller. These messages serve as a connection validation mechanism to ensure the
availability of the adopting wireless controller. Use the spinner to set a value from 1 - 120 seconds.
9. Define the Adjacency Hold Time value. This value sets the time after which the preferred controller group is considered
down and unavailable to provide services. Use the spinner to set a value from 2 - 600 seconds.
10. Enter Controller Hostnames as needed to define resources for adoption. Click +Add Row to add controllers. Set the
following parameters to define Controller Hostnames:
Host
Use the drop-down menu to specify whether the controller adoption resource is defined
as a (non DNS) IP address or a hostname. Once defined, provide the numerical IP or
hostname. A hostname cannot exceed 64 characters.
Pool
Use the spinner controller to set a pool of either 1 or 2. This is the pool the target Virtual
Controller belongs to. The default setting is 1.
Routing Level
Use the spinner controller to set the routing level for the Virtual Controller link. The
default setting is 1.
IPSec Support
Select to enable secure communication between the access point and wireless
controllers.
IPSec GW
Use the drop-down menu to specify if the IPSec gateway resource is defined as a (non
DNS) IP address or a hostname. Once defined, provide the numerical IP or hostname. A
hostname cannot exceed 64 characters.
Force
Select to enable the link to the adopting controller or the controller group to be created
even when not required.
11. Select + Add Row as needed to populate the table with IP addresses or hostnames of adoption resources.
12. Select OK to save the changes made to the general profile configuration. Select Reset to revert to the last saved
configuration.
5.2.4 Profile Wired 802.1X Configuration
System Profile Configuration
802.1X provides administrators secure, identity based access control as another data protection option to utilize with a device
profile.
802.1X is an IEEE standard for media-level (Layer 2) access control, offering the capability to permit or deny network
connectivity based on the identity of the user or device.
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Select Wired 802.1x.
Device Configuration 5 - 21
Figure 5-12 Profile Wired 802.1X screen
5. Set the following Wired 802.1x Settings:
Dot1x Authentication
Control
Select this option to globally enable 802.1x authentication for the selected device. This
setting is disabled by default.
Dot1x AAA Policy
Use the drop-down menu to select an AAA policy to associate with wired 802.1x traffic. If
a suitable AAA policy does not exist, click the Create icon to create a new policy or the
Edit icon to modify an existing policy.
Dot1x Guest VLAN
Control
Select this option to globally enable 802.1x guest VLANs for the selected device. This
setting is disabled by default.
MAC Authentication
AAA Policy
Use the drop-down menu to select an AAA authentication policy for MAC address
authentication. If a suitable MAC AAA policy does not exist, click the Create icon to create
a new policy or the Edit icon to modify an existing policy.
6. Select OK to save the changes to the 802.1x configuration. Select Reset to revert to the last saved configuration.
5.2.5 Profile Interface Configuration
System Profile Configuration
A access point profile can support customizable Ethernet port, virtual interface, port channel, radio and PPPoE configurations
unique to each supported access point model.
A profile’s interface configuration process consists of the following:
• Ethernet Port Configuration
• Virtual Interface Configuration
• Port Channel Configuration
• Access Point Radio Configuration
• WAN Backhaul Configuration
• PPPoE Configuration
Additionally, deployment considerations and guidelines for profile interface configurations are available for review prior to
defining a configuration that could significantly impact the performance of the network. For more information, see WAN
Backhaul Deployment Considerations on page 5-55.
5 - 22 WiNG 5.5.3 Access Point System Reference Guide
5.2.5.1 Ethernet Port Configuration
Profile Interface Configuration
Displays the physical port reporting runtime data and statistics. The following ports are available depending on model:
• AP6511 - fe1, fe2, fe3, fe4, up1
• AP6521 - GE1/POE (LAN)
• AP6522/AP6522M - GE1/POE (LAN)
• AP6532 - GE1/POE (LAN)
• AP6562 - GE1/POE (LAN)
• AP7131 - GE1/POE (LAN), GE2 (WAN)
• AP7161 - GE1/POE (LAN), GE2 (WAN)
• AP7181 - GE1/POE (LAN), GE2 (WAN)
• AP7522 - GE1/POE (LAN)
• AP7532 - GE1/POE (LAN)
• AP8122/AP8132 - GE1/POE (LAN), GE2 (WAN)
• AP8222/AP8232 - GE1/POE (LAN), GE2 (WAN)
To define a profile’s Ethernet port configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Interface menu and select Ethernet Ports.
Figure 5-13 Profile Interfaces - Ethernet Ports screen
Device Configuration 5 - 23
5. Refer to the following to assess port status, mode and VLAN configuration:
Name
Displays the physical port name reporting runtime data and statistics. Supported ports
vary depending on model.
Type
Displays the physical port type.
Description
Displays an administrator defined description for each listed port.
Admin Status
A green check mark defines the port as active and currently enabled with the profile. A
red “X” defines the port as currently disabled and not available for use. The interface
status can be modified with the port configuration as required.
Mode
Displays the profile’s current switching mode as either Access or Trunk. If Access is listed,
the port accepts packets only from the native VLAN. Frames are forwarded out the port
untagged with no 802.1Q header. All frames received on the port are expected as
untagged and mapped to the native VLAN. If set to Trunk, the port allows packets from a
list of VLANs added to the trunk. A port configured as Trunk supports multiple 802.1Q
tagged VLANs and one Native VLAN which can be tagged or untagged.
Native VLAN
Lists the numerical VLAN ID (1 - 4094) set for the native VLAN. The native VLAN allows
an Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is
included in the frame. Additionally, the native VLAN is the VLAN untagged traffic is
directed over when using a port in trunk mode.
Tag Native VLAN
A green check mark defines the native VLAN as tagged. A red “X” defines the native VLAN
as untagged. When a frame is tagged, the 12 bit frame VLAN ID is added to the 802.1Q
header so upstream Ethernet devices know which VLAN ID the frame belongs to. The
device reads the 12 bit VLAN ID and forwards the frame to the appropriate VLAN. When
a frame is received with no 802.1Q header, the upstream device classifies the frame using
the default or native VLAN assigned to the Trunk port. A native VLAN allows an Ethernet
device to associate untagged frames to a VLAN when no 802.1Q frame is included in the
frame.
Allowed VLANs
Displays the VLANs allowed to send packets over the listed port. Allowed VLANs are only
listed when the mode has been set to Trunk.
6. To edit an access point profile’s port configuration, select it from amongst those displayed and then select the Edit button.
The Ethernet port Basic Configuration screen displays by default.
5 - 24 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-14 Ethernet Ports - Basic Configuration screen
7. Set the following Ethernet port Properties:
Description
Enter a brief description for the port (64 characters maximum). The description should
reflect the port’s intended function to differentiate it from others with similar
configurations.
Admin Status
Select the Enabled radio button to define this port as active to the profile it supports.
Select the Disabled radio button to disable this physical port in the profile. It can be
activated at any future time when needed.
Speed
Select the speed at which the port can receive and transmit the data. Select either 10
Mbps, 100 Mbps, 1000 Mbps. Select either of these options to establish a 10, 100 or 1000
Mbps data transfer rate for the selected half duplex or full duplex transmission over the
port. These options are not available if Auto is selected. Select Automatic to enable the
port to automatically exchange information about data transmission speed and duplex
capabilities. Auto negotiation is helpful when in an environment where different devices
are connected and disconnected on a regular basis. Automatic is the default setting.
Duplex
Select either half, full or automatic as the duplex option. Select Half duplex to send data
over the port, then immediately receive data from the same direction in which the data
was transmitted. Like a full-duplex transmission, a half-duplex transmission can carry
data in both directions, just not at the same time. Select Full duplex to transmit data to
and from the port at the same time. Using full duplex, the port can send data while
receiving data as well. Select Automatic to enable to the access point to dynamically
duplex as port performance needs dictate. Automatic is the default setting.
Device Configuration 5 - 25
8. Define the following Cisco Discovery Protocol (CDP) and LLDP parameters to apply to the Ethernet port configuration:
Cisco Discover Protocol
Receive
Select this option to allow the Cisco discovery protocol for receiving data on this port. If
enabled, the port sends out periodic interface updates to a multicast address to advertise
its presence to neighbors. This option is enabled by default.
Cisco Discover Protocol
Transmit
Select this option to allow the Cisco discovery protocol for transmitting data on this port.
If enabled, the port sends out periodic interface updates to a multicast address to
advertise its presence to neighbors. This option is enabled by default.
Link Layer Discovery
Protocol Receive
Select this option to snoop LLDP on this port. If enabled, the port sends out periodic
interface updates to a multicast address to advertise its presence to neighbors. This
option is enabled by default.
Link Layer Discovery
Protocol Transmit
Select this option to transmit LLDP PDUs on this port. If enabled, the port sends out
periodic interface updates to a multicast address to advertise its presence to neighbors.
9. Select Enforce Captive Portal to automatically apply captive portal access permission rules to data transmitted over this
specific Ethernet port. This setting is disabled by default.
A captive portal is an access policy for providing temporary and restrictive access using a standard Web browser. Captive
portals provides authenticated access by capturing and re-directing a wireless user's Web browser session to a captive
portal login page where the user must enter valid credentials to access to the network. Once logged into the captive portal,
additional Terms and Agreement, Welcome, Fail and No Service pages provide the administrator with a number of options
on captive portal screen flow and user appearance. For information on configuring a captive portal policy, see Configuring
Captive Portal Policies on page 9-2.
10. Define the following Switching Mode parameters to apply to the Ethernet port configuration:
Mode
Select either the Access or Trunk radio button to set the VLAN switching mode over the
port. If Access is selected, the port accepts packets only form the native VLANs. Frames
are forwarded out the port untagged with no 802.1Q header. All frames received on the
port are expected as untagged and are mapped to the native VLAN. If the mode is set to
Trunk, the port allows packets from a list of VLANs you add to the trunk. A port configured
as Trunk supports multiple 802.1Q tagged VLANs and one Native VLAN which can be
tagged or untagged. Access is the default mode.
Native VLAN
Use the spinner control to define a numerical Native VLAN ID from 1 - 4094. The native
VLAN allows the access point to associate untagged frames to a VLAN when no 802.1Q
frame is included in the frame. Additionally, the native VLAN is the VLAN which untagged
traffic will be directed over when using a port in trunk mode. The default VLAN is 1.
Tag Native VLAN
Select this option to tag the native VLAN. The IEEE 802.1Q specification is supported for
tagging frames and coordinating VLANs between devices. IEEE 802.1Q adds four bytes to
each frame identifying the VLAN ID for upstream devices that the frame belongs. If the
upstream Ethernet device does not support IEEE 802.1Q tagging, it does not interpret the
tagged frames. When VLAN tagging is required between devices, both devices must
support tagging and be configured to accept tagged VLANs. When a frame is tagged, the
12 bit frame VLAN ID is added to the 802.1Q header so upstream Ethernet devices know
which VLAN ID the frame belongs to. The device reads the 12 bit VLAN ID and forwards
the frame to the appropriate VLAN. When a frame is received with no 802.1Q header, the
upstream device classifies the frame using the default or native VLAN assigned to the
Trunk port. The native VLAN allows an Ethernet device to associate untagged frames to a
VLAN when no 802.1Q frame is included in the frame. This feature is disabled by default.
5 - 26 WiNG 5.5.3 Access Point System Reference Guide
Allowed VLANs
Selecting Trunk as the mode enables the Allowed VLANs parameter. Add VLANs that
exclusively send packets over the listed port.
11. Optionally select the Port Channel option and define a setting from 1 - 8 using the spinner control. This sets the channel
group for the port.
12. Select OK to save the changes made to the Ethernet Port Basic Configuration. Select Reset to revert to the last saved
configuration.
13. Select the Security tab.
Figure 5-15 Ethernet Ports - Security tab
14. Refer to the Access Control field. As part of the port’s security configuration, Inbound IP and MAC address firewall rules
are required.
Use the Inbound IP Firewall Rules and Inbound MAC Firewall Rules drop-down menus to select the firewall rules to
apply to this profile’s Ethernet port configuration.
The firewall inspects IP and MAC traffic flows and detects attacks typically not visible to traditional wired firewall
appliances.
If a firewall rule does not exist suiting the data protection needs of the target port configuration, select the Create icon to
define a new rule configuration.
15. Refer to the Trust field to define the following:
Trust ARP Responses
Select this option to enable ARP trust on this access point port. ARP packets received
on this port are considered trusted and information from these packets is used to
identify rogue devices within the network. The default value is disabled.
Trust DHCP Responses
Select this option to enable DHCP trust on this port. If enabled, only DHCP responses
are trusted and forwarded on this port, and a DHCP server can be connected only to a
DHCP trusted port. The default value is enabled.
Device Configuration 5 - 27
ARP header Mismatch
Validation
Select this option to enable a mismatch check for the source MAC in both the ARP and
Ethernet header. The default value is disabled.
Trust 8021p COS values
Select this option to enable 802.1p COS values on this port. The default value is
enabled.
Trust IP DSCP
Select this option to enable IP DSCP values on this port. The default value is enabled.
NOTE: Some vendor solutions with VRRP enabled send ARP packets with Ethernet
SMAC as a physical MAC and inner ARP SMAC as VRRP MAC. If this configuration is
enabled, a packet is allowed, despite a conflict existing.
16. Set the following 802.1X Settings:
Host Mode
Use the drop-down menu to select the host mode configuration to apply to this port. Options
include single-host or multi-host. The default setting is single-host.
Guest VLAN
Specify a guest VLAN for this port from 1 - 4094. This is the VLAN traffic is bridged on if this
port is unauthorized and the guest VLAN is globally enabled.
Port Control
Use the drop-down menu to set the port control state to apply to this port. Options include
force-authorized, force-unauthorized and automatic. The default setting is port-authorized.
Re Authenticate
Select this setting to force clients to reauthenticate on this port. The default setting is disabled,
thus clients do not need to reauthenticate for connection over this port until this setting is
enabled.
Max Reauthenticate
Count
Set the maximum reauthentication attempts (1 - 10) before this port is moved to unauthorized.
The default setting is 2.
Maximum Request
Set the maximum number of authentication requests (1 - 10) before returning a failed message
to the requesting client. The default setting is 2.
Quiet Period
Set the quiet period for this port from 1 - 65,535 seconds. This is the maximum wait time 802.1x
waits upon a failed authentication attempt. The default setting is 60 seconds.
Reauthenticate
Period
Use the spinner control to set the reauthentication period for this port from 1 - 65,535 seconds.
The default setting is 60 seconds.
Port MAC
Authentication
When enabled, a port’s MAC address is authenticated, as only one MAC address is supported
per wired port. When successfully authenticated, packets from the source are processed.
Packets from all other sources are dropped. Port MAC authentication is supported on RFS4000,
RFS6000 model controllers and NX4500, NX6500, NX7500 and NX9000 series service
platforms.
Port MAC authentication may be enabled on ports in conjunction with Wired 802.1x settings
for a MAC Authentication AAA policy.
17. Select the Enable option within the 802.1x supplicant (client) feature to enable a username and password pair to be
used when authenticating users on this port. Use the Show option to view the actual characters comprising the password
entered in the Password field.
18. Select the Spanning Tree tab.
5 - 28 WiNG 5.5.3 Access Point System Reference Guide
Spanning Tree Protocol (STP) (IEEE 802.1D standard) configures a meshed network for robustness by eliminating loops
within the network and calculating and storing alternate paths to provide fault tolerance.
STP calculation happens when a port comes up. As the port comes up and STP calculation happen, the port is set to Blocked
state. In this state, no traffic can pass through the port. Since STP calculations take up to a minute to complete, the port is
not operational there by effecting the network behind the port. Once the STP calculation is complete, the port's state is
changed to Forwarding and traffic is allowed.
Rapid Spanning Tree Protocol (RSTP) (IEEE 802.1w standard) is an evolution over the standard STP where the primary aim
was to reduce the time taken to respond to topology changes while being backward compatible with STP. PortFast quickly
changes the port state from Blocked to Forwarding to allow traffic while the STP calculation occurs.
Multiple Spanning Tree Protocol (MSTP) provides an extension to RSTP to optimize the usefulness of VLANs. MSTP allows
for a separate spanning tree for each VLAN group, and blocks all but one of the possible alternate paths within each
spanning tree topology.
If there is just one VLAN in the access point managed network, a single spanning tree works fine. However, if the network
contains more than one VLAN, the network topology defined by single STP would work, but it is possible to make better
use of the alternate paths available by using an alternate spanning tree for different VLANs or groups of VLANs.
A MSTP supported deployment uses multiple MST regions with multiple MST instances (MSTI). Multiple regions and other
STP bridges are interconnected using one single common spanning tree (CST)
MSTP includes all of its spanning tree information in a single Bridge Protocol Data Unit (BPDU) format. BPDUs are used to
exchange information bridge IDs and root path costs. Not only does this reduce the number of BPDUs required to
communicate spanning tree information for each VLAN, but it also ensures backward compatibility with RSTP. MSTP
encodes additional region information after the standard RSTP BPDU as well as a number of MSTI messages. Each MSTI
messages conveys spanning tree information for each instance. Each instance can be assigned a number of configured
VLANs. The frames assigned to these VLANs operate in this spanning tree instance whenever they are inside the MST
region. To avoid conveying their entire VLAN to spanning tree mapping in each BPDU, the access point encodes an MD5
digest of their VLAN to an instance table in the MSTP BPDU. This digest is used by other MSTP supported devices to
determine if the neighboring device is in the same MST region as itself.
Device Configuration 5 - 29
Figure 5-16 Ethernet Ports - Spanning Tree tab
19. Refer to the PortFast field to define the following:
Enable PortFast
PortFast reduces the time taken for a port to complete STP. PortFast must only be
enabled on ports on the wireless controller which are directly connected to a server/
workstation and not to another hub or controller. PortFast can be left unconfigured on
the access point.
Select this option to enable drop-down menus for both the Enable PortFast BPDU Filter
and Enable PortFast BPDU Guard options. This setting is disabled by default.
Enable PortFast BPDU
Filter
MSTP BPDUs are messages exchanged when controllers gather information about the
network topology during STP scan. When enabled, PortFast enabled ports do not
transmit or receive BPDU messages. 'Default' sets the PortFast BPDU Filter value to the
bridge's BPDU filter value.
Select Enable to invoke a BPDU filter for this PortFast enabled port channel.
Enable PortFast BPDU
Guard
When enabled, PortFast enabled ports are forced to shut down when they receive BPDU
messages. When set to Default sets the PortFast BPDU Guard value to the bridge's
BPDU guard value.
20. Refer to the MSTP Configuration field to define the following:
Enable as Edge Port
Select to enable the port as an Edge Port for MSTP. An Edge Port is a port known to
connect to a LAN which has no other bridges attached to it or is directly connected to
an user device.
5 - 30 WiNG 5.5.3 Access Point System Reference Guide
Link Type
Select either the Point-to-Point or Shared radio button. Selecting Point-to-Point
indicates the port should be treated as connected to a point-to-point link. Selecting
Shared means this port should be treated as having a shared connection. A port
connected to a hub is on a shared link, while one connected to a access point is a pointto-point link. Point-to-Point is the default setting.
Cisco MSTP
Interoperability
Select to enable or disable interoperability with CISCO’s implementation of MSTP
which is incompatible with standard MSTP.
Force Protocol Version
Select the STP protocol to use with this port. Select Not Supported to disable STP on
this port.
Guard
The Root Guard mechanism prevents election of roots other than those designated as
roots in a network. When this port receives a better BPDU, port state becomes Blocked.
It retains this state till the port no longer receives the better BPDUs and the state is
changed to Forwarding.
Select Root to enable this feature. Select None to disable this feature.
21. Refer to the Spanning Tree Port Cost table.
Define an Instance Index using the spinner control and then set the cost. The default path cost depends on the user defined
port speed. The cost helps determine the role of the port channel in the MSTP network. The designated cost is the cost for
a packet to travel from this port to the root in the MSTP configuration. The slower the media, the higher the cost.
Speed
Default Path Cost
<=100000 bits/sec
200000000
<=1000000 bits/sec
20000000
<=10000000 bits/sec
2000000
<=100000000 bits/sec
200000
<=1000000000 bits/sec
20000
<=10000000000 bits/sec
2000
<=100000000000 bits/sec
200
<=1000000000000 bits/sec
20
>1000000000000 bits/sec
2
22. Select + Add Row as needed to include additional indexes.
23. Refer to the Spanning Tree Port Priority table.
Define an Instance Index using the spinner control and then set the Priority. The lower the priority, the greater the
likelihood of the port becoming a designated port.
24. Select + Add Row needed to include additional indexes.
25. Select OK to save the changes made to the Ethernet port’s security configuration. Select Reset to revert to the last saved
configuration.
Device Configuration 5 - 31
5.2.5.2 Virtual Interface Configuration
Profile Interface Configuration
A Virtual Interface is required for layer 3 (IP) access to provide layer 3 service on a VLAN. The Virtual Interface defines which
IP address is associated with each VLAN ID the access point is connected to. A Virtual Interface is created for the default VLAN
(VLAN 1) to enable remote administration. A Virtual Interface is also used to map VLANs to IP address ranges. This mapping
determines the destination networks for routing.
To review existing Virtual Interface configurations and either create a new Virtual Interface configuration, modify an existing
configuration or delete an existing configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Interface menu and select Virtual Interfaces.
Figure 5-17 Profile Interfaces - Virtual Interfaces screen
5. Review the following parameters unique to each virtual interface configuration:
Name
Displays the name of each listed Virtual Interface assigned when it was created. The
name is from 1 - 4094, and cannot be modified as part of a Virtual Interface edit.
Type
Displays the type of Virtual Interface for each listed access point interface.
Description
Displays the description defined for the Virtual Interface when it was either initially
created or edited.
Admin Status
A green check mark defines the listed Virtual Interface configuration as active and
enabled with its supported profile. A red “X” defines the Virtual Interface as currently
disabled. The interface status can be modified when a new Virtual Interface is created or
an existing one modified.
5 - 32 WiNG 5.5.3 Access Point System Reference Guide
VLAN
Displays the numerical VLAN ID associated with each listed interface.
IP Address
Defines whether DHCP was used to obtain the primary IP address used by the Virtual
Interface configuration.
Once the configurations of existing Virtual Interfaces have been reviewed, determine whether a new interface requires
creation, or an existing Virtual Interface requires edit or deletion.
6. Select Add to define a new Virtual Interface configuration, Edit to modify the configuration of an existing Virtual Interface
or Delete to permanently remove a selected Virtual Interface.
Figure 5-18 Virtual Interfaces - Basic Configuration tab
The Basic Configuration screen displays by default regardless of a whether a new Virtual Interface is being created or an
existing one is being modified.
7. If creating a new Virtual Interface, use the Name spinner control to define a numeric ID from 1 - 4094.
8. Define the following parameters from within the Properties field:
Description
Provide or edit a description (up to 64 characters) for the Virtual Interface that helps
differentiate it from others with similar configurations.
Admin Status
Either select the Disabled or Enabled radio button to define this interface’s current status
within the network. When set to Enabled, the Virtual Interface is operational and
available. The default value is Disabled.
Device Configuration 5 - 33
9. Set the following network information from within the IP Addresses field:
Enable Zero
Configuration
The access point can use Zero Config for IP assignments on an individual virtual interface
basis. Select Primary to use Zero Config as the designated means of providing an IP
address, this eliminates the means to assign one manually. Selecting Secondary is
preferred when wanting the option to either use Zero Config or manual assignments.
Zero Configuration (or Zero Config) is a wireless connection utility included with Microsoft
Windows XP and later as a service that dynamically selects a network to connect based
on a user’s preference and various default settings. Zero config can be used instead of a
wireless network utility from the manufacturer of a computer’s wireless networking
device.
Primary IP Address
Define the IP address for the VLAN associated Virtual Interface.
Use DHCP to Obtain IP
Select this option to allow DHCP to provide the IP address for the Virtual Interface.
Selecting this option disables the Primary IP address field.
Use DHCP to obtain
Gateway/DNS Servers
Select this option to allow DHCP to obtain a default gateway address, and DNS resource
for one virtual interface. This setting is disabled by default and only available when the
Use DHCP to Obtain IP option is selected.
Secondary Addresses
Use the Secondary Addresses parameter to define additional IP addresses to associate
with VLAN IDs. The address provided in this field is used if the primary IP address is
unreachable.
10. Define the Network Address Translation (NAT) direction.
Select either the Inside, Outside or None radio buttons.
• Inside - The inside network is transmitting data over the network to its intended destination. On the way out, the source
IP address is changed in the header and replaced by the (public) IP address.
• Outside - Packets passing through the NAT on the way back to the LAN are searched against the records kept by the NAT
engine. There the destination IP address is changed back to the specific internal private class IP address in order to reach
the LAN over the network.
• None - No NAT activity takes place. This is the default setting.
11. Select OK button to save the changes to the Basic Configuration screen. Select Reset to revert to the last saved
configuration.
12. Select the Security tab.
5 - 34 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-19 Virtual Interfaces - Security tab
13. Use the Inbound IP Firewall Rules drop-down menu to select the firewall rule configuration to apply to this Virtual
Interface.
The firewall inspects and packet traffic to and from connected clients.
If a firewall rule does not exist suiting the data protection needs of this Virtual Interface, select the Create icon to define a
new firewall rule configuration or the Edit icon to modify an existing configuration. For more information, see Wireless
Firewall on page 8-2.
14. Use the VPN Crypto Map drop-down menu to select and assign a VPN crypto map entry to this virtual interface. The VPN
Crypto Map entry defines the type of VPN connection and its parameters. For more information, see Defining Profile VPN
Settings on page 5-104.
15. Select the OK button located at the bottom right of the screen to save the changes to the Security screen. Select Reset to
revert to the last saved configuration.
5.2.5.3 Port Channel Configuration
Profile Interface Configuration
The access point’s profile can be applied to customize the port channel configurations as part of its interface configuration.
To define a port channel configuration for an access point profile:
Device Configuration 5 - 35
Figure 5-20 Profile Interfaces - Port Channels screen
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Interface menu and select Port Channels.
5. Refer to the following to review existing port channel configurations and their current status:
Name
Displays the port channel’s numerical identifier assigned to it when it was created. The
numerical name cannot be modified as part of the edit process.
Type
Displays whether the type is port channel.
Description
Lists a a short description (64 characters maximum) describing the port channel or
differentiating it from others with similar configurations.
Admin Status
A green check mark defines the listed port channel as active and currently enabled with
the access point’s profile. A red “X” defines the port channel as currently disabled and not
available for use. The interface status can be modified with the port channel configuration
as required
6. To edit the configuration of an existing port channel, select it from amongst those displayed and select the Edit button. The
Port Channel Basic Configuration screen displays by default.
5 - 36 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-21 Port Channels - Basic Configuration tab
7. Set the following port channel Properties:
Description
Enter a brief description for the port channel (64 characters maximum). The description
should reflect the port channel’s intended function.
Admin Status
Select the Enabled radio button to define this port channel as active to the controller
profile it supports. Select the Disabled radio button to disable this port channel
configuration within the profile. It can be activated at any future time when needed. The
default setting is disabled.
Speed
Select the speed at which the port channel can receive and transmit the data. Select
either 10 Mbps, 100 Mbps, 1000 Mbps. Select either of these options to establish a 10,
100 or 1000 Mbps data transfer rate for the selected half duplex or full duplex
transmission over the port. These options are not available if Auto is selected. Select
Automatic to enable the port channel to automatically exchange information about data
transmission speed and duplex capabilities. Auto negotiation is helpful when in an
environment where different devices are connected and disconnected on a regular basis.
Automatic is the default setting.
Duplex
Select either Half, Full or Automatic as the duplex option. Select Half duplex to send data
over the port channel, then immediately receive data from the same direction in which the
data was transmitted. Like a Full duplex transmission, a Half duplex transmission can
carry data in both directions, just not at the same time. Select Full duplex to transmit data
to and from the port channel at the same time. Using Full duplex, the port channel can
send data while receiving data as well. Select Automatic to enable to the access point to
dynamically duplex as port channel performance needs dictate. Automatic is the default
setting.
Device Configuration 5 - 37
8. Use the Port Channel Load Balance drop-down menu within the Client Load Balancing field to define whether port
channel load balancing is conducted using a Source/Destination IP or a Source/Destination MAC as criteria. Source/
Destination IP is the default setting.
9. Define the following Switching Mode parameters to apply to the port channel configuration:
Mode
Select either the Access or Trunk radio button to set the VLAN switching mode over the port
channel. If Access is selected, the port channel accepts packets only form the native VLANs.
Frames are forwarded out the port untagged with no 802.1Q header. All frames received on the
port are expected as untagged and are mapped to the native VLAN. If the mode is set to Trunk,
the port channel allows packets from a list of VLANs you add to the trunk. A port channel
configured as Trunk supports multiple 802.1Q tagged VLANs and one Native VLAN which can
be tagged or untagged. Access is the default setting.
Native VLAN
Use the spinner control to define a numerical ID from 1 - 4094. The native VLAN allows an
Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is included in
the frame. Additionally, the native VLAN is the VLAN which untagged traffic will be directed
over when using trunk mode. The default value is 1.
Tag the Native VLAN Select this option to tag the native VLAN. Access points support the IEEE 802.1Q specification
for tagging frames and coordinating VLANs between devices. IEEE 802.1Q adds four bytes to
each frame identifying the VLAN ID for upstream devices that the frame belongs. If the
upstream Ethernet device does not support IEEE 802.1Q tagging, it does not interpret the
tagged frames. When VLAN tagging is required between devices, both devices must support
tagging and be configured to accept tagged VLANs. When a frame is tagged, the 12 bit frame
VLAN ID is added to the 802.1Q header so upstream Ethernet devices know which VLAN ID the
frame belongs to. The device reads the 12 bit VLAN ID and forwards the frame to the
appropriate VLAN. When a frame is received with no 802.1Q header, the upstream device
classifies the frame using the default or native VLAN assigned to the Trunk port. The native
VLAN allows an Ethernet device to associate untagged frames to a VLAN when no 802.1Q
frame is included in the frame. This setting is disabled by default.
Allowed VLANs
Selecting Trunk as the mode enables the Allowed VLANs parameter. Add VLANs that
exclusively send packets over the port channel.
10. Select OK to save the changes made to the port channel Basic Configuration. Select Reset to revert to the last saved
configuration.
11. Select the Security tab.
5 - 38 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-22 Port Channels - Security tab
12. Refer to the Access Control field. As part of the port channel’s security configuration, Inbound IP and MAC address
firewall rules are required.
Use the Inbound IP Firewall Rules and Inbound MAC Firewall Rules drop-down menus to select firewall rules to
apply to this profile’s port channel configuration.
The firewall inspects IP and MAC traffic flows and detects attacks typically not visible to traditional wired firewall
appliances.
If a firewall rule does not exist suiting the data protection needs of the target port channel configuration, select the Create
icon to define a new rule configuration or the Edit icon to modify an existing firewall rule configuration. For more
information, see Wireless Firewall on page 8-2.
13. Refer to the Trust field to define the following:
Trust ARP Responses
Select this option to enable ARP trust on this port channel. ARP packets received on this
port are considered trusted and information from these packets is used to identify rogue
devices within the managed network. The default value is disabled.
Trust DHCP Responses
Select this option to enable DHCP trust. If enabled, only DHCP responses are trusted
and forwarded on this port channel, and a DHCP server can be connected only to a
DHCP trusted port. The default value is enabled.
ARP header Mismatch
Validation
Select this option to enable a mismatch check for the source MAC in both the ARP and
Ethernet header. The default value is enabled.
Trust 802.1p COS values
Select this option to enable 802.1p COS values on this port channel. The default value
is enabled.
Trust IP DSCP
Select this option to enable IP DSCP values on this port channel. The default value is
enabled.
Device Configuration 5 - 39
14. Select OK to save the changes to the security configuration. Select Reset to revert to the last saved configuration.
15. Select the Spanning Tree tab.
Figure 5-23 Port Channels - Spanning Tree tab
16. Define the following PortFast parameters for the port channel’s MSTP configuration:
Enable PortFast
PortFast reduces the time required for a port to complete a MSTP state change from
Blocked to Forward. PortFast must only be enabled on ports on the wireless controller
directly connected to a server/workstation and not another hub or controller. PortFast can
be left unconfigured on an access point.
Select this option to enable drop-down menus for both the Enable PortFast BPDU Filter
and Enable PortFast BPDU Guard options. This setting is disabled by default.
PortFast BPDU Filter
Select Enable to invoke a BPDU filter for this PortFast enabled port channel. Enabling the
BPDU filter feature ensures this port channel does not transmit or receive any BPDUs. The
default setting is None.
PortFast BPDU Guard
Select Enable to invoke a BPDU guard for this PortFast enabled port channel. Enabling the
BPDU Guard feature means this port will shutdown on receiving a BPDU. Thus, no BPDUs
are processed. The default setting is None.
17. Set the following MSTP Configuration parameters for the port channel:
Enable as Edge Port
Select this option to define this port as an edge port. Using an edge (private) port, you
can isolate devices to prevent connectivity over this port channel. This setting is
disabled by default.
5 - 40 WiNG 5.5.3 Access Point System Reference Guide
Link Type
Select either the Point-to-Point or Shared radio button. Selecting Point-to-Point
indicates the port should be treated as connected to a point-to-point link. Selecting
Shared means this port should be treated as having a shared connection. A port
connected to a hub is on a shared link, while one connected to a access point is a pointto-point link. Point-to-Point is the default setting.
Cisco MSTP
Interoperability
Select either the Enable or Disable radio buttons. This enables interoperability with
Cisco’s version of MSTP, which is incompatible with standard MSTP. This setting is
disabled by default.
Force Protocol Version
Sets the protocol version to either STP(0), Not Supported(1), RSTP(2) or MSTP(3). MSTP
is the default setting.
Guard
Determines whether the port channel enforces root bridge placement. Setting the
guard to Root ensures the port is a designated port. Typically, each guard root port is a
designated port, unless two or more ports (within the root bridge) are connected
together. If the bridge receives superior Bridge Protocol Data Units (BPDUs) on a guard
root-enabled port, the guard root moves the port to a root-inconsistent STP state. This
state is equivalent to a listening state. No data is forwarded across the port. Thus, the
guard root enforces the root bridge position.
18. Refer to the Spanning Tree Port Cost table.
Define an Instance Index using the spinner control and then set the cost. The default path cost depends on the user defined
port speed. The cost helps determine the role of the port channel in the MSTP network. The designated cost is the cost for
a packet to travel from this port to the root in the MSTP configuration. The slower the media, the higher the cost.
Speed
Default Path Cost
<=100000 bits/sec
200000000
<=1000000 bits/sec
20000000
<=10000000 bits/sec
2000000
<=100000000 bits/sec
200000
<=1000000000 bits/sec
20000
<=10000000000 bits/sec
2000
<=100000000000 bits/sec
200
<=1000000000000 bits/sec
20
>1000000000000 bits/sec
2
19. Select + Add Row as needed to include additional indexes.
20. Refer to the Spanning Tree Port Priority table.
Define an Instance Index using the spinner control and then set the Priority. The lower the priority, a greater likelihood
of the port becoming a designated port.
21. Select + Add Row needed to include additional indexes.
22. Select OK to save the changes made to the Ethernet Port Spanning Tree configuration. Select Reset to revert to the last
saved configuration.
Device Configuration 5 - 41
5.2.5.4 Access Point Radio Configuration
Profile Interface Configuration
An access point profile can have its radio configuration modified once its radios have successfully associated to the network.
To define a access point radio configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Interface menu and select Radios.
Figure 5-24 Access Point Radios screen
5. Review the following radio configuration data to determine whether a radio configuration requires modification to better
support the network:
Name
Displays whether the reporting radio is radio 1, radio 2 or radio 3. AP7131 models can
have up to 3 radios depending on the SKU. AP6522, AP6522M, AP6532, AP6562, AP7161,
AP7181, AP75XX, AP81XX and AP82XX models have 2 radios, while AP6521 and AP6511
models have 1 radio.
Type
Displays the type of radio housed by each listed access point.
Description
Displays a brief description of the radio provided by the administrator when the radio’s
configuration was added or modified.
Admin Status
A red “X” defines the radio’s status as currently disabled. A green check mark designates
the status as enabled.
5 - 42 WiNG 5.5.3 Access Point System Reference Guide
RF Mode
Displays whether each listed radio is operating in the 802.11a/n or 802.11b/g/n radio
band. If the radio is a dedicated sensor, it will be listed as a sensor to define the radio as
not providing typical WLAN support. If the radio is a client-bridge, it will be listed as a
client bridge and does not provide typical WLAN support. The radio band is set from
within the Radio Settings tab.
Channel
Lists the channel setting for the radio. Smart is the default setting. If set to Smart, the
access point scans non-overlapping channels listening for beacons from other access
points. After the channels are scanned, it selects the channel with the fewest access
points. In the case of multiple access points on the same channel, it will select the
channel with the lowest average power level.
Transmit Power
Lists the transmit power for each radio. The column displays smart if set for dynamic
Smart RF support.
6. If required, select a radio configuration and select the Edit button to modify the radio configuration.
Figure 5-25 Access Point Radio - Radio Settings tab
The Radio Settings tab displays by default.
7. Define the following radio configuration parameters from within the Properties field:
Description
Provide or edit a description (1 - 64 characters) for the radio that helps differentiate it from
others with similar configurations.
Admin Status
Either select the Disabled or Enabled radio button to define this radio’s current status
within the network. When defined as Enabled, the access point is operational and
available for client support.
Device Configuration 5 - 43
Radio QoS Policy
Use the drop-down menu to specify an existing QoS policy to apply to the access point
radio in respect to its intended radio traffic. If there’s no existing suiting the radio’s
intended operation, select the Create icon to define a new QoS policy that can be applied
to this profile.
Association ACL
Use the drop-down menu to specify an existing Association ACL policy to apply to the
access point radio. An Association ACL is a policy-based Access Control List (ACL) that
either prevents or allows wireless clients from connecting to a access point radio. An ACL
is a sequential collection of permit and deny conditions that apply to packets. When a
packet is received on an interface, the packet is compared against any applied ACLs to
verify the packet has the required permissions to be forwarded based on the criteria
specified in the access lists. If a packet does not meet any of the criteria specified in the
ACL, the packet is dropped. Select the Create icon to define a new Association ACL that
can be applied to this profile.
8. Set the following profile Radio Settings for the selected access point radio:
RF Mode
Set the mode to either 2.4 GHz WLAN or 5.0 GHz WLAN support depending on the radio’s
intended client support. Set the mode to sensor if using the radio for rogue device
detection. The radio cannot support rogue detection when one of the radios is functioning
as a WIPS sensor. To set a radio as a detector, disable Sensor support on the other access
point radio. Set the mode to client-bridge to configure the radio as a client bridge. A client
bridge enables the access point to connect to a 3rd party access point and bridge frames
to it.
Lock RF Mode
Select this option to lock Smart RF operation for this radio. The default setting is disabled,
as Smart RF utilization will impact throughput.
Channel
Use the drop-down menu to select the channel of operation for the radio. Only a trained
installation professional should define the radio channel. Select Smart for the radio to
scan non-overlapping channels listening for beacons from other access points. After the
channels are scanned, the radio selects the channel with the fewest access points. In the
case of multiple access points on the same channel, it will select the channel with the
lowest average power level. The default value is Smart.
Channels with a “w” appended to them are unique to the 40 MHz band. Channels with a
“ww” appended to them are 802.11ac specific, only appear when using an AP8232 or
AP7522 or AP7532, and are unique to the 80 MHz band.
DFS Revert Home
Select this option to enable a radio to return back to its original channel. Dynamic
Frequency Selection (DFS) prevents a radio from operating in a channel where radar
signals are present. When radar signals are detected in a channel, the radio changes its
channel of operation to another channel. The radio cannot use the channel it has moved
from for the next thirty (30) minutes. When selected, the radio can return back to its
original channel of operation once the thirty minute period is over. When not selected, the
radio cannot return back to its original channel of operation even after the mandatory
thirty minute evacuation period is over.
Transmit Power
Set the transmit power of the selected radio. If using a dual or three radio model access
point, each radio should be configured with a unique transmit power in respect to its
intended client support function. A setting of 0 defines the radio as using Smart RF to
determine its output power. 20 dBm is the default value.
5 - 44 WiNG 5.5.3 Access Point System Reference Guide
Antenna Gain
Set the antenna from 0.00 - 30.00 dBm. The access point’s Power Management Antenna
Configuration File (PMACF) automatically configures the access point’s radio transmit
power based on the antenna type, its antenna gain (provided here) and the deployed
country’s regulatory domain restrictions. Once provided, the access point calculates the
power range. Antenna gain relates the intensity of an antenna in a given direction to the
intensity that would be produced ideally by an antenna that radiates equally in all
directions (isotropically), and has no losses. Although the gain of an antenna is directly
related to its directivity, its gain is a measure that takes into account the efficiency of the
antenna as well as its directional capabilities. Motorola Solutions recommends that only
a professional installer set the antenna gain. The default value is 0.00.
Antenna Mode
Set the number of transmit and receive antennas on the access point. 1x1 is used for
transmissions over just the single “A” antenna. 2x2 is used for transmissions and receipts
over two antennas for dual antenna models. 1xAll is used when transmission occurs on
one antenna and is received on all receiving antennas. The default setting is dynamic
based on the access point model deployed and its transmit power settings.
Enable Antenna Diversity Select this option to enable the radio to have antenna diversity for transmit frames at non
802.11n data rates. This setting is disabled by default.
Wireless Client Power
Select this option to manually set the radio’s transmission power (in dBm) to connected
clients. The setting is disabled by default.
Dynamic Chain Selection Select this option for the radio to dynamically change the number of transmit chains. This
option is enabled by default.
Data Rates
Once the radio band is provided, the drop-down menu populates with rate options
depending on the 2.4 or 5.0 GHz band selected. If the radio band is set to Sensor or
Detector, the Data Rates drop-down menu is not enabled, as the rates are fixed and not
user configurable. If 2.4 GHz is selected as the radio band, select separate 802.11b,
802.11g and 802.11n rates and define how they are used in combination. If 5.0 GHz is
selected as the radio band, select separate 802.11a and 802.11n rates then define how
they are used together. When using 802.11n (in either the 2.4 or 5.0 GHz band), Set a MCS
(modulation and coding scheme) in respect to the radio’s channel width and guard
interval. A MCS defines (based on RF channel conditions) an optimal combination of 8
data rates, bonded channels, multiple spatial streams, different guard intervals and
modulation types. Clients can associate as long as they support basic MCS (as well as
non-11n basic rates).
If dedicating an AP81XX model radio to either 2.4 or 5 Ghz support, a Custom Rates option
is available to set a modulation and coding scheme (MCS) in respect to the radio’s channel
width and guard interval. A MCS defines (based on RF channel conditions) an optimal
combination of rates, bonded channels, multiple spatial streams, different guard intervals
and modulation types. Clients can associate as long as they support basic MCS (as well
as non-11n basic rates). If Basic is selected within the 802.11n Rates field, the MCS0-7
option is auto selected as a Supported rate and that option is greyed out. If Basic is not
selected, any combination of MCS0-7, MCS8-15 and MCS16-23 can be supported,
including a case where MCS0-7 and MCS16-23 are selected and not MCS8-15. The
MCS0-7 and MCS8-15 options are available to each support access point. However, the
MCS16-23 option is only available to AP81XX model access points and its ability to
provide 3x3x3 MIMO support.
For more information on the 802.11n rates, see section MCS Data Rates on page 5-51.
Device Configuration 5 - 45
Radio Placement
Use the drop-down menu to specify whether the radio is located Indoors or Outdoors. The
placement should depend on the country of operation selected and its regulatory domain
requirements for radio emissions. The default setting is Indoors.
Max Clients
Use the spinner control to set a maximum permissible number of clients to connect with
this access point radio. The available range is from 1- 256 for AP6522, AP6522M, AP6532,
AP6562, AP71XX, AP75XX, AP81XX and AP82XX models and from 1-128 for AP6511 and
AP6521 models.
Rate Selection Methods
Use the drop-down menu to specify the algorithm to use for rate selection. Select
Standard to use the standard rate selection algorithm. Select Opportunistic to use the
Opportunistic rate selection algorithm.
NOTE: AP6522, AP6522M, AP6532, AP6562, AP71XX, AP75XX, AP81XX and AP82XX
model access points can support up to 256 client connections to a single access point
radio. AP6511 and AP6521 model access points (both single radio models) can support
up to 128 client connections to a single radio.
9. Set the following profile WLAN Properties for the selected access point radio:
Beacon Interval
Set the interval between radio beacons in milliseconds (either 50, 100 or 200). A beacon
is a packet broadcast by adopted radios to keep the network synchronized. Included in a
beacon is information such as the WLAN service area, the radio address, the broadcast
destination addresses, a time stamp, and indicators about traffic and delivery such as a
DTIM. Increase the DTIM/beacon settings (lengthening the time) to let nodes sleep longer
and preserve battery life. Decrease these settings (shortening the time) to support
streaming-multicast audio and video applications that are jitter-sensitive.The default
value is 100 milliseconds.
DTIM Interval BSSID
Set a DTIM Interval to specify a period for Delivery Traffic Indication Messages (DTIM). A
DTIM is periodically included in a beacon frame transmitted from adopted radios. The
DTIM period determines how often the beacon contains a DTIM, for example, 1 DTIM for
every 10 beacons. The DTIM indicates broadcast and multicast frames (buffered at the
access point) are soon to arrive. These are simple data frames that require no
acknowledgement, so nodes sometimes miss them. Increase the DTIM/ beacon settings
(lengthening the time) to let nodes sleep longer and preserve their battery life. Decrease
these settings (shortening the time) to support streaming multicast audio and video
applications that are jitter-sensitive.
5 - 46 WiNG 5.5.3 Access Point System Reference Guide
RTS Threshold
Specify a Request To Send (RTS) threshold (from 1 - 2,347 bytes) for use by the WLAN's
adopted access point radios. RTS is a transmitting station's signal that requests a Clear
To Send (CTS) response from a receiving client. This RTS/CTS procedure clears the air
where clients are contending for transmission time. Benefits include fewer data collisions
and better communication with nodes that are hard to find (or hidden) because of other
active nodes in the transmission path.
Control RTS/CTS by setting an RTS threshold. This setting initiates an RTS/CTS exchange
for data frames larger than the threshold, and sends (without RTS/CTS) any data frames
smaller than the threshold.
Consider the trade-offs when setting an appropriate RTS threshold for the WLAN's access
point radios. A lower RTS threshold causes more frequent RTS/CTS exchanges. This
consumes more bandwidth because of additional latency (RTS/CTS exchanges) before
transmissions can commence. A disadvantage is the reduction in data-frame throughput.
An advantage is quicker system recovery from electromagnetic interference and data
collisions. Environments with more wireless traffic and contention for transmission make
the best use of a lower RTS threshold.
A higher RTS threshold minimizes RTS/CTS exchanges, consuming less bandwidth for
data transmissions. A disadvantage is less help to nodes that encounter interference and
collisions. An advantage is faster data-frame throughput. Environments with less
wireless traffic and contention for transmission make the best use of a higher RTS
threshold.
Short Preamble
If using an 802.11bg radio, select this option for the radio to transmit using a short
preamble. Short preambles improve throughput. However, some devices (SpectraLink
phones) require long preambles. The default value is disabled.
Guard Interval
Use the drop-down menu to specify a Long or Any guard interval. The guard interval is the
space between symbols (characters) being transmitted. The guard interval is there to
eliminate inter-symbol interference (ISI). ISI occurs when echoes or reflections from one
symbol interfere with another symbol. Adding time between transmissions allows echo's
and reflections to settle before the next symbol is transmitted. A shorter guard interval
reduces overhead and increases data rates by up to 10%.The default value is Long.
Probe Response Rate
Use the drop-down menu to specify the data transmission rate used for the transmission
of probe responses. Options include, highest-basic, lowest-basic and follow-proberequest (default setting).
Probe Response Retry
Select this option to retry probe responses if they are not acknowledged by the target
wireless client. The default value is enabled.
10. Use the Feed WLAN Packets to Sensor drop-down menu to radio’s tap mode of operation. Options include, Off, Inline
and Promiscuous. The default setting is Off.
11. Select the WLAN Mapping/Mesh Mapping tab.
Device Configuration 5 - 47
Figure 5-26 Access Point Radio - WLAN Mapping tab
12. Refer to the WLAN Mapping/Mesh Mapping field to set WLAN BSSID assignments for an existing access point
deployment.
Administrators can assign each WLAN its own BSSID. If using a single-radio access point, there are 8 BSSIDs available. If
using a dual-radio access point there are 8 BSSIDs for the 802.11b/g/n radio and 8 BSSIDs for the 802.11a/n/c radio.
Each supported access point model can support up to 8 BSS IDs.
13. Select Advanced Mapping to list all the available BSSIDs for the radio.
14. Select Create New WLAN to open a dialog where new WLANs are created.
15. Select Create New MeshPoint to open a dialog where new Mesh Points are created.
16. Select the OK button located at the bottom right of the screen to save the changes to the WLAN Mapping. Select Reset
to revert to the last saved configuration.
17. Select the Legacy Mesh tab.
5 - 48 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-27 Access Point Radio - Mesh Legacy tab
Use the Legacy Mesh screen to define how mesh connections are established and the number of links available amongst
access points within the mesh network.
18. Define the following Mesh Settings:
Mesh
Options include Client, Portal and Disabled. Select Client to scan for mesh portals, or
nodes that have connection to portals, and then connect through them. Portal operation
begins beaconing immediately and accepts connections from other mesh supported
nodes. Select Portal when setting a mesh connection between two Standalone APs. The
default value is Disabled.
Mesh Links
Use the spinner control to define the number of mesh links (1 -6) an access point radio will
attempt to create. The default settings is 3 links.
Mesh PSK
Use the text box to enter the mesh’s secret key. Select either ASCII or HEX from the
drop-down menu. Click the Show option to display the secret key entered in the Mesh PSK
field.
19. Refer to the Preferred Peer Devices table and select + Add Row to define MAC addresses representing peer devices
for preferred mesh connection. Use the Priority spinner control to set a priority (1 -6) for connection preference.
20. Select the OK button located at the bottom right of the screen to save the changes to the Mesh configuration. Select Reset
to revert to the last saved configuration.
21. Select the Advanced Settings tab.
Device Configuration 5 - 49
Figure 5-28 Access Point Radio - Advanced Settings tab
22. Refer to the Aggregate MAC Protocol Data Unit (A-MPDU) field to define how MAC service frames are aggregated by
the access point radio.
A-MPDU Modes
Use the drop-down menu to define the A-MPDU mode supported. Options include
Transmit Only, Receive Only, Transmit and Receive and None. The default value is
Transmit and Receive. Using the default value, long frames can be both sent and received
(up to 64 KB). When enabled, define either a transmit or receive limit (or both).
Minimum Gap Between
Frames
Use the drop-down menu to define the minimum gap between A-MPDU frames (in
microseconds). The default value is 4 microseconds.
Received Frame Size
Limit
If a support mode is enable allowing A-MPDU frames to be received, define an advertised
maximum limit for received A-MPDU aggregated frames. Options include 8191, 16383,
32767 or 65535 bytes. The default value is 65535 bytes.
Transmit Frame Size
Limit
Use the spinner control to set limit on transmitted A-MPDU aggregated frames. The
available range is from 2000 - 65,535 bytes). The default value is 65535 bytes.
23. Use the Aggregate MAC Service Data Unit (A-MSDU) drop-down menu to set the supported A-MSDU mode.
Available modes include Receive Only and Transmit and Receive. Transmit and Receive is the default value. Using Transmit
and Receive, frames up to 4 KB can be sent and received. The buffer limit is not configurable.
24. Set the following Aeroscout Properties for the selected access point radio:
Forward
Use the Forward option to forward Aeroscout packets to the server.
MAC to be forwarded
Use the text area to provide a MAC address that identifies that the packet is received
from Aeroscout tags.
25. Set the following Ekahau Properties for the selected access point radio:
Forwarding Host
Use the Forward Host text area to provide the IP address of the Ekahau Engine.
5 - 50 WiNG 5.5.3 Access Point System Reference Guide
Forwarding Port
Use the Forward Port spinner to configure the port on which to forward captured packets
to the Ekahau Engine.
MAC to be forwarded
Use the text area to provide a MAC address that identifies that the packet is received
from Ekahau tags.
26. Set the following Non-Unicast Traffic values for the profile’s supported access point radio and its connected wireless
clients:
Broadcast/Multicast
Transmit Rate
Use the Select drop-down menu to launch a sub screen to define the data rate broadcast
and multicast frames are transmitted. Seven different rates are available if the not using
the same rate for each BSSID, each with a separate menu.
Broadcast/Multicast
Forwarding
Define whether client broadcast and multicast packets should always follow DTIM, or
only follow DTIM when using Power Save Aware mode. The default setting is Follow
DTIM.
27. Refer to the Sniffer Redirect (Packet Capture) field to define the radio’s captured packet configuration.
Host for Redirected
Packets
If packets are re-directed from an access point radio, define an IP address of a resource
(additional host system) used to capture the re- directed packets. This address is the
numerical (non DNS) address of the host used to capture the re-directed packets.
Channel to Capture
Packets
Use the drop-down menu to specify the channel used to capture re-directed packets. The
default value is channel 1.
28. Select the Enable Off Channel Scan radio button to permit scans on non designated channels for this radio. While this
affords the access point a greater likelihood of catching an unauthorized device, it does consume more bandwidth. The
default setting is disabled. Set the following Channel Scanning properties for the selected access point radio:
Off Channel Scan list for 5
GHz
Use the drop-down menu to select the channels to scan in the 5 GHz band when
performing off channel scans.
Off Channel Scan list for
2.4 GHz
Use the drop-down menu to select the channels to scan in the 2.4 GHz band when
performing off channel scans.
Max Multicast
Use the spinner to set the number of multicast and broadcast packets queued in the
radio’s queue, when exceeded, off channel scan is skipped during the current scanning
interval.
Scan Interval
Use the spinner to set the off channel scan interval in number of dtim periods.
Sniffer Redirect
Use Sniffer Redirect text area to provide the IP address of a remote host where the
captured off channel scan packets are re-directed.
29. Set the following AP7161/AP7181 specific values:
Enable Antenna Downtilt
Antenna Downtilt is used where there is a need for a separation between the 2.4 GHz and
5.0 GHz bands. The 2.4 GHz band is tilted by 15 degrees (up/down tilt) using software.
Select to enable downtilt.
Extend Range
Select to enable extending the range of the access points. The access point uses various
technologies to extend their service range. Use the spinner to set the range of service.
Range can be 1 - 25 Kilometers.
Device Configuration 5 - 51
30. Select the OK button located at the bottom right of the screen to save the changes to the Advanced Settings screen.
Select Reset to revert to the last saved configuration.
5.2.5.4.1 MCS Data Rates
Access Point Radio Configuration
802.11n MCS rates are defined as follows both with and without short guard intervals (SGI):
Table 5.1 MCS-1Stream
Number of
Streams
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
0
1
6.5
7.2
13.5
15
1
1
13
14.4
27
30
2
1
19.5
21.7
40.5
45
3
1
26
28.9
54
60
4
1
39
43.4
81
90
5
1
52
57.8
108
120
6
1
58.5
65
121.5
135
7
1
65
72.2
135
150
Table 5.2 MCS-2Stream
Number of
Streams
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
0
2
13
14.4
27
30
1
2
26
28.9
54
60
2
2
39
43.4
81
90
3
2
52
57.8
108
120
4
2
78
86.7
162
180
5
2
104
115.6
216
240
6
2
117
130
243
270
7
2
130
144.4
270
300
Table 5.3 MCS-3Stream
Number of
Streams
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
0
3
19.5
21.7
40.5
45
1
3
39
43.3
81
90
2
3
58.5
65
121.5
135
5 - 52 WiNG 5.5.3 Access Point System Reference Guide
Table 5.3 MCS-3Stream
Number of
Streams
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
3
3
78
86.7
162
180
4
3
117
130.7
243
270
5
3
156
173.3
324
360
6
3
175.5
195
364.5
405
7
3
195
216.7
405
450
802.11ac MCS rates are defined as follows both with and without short guard intervals (SGI):
Table 5.4 MCS-802.11ac (theoretical throughput for single spatial streams)
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
80 MHz
No SGI
80MHz
With SGI
0
6.5
7.2.
13.5
15
29.3
32.5
1
13
14.4
27
30
58.5
65
2
19.5
21.7
40.5
45
87.8
97.5
3
26
28.9
54
60
117
130
4
39
43.3
81
90
175.5
195
5
52
57.8
108
120
234
260
6
58.5
65
121.5
135
263.3
292.5
7
65
72.2
135
150
292.5
325
8
78
86.7
162
180
351
390
9
n/a
n/a
180
200
390
433.3
Device Configuration 5 - 53
5.2.5.5 WAN Backhaul Configuration
Profile Interface Configuration
A Wireless Wide Area Network (WWAN) card is a specialized network interface card that allows a network device to connect,
transmit and receive data over a Cellular Wide Area Network. The AP7131N model access point has a PCI Express card slot
that supports 3G WWAN cards. The WWAN card uses point to point protocol (PPP) to connect to the Internet Service Provider
(ISP) and gain access to the Internet. PPP is the protocol used for establishing internet links over dial-up modems, DSL
connections, and many other types of point-to-point communications. PPP packages your system’s TCP/IP packets and forwards
them to the serial device where they can be put on the network. PPP is a full-duplex protocol that can be used on various
physical media, including twisted pair or fiber optic lines or satellite transmission. It uses a variation of High Speed Data Link
Control (HDLC) for packet encapsulation.
The following 3G cards are supported:
• Verizon V740
• Verizon PC770
• Sprint C777
• Novatel Merlin XU870
• Sierra Aircard 880E
• Telstra Elite Mobile Broadband
• Option GT Ultra Express
• Vodaphone Mobile Connect E3730
• Aircard 503
• Aircard 504 / AT & T 890
To define a WAN Backhaul configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Interface menu and select WAN Backhaul.
5 - 54 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-29 Profile Interface - WAN Backhaul screen
5. Refer to the WAN (3G) Backhaul configuration to specify the access point’s WAN card interface settings:
WAN Interface Name
Displays the WAN Interface name for the WAN 3G Backhaul card.
Enable WAN (3G)
Select this option to enable 3G WAN card support on the access point. A supported 3G
card must be connected for this feature to work.
6. Define the following authentication parameters from within the Basic Settings field:
Username
Provide username for authentication support by the cellular data carrier.
Password
Provide password for authentication support by the cellular data carrier.
Access Point Name
(APN)
Enter the name of the cellular data provider if necessary. This setting is needed in areas
with multiple cellular data providers using the same protocols such as Europe, the Middle
East and Asia.
Authentication Type
Use the drop-down menu to specify the authentication type used by the cellular data
provider. Supported authentication options include None, PAP, CHAP, MSCHAP, and
MSCHAP-v2.
7. Use the NAT Direction field to specify the NAT direction used with the access point’s WAN card. Options include Inside,
Outside or None. The default is None.
Device Configuration 5 - 55
8. Configure the Inbound IP Firewall Rules. Use the drop-down menu to select a firewall (set of IP access connection rules)
to apply to the PPPoE client connection. If a firewall rule does not exist suiting the data protection needs of the PPPoE client
connection, select the Create icon to define a new rule configuration or the Edit icon to modify an existing rule.
9. Select the VPN Crypto Map to use with this WWAN configuration. Use the drop-down menu to apply an existing crypto
map configuration to this WWAN interface.
10. Use the WWW Default Route Priority spinner to set a default route priority for this interface. The default value is 3000.
11. Select OK to save the changes to the Advanced Settings screen. Select Reset to revert to the last saved configuration.
5.2.5.5.1 WAN Backhaul Deployment Considerations
WAN Backhaul Configuration
Before defining a profile’s WAN Backhaul configuration refer to the following deployment guidelines to ensure these
configuration are optimally effective:
• If the WAN card does not connect after a few minutes after a no shutdown, check the access point’s syslog for a detected
ttyUSB0 No such file event. If this event has occurred, linux didn’t detect the card. Re-seat the card.
• If the WAN card has difficulty connecting to an ISP (syslog shows that it retries LCP ConfReq for a long time), ensure the
SIM card is still valid and is plugged in correctly.
• If a modem doesn’t responding with an OK during the dialing sequence, the WAN card is in an unknown state and will not
accept a command. Re-seat the card and begin the dialup sequence again until the card is recognized.
• If encountering a panic when conducting a hotplug, power off the access point for one minute. The access point could
continue to panic or detect the descriptor of the last utilized WAN card. Thus, it's a good idea to clear the panic state by
temporarily disconnecting then re-applying access point power.
• If wanting to unplug the WAN card, ensure sure you shutdown first, as the probability of getting a panic is reduced. With
the new high-speed WAN cards currently being utilized, the chances of getting a panic significantly increase.
5 - 56 WiNG 5.5.3 Access Point System Reference Guide
5.2.5.6 PPPoE Configuration
Profile Interface Configuration
PPP over Ethernet (PPPoE) is a data-link protocol for dialup connections. PPPoE allows the access point to use a broadband
modem (DSL, cable modem, etc.) for access to high-speed data and broadband networks. Most DSL providers are currently
supporting (or deploying) the PPPoE protocol. PPPoE uses standard encryption, authentication, and compression methods as
specified by the PPPoE protocol. PPPoE enables WiNG supported controllers and access points to establish a point-to-point
connection to an ISP over existing Ethernet interface.
To provide this point-to-point connection, each PPPoE session learns the Ethernet address of a remote PPPoE client, and
establishes a session. PPPoE uses both a discover and session phase to identify a client and establish a point-to-point
connection. By using such a connection, a Wireless WAN failover is available to maintain seamless network access if the
access point’s Wired WAN were to fail.
NOTE: Access points with PPPoE enabled continue to support VPN, NAT, PBR and 3G
failover over the PPPoE interface. Multiple PPPoE sessions are supported using a single
user account user account if RADIUS is configured to allow simultaneous access.
NOTE: PPPoE is supported on AP6522, AP6522M, AP6532, AP6562, AP71XX, AP7522,
AP7532, AP81XX and AP82XX models and is not available on AP6511 and AP6521 model
access points.
When PPPoE client operation is enabled, it discovers an available server and establishes a PPPoE link for traffic slow. When a
wired WAN connection failure is detected, traffic flows through the WWAN interface in fail-over mode (if the WWAN network
is configured and available). When the PPPoE link becomes accessible again, traffic is redirected back through the access
point’s wired WAN link.
When the access point initiates a PPPoE session, it first performs a discovery to identify the Ethernet MAC address of the PPPoE
client and establish a PPPoE session ID. In discovery, the PPPoE client discovers a server to host the PPPoE connection.
To create a PPPoE point-to-point configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Interface menu and select PPPoE.
Device Configuration 5 - 57
Figure 5-30 Profile Interface - PPPoE screen
5. Use the Basic Settings field to enable PPPoE and define a PPPoE client.
Enable PPPoE
Select Enable to support a high speed client mode point-to-point connection using the
PPPoE protocol. The default setting is disabled.
Service
Enter the 128 character maximum PPPoE client service name issued by the service
provider.
DSL Modem Network
(VLAN)
Use the spinner control to set the PPPoE VLAN (client local network) connected to the DSL
modem. This is the local network connected to DSL modem. The available range is
1 - 4,094. The default VLAN is VLAN1.
Client IP Address
Provide the numerical (non hostname) IP address of the PPPoE client.
5 - 58 WiNG 5.5.3 Access Point System Reference Guide
6. Define the following Authentication parameters for PPPoE client interoperation:
Username
Provide the 64 character maximum username used for authentication support by the
PPPoE client.
Password
Provide the 64 character maximum password used for authentication by the PPPoE client.
Use the Show option to view the actual characters comprising the password.
Authentication Type
Use the drop-down menu to specify authentication type used by the PPPoE client, and
whose credentials must be shared by its peer access point. Supported authentication
options include None, PAP, CHAP, MSCHAP, and MSCHAP-v2.
7. Define the following Connection settings for the PPPoE point-to-point connection with the PPPoE client:
Maximum Transmission
Unit (MTU)
Set the PPPoE client Maximum Transmission Unit (MTU) from 500 - 1,492. The MTU is the
largest physical packet size in bytes a network can transmit. Any messages larger than
the MTU are divided into smaller packets before being sent. A PPPoE client should be able
to maintain its point-to-point connection for this defined MTU size. The default MTU is
1,492.
Client Idle Timeout
Set a timeout in either Seconds (1 - 65,535), Minutes (1 - 1,093) or Hours. The access point
uses the defined timeout so it does not sit idle waiting for input from the PPPoE client and
server that may never come. The default setting is 10 minutes.
Keep Alive
Select this option to ensure the point-to-point connection to the PPPoE client is
continuously maintained and not timed out. This setting is disabled by default.
8. Set the Network Address Translation (NAT) direction for the PPPoE configuration.
Network Address Translation (NAT) converts an IP address in one network to a different IP address or set of IP addresses
in another network. The access point router maps its local (Inside) network addresses to WAN (Outside) IP addresses, and
translates the WAN IP addresses on incoming packets to local IP addresses. NAT is useful because it allows the
authentication of incoming and outgoing requests, and minimizes the number of WAN IP addresses needed when a range
of local IP addresses is mapped to each WAN IP address. The default setting is None (neither inside or outside).
9. Define the following Security Settings for the PPPoE configuration:
Inbound IP Firewall
Rules
Use the drop-down menu to select a firewall (set of IP access connection rules) to apply
to the PPPoE client connection. If a firewall rule does not exist suiting the data protection
needs of the PPPoE client connection, select the Create icon to define a new rule
configuration or the Edit icon to modify an existing rule. For more information, see
Wireless Firewall on page 8-2.
VPN Crypto Map
Use the drop-down menu to apply an existing crypt map configuration to this PPPoE
interface.
10. Use the spinner control to set the Default Route Priority for the default route learnt using PPPoE.
Select from 1 - 8,000. The default setting is 2,000.
11. Select OK to save the changes to the PPPoE screen. Select Reset to revert to the last saved configuration. Saved
configurations are persistent across reloads.
Device Configuration 5 - 59
5.2.6 Profile Network Configuration
System Profile Configuration
Setting an access point profile’s network configuration is a large task comprised of numerous administration activities.
An access point profile network configuration process consists of the following:
• DNS Configuration
• ARP
• L2TPv3 Profile Configuration
• IGMP Snooping
• Quality of Service (QoS)
• Spanning Tree Configuration
• Routing
• Dynamic Routing (OSPF)
• Forwarding Database
• Bridge VLAN
• Cisco Discovery Protocol Configuration
• Link Layer Discovery Protocol Configuration
• Miscellaneous Network Configuration
• Alias
Before beginning any of the profile network configuration activities described in the sections above, review the configuration
and deployment considerations available in Profile Network Configuration and Deployment Considerations on page 5-103.
5 - 60 WiNG 5.5.3 Access Point System Reference Guide
5.2.6.1 DNS Configuration
Profile Network Configuration
Domain Naming System (DNS) is a hierarchical naming system for resources connected to the Internet or a private network.
Primarily, DNS resources translate domain names into IP addresses. If one DNS server does not know how to translate a
particular domain name, it asks another one until the correct IP address is returned. DNS enables access to resources using
human friendly notations. DNS converts human friendly domain names into notations used by different networking equipment
for locating resources.
As a resource is accessed (using human-friendly hostnames), it’s possible to access the resource even if the underlying machine
friendly notation name changes. Without DNS, in the simplest terms, you would need to remember a series of numbers
(123.123.123.123) instead of an easy to remember domain name (www.domainname.com).
To define the DNS configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select DNS.
Figure 5-31 Network - DNS screen
5. Provide a default Domain Name used when resolving DNS names. The name cannot exceed 64 characters.
6. Set the following DNS configuration data:
Enable Domain Lookup
Select this option to enable DNS. When enabled, human friendly domain names can be
converted into numerical IP destination addresses. This feature is enabled by default.
DNS Server Forwarding
Select to enable the forwarding DNS queries to external DNS servers if a DNS query
cannot be processed by the access point’s own DNS resources. This feature is disabled
by default.
7. In the Name Servers field, provide the IP addresses of up to three DNS server resources available to the access point.
Device Configuration 5 - 61
8. Select OK to save the changes made to the DNS configuration. Select Reset to revert to the last saved configuration.
5.2.6.2 ARP
Profile Network Configuration
Address Resolution Protocol (ARP) is a protocol for mapping an IP address to a hardware MAC address recognized on the
network. ARP provides protocol rules for making this correlation and providing address conversion in both directions.
When an incoming packet destined for a host arrives, the gateway uses ARP to find a physical host or MAC address that
matches the IP address. ARP looks in its ARP cache and, if it finds the address, provides it so the packet can be converted to
the right packet length and format and sent to the destination. If no entry is found for the IP address, ARP broadcasts a request
packet in a special format to all the machines on the LAN to see if one machine knows that it has that IP address associated
with it. A machine that recognizes the IP address as its own returns a reply. ARP updates the ARP cache for future reference,
and then sends the packet to the MAC address that replied.
To define an ARP supported configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select ARP.
5. Select + Add Row from the lower right-hand side of the screen to populate the ARP table with rows used to define ARP
network address information.
Figure 5-32 Network - ARP screen
6. Set the following parameters to define the ARP configuration:
Switch VLAN Interface
Use the spinner control to select a VLAN for an address requiring resolution.
IP Address
Define the IP address used to fetch a MAC Address.
MAC Address
Displays the target MAC address that’s subject to resolution. This is the MAC used for
mapping an IP address to a MAC address that’s recognized on the network.
5 - 62 WiNG 5.5.3 Access Point System Reference Guide
Device Type
Specify the device type the ARP entry supports (Host, Router or DHCP Server). Host is the
default setting.
7. Select the OK button located at the bottom right of the screen to save the changes to the ARP configuration. Select Reset
to revert to the last saved configuration.
5.2.6.3 L2TPv3 Profile Configuration
Profile Network Configuration
L2TP V3 is an IETF standard used for transporting different types of layer 2 frames in an IP network (and access point profile).
L2TP V3 defines control and encapsulation protocols for tunneling layer 2 frames between two IP nodes.
Use L2TP V3 to create tunnels for transporting layer 2 frames. L2TP V3 enables WING supported controllers and access points
to create tunnels for transporting Ethernet frames to and from bridge VLANs and physical ports. L2TP V3 tunnels can be defined
between WING devices and other vendor devices supporting the L2TP V3 protocol.
Multiple pseudowires can be created within an L2TP V3 tunnel. Access points support an Ethernet VLAN pseudowire type
exclusively.
NOTE: A pseudowire is an emulation of a layer 2 point-to-point connection over a
packet-switching network (PSN). A pseudowire was developed out of the necessity to
encapsulate and tunnel layer 2 protocols across a layer 3 network.
Ethernet VLAN pseudowires transport Ethernet frames to and from a specified VLAN. One or more L2TP V3 tunnels can be
defined between tunnel end points. Each tunnel can have one or more L2TP V3 sessions. Each tunnel session corresponds to
one pseudowire. An L2TP V3 control connection (a L2TP V3 tunnel) needs to be established between the tunneling entities
before creating a session.
For optimal pseudowire operation, both the L2TP V3 session originator and responder need to know the psuedowire type and
identifier. These two parameters are communicated during L2TP V3 session establishment. An L2TP V3 session created within
an L2TP V3 connection also specifies multiplexing parameters for identifying a pseudowire type and ID.
The working status of a pseudowire is reflected by the state of the L2TP V3 session. If a L2TP V3 session is down, the
pseudowire associated with it must be shut down. The L2TP V3 control connection keep-alive mechanism can serve as a
monitoring mechanism for the pseudowires associated with a control connection.
NOTE: If connecting an Ethernet port to another Ethernet port, the pseudowire type
must be Ethernet port, if connecting an Ethernet VLAN to another Ethernet VLAN, the
pseudowire type must be Ethernet VLAN.
To define an L2TPV3 configuration for an access point profile:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select L2TPv3.
Device Configuration 5 - 63
Figure 5-33 Network - L2TPv3 screen - General tab
5. Set the following General Settings for an L2TPv3 profile configuration:
Host Name
Define a 64 character maximum hostname to specify the name of the host that’s sent
tunnel messages. Tunnel establishment involves exchanging 3 message types (SCCRQ,
SCCRP and SCCN) with the peer. Tunnel IDs and capabilities are exchanged during the
tunnel establishment with the host.
Router ID
Set either the numeric IP address or the integer used as an identifier for tunnel AVP
messages. AVP messages assist in the identification of a tunnelled peer.
UDP Listen Port
Select this option to set the port used for listening to incoming traffic. Select a port from
1,024 - 65,353.
Tunnel Bridging
Select this option to enable or disable bridge packets between two tunnel end points. This
setting is disabled by default.
6. Select the L2TPv3 Tunnel tab.
5 - 64 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-34 Network - L2TPv3 screen - T2TP tunnel tab
7. Review the following L2TPv3 tunnel configuration data:
Name
Displays the name of each listed L2TPv3 tunnel assigned upon creation.
Local IP Address
Lists the IP address assigned as the local tunnel end point address, not the interface IP
address. This IP is used as the tunnel source IP address. If this parameter is not specified,
the source IP address is chosen automatically based on the tunnel peer IP address.
MTU
Displays the maximum transmission unit (MTU) size for each listed tunnel. The MTU is the
size (in bytes) of the largest protocol data unit that the layer can pass between tunnel
peers.
Use Tunnel Policy
Lists the L2TPv3 tunnel policy assigned to each listed tunnel.
Local Hostname
Lists the tunnel specific hostname used by each listed tunnel. This is the hostname
advertised in tunnel establishment messages.
Local Router ID
Specifies the router ID sent in the tunnel establishment messages.
Establishment Criteria
Specifies tunnel criteria between two peers.
Critical Resource
Specifies the critical resource that should exist for a tunnel between two peers to be
created and maintained. Critical resources are device IP addresses or interface
destinations interpreted as critical to the health of the network. The critical resource
feature allows for the continuous monitoring of these defined addresses. A critical
resource, if not available, can result in the network suffering performance degradation.
Peer IP Address
Lists the IP address of the remote peer.
Host Name
Lists the tunnel specific hostname used by the remote peer.
Device Configuration 5 - 65
8. Either select Add to create a new L2TPv3 tunnel configuration, Edit to modify an existing tunnel configuration or Delete
to remove a tunnel from those available to this profile.
Figure 5-35 Network - L2TPv3 screen - Add T2TP Tunnel Configuration
9. If creating a new tunnel configuration, assign it a 31 character maximum Name.
10. Define the following Settings required for the L2TP tunnel configuration:
Local IP Address
Enter the IP address assigned as the local tunnel end point address, not the interface IP
address. This IP is used as the tunnel source IP address. If this parameter is not specified,
the source IP address is chosen automatically based on the tunnel peer IP address. This
parameter is applicable when establishing the tunnel and responding to incoming tunnel
create requests.
5 - 66 WiNG 5.5.3 Access Point System Reference Guide
MTU
Set the maximum transmission unit (MTU). The MTU is the size (in bytes) of the largest
protocol data unit the layer can pass between tunnel peers. Define a MTU between
128 - 1,460 bytes. The default setting is 1,460. A larger MTU means processing fewer
packets for the same amount of data.
Use Tunnel Policy
Select the L2TPv3 tunnel policy. The policy consists of user defined values for protocol
specific parameters which can be used with different tunnels. If none is available a new
policy can be created or an existing one can be modified. For more information, refer to
L2TP V3 Configuration on page 7-8.
Local Hostname
Provide the tunnel specific hostname used by this tunnel. This is the hostname advertised
in tunnel establishment messages.
Local Router ID
Specify the router ID sent in tunnel establishment messages with a potential peer device.
Establishment Criteria
Configure establishment criteria for creating a tunnel between the device and the NOC.
This criteria ensures only one tunnel is created between two sites where the tunnel is
established between the vrrp-master/cluster master/rf-domain manager at the remote
site and the controller at the NOC. The tunnel is created based on the role of the remote
peer.
• always – The tunnel is always created irrespective of the role of the local device.
• vrrp-master – The tunnel is only created when the local device is a VRRP master.
• cluster-master – The tunnel is only created when the local device is a cluster master.
• rf-domain-manager – The tunnel is only created when the local device is a RF-Domain
manager.
In all the above cases, if the local device goes offline for any reason, the tunnel is brought
down.
VRRP Group
This field is enabled only when the Establishment Criteria is set to vrrp-master. Use the
spinner to select the VRRP group.
Critical Resource
Enter the critical resources required for creating and maintaining a L2TPV3 tunnel. A
tunnel is only established when all critical resources for the tunnel to be operational are
available at the time when the tunnel is created. If any one of the listed critical resources
goes down, the tunnel is disabled.
When a tunnel is established, the listed critical resources are checked for availability.
Tunnel establishment is started if the critical resources are available. Similarly, for
incoming tunnel termination requests, listed critical resources are checked and tunnel
terminations are only allowed when the critical resources are available.
For more information on managing critical resources, see Profile Critical Resources on
page 5-139.
11. Refer to the Peer table to review the configurations of the peers available for tunnel connection.
Select + Add Row to populate the table with a maximum of two peer configurations.
Device Configuration 5 - 67
Figure 5-36 Network - L2TPv3 screen - Add T2TP Peer Configuration
12. Define the following Peer parameters:
Peer ID
Define the primary peer ID used to set the primary and secondary peer for tunnel failover.
If the peer is not specified, tunnel establishment does not occur. However, if a peer tries
to establish a tunnel with this access point, it creates the tunnel if the hostname and/or
Router ID matches.
Peer IP Address
Select this option to enter the numeric IP address used as the tunnel destination peer
address for tunnel establishment.
Host Name
Assign the peer a hostname that can be used as matching criteria in the tunnel
establishment process.
Router ID
Specify the router ID sent in tunnel establishment messages with this specific peer.
Encapsulation
Select either IP or UDP as the peer encapsulation protocol. The default setting is IP. UDP
uses a simple transmission model without implicit handshakes.
UDP Port
If UDP encapsulation is selected, use the spinner control to define the UDP encapsulation
port.
IPSEC Secure
Select this option to provide IPSEC security for the tunnel.
IPSEC Gateway
Enter the IP address/Hostname for the IPSEC gateway.
13. Select OK to save the peer configuration.
14. Refer to the Session table to review the configurations of the peers available for tunnel connection.
Select + Add Row to populate the table with configurable session parameters for this tunnel configuration.
15. Define the following Session parameters:
Name
Enter a 31 character maximum session name. There is no idle timeout for a tunnel. A
tunnel is not usable without a session and a subsequent session name. The tunnel is
closed when the last session tunnel session is closed.
5 - 68 WiNG 5.5.3 Access Point System Reference Guide
Pseudowire ID
Define a psuedowire ID for this session. A pseudowire is an emulation of a layer 2
point-to-point connection over a packet-switching network (PSN). A pseudowire was
developed out of the necessity to encapsulate and tunnel layer 2 protocols across a layer
3 network.
Traffic Source Type
Lists the type of traffic tunnelled in this session.
Traffic Source Value
Define a VLAN range to include in the tunnel session. Available VLAN ranges are from
1 - 4,094.
Native VLAN
Select this option to provide a VLAN ID that will not be tagged in tunnel establishment
and packet transfer.
16. Select OK to save the changes within the T2TP Tunnel screen. Select Reset to revert the screen to its last saved
configuration.
17. Select the Manual Session tab.
After successful tunnel connection and establishment, individual sessions can be created. Each session is a single data
stream. After successful session establishment, data corresponding to that session (pseudowire) can be transferred. If a
session is down, the pseudowire associated with it is shut down as well.
Figure 5-37 Network - L2TPv3 screen - Manual Session tab
18. Refer to the following manual session configurations to determine whether a session should be created or modified:
IP Address
Lists the IP address assigned as the local tunnel end point address, not the interface IP
address. This IP is used as the tunnel source IP address. If this parameter is not specified,
the source IP address is chosen automatically based on the tunnel peer IP address. This
parameter is applicable when establishing the session and responding to incoming
requests.
Device Configuration 5 - 69
Local Session ID
Displays the numeric identifier assigned to each listed tunnel session. This is the
pseudowire ID for the session. This pseudowire ID is sent in a session establishment
message to the L2TP peer.
MTU
Displays each sessions’s maximum transmission unit (MTU). The MTU is the size (in bytes)
of the largest protocol data unit the layer can pass between tunnel peers in this session.
A larger MTU means processing fewer packets for the same amount of data.
Name
Lists the name assigned to each listed manual session.
Remote Session ID
Lists the remote session ID passed in the establishment of the tunnel session.
19. Select Add to create a new manual session, Edit to modify an existing session configuration or Delete to remove a
selected manual session.
Figure 5-38 Network - L2TPv3 screen, Add T2TP Peer Configuration
20. Set the following session parameters:
Name
Define a 31 character maximum name for this tunnel session. Each session name
represents a single data stream.
5 - 70 WiNG 5.5.3 Access Point System Reference Guide
IP Address
Specify the IP address used as a tunnel source IP address. If not specified, the tunnel
source IP address is selected automatically based on the tunnel peer IP address. This
address is applicable only for initiating the tunnel. When responding to incoming tunnel
create requests, the tunnel would use the IP address received in the tunnel create
request.
IP
Set the IP address of an L2TP tunnel peer. This is the peer allowed to establish the tunnel.
Local Session ID
Set the numeric identifier for the tunnel session. This is the pseudowire ID for the session.
This pseudowire ID is sent in session establishment message to the L2TP peer.
MTU
Define the session maximum transmission unit (MTU) as the size (in bytes) of the largest
protocol data unit the layer can pass between tunnel peers in this session. A larger MTU
means processing fewer packets for the same amount of data.
Remote Session ID
Use the spinner control to set the remote session ID passed in the establishment of the
tunnel session. Assign an ID from 1 - 4,294,967,295.
Encapsulation
Select either IP or UDP as the peer encapsulation protocol. The default setting is IP. UDP
uses a simple transmission model without implicit handshakes.
UDP Port
If UDP encapsulation is selected, use the spinner control to define the UDP encapsulation
port. This is the port where the L2TP service is running.
Source VLAN
Define the VLAN range (1 - 4,094) to include in the tunnel. Tunnel session data includes
VLAN tagged frames.
Native VLAN
Select this option to define the native VLAN that will not be tagged.
21. Select the + Add Row button to set the following:
Cookie Size
Set the size of the cookie field within each L2TP data packet. Options include 0, 4 and 8.
The default setting is 0.
Value 1
Set the cookie value first word.
Value 2
Set the cookie value second word.
End Point
Define whether the tunnel end point is local or remote.
22. Select OK to save the changes to the session configuration. Select Reset to revert to the last saved configuration.
Device Configuration 5 - 71
5.2.6.4 IGMP Snooping
Profile Network Configuration
Internet Group Management Protocol (IGMP) is a protocol to establish and maintain multicast group memberships to interested
members. Multicasting allows a networked computer to send content to multiple computers who have registered to receive
the content. IGMP Snooping is for listening to IGMP traffic between an IGMP host and routers in the network to maintain a
map of the links that require multicast streams. Multicast traffic is filtered out for those links which do not require them.
To configure IGMP Snooping:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select IGMP Snooping.
Figure 5-39 IGMP Snooping screen
5. Set the following parameters to configure general IGMP Snooping values:
Enable IGMP Snooping
Select this option to enable IGMP Snooping on the access point. This feature is enabled
by default.
Forward Unknown
Multicast Packets
Select this option to enable the access point to forward multicast packets from
unregistered multicast groups. If disabled, the Unknown Multicast Forward feature is
also disabled for the selected VLANs. This is enabled by default.
5 - 72 WiNG 5.5.3 Access Point System Reference Guide
6. Set the following for IGMP Querier configuration:
Enable IGMP Querier
Select this option to enable IGMP querier. IGMP snoop querier is used to keep host
memberships alive. It is primarily used in a network where there is a multicast streaming
server and hosts subscribed to the server and no IGMP querier present. The controller can
perform the IGMP querier role. An IGMP querier sends out periodic IGMP query packets.
Interested hosts reply with an IGMP report packet. IGMP snooping is only conducted on
wireless radios. IGMP multicast packets are flooded on wired ports. IGMP multicast
packet are not flooded on the wired port. IGMP membership is also learnt on it and only
if present, then forwarded on that port. An AP71XX model access point can also be an
IGMP querier.
IGMP Version
Use the spinner control to set the IGMP version compatibility to IGMP version 1, 2 or 3.
The default IGMP version is 3.
IGMP Query Interval
Sets the IGMP query interval. This parameter is used only when the querier functionality
is enabled. Define an interval value in Seconds (1 - 18000 seconds), Minutes (1 - 300
minutes) or Hours (1 - 5 hours) up to maximum of 5 hours. The default value is 60 seconds.
IGMP Robustness
Variable
Sets the IGMP robustness variable. The robustness variable is a way of indicating how
susceptible the subnet is to lost packets. IGMP can recover from robustness variable
minus 1 lost IGMP packets. Define a robustness variable from 1 - 7. The default
robustness value is 2.
Maximum Response Time Specify the maximum time (from 1 - 25 seconds) before sending a responding report.
When no reports are received from a radio, radio information is removed from the IGMP
snooping table. The access point only forwards multicast packets to radios present in the
snooping table. For IGMP reports from wired ports, the controller forwards these reports
to the multicast router ports. The default setting is 10 seconds.
Other Querier Time Expiry Specify an interval in either Seconds (60 - 300) or Minutes (1 - 5) to set a timeout interval
for other querier resources. The default setting is 1 minute.
7. Select the OK button located at the bottom right of the screen to save the changes. Select Reset to revert to the last saved
configuration.
Device Configuration 5 - 73
5.2.6.5 Quality of Service (QoS)
Profile Network Configuration
The uses different Quality of Service (QoS) screens to define WLAN and device radio QoS configurations. The System Profiles
> Network > QoS facility is separate from WLAN and radio QoS configurations, and is used to configure the priority of different
DSCP packet types.
QoS values are required to provide priority of service to some packets over others. For example, VoIP packets get higher priority
than data packets to provide a better quality of service for high priority voice traffic.
The profile QoS screen maps the 6-bit Differentiated Service Code Point (DSCP) code points to the older 3-bit IP Precedent field
located in the Type of Service byte of an IP header. DSCP is a protocol for specifying and controlling network traffic by class so
that certain traffic types get precedence. DSCP specifies a specific per-hop behavior applied to a packet.
To define an QoS configuration for DSCP mappings:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select Quality of Service (QoS).
Figure 5-40 Network - Quality of Service (QoS) screen
5. Set the following parameters for IP DSCP mappings for untagged frames:
DSCP
Lists the DSCP value as a 6-bit parameter in the header of every IP packet used for packet
classification.
5 - 74 WiNG 5.5.3 Access Point System Reference Guide
802.1p Priority
Assign a 802.1p priority as a 3-bit IP precedence value in the Type of Service field of the
IP header used to set the priority. The valid values for this field are 0-7. Up to 64 entries
are permitted. The priority values are:
• 0 – Best Effort
• 1 – Background
• 2 – Spare
• 3 – Excellent Effort
• 4 – Controlled Load
• 5 – Video
• 6 – Voice
• 7 – Network Control
6. Use the spinner controls within the 802.1p Priority field for each DSCP row to change its priority value.
7. Select the OK button located at the bottom right of the screen to save the changes. Select Reset to revert to the last saved
configuration.
5.2.6.6 Spanning Tree Configuration
Profile Network Configuration
The Multiple Spanning Tree Protocol (MSTP) provides an extension to RSTP to optimize the usefulness of VLANs. MSTP allows
for a separate spanning tree for each VLAN group, and blocks all but one of the possible alternate paths within each spanning
tree topology.
If there’s just one VLAN in the access point managed network, a single spanning tree works fine. However, if the network
contains more than one VLAN, the network topology defined by single STP would work, but it’s possible to make better use of
the alternate paths available by using an alternate spanning tree for different VLANs or groups of VLANs.
A MSTP supported deployment uses multiple MST regions with multiple MST instances (MSTI). Multiple regions and other STP
bridges are interconnected using one single common spanning tree (CST).
MSTP includes all of its spanning tree information in a single Bridge Protocol Data Unit (BPDU) format. BPDUs are used to
exchange information bridge IDs and root path costs. Not only does this reduce the number of BPDUs required to communicate
spanning tree information for each VLAN, but it also ensures backward compatibility with RSTP. MSTP encodes additional
region information after the standard RSTP BPDU as well as a number of MSTI messages. Each MSTI messages conveys
spanning tree information for each instance. Each instance can be assigned a number of configured VLANs. The frames
assigned to these VLANs operate in this spanning tree instance whenever they are inside the MST region. To avoid conveying
their entire VLAN to spanning tree mapping in each BPDU, the access point encodes an MD5 digest of their VLAN to an instance
table in the MSTP BPDU. This digest is used by other MSTP supported devices to determine if the neighboring device is in the
same MST region as itself.
To define the spanning tree configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select Spanning Tree.
Device Configuration 5 - 75
Figure 5-41 Network - Spanning Tree screen
5. Set the following MSTP Configuration parameters:
MSTP Enable
Select this option to enable MSTP for this profile. MSTP is disabled by default.Enable
this setting if requiring different (groups) of VLANs with the profile supported network
segment.
Max Hop Count
Define the maximum number of hops the BPDU considers valid in the spanning tree
topology. The available range is from 7 -127. The default setting is 20.
MST Config Name
Define a 64 character maximum name for the MST region as an identifier for the
configuration.
MST Revision Level
Set a numeric revision value ID for MST configuration information. Set a value from
0 - 255. The default setting is 0.
Cisco MSTP
Interoperability
Select either the Enable or Disable radio buttons to enable/disable interoperability with
Cisco’s version of MSTP, which is incompatible with standard MSTP. This setting is
disabled by default.
5 - 76 WiNG 5.5.3 Access Point System Reference Guide
Hello Time
Set a BPDU hello interval from 1 - 10 seconds. BPDUs are exchanged regularly (every 2
seconds by default) and enable supported devices to keep track of network changes and
start/stop port forwarding as required.
Forward Delay
Set the forward delay time from 4 - 30 seconds. When a device is first attached to a
port, it does not immediately start to forward data. It first processes BPDUs and
determines the network topology. When a host is attached the port always goes into
the forwarding state, after a delay it goes through the listening and learning states. The
time spent in the listening and learning states is defined by the forward delay (15
seconds by default).
Maximum Age
Use the spinner control to set the maximum time (in seconds) to listen for the root
bridge. The root bridge is the spanning tree bridge with the smallest (lowest) bridge ID.
Each bridge has a unique ID and a configurable priority number, the bridge ID contains
both. The available range is from 6 - 40. The default setting is 20.
6. Define the following PortFast parameters for the profile configuration:
PortFast BPDU Filter
Select Enable to invoke a BPDU filter for this PortFast enabled port. Enabling the BPDU
filter ensures this port channel does not transmit or receive any BPDUs. BPDUs are
exchanged regularly, and enable the access point to keep track of network changes and
to start and stop port forwarding as required. The default setting is Disabled.
PortFast BPDU Guard
Select Enable to invoke a BPDU guard for the PortFast enabled port. Enabling the BPDU
Guard means this port will shutdown on receiving a BPDU. Thus, no BPDUs are
processed. BPDUs are exchanged regularly, and enable the access point to keep track
of network changes and to start and stop port forwarding as required. The default
setting is Disabled.
7. Define the following Error Disable settings:
Enable Recovery
Select this option to enable an error disable timeout resulting from a BPDU guard. This
setting is disabled by default.
Recovery Interval
Define the recovery interval used to enable disabled ports. The available range is from
10 - 1,000,000 seconds, with a default setting of 300.
8. Use the Spanning Tree Instance table to add indexes to the spanning tree topology.
Add up to 16 indexes and use the Priority setting to define the bridge priority used to determine the root bridge. The lower
the setting defined, the greater the likelihood of becoming the root bridge in the spanning tree topology.
9. Use the Spanning Tree Instance VLANs table to add VLAN instance indexes (by numeric ID) and VLANs to the spanning
tree topology.
10. Select the OK button located at the bottom right of the screen to save the changes. Select Reset to revert to the last saved
configuration.
Device Configuration 5 - 77
5.2.6.7 Routing
Profile Network Configuration
Routing is the process of selecting IP paths to send access point managed network traffic. Use the Routing screen to set
destination IP and gateway addresses enabling assignment of static IP addresses for requesting clients without creating
numerous host pools with manual bindings. This eliminates the need for a long configuration file and reduces the resource
space required to maintain address pools.
To create static routes:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select Routing.
Figure 5-42 Network - Routing screen
5. Select IP Routing to enable static routes using IP addresses. This option is enabled by default.
5 - 78 WiNG 5.5.3 Access Point System Reference Guide
6. Select the Policy Based Routing policy to apply to this profile. Select the Create icon to create a policy based route or
select the Edit icon to edit an existing policy after selecting it in the drop-down list.
7. Select Add Row + as needed to include single rows with in the static IPv4 route table.
8. Add IP addresses and network masks in the Network Address column of the Static Routes table.
9. Provide the Gateway used to route traffic.
10. Refer to the Default Route Priority field and set the following parameters:
Static Default Route
Priority
Use the spinner control to set the priority value (1 - 8,000) for the default static route.
This is weight assigned to this route versus others that have been defined. The default
setting is 100.
DHCP Client Default Route
Priority
Use the spinner control to set the priority value (1 - 8,000) for the default route learnt
from the DHCP client. The default setting is 1000.
Enable Routing Failure
When selected, all default gateways are monitored for activity. The system will failover
to a live gateway if the current gateway becomes unusable. This feature is enabled by
default.
11. Select the OK button located at the bottom right of the screen to save the changes. Select Reset to revert to the last saved
configuration.
Device Configuration 5 - 79
5.2.6.8 Dynamic Routing (OSPF)
Profile Network Configuration
Open Shortest Path First (OSPF) is a link-state interior gateway protocol (IGP). OSPF routes IP packets within a single routing
domain (autonomous system), like an enterprise LAN. OSPF gathers link state information from neighbor routers and constructs
a network topology. The topology determines the routing table presented to the Internet Layer which makes routing decisions
based solely on the destination IP address found in IP packets.
OSPF detects changes in the topology, like a link failure, and plots a new loop-free routing structure. It computes the shortest
path for each route using a shortest path first algorithm. Link state data is maintained on each router and is periodically updated
on all OSPF member routers.
OSPF uses a route table managed by the link cost (external metrics) defined for each routing interface. The cost could be the
distance of a router (round-trip time), link throughput or link availability. Setting a cost value provides a dynamic way to load
balancing traffic between routes of equal cost.
An OSPF network can be subdivided into routing areas to simplify administration and optimize traffic utilization. Areas are
logical groupings of hosts and networks, including routers having interfaces connected to an included network. Each area
maintains a separate link state database whose information may be summarized towards the rest of the network by the
connecting router. Areas are identified by 32-bit IDs, expressed either in decimal, or octet-based dot-decimal notation. Areas
can defined as:
• stub area - A stub area is an area which does not receive route advertisements external to the autonomous system (AS),
and routing from within the area is based entirely on a default route.
• totally-stub - A totally stubby area does not allow summary routes and external routes. A default route is the only way to
route traffic outside of the area. When there’s only one route out of the area, fewer routing decisions are needed, lowering
system resource utilization.
• non-stub - A non-stub area imports autonomous system external routes and sends them to other areas. However, it still
cannot receive external routes from other areas.
• nssa - NSSA is an extension of a stub that allows the injection of limited external routes into a stub area. If selecting NSSA,
no external routes, except a default route, enter the area.
• totally nssa - Totally nssa is an NSSA using 3 and 4 summary routes are not flooded into this type of area. It is also possible
to declare an area both totally stubby and not-so-stubby, which means that the area will receive only the default route from
area 0.0.0.0, but can also contain an autonomous system boundary router (ASBR) that accepts external routing information
and injects it into the local area, and from the local area into area 0.0.0.0.
A router running OSPF sends hello packets to discover neighbors and elect a designated router. The hello packet includes link
state information and list of neighbors. OSPF is savvy with layer 2 topologies. If on a point-to-point link, OSPF knows it is
sufficient, and the link stays up. If on a broadcast link, the router waits for election before determining if the link is functional.
To define a dynamic routing configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select Dynamic Routing.
5 - 80 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-43 Network - OSPF Settings tab
5. Enable/disable OSPF and provide the following dynamic routing settings:
Enable OSPF
Select this option to enable OSPF for this access point. OSPF is disabled by default.
Router ID
Select this option to define a router ID (numeric IP address) for this access point. This
ID must be established in every OSPF instance. If not explicitly configured, the highest
logical IP address is duplicated as the router identifier. However, since the router
identifier is not an IP address, it does not have to be a part of any routable subnet in the
network.
Auto-Cost
Select this option to specify the reference bandwidth (in Mbps) used to calculate the
OSPF interface cost if OSPF is either STUB or NSSA. The default setting is 1.
Passive Mode on All
Interfaces
When selected, all layer 3 interfaces are set as an OSPF passive interface. This setting
is disabled by default.
Passive Removed
If enabling Passive Mode on All Interfaces, use the spinner control to select VLANs (by
numeric ID) as OSPF non passive interfaces. Multiple VLANs can be added to the list.
Passive Mode
If disabling Passive Mode on All Interfaces, use the spinner control to select VLANs (by
numeric ID) as OSPF passive interfaces. Multiple VLANs can be added to the list.
Device Configuration 5 - 81
VRRP State Check
Select this option to enable checking VRRP state. If the interface’s VRRP state is not
Backup, then the interface is published via OSPF.
6. Set the following OSPF Overload Protection settings:
Number of Routes
Use the spinner controller to set the maximum number of OSPN routes permitted. The
available range is from 1 - 4,294,967,295.
Retry Count
Set the maximum number of retries (OSPF resets) permitted before the OSPF process is
shut down. The available range is from 1 - 32. The default setting is 5.
Retry Time Out
Set the duration (in seconds) the OSPF process remains off before initiating its next
retry. The available range is from 1 - 3,600 seconds. The default is 60 seconds.
Reset Time
Set the reset time (in seconds) that, when exceeded, changes the retry count is zero.
The available range is from 1 - 86,400. The default is 360 seconds.
7. Set the following Default Information:
Originate
Select this option to make the default route a distributed route. This setting is disabled
by default.
Always
Enabling this settings continuously maintains a default route, even when no routes
appear in the routing table. This setting is disabled by default.
Metric Type
Select this option to define the exterior metric type (1 or 2) used with the default route.
Route Metric
Select this option to define route metric used with the default route. OSPF uses path
cost as its routing metric. It’s defined by the speed (bandwidth) of the interface
supporting a given route.
8. Refer to the Route Redistribution table to set the types of routes used by OSPF.
Select the + Add Row button to populate the table. Set the Route Type used to define the redistributed route. Options
include connected, kernel and static.
Select the Metric Type option to define the exterior metric type (1 or 2) used with the route redistribution. Select the
Metric option to define route metric used with the redistributed route.
9. Use the OSPF Network table to define networks (IP addresses) to connect using dynamic routes.
Select the + Add Row button to populate the table. Add the IP address and mask of the Network(s) participating in OSPF.
Additionally, define the OSPF area (IP address) to which the network belongs.
10. Set an OSPF Default Route Priority (1 - 8,000) as the priority of the default route learnt from OSPF.
11. Select the Area Settings tab.
An OSPF Area contains a set of routers exchanging Link State Advertisements (LSAs) with others in the same area. Areas
limit LSAs and encourage aggregate routes.
5 - 82 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-44 Network - Area Settings tab
12. Review existing Area Settings configurations using:
Area ID
Displays either the IP address or integer representing the OSPF area.
Authentication Type
Lists the authentication schemes used to validate the credentials of dynamic route
connections.
Type
Lists the OSPF area type in each listed configuration.
13. Select Add to create a new OSPF configuration, Edit to modify an existing configuration or Delete to remove a
configuration.
Figure 5-45 Network - OSPF Area Configuration screen
Device Configuration 5 - 83
14. Set the OSPF Area configuration.
Area ID
Use the drop-down menu and specify either an IP address or Integer for the OSPF area.
Authentication Type
Select either None, simple-password or message-digest as credential validation
scheme used with the OSPF dynamic route. The default setting is None.
Type
Set the OSPF area type as either stub, totally-stub, nssa, totally-nssa or non-stub.
Default Cost
Select this option to set the default summary cost advertised if creating a stub. Set a
value from 1 - 16, 777,215.
Translate Type
Define how messages are translated. Options include translate-candidate,
translate-always and translate-never. The default setting is translate-candidate.
Range
Specify a range of addresses for routes matching address/mask for OSPF
summarization.
15. Select the OK button to save the changes to the area configuration. Select Reset to revert to the last saved configuration.
16. Select the Interface Settings tab.
Figure 5-46 Network - Interface Settings tab
17. Review existing Interface Settings.
Name
Displays the name defined for the interface configuration.
Type
Displays the type of interface.
Description
Lists each interface’s 32 character maximum description.
Admin Status
A green check mark defines the interface as active and currently enabled with the
profile. A red “X” defines the interface as currently disabled and not available for use.
VLAN
Lists the VLAN IDs set for each listed OSPF route virtual interface.
IP Address
Displays the IP addresses defined as virtual interfaces for dynamic OSPF routes. Zero
config and DHCP can be used to generate route addresses, or a primary and secondary
address can be manually provided.
5 - 84 WiNG 5.5.3 Access Point System Reference Guide
18. Select the Add button to define a new set of virtual interface basic settings, or Edit to update the settings of an existing
virtual interface configuration.
Figure 5-47 Network - OSPF Virtual Interfaces - Basic Configuration tab
19. Within the Properties field, enter a 32 character maximum Description to help differentiate the virtual interface
configuration used with this OSPF route. Enable/disable admin privileges as need. They’re disabled by default.
20. Use the IP Addresses Area to set how route addresses are created for the virtual configuration.
Zero Configuration can be enabled and set as the Primary or Secondary means of providing IP addresses for the OSPF virtual
route. Zero configuration (or zero config) is a wireless connection utility included with Microsoft Windows XP and later as
a service dynamically selecting a network to connect based on a user's preferences and various default settings. Zero config
can be used instead of a wireless network utility from the manufacturer of a computer's wireless networking device. The
drivers for the wireless adapter query the NDIS Object IDs and pass the available network names (SSIDs) to the service.
The service then lists them in the user interface on the Wireless Networks tab in the connection's Properties or in the
Wireless Network Connection dialog box accessible from the notification area. A checked build version of the WZC service
can be used by developers to obtain additional diagnostic and tracing information logged by the service.
21. Select Use DHCP to Obtain IP to use the access point’s DHCP server resource as the means of providing requested IP
addresses to the OSPF route’s virtual interface.
22. Select Use DHCP to Obtain Gateway/DNS Servers to learn the default gateway, name servers, and domain name on
just this interface. Once selected, specify an IP address and mask in dot-decimal format.
23. Define the NAT Direction as either Inside, Outside or None. Network Address Translation (NAT), is an Internet standard
that enables a Local Area Network (LAN) to use IP addresses for internal traffic (inside) and a second set of addresses for
external (outside) traffic.
24. Select OK to save the changes to the basic configuration. Select Reset to revert to the last saved configuration.
25. Select the Security tab.
Device Configuration 5 - 85
Figure 5-48 Network - OSPF Virtual Interface - Security tab
26. Use the Inbound IP Firewall Rules drop-down menu to select the IP access and deny rules to apply to the OSPF dynamic
route.
Either select an existing IP firewall policy or use the default set of IP firewall rules. The firewall inspects OSPF route traffic
flows and detects potential attacks on the dynamic route not visible to traditional wired firewall appliances. Select the
Create icon to define a new set of IP firewall rules that can be applied to the OSPF route configuration. Selecting Edit
allows for the modification of an existing IP firewall rules configuration. For more information, see Wireless Firewall on
page 8-2.
27. Use the VPN Crypto Map drop-down menu to select and apply a VPN crypto map entry to apply to the OSPF dynamic route.
Crypto Map entries are sets of configuration parameters for encrypting packets passing through the VPN Tunnel. If a Crypto
Map configuration does not exist suiting the needs of this virtual interface, select the Create icon to define a new Crypto
Map configuration or the Edit icon to modify an existing configuration.
28. Select OK to save the changes to the OSPF route security configuration. Select Reset to revert to the last saved
configuration.
5 - 86 WiNG 5.5.3 Access Point System Reference Guide
5.2.6.9 Forwarding Database
Profile Network Configuration
A Forwarding Database is used by a bridge to forward or filter packets. The bridge reads the packet’s destination MAC address
and decides to either forward the packet or drop (filter) it. If it is determined the destination MAC is on a different network
segment, it forwards the packet to the segment. If the destination MAC is on the same network segment, the packet is dropped
(filtered). As nodes transmit packets through the bridge, the bridge updates its forwarding database with known MAC
addresses and their locations on the network. This information is then used to decide to filter or forward the packet.
To define a forwarding database configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select Forwarding Database.
Figure 5-49 Network - Forwarding Database screen
5. Define a Bridge Aging Time from 0, 10-1,000,000 seconds.
The aging time defines the length of time an entry will remain in the bridge’s forwarding table before it is deleted due to
lack of activity. If an entry replenishments a destination, generating continuous traffic, this timeout value will never be
invoked. However, if the destination becomes idle, the timeout value represents the length of time that must be exceeded
before an entry is deleted from the forwarding table. The default setting is 300 seconds.
6. Use the + Add Row button to create a new row within the MAC address table.
7. Set a destination MAC Address address. The bridge reads the packet’s destination MAC address and decides to forward
the packet or drop (filter) it. If it’s determined the destination MAC is on a different network, it forwards the packet to the
segment. If the destination MAC is on the same network segment, the packet is dropped (filtered).
Device Configuration 5 - 87
8. Define the target VLAN ID if the destination MAC is on a different network segment.
9. Provide an Interface Name used as the target destination interface for the target MAC address.
10. Select OK to save the changes. Select Reset to revert to the last saved configuration.
5.2.6.10 Bridge VLAN
Profile Network Configuration
A Virtual LAN (VLAN) is separately administrated virtual network within the same physical managed network. VLANs are
broadcast domains to allow control of broadcast, multicast, unicast and unknown unicast within a Layer 2 device.
For example, say several computers are used in conference room X and some in conference Y. The systems in conference room
X can communicate with one another, but not with the systems in conference room Y. The creation of a VLAN enables the
systems in conference rooms X and Y to communicate with one another even though they are on separate physical subnets.
The systems in conference rooms X and Y are managed by the same single device, but ignore the systems that aren't using
same VLAN ID.
Administrators often need to route traffic to interoperate between different VLANs. Bridging VLANs are only for non-routable
traffic, like tagged VLAN frames destined to some other device which will untag it. When a data frame is received on a port,
the VLAN bridge determines the associated VLAN based on the port of reception. Using forwarding database information, the
Bridge VLAN forwards the data frame on the appropriate port(s). VLANs are useful to set separate networks to isolate some
computers from others, without actually having to have separate cabling and Ethernet switches. Another common use is to put
specialized devices like VoIP Phones on a separate network for easier configuration, administration, security, or quality of
service.
To define a bridge VLAN configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select Bridge VLAN.
Figure 5-50 Network - Bridge VLAN screen
VLAN
Lists the numerical identifier defined for the Bridge VLAN when it was initially created.
The available range is from 1 - 4095. This value cannot be modified during the edit
process.
5 - 88 WiNG 5.5.3 Access Point System Reference Guide
Description
Lists a description of the VLAN assigned when it was created or modified. The
description should be unique to the VLAN’s specific configuration and help differentiate
it from other VLANs with similar configurations.
Edge VLAN Mode
Defines whether the VLAN is currently in edge VLAN mode. An edge VLAN is the VLAN
where hosts are connected. For example, if VLAN 10 is defined with wireless clients
and VLAN 20 is where the default gateway resides, VLAN 10 should be marked as an
edge VLAN and VLAN 20 shouldn’t be marked as an edge VLAN. When defining a VLAN
as edge VLAN, the firewall enforces additional checks on hosts in that VLAN. For
example, a host cannot move from an edge VLAN to another VLAN and still keep
firewall flows active.
Trust ARP Response
When ARP trust is enabled, a green check mark displays. When disabled, a red “X”
displays. Trusted ARP packets are used to update the IP-MAC Table to prevent IP spoof
and arp-cache poisoning attacks.
Trust DHCP Responses
When DHCP trust is enabled, a green check mark displays. When disabled, a red “X”
displays. When enabled, DHCP packets from a DHCP server are considered trusted and
permissible within the network. DHCP packets are used to update the DHCP Snoop
Table to prevent IP spoof attacks.
5. Select Add to define a new Bridge VLAN configuration, Edit to modify the configuration of an existing Bridge VLAN
configuration or Delete to remove a VLAN configuration.
Figure 5-51 Network - Bridge VLAN Configuration screen
6. If adding a new Bridge VLAN configuration, use the spinner control to define a VLAN ID from 1 - 4095. This value must be
defined and saved before the General tab can become enabled and the remainder of the settings defined.
Device Configuration 5 - 89
7. If creating a new Bridge VLAN, provide a Description (up to 64 characters) unique to the VLAN’s specific configuration to
help differentiate it from other VLANs with similar configurations.
8. Firewalls, generally, are configured for all interfaces on a device. When configured, firewalls generate flow tables that
store information on the traffic allowed to traverse through the firewall. These flow tables occupy a large portion of the
limited memory that could be used for other critical purposes. With the per VLAN firewall feature enabled on an interface,
flow tables are only generated for that interface. Flow tables are not generated for those interfaces where this feature is
not enabled. This frees up memory which can be used for other purposes.
Firewalls can be switched off for those interfaces which are known to carry trusted traffic and only enabled on the
interfaces that can provide a vector for an attack on the network. Select the Per VLAN Firewall option to enable firewall
on this interface.
9. Select the L2 Tunnel Broadcast Optimization option to prevent flooding of ARP packets on this bridge interface.
Broadcast Optimization prevents flooding of ARP packets over the virtual interface. Based on the learned information, ARP
packets are filtered at the wireless controller level.
10. Define the following Extended VLAN Tunnel parameters:
Bridging Mode
Specify one of the following bridging mode for use on the VLAN:
• Automatic: Select Automatic mode to let the access point determine the best
bridging mode for the VLAN.
• Local: Select Local to use local bridging mode for bridging traffic on the VLAN.
• Tunnel: Select Tunnel to use a shared tunnel for bridging traffic on the VLAN. Tunnel
must be selected to successfully create a mesh connection between two Standalone
APs.
• isolated-tunnel: Select isolated-tunnel to use a dedicated tunnel for bridging traffic
on the VLAN.
IP Outbound Tunnel ACL
Select an IP Outbound Tunnel ACL for outbound traffic from the drop-down menu. If an
appropriate outbound IP ACL is not available select the create icon to make a new one.
MAC Outbound Tunnel ACL Select a MAC Outbound Tunnel ACL for outbound traffic from the drop-down menu. If
an appropriate outbound MAC ACL is not available select the create icon to make a new
one.
NOTE: If creating a mesh connection between two access points in Standalone AP
mode, Tunnel must be selected as the Bridging Mode to successfully create the mesh
link between the two access points.
11. Select Tunnel Over Level 2 to tunnel extended VLAN traffic over level 2 links.
12. Define the following Layer 2 Firewall parameters:
Trust ARP Response
Select this option to use trusted ARP packets to update the DHCP Snoop Table to
prevent IP spoof and arp-cache poisoning attacks. This feature is disabled by default.
Trust DHCP Responses
Select this option to use DHCP packets from a DHCP server as trusted and permissible
within the network. DHCP packets update the DHCP Snoop Table to prevent IP spoof
attacks. This feature is disabled by default.
Enable Edge VLAN Mode
Select this option to enable edge VLAN mode. When selected, the IP address in the
VLAN is not used for normal operations, as its now designated to isolate devices and
prevent connectivity. This feature is enabled by default.
5 - 90 WiNG 5.5.3 Access Point System Reference Guide
13. Refer to the Captive Portal field to select an existing captive portal configuration to apply access restrictions to the bridge
VLAN configuration.
A captive portal is an access policy for providing temporary and restrictive access using a standard Web browser. Captive
portals provides authenticated access by capturing and re-directing a wireless user's Web browser session to a captive
portal login page where the user must enter valid credentials to access to the network. Once logged into the captive portal,
additional Terms and Agreement, Welcome, Fail and No Service pages provide the administrator with a number of options
on captive portal screen flow and user appearance.
If an existing captive portal does not suite the bridge VLAN configuration, either select the Edit icon to modify an existing
configuration or select the Create icon to define a new configuration that can be applied to the bridge VLAN. For
information on configuring a captive portal policy, see Configuring Captive Portal Policies on page 9-2.
14. Select the IGMP Snooping tab.
Figure 5-52 Network - Bridge VLAN - IGMP Snooping screen
15. Define the following IGMP General parameters:
Enable IGMP Snooping
Select this option to enable IGMP snooping. If disabled, snooping on this bridge VLAN
is disabled. This feature is enabled by default. If disabled, the settings under bridge
configuration are overridden.
Forward Unknown
Multicast Packets
Select this option to enable forwarding of multicast packets from unregistered
multicast groups. If disabled, the unknown multicast forward feature is also disabled
for this bridge VLAN. This settings is enabled by default.
Device Configuration 5 - 91
16. Define the following Multicast Router settings:
Interface Names
Select the interface used for IGMP snooping over a multicast router. Multiple interfaces
can be selected.
Multicast Router Learn
Mode
Select static or pim-dvmrp as the mode used to determine client multicast traffic levels
on specific routes.
17. Set the following IGMP Querier parameters for the bridge VLAN configuration:
Enable IGMP Querier
IGMP snoop querier is used to keep host memberships alive. It’s primarily used in a
network where there’s a multicast streaming server, hosts subscribed to the server and
no IGMP querier present. An IGMP querier sends out periodic IGMP query packets.
Interested hosts reply with an IGMP report packet. IGMP snooping is only conducted on
wireless radios. IGMP multicast packets are flooded on wired ports. IGMP multicast
packet are not flooded on the wired port. IGMP membership is also learnt on it and only
if present, then it is forwarded on that port.
Source IP Address
Define an IP address applied as the source address in the IGMP query packet. This
address is used as the default VLAN querier IP address.
IGMP Version
Use the spinner control to set the IGMP version compatibility to either version 1, 2 or 3.
The default setting is 3.
Maximum Response Time
Specify the maximum time (from 1 - 25 seconds) before sending a responding report.
When no reports are received from a radio, radio information is removed from the
snooping table. For IGMP reports from wired ports, reports are only forwarded to the
multicast router ports. The default setting is 10 seconds.
Other Querier Timer Expiry
Specify an interval in either Seconds (60 - 300) or Minutes (1 - 5) used as a timeout
interval for other querier resources. The default setting is 1 minute.
18. Select the OK button located at the bottom right of the screen to save the changes. Select Reset to revert to the last saved
configuration.
5 - 92 WiNG 5.5.3 Access Point System Reference Guide
5.2.6.11 Cisco Discovery Protocol Configuration
Profile Network Configuration
The Cisco Discovery Protocol (CDP) is a proprietary Data Link Layer protocol implemented in Cisco networking equipment. It's
primarily used to obtain IP addresses of neighboring devices and discover their platform information. CDP is also used to obtain
information about the interfaces the access point uses. CDP runs only over the data link layer enabling two systems that support
different network-layer protocols to learn about each other.
To define the profile’s CDP configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select Cisco Discovery Protocol.
Figure 5-53 Network - Cisco Discovery Protocol (CDP) screen
5. Enable/disable CDP and set the following settings:
Enable CDP
Select this option to enable CDP and allow for network address discovery of Cisco
supported devices and operating system version. This setting is enabled by default.
Hold Time
Set a hold time (in seconds) for the transmission of CDP packets. Set a value from 10 1,800. The default setting is 1,800 seconds.
Timer
Use the spinner control to set the interval for CDP packet transmissions. The default
setting is 60 seconds.
6. Select the OK button located at the bottom right of the screen to save the changes to the CDP configuration. Select Reset
to revert to the last saved configuration.
Device Configuration 5 - 93
5.2.6.12 Link Layer Discovery Protocol Configuration
Profile Network Configuration
The Link Layer Discovery Protocol (LLDP) provides a standard way for a controller or access point to advertise information about
themselves to networked neighbors and store information they discover from their peers.
LLDP is neighbor discovery protocol that defines a method for network access devices using Ethernet connectivity to advertise
information about them to peer devices on the same physical LAN and store information about the network. It allows a device
to learn higher layer management and connection endpoint information from adjacent devices.
Using LLDP, an access point is able to advertise its own identification, capabilities and media-specific configuration information
and learn the same information from connected peer devices.
LLDP information is sent in an Ethernet frame at a fixed interval. Each frame contains one Link Layer Discovery Protocol Data
Unit (LLDP PDU). A single LLDP PDU is transmitted in a single 802.3 Ethernet frame.
To set the LLDP configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select Link Layer Discovery Protocol.
Figure 5-54 Network - Link Layer Discovery Protocol (LLDP) screen
5. .Set the following LLDP parameters for the profile configuration:
Enable LLDP
Select this option to enable LLDP on the access point. LLDP is enabled by default When
enabled, an access point advertises its identity, capabilities and configuration information
to connected peers and learns the same from them.
Hold Time
Use the spinner control to set the hold time (in seconds) for transmitted LLDP PDUs. Set a
value from 10 - 1,800. The default hold time is 180 seconds.
Timer
Set the interval used to transmit LLDP PDUs. Define an interval from 5 - 900 seconds. The
default setting is 60 seconds.
Inventory Management
Discovery
Select this option to include LLPD-MED inventory management discovery TLV in LLDP
PDUs. This setting is enabled by default.
5 - 94 WiNG 5.5.3 Access Point System Reference Guide
Extended Power via MDI
Discovery
Select this option to include LLPD-MED extended power via MDI discovery TLV in LLDP
PDUs. This setting is disabled by default.
6. Select the OK button to save the changes to the LLDP configuration. Select Reset to revert to the last saved configuration.
5.2.6.13 Miscellaneous Network Configuration
Profile Network Configuration
A profile can be configured to include a hostname in a DHCP lease for a requesting device and its profile. This helps an
administrator track the leased DHCP IP address by hostname for the supported device profile. When numerous DHCP leases
are assigned, an administrator can better track the leases when hostnames are used instead of devices.
To include hostnames in DHCP requests:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Network menu and select Miscellaneous.
Figure 5-55 Network - Miscellaneous screen
5. Select the Include Hostname in DHCP Request option to include a hostname in a DHCP lease for a requesting device.
This feature is enabled by default.
6. Select the DHCP Persistent Lease option to retain the lease that was last used by the access point if the access point’s
DHCP server resource were to become unavailable. This feature is enabled by default.
7. Select the OK button located at the bottom right of the screen to save the changes. Select Reset to revert to the last saved
configuration.
Device Configuration 5 - 95
5.2.6.14 Alias
Profile Network Configuration
With large deployments, the configuration of remote sites utilizes a set of shared attributes, of which a small set of attributes
are unique for each location. For such deployments, maintaining separate configuration (WLANs, profiles, policies and ACLs)
for each remote site is complex. Migrating any global change to a particular configuration item to all the remote sites is a
complex and time consuming operation.
Also, this practice does not scale gracefully for quick growing deployments.
An alias enables an administrator to define a configuration item, such as a hostname, as an alias once and use the defined
alias across different configuration items such as multiple ACLs.
Once a configuration item, such as an ACL, is utilized across remote locations, the alias used in the configuration item (ACL) is
modified to meet local deployment requirement. Any other ACL or other configuration items using the modified alias also get
modified, simplifying maintenance at the remote deployment.
Aliases have scope depending on where the Alias is defined. Alias are defined with the following scopes:
• Global aliases are defined from the Configuration > Network > Alias screen. Global aliases are available for use globally
across all devices, profiles and RF Domains in the system.
• Profiles aliases are defined from Configuration > Devices > System Profile > Network > Alias screen. These aliases
are available for use to a specific group of wireless controllers or access points. Alias values defined in this profile override
alias values defined within global aliases.
• RF Domain aliases are defined from Configuration > Devices > RF Domain > Alias screen. These aliases are available
for use for a site as a RF Domain is site specific. RF Domain alias values override alias values defined in a global alias or a
profile alias configuration.
• Device aliases are defined from Configuration > Devices > Device Overrides > Network > Alias screen. Device alias
are utilized by a single device only. Device alias values override alias values defined in a global alias, profiles alias or RF
Domain alias configuration.
Using an alias, configuration changes made at a remote location override any updates at the management center. For example,
if an Network Alias defines a network range as 192.168.10.0/24 for the entire network, and at a remote deployment location,
the local network range is 172.16.10.0/24, the Network Alias can be overridden at the deployment location to suit the local
requirement. For the remote deployment location, the Network Alias works with the 172.16.10.0/24 network. Existing ACLs
using this Network Alias need not be modified and will work with the local network for the deployment location. This simplifies
ACL definition and management while taking care of specific local deployment requirements.
Alias are classified as:
• Network Basic Alias
• Network Group Alias
• Network Service Alias
5.2.6.14.1Network Basic Alias
Alias
A basic alias is a set of configurations that consist of VLAN, host, network and address range alias configurations. VLAN
configuration is a configuration for optimal VLAN re-use and management for local and remote deployments. A host alias
configuration is for a particular host device’s IP address. A network alias configuration is utilized for an IP address on a
particular network. An address range alias is a configuration for a range of IP addresses.
A basic alias configuration can contain multiple instances for each of the five (5) alias types.
To edit or delete a basic alias configuration:
1. Select Configuration tab from the web user interface.
5 - 96 WiNG 5.5.3 Access Point System Reference Guide
2. Select System Profiles.
3. Select Network to expand it and display its sub menus.
4. Select the Alias item.
Figure 5-56 Network - Basic Alias Screen
5. Select + Add Row to define VLAN Alias settings:
Use the VLAN Alias field to create unique aliases for VLANs that can be used at different deployments. For example, if a
named VLAN is defined as 10 for the central network, and the VLAN is set at 26 at a remote location, the VLAN can be
overridden at the deployment location with an alias. At the remote deployment location, the network is functional with a
VLAN ID of 26 but utilizes the name defined at the centrally managed network. A new VLAN need not be created specifically
for the remote deployment.
Name
If adding a new VLAN Alias, provide it a distinguishing name up to 32 characters. The alias
name always starts with a dollar sign ($).
VLAN
Use the spinner control to set a numeric VLAN from 1 - 4094.
A VLAN alias is used to replace VLANs in the following locations:
• Bridge VLAN
• IP Firewall Rules
• L2TPv3
• Switchport
Device Configuration 5 - 97
• Wireless LANs
6. Select + Add Row to define Address Range Alias settings:
Use the Address Range Alias field to create aliases for IP address ranges that can be utilized at different deployments.
For example, if an ACL defines a pool of network addresses as 192.168.10.10 through 192.168.10.100 for an entire network,
and a remote location’s network range is 172.16.13.20 through 172.16.13.110, the remote location’s ACL can be overridden
using an alias. At the remote location, the ACL works with the 172.16.13.20-110 address range. A new ACL need not be
created specifically for the remote deployment location.
Name
If adding a new Address Alias, provide it a distinguishing name up to 32 characters. The
alias name always starts with a dollar sign ($).
Start IP
Set a starting IP address used with a range of addresses utilized with the address range
alias.
End IP
Set a ending IP address used with a range of addresses utilized with the address range
alias.
An address range alias can be used to replace an IP address range in IP firewall rules.
7. Select + Add Row to define Host Alias settings:
Use the Host Alias field to create aliases for hosts that can be utilized at different deployments. For example, if a central
network DNS server is set a static IP address, and a remote location’s local DNS server is defined, this host can be
overridden at the remote location. At the remote location, the network is functional with a local DNS server, but uses the
name set at the central network. A new host need not be created at the remote location. This simplifies creating and
managing hosts and allows an administrator to better manage specific local requirements
Name
If adding a new Host Alias, provide it a distinguishing name up to 32 characters. The alias name
always starts with a dollar sign ($).
Host
Set the IP address of the host machine.
A host alias can be used to replace hostnames in the following locations:
• IP Firewall Rules
• DHCP
8. Select + Add Row to define Network Alias settings:
Use the Network Alias field to create aliases for IP networks that can be utilized at different deployments. For example,
if a central network ACL defines a network as 192.168.10.0/24, and a remote location’s network range is 172.16.10.0/24,
the ACL can be overridden at the remote location to suit their local (but remote) requirement. At the remote location, the
ACL functions with the 172.16.10.0/24 network. A new ACL need not be created specifically for the remote deployment.
This simplifies ACL definition and allows an administrator to better manage specific local requirements.
Name
If adding a new Network Alias, provide it a distinguishing name up to 32 characters. The alias
name always starts with a dollar sign ($).
Network
Provide a network address in the form of host/mask.
A network alias can be used to replace network declarations in the following locations:
• IP Firewall Rules
• DHCP
9. Select + Add Row to define String Alias settings:
5 - 98 WiNG 5.5.3 Access Point System Reference Guide
Use the String Alias field to create aliases for strings that can be utilized at different deployments. For example, if the
main domain at a remote location is called loc1.domain.com and at another deployment location it is called
loc2.domain.com, the alias can be overridden at the remote location to suit the local (but remote) requirement. At one
remote location, the alias functions with the loc1.domain.com domain and at the other with the loc2.domain.com domain.
Name
If adding a new String Alias, provide it a distinguishing name up to 32 characters. The alias
name always starts with a dollar sign ($).
Value
Provide a string value to use in the alias.
A string alias can be used to replace domain name stings in DHCP.
10. Select OK when completed to update the basic alias rules. Select Reset to revert the screen back to its last saved
configuration.
5.2.6.14.2Network Group Alias
Alias
A network group alias is a set of configurations that consist of host and network configurations. Network configurations are
complete networks in the form 192.168.10.0/24 or IP address range in the form 192.168.10.10-192.168.10.20. Host
configuration is in the form of single IP address, 192.168.10.23.
A network group alias can contain multiple definitions for Host, Network, and IP address range. A maximum of eight (8) Host
entries, eight (8) Network entries and eight (8) IP addresses range entries can be configured inside a network group alias. A
maximum of 32 Network Group Alias entries can be created.
A network group alias can be used in IP firewall rules to substitute hosts, subnets and IP address ranges:
To edit or delete a network alias configuration:
1. Select Configuration tab from the web user interface.
2. Select System Profiles.
3. Select Network to expand it and display its sub menus.
4. Select the Alias item, the Basic Alias screen displays.
5. Select the Network Group Alias tab.
Device Configuration 5 - 99
Figure 5-57 Network - Alias - Network Group Alias screen
Name
Displays the administrator assigned name of the Network Group Alias.
Host
Displays all host aliases configured in this network group alias. Displays a blank column if no
host alias is defined.
Network
Displays all network aliases configured in this network group alias. Displays a blank column if
no network alias is defined.
6. Select Edit to modify the attributes of an existing policy or Delete to remove obsolete policies from the list of those
available. Select Add to create a new Network Group Alias. Copy to copy an existing policy or Rename to rename an
existing policy.
5 - 100 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-58 Network - Alias - Network Group Alias Add screen
7. If adding a new Network Group Alias, provide it a name of up to 32 characters.
NOTE: The Network Group Alias Name always starts with a dollar sign ($).
8. Define the following network group alias parameters:
Host
Specify the Host IP address for up to eight IP addresses supporting network aliasing. Select the
down arrow to add the IP address to the table.
Network
Specify the netmask for up to eight IP addresses supporting network aliasing. Subnets can
improve network security and performance by organizing hosts into logical groups. Applying the
subnet mask to an IP address separates the address into a host address and an extended
network address. Select the down arrow to add the mask to the table.
9. Within the Range table, use the + Add Row button to specify the Start IP address and End IP address for the alias range
or double-click on an existing an alias range entry to edit it.
10. Select OK when completed to update the network group alias rules. Select Reset to revert the screen back to its last saved
configuration.
Device Configuration 5 - 101
5.2.6.14.3Network Service Alias
Alias
Network Service Alias is a set of configurations that consist of protocol and port mappings. Both source and destination ports
are configurable. For each protocol, up to 2 source port ranges and up to 2 destination port ranges can be configured. A
maximum of 4 protocol entries can be configured per Network Service Alias.
Use a service alias to associate more than one IP address to a network interface, providing multiple connections to a network
from a single IP node.
A network service alias can be used to substitute protocols and ports in IP firewall rules:
To edit or delete a network service alias configuration:
1. Select Configuration tab from the web user interface.
2. Select System Profiles.
3. Select Network to expand it and display its sub menus.
4. Select the Alias item, the Basic Alias screen displays.
5. Select the Network Service Alias tab.
Figure 5-59 Network - Alias - Network Service Alias screen
6. Select Edit to modify the attributes of an existing policy or Delete to remove obsolete policies from the list of those
available. Select Add to create a new Network Service Alias.
5 - 102 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-60 Network - Alias - Network Service Alias Add screen
7. If adding a new Network Service Alias, provide it a name up to 32 characters.
NOTE: The Network Service Alias Name always starts with a dollar sign ($).
8. Within the Range field, use the + Add Row button to specify the Start IP address and End IP address for the service alias
range or double-click on an existing service alias range entry to edit it.
Protocol
Specify the protocol for which the alias has to be created. Use the drop down to select the
protocol from eigrp, gre, icmp, igmp, ip, vrrp, igp, ospf, tcp and udp. Select other if the protocol
is not listed. When a protocol is selected, its protocol number is automatically selected.
Source Port
(Low and High)
Note: Use this field only if the protocol is tcp or udp.
Specify the source ports for this protocol entry. A range of ports can be specified. Select the
Enter Range button next to the field to enter a lower and higher port range value. Up to eight
(8) such ranges can be specified.
Destination Port
(Low and High)
Note: Use this field only if the protocol is tcp or udp.
Specify the destination ports for this protocol entry. A range of ports can be specified. Select
the Enter Range button next to the field to enter a lower and higher port range value. Up to eight
(8) such ranges can be specified.
9. Select OK when completed to update the network service alias rules. Select Reset to revert the screen back to its last
saved configuration.
Device Configuration 5 - 103
5.2.6.15 Profile Network Configuration and Deployment Considerations
Profile Network Configuration
Before defining a profile’s network configuration, refer to the following deployment guidelines to ensure the profile
configuration is optimally effective:
• Administrators often need to route traffic to interoperate between different VLANs. Bridging VLANs are only for
non-routable traffic, like tagged VLAN frames destined to some other device which will untag it. When a data frame is
received on a port, the VLAN bridge determines the associated VLAN based on the port of reception.
• Static routes, while easy, can be overwhelming within a large or complicated network. Each time there is a change,
someone must manually make changes to reflect the new route. If a link goes down, even if there is a second path, the
router would ignore it and consider the link down.
• Static routes require extensive planning and have a high management overhead. The more routers that exist in a network,
the more routes need to be configured. If you have N number of routers and a route between each router is needed, then
you must configure N x N routes. Thus, for a network with nine routers, you will need a minimum of 81 routes
(9 x 9 = 81).
5 - 104 WiNG 5.5.3 Access Point System Reference Guide
5.2.7 Profile Security Configuration
System Profile Configuration
An access point profile can have its own firewall policy, wireless client role policy, WEP shared key authentication and NAT
policy applied.
For more information, refer to the following:
• Defining Profile VPN Settings
• Defining Profile Security Settings
• Setting the Certificate Revocation List (CRL) Configuration
• Setting the Profile’s NAT Configuration
• Setting the Profile’s Bridge NAT Configuration
5.2.7.1 Defining Profile VPN Settings
Profile Security Configuration
IPSec VPN provides a secure tunnel between two networked peer access points or controllers. Administrators can define which
packets are sent within the tunnel, and how they’re protected. When a tunnelled peer sees a sensitive packet, it creates a
secure tunnel and sends the packet through the tunnel to its remote peer destination.
Tunnels are sets of security associations (SA) between two peers. SAs define the protocols and algorithms applied to sensitive
packets and specify the keying mechanisms used by tunnelled peers. SAs are unidirectional and exist in both the inbound and
outbound direction. SAs are established per the rules and conditions of defined security protocols (AH or ESP).
Use crypto maps to configure IPSec VPN SAs. Crypto maps combine the elements comprising IPSec SAs. Crypto maps also
include transform sets. A transform set is a combination of security protocols, algorithms and other settings applied to IPSec
protected traffic. One crypto map is utilized for each IPSec peer, however for remote VPN deployments one crypto map is used
for all the remote IPSec peers.
Internet Key Exchange (IKE) protocol is a key management protocol standard used in conjunction with IPSec. IKE enhances
IPSec by providing additional features, flexibility, and configuration simplicity for the IPSec standard. IKE automatically
negotiates IPSec SAs, and enables secure communications without time consuming manual pre-configuration.
To define a profile’s VPN settings:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Security menu and select VPN.
Device Configuration 5 - 105
Figure 5-61 Profile Security - VPN IKE Policy screen
5. Select either the IKEv1 or IKEv2 radio button to enforce VPN peer key exchanges using either IKEv1 or IKEv2.
IKEv2 provides improvements from the original IKEv1 design (improved cryptographic mechanisms, NAT and firewall
traversal, attack resistance etc.) and is recommended in most deployments. The appearance of the IKE Policy screens differ
depending on the selected IKEv1 or IKEv2 mode.
6. Refer to the following to determine whether an IKE Policy requires creation, modification or removal:
Name
Displays the 32 character maximum name assigned to the IKE policy.
DPD Keep Alive
Lists each policy’s IKE keep alive message interval defined for IKE VPN tunnel dead peer
detection.
IKE LifeTime
Displays each policy’s lifetime for an IKE SA. The lifetime defines how long a connection
(encryption/authentication keys) should last, from successful key negotiation to expiration. Two
peers need not exactly agree on the lifetime, though if they do not, there is some clutter for a
superseded connection on the peer defining the lifetime as longer.
DPD Retries
Lists each policy’s maximum number of keep alive messages sent before a VPN tunnel connection
is defined as dead by the peer. This screen only appears when IKEv1 is selected.
7. Select Add to define a new IKE Policy configuration, Edit to modify an existing configuration or Delete to remove an
existing configuration.
5 - 106 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-62 Profile Security - VPN IKE Policy create/modify screen (IKEv1 example)
Name
If creating a new IKE policy, assign it a name (32 character maximum) to help
differentiate this IKE configuration from others with similar parameters.
DPD Keep Alive
Configure the IKE keep alive message interval used for dead peer detection on the
remote end of the IPSec VPN tunnel. Set this value in either Seconds (10 - 3,600),
Minutes (1 - 60) or Hours (1). The default setting is 30 seconds. This setting is required
for both IKEv1 and IKEV2.
Mode
If using IKEv1, use the drop-down menu to define the IKE mode as either Main or
Aggressive. IPSEC has two modes in IKEv1 for key exchanges. Aggressive mode
requires 3 messages be exchanged between the IPSEC peers to setup the SA, Main
requires 6 messages. The default setting is Main.
DPD Retries
Use the spinner control to set the maximum number of keep alive messages sent before
a VPN tunnel connection is defined as dead. The available range is from 1 - 100. The
default setting is 5.
IKE LifeTime
Set the lifetime defining how long a connection (encryption/authentication keys) should
last from successful key negotiation to expiration. Set this value in either Seconds (600
- 86,400), Minutes (10 - 1,440), Hours (1 - 24) or Days (1). This setting is required for both
IKEv1 and IKEV2.
Device Configuration 5 - 107
8. Select + Add Row to define the network address of a target peer and its security settings.
Name
If creating a new IKE policy, assign the target peer (tunnel destination) a 32 character
maximum name to distinguish it from others with a similar configuration.
DH Group
Use the drop-down menu to define a Diffie-Hellman (DH) identifier used by the VPN
peers to derive a shared secret password without having to transmit. DH groups
determine the strength of the key used in key exchanges. The higher the group number,
the stronger and more secure the key. Options include 2, 5 and 14. The default setting
is 5.
Encryption
Select an encryption method used by the tunnelled peers to securely interoperate.
Options include 3DES, AES, AES-192 and AES-256. The default setting is AES-256.
Authentication
Select an authentication hash algorithm used by the peers to exchange credential
information. Options include SHA and MD5. The default setting is SHA.
9. Select OK to save the changes made within the IKE Policy screen. Select Reset to revert to the last saved configuration.
Select the Delete Row icon to remove a peer configuration.
10. Select the Peer Configuration tab to assign additional network address and IKE settings to the an intended VPN tunnel
peer destination.
Figure 5-63 Profile Security - VPN Peer Destination screen (IKEv1 example)
11. Select either the IKEv1 or IKEv2 radio button to enforce VPN key exchanges using either IKEv1 or IKEv2.
12. Refer to the following to determine whether a VPN Peer Configuration requires creation, modification or removal:
Name
Lists the 32 character maximum name assigned to each listed peer configuration.
IP/Hostname
Displays the IP address (or host address FQDN) of the IPSec VPN peer targeted for secure
tunnel connection and data transfer.
Authentication Type
Lists whether the peer configuration has been defined to use pre-shared key (PSK) or RSA.
Rivest, Shamir, and Adleman (RSA) is an algorithm for public key cryptography. It’s the first
algorithm known to be suitable for signing, as well as encryption. If using IKEv2, this screen
displays both local and remote authentication, as both ends of the VPN connection require
authentication.
5 - 108 WiNG 5.5.3 Access Point System Reference Guide
LocalID
Lists the access point’s local identifier used within this peer configuration for an IKE
exchange with the target VPN IPSec peer.
RemoteID
Displays the means the target remote peer is to be identified (string, FQDN etc.) within the
VPN tunnel.
IKE Policy Name
Lists the IKEv1 or IKE v2 policy used with each listed peer configuration. If a policy requires
creation, select the Create button.
13. Select Add to define a new peer configuration, Edit to modify an existing configuration or Delete to remove an existing
peer configuration. The parameters vary depending on whether IKEv1 or IKEv2 is selected.
Figure 5-64 Profile Security - VPN Peer Configuration create/modify screen (IKEv2 example)
Name
If creating a new peer configuration (remote gateway) for VPN tunnel connection,
assign it a name (32 character maximum) to distinguish it from others with similar
attributes.
IP Type
Enter either the IP address or FQDN hostname of the IPSec VPN peer used in the tunnel
setup. If IKEv1 is used, this value is titled IP Type, if IKEv2 is used, this parameter is titled
Select IP/Hostname.
Authentication Type or
Local Authentication Type
Select either pre-shared key (PSK) or RSA. Rivest, Shamir, and Adleman (RSA) is an
algorithm for public key cryptography. It’s the first algorithm known to be suitable for
signing, as well as encryption If using IKEv2, this screen displays both local and remote
authentication options, as both ends of the VPN connection require authentication. RSA
is the default value for both local and remote authentication (regardless of IKEv1 or
IKEv2).
Device Configuration 5 - 109
Authentication Value or
Define the authentication string (shared secret) that must be shared by both ends of the
Local Authentication Value VPN tunnel connection. The string must be from 8 - 21 characters long. If using IKEv2,
both a local and remote string must be specified for handshake validation and both ends
(local and remote) of the VPN connection.
Local Identity
Select the access point’s local identifier used with this peer configuration for an IKE
exchange with the target VPN IPSec peer. Options include IP Address, Distinguished
Name, FQDN, email and string. The default setting is string.
Remote Identity
Select the access point’s remote identifier used with this peer configuration for an IKE
exchange with the target VPN IPSec peer. Options include IP Address, Distinguished
Name, FQDN, email and string. The default setting is string.
IKE Policy Name
Select the IKEv1 or IKE v2 policy name (and settings) to apply to this peer configuration.
If a policy requires creation, select the Create icon.
14. Select OK to save the changes made within the Peer Configuration screen. Select Reset to revert to the last saved
configuration.
15. Select the Transform Set tab.
Create or modify Transform Set configurations to specify how traffic is protected within crypto ACL defining the traffic
that needs to be protected.
Figure 5-65 Profile Security - VPN Transform Set tab
16. Review the following attributes of an existing Transform Set configurations:
Transform Set
Lists the 32 character maximum name assigned to each listed transform set upon
creation. Again, a transform set is a combination of security protocols, algorithms and
other settings applied to IPSec protected traffic.
Authentication Algorithm
Lists each transform sets’s authentication scheme used to validate identity credentials.
The authentication scheme is either HMAC-SHA or HMAC-MD5.
5 - 110 WiNG 5.5.3 Access Point System Reference Guide
Encryption Algorithm
Displays each transform set’s encryption method for protecting transmitted traffic.
Mode
Displays either Tunnel or Transport as the IPSec tunnel type used with the transform set.
Tunnel is used for site-to-site VPN and Transport should be used for remote VPN
deployments.
17. Select Add to define a new transform set configuration, Edit to modify an existing configuration or Delete to remove an
existing transform set.
Figure 5-66 Profile Security - VPN Transform Set create/modify screen
18. Define the following settings for the new or modified Transform Set configuration:
Transform Set
If creating a new transform set, define a 32 character maximum name to differentiate
this configuration from others with similar attributes.
Authentication Algorithm
Set the transform sets’s authentication scheme used to validate identity credentials.
Use the drop-down menu to select either HMAC-SHA or HMAC-MD5. The default
setting is HMAC-SHA.
Encryption Algorithm
Set the transform set encryption method for protecting transmitted traffic. Options
include DES, 3DES, AES, AES-192 and AES-256. The default setting is AES-256.
Mode
Use the drop-down menu to select either Tunnel or Transport as the IPSec tunnel type
used with the transform set. Tunnel is used for site-to-site VPN and Transport should be
used for remote VPN deployments.
19. Select OK to save the changes made within the Transform Set screen. Select Reset to revert to the last saved
configuration.
20. Select the Crypto Map tab.
Use crypto maps (as applied to IPSec VPN) to combine the elements used to create IPSec SAs (including transform sets).
Device Configuration 5 - 111
Figure 5-67 Profile Security - VPN Crypto Map tab
21. Review the following Crypto Map configuration parameters to assess their relevance:
Name
Lists the 32 character maximum name assigned for each crypto map upon creation. This
name cannot be modified as part of the edit process.
Type
Displays the site-to-site-manual, site-to-site-auto or remote VPN configuration defined for
each listed crypto map configuration. With site-to-site deployments, an IPSEC Tunnel is
deployed between two gateways, each at the edge of two different remote networks. With
remote VPN, an access point located at remote branch defines a tunnel with a security
gateway. This facilitates the endpoints in the branch office to communicate with the
destination endpoints (behind the security gateway) in a secure manner.
IP Firewall Rules
Lists the IP firewall rules defined for each displayed crypto map configuration. Each firewall
policy contains a unique set of access/deny permissions applied to the VPN tunnel and its
peer connection.
IPSec Transform Set
Displays the transform set (encryption and has algorithms) applied to each listed crypto map
configuration. Thus, each crypto map can be customized with its own data protection and
peer authentication schemes.
22. If requiring a new crypto map configuration, select the Add button. If updating the configuration of an existing crypto map,
select it from amongst those available and select the Edit button.
23. If adding a new crypto map, assign it a name up to 32 characters as a unique identifier. Select the Continue button to
proceed to the VPN Crypto Map screen.
5 - 112 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-68 Profile Security - VPN Crypto Map screen
24. Review the following before determining whether to add or modify a crypto map configuration:
Sequence
Each crypto map configuration uses a list of entries based on a sequence number. Specifying
multiple sequence numbers within the same crypto map, provides the flexibility to connect
to multiple peers from the same interface, based on the sequence number (from 1 - 1,000).
Type
Displays the site-to-site-manual, site-to-site-auto or remote VPN configuration defined for
each listed crypto map configuration.
IP Firewall Rules
Lists the IP firewall rules defined for each displayed crypto map configuration. Each firewall
policy contains a unique set of access/deny permissions applied to the VPN tunnel and its
peer connection.
IPSec Transform Set
Displays the transform set (encryption and hash algorithms) applied to each listed crypto map
configuration. Thus, each crypto map can be customized with its own data protection and
peer authentication schemes.
25. If requiring a new crypto map configuration, select the Add button. If updating the configuration of an existing crypto map,
select it from amongst those available and select the Edit button.
Device Configuration 5 - 113
Figure 5-69 Profile Security - VPN Crypto Map Entry screen
26. Define the following parameters to set the crypto map configuration:
Sequence
Each crypto map configuration uses a list of entries based on a sequence number.
Specifying multiple sequence numbers within the same crypto map extends connection
flexibility to multiple peers on the same interface, based on this selected sequence
number (from 1 - 1,000).
Type
Define the site-to-site-manual, site-to-site-auto or remote VPN configuration defined
for each listed crypto map configuration.
5 - 114 WiNG 5.5.3 Access Point System Reference Guide
IP Firewall Rules
Use the drop-down menu to select the access list (ACL) used to protect IPSec VPN
traffic. New access/deny rules can be defined for the crypto map by selecting the
Create icon, or an existing set of firewall rules can be modified by selecting the Edit
icon.
IPSec Transform Set
Select the transform set (encryption and hash algorithms) to apply to this crypto map
configuration.
Mode
Use the drop-down menu to define which mode (pull or push) is used to assign a virtual
IP. This setting is relevant for IKEv1 only, since IKEv2 always uses the configuration
payload in pull mode. The default setting is push.
Local End Point
Select this option to define an IP address as a local tunnel end-point address. This
setting represents an alternative to an interface IP address.
Perfect Forward Secrecy
(PFS)
PFS is key-establishment protocol, used to secure VPN communications. If one
encryption key is compromised, only data encrypted by that specific key is
compromised. For PFS to exist, the key used to protect data transmissions must not be
used to derive any additional keys. Options include None, 2, 5 and 14. The default
setting is None.
Lifetime (kB)
Select this option to define a connection volume lifetime (in kilobytes) for the duration
of an IPSec VPN security association. Once the set volume is exceeded, the association
is timed out. Use the spinner control to set the volume from 500 - 2,147,483,646
kilobytes.
Lifetime (seconds)
Select this option to define a lifetime (in seconds) for the duration of an IPSec VPN
security association. Once the set value is exceeded, the association is timed out. The
available range is from 120 - 86,400 seconds. The default setting is 120 seconds.
Protocol
Select the security protocol used with the VPN IPSec tunnel connection. SAs are
unidirectional, existing in each direction and established per security protocol. Options
include ESP and AH. The default setting is ESP.
Remote VPN Type
Define the remote VPN type as either None or XAuth. XAuth (extended authentication)
provides additional authentication validation by permitting an edge device to request
extended authentication information from an IPSec host. This forces the host to respond
with additional authentication credentials. The edge device respond with a failed or
passed message. The default setting is XAuth.
Manual Peer IP
Select this option to define the IP address of an additional encryption/decryption peer.
Time Out
Select this option to set the IPSec SA time out value. Use the textbox and the drop-down
list to configure the time out duration.
Enable NAT after IPSec
Select this option to enable NAT after IPSec. Enable this if there are NATted networks
behind VPN tunnels.
27. Select OK to save the updates made to the Crypto Map Entry screen. Selecting Reset reverts the screen to its last saved
setting.
28. Select Remote VPN Server.
Use this screen to define the server resources used to secure (authenticate) a remote VPN connection with a target peer.
Device Configuration 5 - 115
Figure 5-70 Profile Security - Remote VPN Server tab (IKEv2 example)
29. Select either the IKEv1 or IKEv2 radio button to enforce peer key exchanges over the remote VPN server using either IKEv1
or IKEv2.
IKEv2 provides improvements from the original IKEv1 design (improved cryptographic mechanisms, NAT and firewall
traversal, attack resistance etc.) and is recommended in most deployments. The appearance of the screen differs depending
on the selected IKE mode.
30. Set the following IKEv1 or IKe v2 Settings:
Authentication Method
Use the drop-down menu to specify the authentication method used to validate the
credentials of the remote VPN client. Options include Local (on board RADIUS resource
if supported) and RADIUS (designated external RADIUS resource). If selecting Local,
select the + Add Row button and specify a User Name and Password for authenticating
remote VPN client connections with the local RADIUS resource. The default setting is
Local. AP6511 and AP6521 model access points do not have a local RADIUS resource
and must use an external RADIUS server resource.
5 - 116 WiNG 5.5.3 Access Point System Reference Guide
AAA Policy
Select the AAA policy used with the remote VPN client. AAA policies define RADIUS
authentication and accounting parameters. The access point can optionally use AAA
server resources (when using RADIUS as the authentication method) to provide user
database information and user authentication data.
31. Refer to the Wins Server Settings field and specify primary and secondary server resources for validating RADIUS
authentication requests on behalf of a remote VPN client. These external WINS server resources are available to validate
RADIUS resource requests.
32. Refer to the Name Server Settings field and specify primary and secondary server resources for validating RADIUS
authentication requests on behalf of a remote VPN client. These external name server resources are available to validate
RADIUS resource requests.
33. Select the IP Local Pool option to define an IP address and mask for a virtual IP pool used to IP addresses to remote VPN
clients.
34. If using IKEv2 specify following additional settings (required for IKEv2 only):
DHCP Server Type
Specify whether the Dynamic Host Configuration Protocol (DHCP) server is specified as
an IP address, Hostname (FQDN) or None (a different classification will be defined).
DHCP allows hosts on an IP network to request and be assigned IP addresses as well
as discover information about the network where they reside.
DHCP Server
Depending on the DHCP server type selected, enter either the numerical IP address,
hostname or other (if None is selected as the server type).
IP Local Pool
Select this option to define an IP address and mask for a virtual IP pool used to IP
addresses to remote VPN clients.
Relay Agent IP Address
Select this option to define DHCP relay agent IP address.
35. Select OK to save the updates made to the Remote VPN Server screen. Selecting Reset reverts the screen to its last
saved configuration.
36. Select the Remote VPN Client tab.
The Remote VPN Client screen provides options for configuring the remote VPN client.
Device Configuration 5 - 117
Figure 5-71 Profile Security - Remote VPN Client tab
37. Refer to the following fields to define Remote VPN Client Configuration settings:
Shutdown
Select this option to disable the remote VPN client. The default is disabled.
Transform Set
Configure the transform set used to specify how traffic is protected within the crypto ACL
defining the traffic that needs to be protected. Select the appropriate traffic set from the
drop-down menu or click the icon next to the drop-down menu to create a new transform
set.
38. Refer to the following fields to define the Remote VPN Client Peer List:
IKEV2 Peer
Use the drop-down menu to select the remote IKE v2 peer. Use the icon next to the dropdown to create a new peer.
Priority
Use the spinner to set the priority in which a remote peer is connected. The lower the
number the higher the priority.
39. Select OK to save the updates made to the Remote VPN Client screen. Selecting Reset reverts the screen to its last saved
configuration.
40. Select the Global Settings tab.
The Global Settings screen provides options for Dead Peer Detection (DPD). DPD represents the actions taken upon the
detection of a dead peer within the IPSec VPN tunnel connection.
5 - 118 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-72 Profile Security - Global VPN Settings tab
41. Refer to the following fields to define IPSec security, lifetime and authentication settings:
df bit
Select the DF bit handling technique used for the ESP encapsulating header. Options
include clear, set and copy. The default setting is copy.
IPsec Lifetime (kb)
Set a connection volume lifetime (in kilobytes) for the duration of an IPSec VPN security
association. Once the set volume is exceeded, the association is timed out. Use the
spinner control to set the volume from 500 - 2,147,483,646 kilobytes. The default
settings is 4,608,000 kilobytes.
IPsec Lifetime (seconds)
Set a lifetime (in seconds) for the duration of an IPSec VPN security association. Once
the set value is exceeded, the association is timed out. Options include Seconds (120 86,400), Minutes (2 - 1,440), Hours (1 - 24) or Days (1). The default setting is 3,600
seconds.
Plain Text Deny
Select global or interface to set the scope of the ACL. The default setting is global,
expanding the rules of the ACL beyond just the interface.
42. Define the following IKE Dead Peer Detection settings:
DPD Keep Alive
Define the interval (or frequency) of IKE keep alive messages for dead peer detection.
Options include Seconds (10 - 3,600), Minutes (1 - 60) and Hours (1). The default setting
is 30 seconds.
Device Configuration 5 - 119
DPD Retries
Use the spinner control to define the number of keep alive messages sent to an IPSec
VPN client before the tunnel connection is defined as dead. The available range is from
1 - 100. The default number of messages is 5.
NAT Keep Alive
Define the interval (or frequency) of NAT keep alive messages for dead peer detection.
Options include Seconds (10 - 3,600), Minutes (1 - 60) and Hours (1). The default setting
is 20 seconds.
Cookie Challenge
Threshold
Use the spinner control to define the threshold (1 - 100) that, when exceeded, enables
the cookie challenge mechanism.
Crypto NAT Pool
Use the drop-down menu to select the NAT pool for internal source NAT for IPSec
tunnels.
43. Select OK to save the updates made to the Global Settings screen. Selecting Reset reverts the screen to its last saved
configuration.
5 - 120 WiNG 5.5.3 Access Point System Reference Guide
5.2.7.2 Auto IPSec Tunnel
Profile Security Configuration
IPSec tunnels are established to secure traffic, data and management traffic, from access points to remote wireless controllers.
Secure tunnels must be established between access points and the wireless controller with minimum configuration pushed
through DHCP option settings.
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Security menu and select Auto IPSec Tunnel.
Figure 5-73 Profile Security – Auto IPSec Tunnel screen
5. Refer to the following table to configure the Auto IPSec Tunnel settings:
Group ID
Configure the ID string used for IKE authentication. String length can be between 1 - 64
characters.
Authentication Type
Set the IPSec Authentication Type. Options include PSK (Pre Shared Key) or rsa.
Authentication Key
Set the common key for authentication between the remote tunnel peer. Key length is
between 8 - 21 characters.
IKE Version
Configure the IKE version to use. The available options are ikev1-main, ikev1-aggr and
ikev2.
Enable NAT after IPSec
Select this option to enable NAT after IPSec. Enable this option if there are NATted
networks behind VPN tunnels.
Use Unique ID
In scenarios where different access points behind different NAT boxes/routers have the
same IP address, it is not possible to create a tunnel between the wireless controller
and access point, as the wireless controller fails to identify the access point uniquely.
When selected, each access point behind the same NAT box/router will have a unique
ID. This unique ID is used to create the VPN tunnel.
6. Select OK to save the updates made to the Auto IPSec Tunnel screen. Selecting Reset reverts the screen to its last saved
configuration.
Device Configuration 5 - 121
5.2.7.3 Defining Profile Security Settings
Profile Security Configuration
A profile can leverage existing firewall, wireless client role and WIPS policies and configurations and apply them to the profile’s
configuration. This affords each profile a truly unique combination of data protection policies best meeting the data protection
requirements of the access point’s numerous deployment scenarios.
To define a profile’s security settings:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Security menu and select Settings.
Figure 5-74 Profile Security - Settings screen
5. Select the WEP Shared Key Authentication radio button to require profile supported devices to use a WEP key to access
the network using this profile. The access point, other proprietary routers, and Motorola Solutions clients use the key
algorithm to convert an ASCII string to the same hexadecimal number. Clients without Motorola Solutions adapters need
to use WEP keys manually configured as hexadecimal numbers. This option is disabled by default.
6. Client Identity is a set of unique fingerprints used to identify a class of devices. This information is used to configure
permissions and access rules for devices classes in the network. Client Identity Group is a collection of client identities
that identify devices and applies specific permissions and restrictions on these devices. From the drop-down menu select
the client identity group to use with this device profile. For more information, see Device Fingerprinting on page 8-18.
7. Select OK to save the changes made within the Settings screen. Select Reset to revert to the last saved configuration.
5 - 122 WiNG 5.5.3 Access Point System Reference Guide
5.2.7.4 Setting the Certificate Revocation List (CRL) Configuration
Profile Security Configuration
A certificate revocation list (CRL) is a list of certificates that have been revoked or are no longer valid. A certificate can be
revoked if the certificate authority (CA) had improperly issued a certificate, or if a private-key is compromised. The most
common reason for revocation is the user no longer being in sole possession of the private key.
To define a CRL configuration that can be applied to a profile:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Security menu and select Certificate Revocation.
Figure 5-75 Profile Security - Certificate Revocation List (CRL) Update Interval screen
5. Select the + Add Row button to add a column within the Certificate Revocation List (CRL) Update Interval table to
quarantine certificates from use in the network.
Additionally, a certificate can be placed on hold for a user defined period. If, for instance, a private key was found and
nobody had access to it, its status could be reinstated.
6. Provide the name of the trustpoint in question within the Trustpoint Name field. The name cannot exceed 32 characters.
7. Enter the resource ensuring the trustpoint’s legitimacy within the URL field.
8. Use the spinner control to specify an interval (in hours) after which a device copies a CRL file from an external server and
associates it with a trustpoint.
9. Select OK to save the changes made within the Certificate Revocation List (CRL) Update Interval screen. Select Reset
to revert to the last saved configuration.
Device Configuration 5 - 123
5.2.7.5 Setting the Profile’s NAT Configuration
Profile Security Configuration
Network Address Translation (NAT) is a technique to modify network address information within IP packet headers in transit
across a traffic routing device. This enables mapping one IP address to another to protect network address credentials. With
typical deployments, NAT is used as an IP masquerading technique to hide private IP addresses behind a single, public facing,
IP address.
NAT is a process of modifying network address information in IP packet headers while in transit across a traffic routing device
for the purpose of remapping one IP address to another. In most deployments, NAT is used in conjunction with IP masquerading
which hides RFC1918 private IP addresses behind a single public IP address.
NAT can provide a profile outbound Internet access to wired and wireless hosts connected to an access point. Many-to-one
NAT is the most common NAT technique for outbound Internet access. Many-to-one NAT allows an access point to translate
one or more internal private IP addresses to a single, public facing, IP address assigned to a 10/100/1000 Ethernet port or 3G
card.
To define a NAT configuration that can be applied to a profile:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Security menu and select NAT.
Figure 5-76 Profile Security - NAT Pool tab
5 - 124 WiNG 5.5.3 Access Point System Reference Guide
The NAT Pool tab displays by default. The NAT Pool tab lists those NAT policies created thus far. Any of these policies can
be selected and applied to the access point profile.
5. Select Add to create a new NAT policy that can be applied to a profile. Select Edit to modify the attributes of a existing
policy or select Delete to remove obsolete NAT policies from the list of those available to a profile.
Figure 5-77 Profile Security - NAT Pool tab - NAT Pool field
6. If adding a new NAT policy or editing the configuration of an existing policy, define the following parameters:
Name
If adding a new NAT policy, provide a name to help distinguish it from others with similar
configurations. The length cannot exceed 64 characters.
IP Address Range
Define a range of IP addresses that are hidden from the public Internet. NAT modifies network
address information in the defined IP range while in transit across a traffic routing device. NAT
only provides IP address translation and does not provide a firewall. A branch deployment with
NAT by itself will not block traffic from being potentially routed through a NAT device.
Consequently, NAT should be deployed with a stateful firewall.
7. Select the + Add Row button to append additional rows to the IP Address Range table.
8. Select OK to save the changes made to the profile’s NAT Pool configuration. Select Reset to revert to the last saved
configuration.
9. Select the Static NAT tab. The Source tab displays by default.
The Source tab displays by default and lists existing static NAT configurations. Existing static NAT configurations are not
editable, but new configurations can be added or existing ones deleted as they become obsolete.
Static NAT creates a permanent, one-to-one mapping between an address on an internal network and a perimeter or
external network. To share a Web server on a perimeter interface with the Internet, use static address translation to map
the actual address to a registered IP address. Static address translation hides the actual address of the server from users
on insecure interfaces. Casual access by unauthorized users becomes much more difficult. Static NAT requires a dedicated
address on the outside network for each host.
Device Configuration 5 - 125
Figure 5-78 Profile Security - Static NAT screen - Source tab
10. To map a source IP address from an internal network to a NAT IP address click the Add button. The following screen
displays:
Figure 5-79 Profile Security - Static NAT screen - New Source entry
5 - 126 WiNG 5.5.3 Access Point System Reference Guide
11. Define the following Source NAT parameters:
Protocol
Select the protocol for use with static translation. TCP, UDP and Any are the available
options. Transmission Control Protocol (TCP) is a transport layer protocol used by
applications requiring guaranteed delivery. It’s a sliding window protocol handling both
timeouts and retransmissions. TCP establishes a full duplex virtual connection between
two endpoints. Each endpoint is defined by an IP address and a TCP port number. The User
Datagram Protocol (UDP) offers only a minimal transport service, non-guaranteed
datagram delivery, and provides applications direct access to the datagram service of the
IP layer. UDP is used by applications not requiring the level of service of TCP or are using
communications services (multicast or broadcast delivery) not available from TCP. The
default setting is Any.
Source IP
Enter the address used at the (internal) end of the static NAT configuration. This address
(once translated) will not be exposed to the outside world when the translation address is
used to interact with the remote destination.
Source Port
Use the spinner control to set the local port number used at the (internal) end of the static
NAT configuration. The default value is port 1.
NAT IP
Enter the IP address of the matching packet to the specified value. The IP address modified
can be either source or destination based on the direction specified.
NAT Port
Enter the port number of the matching packet to the specified value. This option is valid
only if the direction specified is destination.
Network
Select Inside or Outside NAT as the network direction. The default setting is Inside.
Select Inside to create a permanent, one-to-one mapping between an address on an
internal network and a perimeter or external network. To share a Web server on a
perimeter interface with the Internet, use static address translation to map the actual
address to a registered IP address. Static address translation hides the actual address of
the server from users on insecure interfaces. Casual access by unauthorized users
becomes much more difficult. Static NAT requires a dedicated address on the outside
network for each host. Inside NAT is the default setting.
12. Select the Destination tab to view destination NAT configurations and define packets passing through the NAT on the way
back to the LAN are searched against to the records kept by the NAT engine. The destination IP address is changed back to
the specific internal private class IP address to reach the LAN over the network.
Device Configuration 5 - 127
Figure 5-80 Profile Security - Static NAT screen - Destination tab
13. Select Add to create a new NAT destination configuration or Delete to permanently remove a NAT destination. Existing
NAT destination configurations are not editable.
Figure 5-81 NAT Destination - Add screen
5 - 128 WiNG 5.5.3 Access Point System Reference Guide
14. Set the following Destination configuration parameters:
Static NAT creates a permanent, one-to-one mapping between an address on an internal network and a perimeter or
external network. To share a Web server on a perimeter interface with the Internet, use static address translation to map
the actual address to a registered IP address. Static address translation hides the actual address of the server from users
on insecure interfaces. Casual access by unauthorized users becomes much more difficult. Static NAT requires a dedicated
address on the outside network for each host.
Protocol
Select the protocol for use with static translation. TCP, UDP and Any are the available
options. Transmission Control Protocol (TCP) is a transport layer protocol used by
applications requiring guaranteed delivery. It’s a sliding window protocol handling both
timeouts and retransmissions. TCP establishes a full duplex virtual connection between
two endpoints. Each endpoint is defined by an IP address and a TCP port number. The User
Datagram Protocol (UDP) offers only a minimal transport service, non-guaranteed
datagram delivery, and provides applications direct access to the datagram service of the
IP layer. UDP is used by applications not requiring the level of service of TCP or are using
communications services (multicast or broadcast delivery) not available from TCP. The
default setting is Any.
Destination IP
Enter the address used at the (source) end of the static NAT configuration. This address
(once translated) will not be exposed to the outside world when the translation address is
used to interact with the remote destination.
Destination Port
Use the spinner control to set the local port number used at the (source) end of the static
NAT configuration. The default value is port 1.
NAT IP
Enter the IP address of the matching packet to the specified value. The IP address modified
can be either source or destination based on the direction specified.
NAT Port
Enter the port number of the matching packet to the specified value. This option is valid
only if the direction specified is destination.
Network
Select Inside or Outside NAT as the network direction. The default setting is Inside.
Select Inside to create a permanent, one-to-one mapping between an address on an
internal network and a perimeter or external network. To share a Web server on a
perimeter interface with the Internet, use static address translation to map the actual
address to a registered IP address. Static address translation hides the actual address of
the server from users on insecure interfaces. Casual access by unauthorized users
becomes much more difficult. Static NAT requires a dedicated address on the outside
network for each host. Inside NAT is the default setting.
15. Select OK to save the changes made to the static NAT configuration. Select Reset to revert to the last saved configuration.
16. Select the Dynamic NAT tab.
Dynamic NAT configurations translate the IP address of packets going out from one interface to another interface based on
configured conditions. Dynamic NAT requires packets be switched through a NAT router to generate translations in the
translation table.
Device Configuration 5 - 129
Figure 5-82 Profile Security - Dynamic NAT tab
17. Refer to the following to determine whether a new Dynamic NAT configuration requires creation, edit or deletion:
Source List ACL
Lists the ACL defining packet selection criteria for the NAT configuration. NAT is applied
only on packets which match a rule defined in the access list. These addresses (once
translated) are not exposed to the outside world when the translation address is used to
interact with the remote destination.
Network
Displays Inside or Outside NAT as the network direction for the dynamic NAT
configuration.
Interface
Lists the VLAN (from 1 - 4094) used as the communication medium between the source
and destination points within the NAT configuration.
Overload Type
Lists the Overload Type used with the listed IP ACL rule. Options include NAT Pool, One
Global Address and Interface IP Address. The default setting is Interface IP Address.
NAT Pool
Displays the name of an existing NAT pool used with the NAT configuration.
Overload IP
Enables the use of one global address for numerous local addresses.
ACL Precedence
Lists the administrator assigned priority set for the listed source list ACL. The lower the
value listed, the higher the priority assigned to this ACL rule.
18. Select Add to create a new Dynamic NAT configuration, Edit to modify an existing configuration or Delete to permanently
remove a configuration.
5 - 130 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-83 Profile Security - Source ACL List screen
19. Set the following to define the Dynamic NAT configuration:
Source List ACL
Use the drop-down menu to select an ACL name to define the packet selection criteria for
NAT. NAT is applied only on packets which match a rule defined in the access list. These
addresses (once translated) are not exposed to the outside world when the translation
address is used to interact with the remote destination.
Network
Select Inside or Outside NAT as the network direction for the dynamic NAT configuration.
Inside is the default setting.
20. Select + Add Row to launch a pop up screen used to define the Interface, Overload Type, Nat Pool and Overload IP
used with the dynamic NAT configuration.
Interface
Use the drop-down menu to select the VLAN ID (from 1 - 4094) used as the communication
medium between the source and destination points within the NAT configuration. Ensure
the VLAN selected represents the intended network traffic within the NAT supported
configuration. VLAN1 is available by default. Optionally, select the wwan1 radio button if
the access point model supports a wwan interface as the outgoing layer 3 interface for
NAT.
Overload Type
Select this option of Overload Type used with the listed IP ACL rule. Options include NAT
Pool, One Global Address and Interface IP Address. Interface IP Address is the default
setting. If NAT Pool is selected, provide the Overload IP address.
NAT Pool
Provide the name of an existing NAT pool for use with the NAT configuration. Optionally
select the Create icon to define a new NAT Pool configuration.
Overload IP
Enables the use of one global address for numerous local addresses.
Device Configuration 5 - 131
21. Select OK to save the changes made to the dynamic NAT configuration. Select Reset to revert to the last saved
configuration.
5 - 132 WiNG 5.5.3 Access Point System Reference Guide
5.2.7.6 Setting the Profile’s Bridge NAT Configuration
Profile Security Configuration
Use Bridge NAT to manage Internet traffic originating at a remote site. In addition to traditional NAT functionality, Bridge NAT
provides a means of configuring NAT for bridged traffic through an access point. NAT rules are applied to bridged traffic through
the access point, and matching packets are NATed to the WAN link instead of being bridged on their way to the router.
Using Bridge NAT, a tunneled VLAN (extended VLAN) is created between the NoC and a remote location. When a remote client
needs to access the Internet, Internet traffic is routed to the NoC, and from there routed to the Internet. This increases the
access time for the end user on the client.
To resolve latency issues, Bridge NAT identifies and segregates traffic heading towards the NoC and outwards towards the
Internet. Traffic towards the NoC is allowed over the secure tunnel. Traffic towards the Internet is switched to a local WLAN
link with access to the Internet.
NOTE: Bridge NAT supports single AP deployments only. This feature cannot be used in
a branch deployment with multiple access points.
To define a Bridge NAT configuration that can be applied to a profile:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Security menu and select Bridge NAT.
Figure 5-84 Profile Security - Bridge NAT screen
Device Configuration 5 - 133
5. Review the following Bridge NAT configurations to determine whether a new Bridge NAT configuration requires creation
or an existing configuration modified or removed:
ACL
Lists the ACL applying IP address access/deny permission rules to the Bridge NAT configuration.
Interface
Lists the communication medium (outgoing layer 3 interface) between source and destination
points. This is either the access point’s pppoe1 or wwan1 interface or the VLAN used as the
redirection interface between the source and destination.
NAT Pool
Lists the names of existing NAT pools used with the Bridge NAT configuration. This displays only
when Overload Type is NAT Pool.
Overload IP
Lists the address used globally and collectively for numerous local addresses.
Overload Type
Lists the overload type used with the listed IP ACL rule. Set as either NAT Pool, One Global
Address or Interface IP Address.
6. Select Add to create a new Bridge VLAN configuration, Edit to modify an existing configuration or Delete to remove a
configuration.
Figure 5-85 Profile Security - Dynamic NAT screen
7. Select the ACL whose IP rules are to be applied to this policy based forwarding rule. A new ACL can be defined by selecting
the Create icon, or an existing set of IP ACL rules can be modified by selecting the Edit icon.
8. Use the IP Address Range table to configure IP addresses and address ranges that can used to access the Internet.
Interface
Lists the outgoing layer 3 interface on which traffic is re-directed. The interface can be an
access point WWAN or PPPoE interface. Traffic can also be redirected to a designated
VLAN.
NAT Pool
Displays the NAT pool used by this Bridge NAT entry. A value is only displayed only when
Overload Type has been set to NAT Pool.
Overload IP
Lists whether a single global address collectively supports numerous local addresses.
Overload Type
Displays the override type for this policy based forwarding rule.
9. Select + Add Row to set the IP address range settings for the Bridge NAT configuration.
5 - 134 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-86 Profile Security - Source Dynamic NAT screen - Add Row field
10. Select OK to save the changes made within the Add Row and Dynamic NAT screens. Select Reset to revert to the last
saved configuration.
5.2.7.7 Profile Security Configuration and Deployment Considerations
Profile Security Configuration
Before defining a profile’s security configuration, refer to the following deployment guidelines to ensure the profile
configuration is optimally effective:
• Ensure the contents of the certificate revocation list are periodically audited to ensure revoked certificates remained
quarantined or validated certificates are reinstated.
• NAT alone does not provide a firewall. If deploying NAT on a profile, add a firewall on the profile to block undesirable
traffic from being routed. For outbound Internet access, a stateful firewall can be configured to deny all traffic. If port
address translation is required, a stateful firewall should be configured to only permit the TCP or UDP ports being
translated.
Device Configuration 5 - 135
5.2.8 Virtual Router Redundancy Protocol (VRRP) Configuration
System Profile Configuration
A default gateway is a critical resource for connectivity. However, it’s prone to a single point of failure. Thus, redundancy for
the default gateway is required by the access point. If WAN backhaul is available on an AP7131, and a router failure occurs,
then the access point should act as a router and forward traffic on to its WAN link.
Define an external Virtual Router Redundancy Protocol (VRRP) configuration when router redundancy is required in a wireless
network requiring high availability.
Central to the configuration of VRRP is the election of a VRRP master. A VRRP master (once elected) performs the following
functions:
• Responds to ARP requests
• Forwards packets with a destination link layer MAC address equal to the virtual router MAC address
• Rejects packets addressed to the IP address associated with the virtual router, if it is not the IP address owner
• Accepts packets addressed to the IP address associated with the virtual router, if it is the IP address owner or accept
mode is true
Those nodes that lose the election process enter a backup state. In the backup state they monitor the master for any failures,
and in case of a failure one of the backups, in turn, becomes the master and assumes the management of the designated virtual
IPs. A backup does not respond to an ARP request, and discards packets destined for a virtual IP resource.
NOTE: VRRP support is available only on AP7131 model access point, and is not
available in other models.
To define the configuration of a VRRP group:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Select VRRP.
Figure 5-87 Profiles - VRRP screen - VRRP tab
5 - 136 WiNG 5.5.3 Access Point System Reference Guide
5. Review the following VRRP configuration data to assess if a new VRRP configuration is required or if an existing VRRP
configuration requires modification or removal:
Virtual Router ID
Lists a numerical index (from 1 - 254) used to differentiate VRRP configurations. The index
is assigned when a VRRP configuration is initially defined. This ID identifies the virtual
router a packet is reporting status for.
Description
Displays a description assigned to the VRRP configuration when it was either created or
modified. The description is implemented to provide additional differentiation beyond the
numerical virtual router ID.
Virtual IP Addresses
Lists the virtual interface IP address used as the redundant gateway address for the
virtual route.
Interface
Displays the interfaces selected on the access point to supply VRRP redundancy failover
support.
Priority
Lists a numerical value (from 1 - 254) used for the virtual router master election process.
The higher the numerical value, the higher the priority in the election process.
6. Select the Version tab to define the VRRP version scheme used with the configuration.
Figure 5-88 Profiles - VRRP screen - Version tab
VRRP version 3 (RFC 5798) and 2 (RFC 3768) are selectable to set the router redundancy. Version 3 supports sub-second
(centisecond) VRRP failover and support services over virtual IP. For more information on the VRRP protocol specifications
Device Configuration 5 - 137
(available publicly) refer to http://www.ietf.org/rfc/rfc3768.txt (version 2) and http://www.ietf.org/rfc/rfc5798.txt (version
3).
7. From within the VRRP tab, select Add to create a new VRRP configuration or Edit to modify the attributes of an existing
VRRP configuration. If necessary, existing VRRP configurations can be selected and permanently removed by selecting
Delete.
If adding or editing a VRRP configuration, the following screen displays:
Figure 5-89 Profiles - VRRP screen
8. If creating a new VRRP configuration, assign a Virtual Router ID from 1 - 255. In addition to functioning as numerical
identifier, the ID identifies the access point’s virtual router a packet is reporting status for.
5 - 138 WiNG 5.5.3 Access Point System Reference Guide
9. Define the following VRRP General parameters:
Description
In addition to an ID assignment, a virtual router configuration can be assigned a textual
description (up to 64 characters) to further distinguish it from others with a similar
configuration.
Priority
Use the spinner control to set a VRRP priority setting from 1 - 254. The access point uses
the defined setting as criteria in selection of a virtual router master. The higher the value,
the greater the likelihood of this virtual router ID being selected as the master.
Virtual IP Addresses
Provide up to 8 IP addresses representing the Ethernet switches, routers or security
appliances defined as virtual router resources to the AP7131 access point.
Advertisement Interval
Unit
Select either seconds, milliseconds or centiseconds as the unit used to define VRRP
advertisements. Once an option is selected, the spinner control becomes enabled for that
Advertisement Interval option. The default interval unit is seconds. If changing the VRRP
group version from 2 to 3, ensure the advertisement interval is in centiseconds. Use VRRP
group version 2 when the advertisement interval is either in seconds or milliseconds.
Advertisement Interval
Once the Advertisement Interval Unit has been selected, use the spinner control to set the
interval at which the VRRP master sends out advertisements on each of its configured
VLANs. The default setting is 1 second.
Preempt
Select this option to ensure a high priority backup router is available to preempt a lower
priority backup router resource. The default setting is enabled. When selected, the
Preempt Delay option becomes enabled to set the actual delay interval for pre-emption.
This setting determines if a node with a higher priority can takeover all the Virtual IPs from
the nodes with a lower priority.
Preempt Delay
If the Preempt option is selected, use the spinner control to set the delay interval (in
seconds) for preemption.
Interface
Select this value to enable/disable VRRP operation and define the AP7131 VLAN
(1 - 4,094) interface where VRRP will be running. These are the interfaces monitored to
detect a link failure.
10. Refer to the Protocol Extension field to define the following:
Sync Group
Select this option to assign a VRRP sync group to this VRRP ID’s group of virtual IP
addresses. This triggers VRRP failover if an advertisement is not received from the virtual
masters that are part of this VRRP sync group. This setting is disabled by default.
Network Monitoring:
Local Interface
Select wwan1, pppoe1 and VLAN ID(s) as needed to extend VRRP monitoring to these
local access point interfaces. Once selected, these interfaces can be assigned an
increasing or decreasing level or priority for virtual routing within the VRRP group.
Network Monitoring:
Critical Resources
Assign the priority level for the selected local interfaces. Backup virtual routers can
increase or decrease their priority in case the critical resources connected to the master
router fail, and then transition to the master state themselves. Additionally, the master
virtual router can lower its priority if the critical resources connected to it fails, so the
backup can transition to the master state. This value can only be set on the backup or
master router resource, not both. Options include None, increment-priority, and
decrement priority.
Device Configuration 5 - 139
Network Monitoring:
Delta Priority
Use this setting to decrement the configured priority (by the set value) when the
monitored interface is down. When critical resource monitoring, the configured value is
incremented by the value defined.
11. Select OK to save the changes made to the VRRP configuration. Select Reset to revert to the last saved configuration.
5.2.9 Profile Critical Resources
System Profile Configuration
Critical resources are device IP addresses or interface destinations on the network interoperated as critical to the health of the
network. The critical resource feature allows for the continuous monitoring of these addresses. A critical resource, if not
available, can result in the network suffering performance degradation. A critical resource can be a gateway, a AAA server, a
WAN interface or any hardware or service on which the stability of the network depends. Critical resources are pinged regularly
by the access point. If there’s a connectivity issue, an event is generated stating a critical resource is unavailable. By default,
there’s no enabled critical resource policy and one needs to be created and implemented.
Critical resources can be monitored directly through the interfaces on which they’re discovered. For example, a critical resource
on the same subnet as the access point can be monitored by its IP address. However, a critical resource located on a VLAN
must continue to monitored on that VLAN.
Critical resources can be configured for access points and wireless controllers using their respective profiles.
To define critical resources:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Select Critical Resources.
Figure 5-90 Critical Resources screen - List of Critical Resources tab
The screen lists the destination IP addresses or interfaces (VLAN, WWAN, or PPPoE) used for critical resource connection.
IP addresses can be monitored directly by the access point or controller, whereas a VLAN, WWAN or PPPoE must be
monitored behind an interface.
5. Select the Add button at the bottom of the screen to add a new critical resource and connection method, or select and
existing resource and select Edit to update the resource’s configuration.
5 - 140 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-91 Critical Resources screen - Adding a Critical Resource
6. Use the Offline Resource Detection drop-down menu to define how critical resource event messages are generated.
Options include Any and All. If selecting Any, an event is generated when the state of any single critical resource changes.
If selecting All, an event is generated when the state of all monitored critical resources change.
7. Select the IP option (within the Monitor Via field at the top of the screen) to monitor a critical resource directly (within
the same subnet) using the provided critical resource IP address as a network identifier.
8. Select the Interface option (within the Monitor Via field at the top of the screen) to monitor a critical resource using either
the critical resource’s VLAN, WWAN1 or PPPoE1 interface. If VLAN is selected, a spinner control is enabled to define the
destination VLAN ID used as the interface for the critical resource.
9. Select + Add Row to define the following for critical resource configurations:
IP Address
Provide the IP address of the critical resource. This is the address used by the access point to ensure
the critical resource is available. Up to four addresses can be defined.
Mode
Set the ping mode used when the availability of a critical resource is validated. Select from:
• arp-only – Use the Address Resolution Protocol (ARP) for only pinging the critical resource. ARP
is used to resolve hardware addresses when only the network layer address is known.
• arp-and-ping – Use both ARP and Internet Control Message Protocol (ICMP) for pinging the critical
resource and sending control messages (device not reachable, requested service not available,
etc.).
Port
Provide the port on which the critical resource is available. Use the spinner control to set the port
number.
VLAN
Define the VLAN on which the critical resource is available using the spinner control.
Device Configuration 5 - 141
10. Select the Monitor Interval tab.
Figure 5-92 Critical Resources screen - Monitor Interval tab
11. Set the duration between two successive pings from the access point to the critical resource. Define this value in seconds
from 5 - 86,400. The default setting is 30 seconds.
12. Configure the IP address for Port-Limited Monitoring in the Source IP for Port-Limited Monitoring field. Sets the IP
address used as the source address in ARP packets used to detect a critical resource on a layer 2 interface. Generally, the
source address 0.0.0.0 is used in the APR packets used to detect critical resources. However, some devices do not support
the above IP address and drop the ARP packets. Use this field to provide an IP address specifically used for this purpose.
The IP address used for Port-Limited Monitoring must be different from the IP address configured on the device.
13. Select OK to save the changes to the critical resource configuration and monitor interval. Select Reset to revert to the last
saved configuration.
5 - 142 WiNG 5.5.3 Access Point System Reference Guide
5.2.10 Profile Services Configuration
System Profile Configuration
A profile can contain specific guest access (captive portal) server configurations. These guest network access permissions can
be defined uniquely as profile requirements dictate.
To define a profile’s services configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Select Services.
Figure 5-93 Profile Services - Services screen
5. Refer to the Captive Portal Hosting field to select or set a guest access configuration (captive portal) for use with this
profile.
A captive portal is guest access policy for providing guests temporary and restrictive access to the access point managed
network.
A captive portal provides secure authenticated access using a standard Web browser. Captive portals provides
authenticated access by capturing and re-directing a wireless user's Web browser session to a captive portal login page
where the user must enter valid credentials to access to the wireless network. Once logged into the captive portal,
additional Agreement, Welcome and Fail pages provide the administrator with a number of options on screen flow and user
appearance.
Either select an existing captive portal policy, use the default captive portal policy or select the Create link to create a new
captive portal configuration that can be applied to this profile. For more information, see Configuring Captive Portal Policies
on page 9-2.
6. Select OK to save the changes made to the profile’s services configuration. Select Reset to revert to the last saved
configuration.
Device Configuration 5 - 143
5.2.10.1 Profile Services Configuration and Deployment Considerations
Profile Services Configuration
Before defining a profile’s captive portal and DHCP configuration, refer to the following deployment guidelines to ensure the
profile configuration is optimally effective:
• A profile plan should consider the number of wireless clients allowed on the profile’s guest (captive portal) network and the
services provided, or if the profile should support guest access at all.
• Profile configurations supporting a captive portal should include firewall policies to ensure logical separation is provided
between guest and internal networks so internal networks and hosts are not reachable from guest devices.
• DHCP’s lack of an authentication mechanism means a DHCP server supported profile cannot check if a client or user is
authorized to use a given user class. This introduces a vulnerability when using user class options. Ensure a profile using
DHCP resources is also provisioned with a strong user authorization and validation configuration.
5 - 144 WiNG 5.5.3 Access Point System Reference Guide
5.2.11 Profile Management Configuration
System Profile Configuration
The access point has mechanisms to allow/deny management access to the network for separate interfaces and protocols
(HTTP, HTTPS, Telnet, SSH or SNMP). These management access configurations can be applied strategically to profiles as
resource permissions dictate.
Additionally, an administrator can define a profile with unique configuration file and device firmware upgrade support.
To define a profile’s management configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Management menu item and select Settings.
Device Configuration 5 - 145
Figure 5-94 Profile Management - Settings screen
5. Refer to the Message Logging field to define how the profile logs system events. It’s important to log individual events
to discern an overall pattern that may be negatively impacting performance using the configuration defined for the access
point’s profile.
Enable Message Logging
Select this option to enable the profile to log system events to a user defined log file
or a syslog server. Selecting this radio button enables the rest of the parameters
required to define the profile’s logging configuration. This option is disabled by
default.
5 - 146 WiNG 5.5.3 Access Point System Reference Guide
Remote Logging Host
Use this table to define numerical (non DNS) IP addresses for up to three external
resources where logged system events can be sent on behalf of the profile. Select
Clear to remove an IP address.
Facility to Send Log
Messages
Use the drop-down menu to specify the server facility (if used) for the profile event log
transfer.
Syslog Logging Level
Event severity coincides with the syslog logging level defined for the profile. Assign a
numeric identifier to log events based on criticality. Severity levels include
0 - Emergency, 1 - Alert, 2 - Critical, 3 - Errors, 4 - Warning, 5 - Notice, 6 - Info and
7 - Debug. The default logging level is 4.
Console Logging Level
Event severity coincides with the console logging level defined for the profile. Assign
a numeric identifier to log events based on criticality. Severity levels include
0 - Emergency, 1 - Alert, 2 - Critical, 3 - Errors, 4 - Warning, 5 - Notice, 6 - Info and
7 - Debug. The default logging level is 4.
Buffered Logging Level
Event severity coincides with the buffered logging level defined for the profile. Assign
a numeric identifier to log events based on criticality. Severity levels include
0 - Emergency, 1 - Alert, 2 - Critical, 3 - Errors, 4 - Warning, 5 - Notice, 6 - Info and
7 - Debug. The default logging level is 4.
Time to Aggregate Repeated
Messages
Define the interval (duration) system events are logged on behalf of the access point
profile. The shorter the interval, the sooner the event is logged. Either define an
interval in Seconds (0 - 60) or Minutes (0 -1). The default value is 0 seconds.
Forward Logs to Controller
Select this option to define a log level for forwarding event logs. Log levels include
Emergency, Alert, Critical, Error, Warning, Notice, Info and Debug. The default logging
level is Error.
6. Refer to the System Event Messages field to define how system messages are logged and forwarded on behalf of the
access point’s profile.
7. Select the Enable System Events radio button to allow the profile to capture system events and append them to a log file.
It’s important to log individual events to discern an overall pattern that may be negatively impacting the access point’s
performance. This settings is enabled by default.
8. Select the Enable System Event Forwarding radio button to enable the forwarding of system events. This setting is
enabled by default.
9. Refer to the Events E-mail Notification field to define how system event notification E-mails are sent on behalf of the
access point profile.
SMTP Server
Specify either the Hostname or IP Address of the outgoing SMTP server where
notification E-mails are originated.
Port of SMTP
If a non-standard SMTP port is used on the outgoing SMTP server, select this option
and specify a port from 1 - 65,535 for the outgoing SMTP server.
Sender E-mail Address
Specify the E-mail address where notification E-mails are originated.
Recipient's E-mail Address
Specify the destination E-mail address where notification E-mails are sent. Multiple
E-mail addresses can be specified by typing each address individually and selecting
the button next to the E-mail text box to add it to a list.
Device Configuration 5 - 147
Username for SMTP Server
Specify the sender’s username on the outgoing SMTP server. Many SMTP servers
require users to authenticate with a username and password before sending E-mail
through the server.
Password for SMTP Server
Specify the sender’s username password on the outgoing SMTP server. Many SMTP
servers require users to authenticate with a username and password before sending
E-mail through the server.
10. Use the Persist Configuration Across Reloads option to define how the access point saves (in flash memory) the
configuration received from its connected Virtual Controller. Stored configurations can be made available to the access
point if the access point’s connected Virtual Controller were to be unreachable. Options include Enabled, Disabled and
Secure.
11. Use the HTTP Analytics area to configure how analytics is sent to the HTTP analytics server. Select the Compress option
to send the HTTP analytics compressed. Use the Update Interval fields to configure the update interval between two
updates to the HTTP analytics server.
12. Select OK to save the changes made to the profile’s Management Settings. Select Reset to revert to the last saved
configuration.
13. Select Firmware from the Management menu.
Figure 5-95 Profile Management - Firmware screen
14. Refer to the Auto Install via DHCP field to define the configuration used by the profile to update firmware using DHCP:
Enable Configuration Update Select this option to enable automatic configuration file updates for the profile from
a location external to the access point. If enabled (the setting is disabled by default),
provide a complete path to the target configuration file used in the update. To use this
option, first create a Virtual Interface in the Interfaces section and enable the Use
DHCP to Obtain Gateway/DNS Servers option for that Virtual Interface.
Enable Firmware Update
Select this option to enable automatic firmware updates (for this profile) from a
location external to the access point. To use this option, first create a Virtual Interface
in the Interfaces section and enable the Use DHCP to obtain Gateway / DNS Servers
option for that Virtual Interface. This value is disabled by default. For information on
upgrading an AP6532 from firmware version 5.1, refer to Upgrading AP6532 Firmware
from 5.1 on page 5-149.
5 - 148 WiNG 5.5.3 Access Point System Reference Guide
15. Use the parameters within the Automatic Adopted AP Firmware Upgrade field to define an automatic firmware
configuration.
Enable Controller Upgrade
of AP Firmware
Select the access point model to upgrade to a newer firmware version using its
associated Virtual Controller AP’s most recent firmware file for that model. The only
available option is AP71XX.
Number of Concurrent
Upgrades
Use the spinner control to define the maximum number (from 1 - 20) of adopted APs
that can receive a firmware upgrade at the same time. Keep in mind, during a
firmware upgrade, the access point is offline and unable to perform its normal
wireless client support function until the upgrade process is complete.
16. Select OK to save the changes made to the profile’s Management Firmware configuration. Select Reset to revert to the
last saved configuration.
17. Select the Heartbeat option from the Management menu.
Figure 5-96 Profile Management - Device Heartbeat Settings screen
18. Select the Service Watchdog option to implement heartbeat messages to ensure other associated devices are up and
running. The Service Watchdog is enabled by default.
19. Select OK to save the changes made to the profile maintenance Heartbeat tab. Select Reset to revert to the last saved
configuration.
Device Configuration 5 - 149
5.2.11.1 Upgrading AP6532 Firmware from 5.1
Profile Management Configuration
An existing AP6532 deployment running factory installed 5.1 version firmware can be upgrade to this most recent 5.4 version
baseline. To upgrade AP6532 from the 5.1 version baseline:
Ensure you have the following resources:
• A computer with a SSH client and a FTP or TFTP server
• The latest AP6532 5.4 image file in the computer’s FTP or TFTP directory
• A PoE hub
1. Calculate the AP6532's IP address.
The AP6532 has an IP of 169.254.<last two digits of its MAC address in decimal>, with subnet mask of 255.255.0.0. For
example, if the MAC address is 00-23-68-86-48-18, the last two digits of its IP address will be 72.24
(48 hexadecimal = 72 decimal, 18 hexadecimal = 24 decimal). So the IP address is 169.254.72.24, with subnet mask of
255.255.0.0.
2. Configure the computer with an IP address in the same subnet. For example, 169.254.0.1, and a subnet mask of 255.255.0.0.
3. Ping the AP6532 from the computer to ensure IP connectivity.
4. Open an SSH session on the computer and connect to the AP6532’s IP address.
5. Login with a username and password of admin/motorola. The CLI will prompt for a new password. Re-enter the password
and confirm.
6. Within the CLI, type enable.
7. Enter commit write memory to save the new password.
8. To upgrade firmware using a FTP server, use the upgrade command.
ftp://<username>:<password>@169.254.0.1/AP6532-5.4.0.0-047R.img.
Alternatively, a user can upgrade the AP6532 firmware using a TFTP server using the upgrade command.
tftp://169.254.0.1/AP6532-5.4.0.0-047R.img.
The AP6532 downloads the firmware from FTP/TFTP server. This process will take a few minutes.
9. When finished, type reload to reboot the AP6532. Press 'y' when asked to confirm the reboot.
10. The AP6532 reboots and SSH session is terminated. The reboot takes a couple of minutes.
11. Run a ping from the computer to the AP6532. A ping will be timed out during the reboot.
12. When the ping resumes, start an SSH session again to the AP6532.
13. Login to the AP6532 using the new password and confirm the firmware upgrade is successful by issuing a
show version command.
5.2.11.2 Profile Management Configuration and Deployment Considerations
Profile Management Configuration
Before defining a access point profile’s management configuration, refer to the following deployment guidelines to ensure the
profile configuration is optimally effective:
• Define profile management access configurations providing both encryption and authentication. Management services like
HTTPS, SSH and SNMPv3 should be used when possible, as they provide data privacy and authentication.
• Motorola Solutions recommends SNMPv3 be used for management profile configurations, as it provides both encryption,
and authentication.
5 - 150 WiNG 5.5.3 Access Point System Reference Guide
5.2.12 Mesh Point Configuration
System Profile Configuration
The access point can be configured to be a part of a meshed network. A mesh network is one where each node in the network
is be able to communicate with other nodes in the network and where the node can maintain more than one path to its peers.
Mesh network provides robust, reliable and redundant connectivity to all the members of the network. When one of the
participant node in a Mesh Network becomes unavailable, the other nodes in the network are still able to communicate with
each other either directly or through intermediate nodes.
Mesh Point is the name given to a device that is a part of a meshed network.
Use the Mesh Point screen to configure the parameters that set how this device behaves as a part of the mesh network.
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Select Mesh Point. The Mesh Point screen displays.
Figure 5-97 Mesh Point Configuration - Mesh Point screen
The Mesh Point screen displays a list of configured MeshConnex policies on this device.
5. Refer to the following for more information on the Mesh Point screen:
Mesh Connex Policy
Displays the name of the selected Mesh Connex™ policy.
Is Root
Displays the root status of the mesh point. If the device is a mesh root, then this field displays
“True”.
Preferred Root
Displays the MAC address of the preferred root. A Preferred Root is a root node that this mesh
point prefers to join over other root nodes in the mesh network.
Preferred Neighbor
Displays the MAC address of the preferred neighbor. A Preferred Neighbor is a node that this
mesh point prefers to have a mesh connection with over other nodes in the mesh network.
Preferred Interface
Displays the name of the preferred interface. A Preferred Interface is an interface on this mesh
point that is preferred over other interfaces on the device when forming a mesh network.
Monitor Critical
Resource
Displays if this mesh point monitors critical resources for maintaining a mesh connection.
Device Configuration 5 - 151
Monitor Primary Port
Link
Displays if this mesh point monitors link status on the primary port.
Path Method
Displays the path selection method used to select the path to the root node.
6. Select the Add button to create a new Mesh Connex policy.
Figure 5-98 Mesh Point Configuration - Add Mesh Point Mesh Connex Policy screen
7. Refer to the following for more information on the Mesh Point Mesh Connex Policy screen:
MeshConnex Policy
Provide a name for the Mesh Connex Policy. Use the Create icon to create a new Mesh
Connex Policy. To edit an existing policy, select it from the drop-down and click the Edit
icon. For more information on creating or editing a Mesh Connex policy, see MeshConnex
Policy on page 6-85
Is Root
From the drop-down menu, select the root behavior of this access point. Select True to
indicate this access point is a root node for this mesh network. Select False to indicate
this access point is not a root node for this mesh network.
5 - 152 WiNG 5.5.3 Access Point System Reference Guide
Root Selection Method
Use the drop-down menu to determine whether this mesh point is the root or non-root
mesh point. Select either None, auto-mint or auto-proximity. The default is None.
When auto-mint is selected, root selection is based on the total cost to the root. Cost to
the root is measured as total past cost through hops to the root node. Root selection will
happen for the root that has the least path cost.
When auto-proximity is selected, root selection is based on signal strength of candidate
roots.
None indicates no preference in root selection.
Set as Cost Root
Select this option to set the mesh point as the cost root for mesh point root selection.
This setting is disabled by default.
Monitor Critical
Resource
Select this option to monitor critical resources. If a configured critical resource becomes
unavailable, the mesh point is removed from the mesh network.
Monitor Primary Port Link Select this option to indicate this mesh point monitors the link on the primary port. If the
link on the primary port becomes unavailable, the mesh network is brought down.
Wired Peer Exclude
Select this option to exclude wired peers when creating mesh links.
Path Method
From the drop-down menu, select the method to use for path selection in a mesh network.
The available options are:
• None – Select this to indicate no criteria used in root path selection.
• uniform – Indicates that the path selection method is uniform. When selected, two
paths will be considered equivalent if the average value is the same for these paths.
• mobile-snr-leaf – Select this if this access point is mounted on a vehicle or a mobile
platform (AP7161 models only). When selected, the path to the route is selected based
on the Signal To Noise Ratio (SNR) to the neighbor device.
• snr-leaf – Select this to indicate the path with the best signal to noise ratio is always
selected.
• bound-pair – Select this option to bind one mesh point connection at a time. Once
established, other mesh point connection requests are denied.
Preferred Neighbor
Enter the MAC address of the mesh point device that is the preferred neighbor.
Preferred Root
Enter the MAC address of the mesh point root that is the preferred root.
Preferred Interface
From the drop-down menu, select the preferred interface for forming a mesh network.
Select from None, 2.4GHz, 4.9GHz or 5GHz. The default value is None.
Minimum Threshold
Enter the minimum value for SNR above which a candidate for the next hop in a dynamic
mesh network is considered for selection. This field along with Signal Strength Delta and
Sustained Time Period are used to dynamically select the next hop in a dynamic mesh
network.
Signal Strength Delta
Enter a delta value in dB. A candidate for selection as a next hop in a dynamic mesh
network must have a SNR value that is higher than the value configured here. This field
along with the Minimum Threshold and Sustained Time Period is used to dynamically
select the next hop in a dynamic mesh network.
Sustained Time Period
Indicates the duration (in minutes) a signal must sustain the constraints specified in the
Minimum Threshold and Signal Strength Delta path hysteresis values. These values are
used to dynamically select the next hop in a dynamic mesh network.
Device Configuration 5 - 153
SNR Delta Range
Select the root selection method hysteresis (from 1 - 100dB) SNR delta range a candidate
must sustain. The default setting is 1 dB.
NOTE: With this release of Motorola Solutions WiNG software, an AP7161 model
access point can be deployed as a Vehicle Mounted Modem (VMM) to provide wireless
network access to a mobile vehicle (car, train, etc.). A VMM provides layer 2 mobility for
connected devices. VMM does not provide layer 3 services, such as IP mobility. For
VMM deployment considerations, see Vehicle Mounted Modem (VMM) Deployment
Consideration on page 5-158.
8. Click the Auto Channel Selection tab to configure the parameters for the Mesh Connex Auto Channel Selection policy.
The following screen displays:
Figure 5-99 Mesh Connex Auto Channel Selection screen
9. By default, the Dynamic Root Selection screen displays.
5 - 154 WiNG 5.5.3 Access Point System Reference Guide
This screen provides configuration for the 2.4 GHz and 5.0/4.9 GHz frequencies. Refer to the following for more information
on the Auto Channel Selection Dynamic Root Selection screen. These descriptions are common for configuring the 2.4 GHZ
and 5.0/4.9 GHz frequencies
Channel Width
Configure the channel width that mesh point automatic channel scan should assign to the
selected radio. The available options are:
• Automatic – Indicates the channel width is calculated automatically. This is the
default value.
• 20 MHz – Indicates the width between two adjacent channels is 20 MHz.
• 40 MHz – Indicates the width between two adjacent channels is 40 MHz.
Priority Meshpoint
Configure the mesh point monitored for automatic channel scan. This is the mesh point
given priority over other available mesh points. When configured, a mesh is created with
this mesh point. When not configured, a mesh point is automatically selected.
Off-channel Duration
Configure the duration in the range of 20 - 250 milliseconds for the Off Channel Duration
field. This is the duration the scan dwells on each channel when performing an off
channel scan.
Off-channel Scan
Frequency
Configure the time duration in seconds between two consecutive Off Channel Scans. Set
a duration between 1 - 60 seconds.
Meshpoint Root - Sample
Count
Configure the number of scans to be performed for data collection before a mesh channel
is selected. Set a value between 1 - 10 scans.
Meshpoint Root - Channel
Hold Time
Configure the minimum duration to stay on a selected channel before the channel
conditions are reassessed for a possible channel change. Set a value between 0 - 1440
minutes. Set this value to ‘Zero’ (0) to prevent a automatic channel selection from
happening.
10. Click the Path Method SNR tab to configure the signal to noise ratio values when selecting the path to the mesh point
root.
Device Configuration 5 - 155
Figure 5-100 Mesh Point Auto Channel Selection Path Method SNR screen
11. Refer to the following for more information on the Path Method SNR screen. These descriptions apply to both the 2.4 GHz
and 5.0/4.9 GHz frequencies.
Channel Width
Configure the channel width that mesh point automatic channel scan should assign to the
selected radio. The available options are:
• Automatic – Indicates the channel width is calculated automatically. This is the
default value.
• 20 MHz – Indicates the width between two adjacent channels is 20 MHz.
• 40 MHz – Indicates the width between two adjacent channels is 40 MHz.
Priority Meshpoint
Configure the mesh point monitored for automatic channel scan. This is the mesh point
given priority over other available mesh points. When configured, a mesh is created with
this mesh point. When not configured, a mesh point is automatically selected.
SNR Delta
Configure the signal to noise ratio delta value for path selection.
When path selection happens, this value is considered for selecting the optimal path. A
better candidate on a different channel must have a signal strength that exceeds this
delta value when compared to the signal strength of the next hop in the mesh network.
5 - 156 WiNG 5.5.3 Access Point System Reference Guide
SNR Threshold
Configure the signal to noise threshold value for path selection.
When the signal strength of the next hop in the mesh network goes below this value, a
scan is triggered to select a better next hop.
Off-channel Duration
Configure the duration in the range of 20 - 250 milliseconds for the Off Channel Duration
field. This is the duration that the scan dwells on each channel when performing an off
channel scan.
12. Click the Path Method Root Path Metric tab to configure the parameters controlling the calculation of the root path
metrics.
Figure 5-101 Mesh Point Auto Channel Selection Path Method Root Path Metric screen
Device Configuration 5 - 157
13. Refer to the following for more information on the Path Method Root Path Metric screen. These descriptions apply to both
the 2.4 GHz and 5.0/4.9 GHz frequencies.
Channel Width
Configure the channel width that mesh point automatic channel scan should assign to the
selected radio. The available options are:
• Automatic – Indicates the channel width is calculated automatically. This is the
default value.
• 20 MHz – Indicates the width between two adjacent channels is 20 MHz.
• 40 MHz – Indicates the width between two adjacent channels is 40 MHz.
Priority Meshpoint
Configure the mesh point monitored for automatic channel scan. This is the mesh point
given priority over other available mesh points. When configured, a mesh is created with
this mesh point. When not configured, a mesh point is automatically selected.
Meshpoint Path Minimum Configure the minimum path metric value for a mesh connection to be established. Set a
value between 100 - 20,000.
Meshpoint Path Metric
Threshold
Configure a minimum threshold value for triggering an automatic channel selection for
mesh point selection. Set a value in between 800 - 65535.
Meshpoint Tolerance
Period
Configure the time duration in seconds to wait before triggering a automatic channel
selection for the next hop.
Meshpoint Root Sample
Count
Configure the number of scans performed for data collection before a mesh point root is
selected. Set a value between 1 - 10 scans.
Meshpoint Root Offchannel Scan Frequency
Configure the time duration in seconds between two consecutive Off Channel Scans for
mesh point root. Set a duration between 1 - 60 seconds.
Meshpoint Root Channel
Hold Time
Configure the minimum duration to stay on a selected channel before the channel
conditions are reassessed for a possible channel change for mesh point root. Set a value
between 0 - 1440 minutes. Set this value to ‘Zero’ (0) to prevent a automatic channel
selection from happening.
Meshpoint Root Channel
Switch Delta
Configure the delta value in dBm in the range 5 - 35 dBm which when crossed triggers a
mesh point root automatic channel selection.
14. Select OK to save the changes. Select Reset to revert to the last saved configuration. Select Exit to close this screen.
5 - 158 WiNG 5.5.3 Access Point System Reference Guide
5.2.12.1 Vehicle Mounted Modem (VMM) Deployment Consideration
Mesh Point Configuration
Before defining a VMM configuration (mounting an AP7161 mesh point on a moving vehicle), refer to the following deployment
guidelines to ensure the configuration is optimally effective:
• Disable layer 2 stateful packet inspection from the firewall policy.
• Set the RTS threshold value to 1 on all mesh devices. The default value is 2347. For more information on defining radio
settings, see Access Point Radio Configuration on page 5-41.
• Use Opportunistic as the rate selection settings for the AP7161 radio The default is Standard. For more information on
defining this settings, see Radio Override Configuration on page 5-221.
• Disable Dynamic Chain Selection (radio setting). The default value is enabled. This setting is disabled from the Command
Line Interface (CLI) using the dynamic-chain-selection command, or, in the UI (refer Radio Override Configuration
on page 5-221.
• Disable A-MPDU Aggregation if the intended vehicular speed is greater than 30 mph. For more information, see Radio
Override Configuration on page 5-221.
Device Configuration 5 - 159
5.2.13 Advanced Profile Configuration
System Profile Configuration
An access point profile’s advanced configuration is comprised of defining connected client load balance settings, a MINT
protocol configuration and miscellaneous settings (NAS ID, access point LEDs and RF Domain Manager).
To set an access point profile’s advanced configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Expand the Advanced menu item.
The following items are available as advanced access point profile configuration options:
• Advanced Profile Client Load Balancing
• Configuring MINT Protocol
• Advanced Profile Miscellaneous Configuration
5 - 160 WiNG 5.5.3 Access Point System Reference Guide
5.2.13.1 Advanced Profile Client Load Balancing
Advanced Profile Configuration
Use the screen to administer the client load across an access point’s radios. AP7131 models can have from 1-3 radios depending
on the SKU. AP6522, AP6522M, AP6532, AP6562, AP71XX, AP75XX, AP81XX and AP82XX models have 2 radios, while AP6511
and AP6521 models have a single radio.
1. Select Client Load Balancing from the expanded Advanced menu.
Figure 5-102 Advanced Profile Configuration - Client Load Balancing screen
2. Use the drop-down menu to define a SBC strategy. Options include Prefer 5GHz, Prefer 2.4 GHz, and distribute-by-ratio.
The default value is Prefer 5GHz.
3. Set the following Neighbor Selection Strategies:
Use probes from common
clients
Select this option to use probes from shared clients in the neighbor selection process.
This feature is enabled by default, to provide the best common group of available
clients amongst access points in neighbor selection.
Device Configuration 5 - 161
Use notifications from
roamed clients
Select this option to use roamed client notifications in the neighbor selection process.
This feature is enabled by default, allowing access points in the neighbor selection
process to consider device roaming counts as selection criteria.
Use smart-rf neighbor
detection
Select this option to use SMART RF access point transmission adjustments as criteria
in the neighbor selection process. This feature is enabled by default.
4. Select the Balance Band Loads by Ratio radio button to balance the radio load, by assigning a ratio to both the 2.4 and
5GHz bands. Balancing radio load by band ratio allows an administrator to assign a greater weight to radio traffic on either
the 2.4 or 5.0 GHz band. This setting is enabled by default.
5. Set the following Channel Load Balancing settings:
Balance 2.4GHz Channel
Loads
Select this option to balance loads across channels in the 2.4 GHz radio band. This can
prevent congestion on the 2.4 GHz radio if a channel is over utilized. This setting is
enabled by default. Selecting this feature enables parameters within the Channel
Load Balancing field for assigning weightage and throughput values.
Balance 5GHz Channel
Loads
Select this option to balance loads across channels in the 5.0 GHz radio band. This can
prevent congestion on the 5.0 GHz radio if a channel is over utilized. This setting is
enabled by default. Selecting this feature enables parameters within the Channel
Load Balancing field for assigning weightage and throughput values.
6. Select the Balance AP Loads radio button to distribute this access point’s radio load amongst other access point radios.
This setting is disabled by default, keeping the load on this access point radio.
7. Set the following Band Control values within the Advanced Parameters field.
Max. Band Load Difference
Considered Equal
Use the spinner control to set a value (from 0 - 100%) considered an adequate
discrepancy (or deviation) when comparing 2.4 and 5GHz radio band load balances.
The default setting is 1%. Thus, using a default setting of 10% means 10% is
considered inconsequential when comparing 2.4 and 5.0 GHz load balances on this
access point. This setting is not available if the Steering Strategy has been set to
Disable.
Band Ratio (2.4GHz)
Use the spinner control to set a loading ratio (from 0 - 10) the access point 2.4 GHz
radio uses in respect to radio traffic load on the 2.4 GHz band. This allows an
administrator to weight the traffic load if wishing to prioritize client traffic on the 2.4
GHz radio band. The higher the value set, the greater the weight assigned to radio
traffic load on the 2.4 GHz radio band. The default setting is 1. This setting is enabled
only when Steer by ratio is selected as the steering strategy.
Band Ratio (5GHz)
Use the spinner control to set a loading ratio (from 0 - 10) the access point
5.0 GHz radio uses in respect to radio traffic on the 5.0 GHz band. This allows an
administrator to weight client traffic if wishing to prioritize client traffic on the 5.0 GHz
radio band. The higher the value set, the greater the weight assigned to radio traffic
load on the 5.0 GHz radio band. The default setting is 1. This setting is enabled only
when Steer by ratio is selected as the steering strategy.
5 GHz load at which both
bands enabled
When the Steering Strategy is set to Steer at 5.0 GHz, use the spinner control to set
a value (from 0 - 100%) at which the load on the 2.4 GHz radio is equally preferred to
this 5.0 GHz radio load. The default is 10%.
5 - 162 WiNG 5.5.3 Access Point System Reference Guide
2.4 GHz load at which both
bands enabled
When the Steering Strategy is set to Steer at 2.4 GHz, use the spinner control to set
a value (from 0 - 100%) at which the load on the 5.0 GHz radio is equally preferred to
this 2.4 GHz radio load. The default is 10%.
8. Set the following Neighbor Selection values within the Advanced Parameters field:
Minimum signal strength for
common clients
When Using probes from common clients is selected as a neighbor selection strategy,
use the spinner control to set a value from 0 -100% as signal strength criteria for a
client to be regarded as a common client in the neighbor selection process.
Minimum number of clients
seen
When Using probes from common clients is selected as a neighbor selection strategy,
use the spinner control to set the number of clients (from 0 -256) that must be shared
by at least 2 access points to be regarded as neighbors in the neighbor selection
process. The default value is 1.
Max confirmed neighbors
Use the spinner control to set the maximum number of access point neighbors (from
0 - 16) of the same model available for load balance distributions. The default setting
is 10.
Minimum signal strength for
smart-rf neighbors
When Using smart-rf neighbor detection is selected as a neighbor selection strategy,
use the spinner control to set a minimum signal strength value (from 0 - 100%) for a
SMART RF detected access point to be qualified as a neighbor.
9. Set the following Channel Load Balancing values within the Advanced Parameters field:
Max. 2.4GHz Load Difference
Considered Equal
Use the spinner control to set a value (from 0 - 100%) considered an adequate
discrepancy (or deviation) when comparing access point 2.4GHz radio load balances.
The default setting is 1%. Thus, using a default setting of 10% means 10% is
considered inconsequential when comparing access point radio load balances
exclusively on the 2.4GHz radio band.
Min. Value to Trigger 2.4GHz
Channel Balancing
Use the spinner control to define a threshold (from 1 - 100%) the access point uses
(when exceeded) to initiate channel load balancing in the 2.4GHz radio band. Set this
value higher when wishing to keep radio traffic within their current channel
designations. The default is 5%.
Weightage given to Client
Count
Use the spinner control to assign a weight (from 0 - 100%) the access point uses to
prioritize 2.4GHz radio client count in the 2.4GHz radio load calculation. Assign this
value higher this 2.4GHz radio is intended to support numerous clients and their
throughput is secondary to maintaining association. The default setting is 90%.
Weightage given to
Throughput
Use the spinner control to assign a weight (from 0 - 100%) the access point uses to
prioritize 2.4 radio throughput in the access point load calculation. Assign this value
higher if throughput and radio performance are considered mission critical and more
important than a high client connection count. The default setting is 10%.
Max. 5GHz Load Difference
Considered Equal
Use the spinner control to set a value (from 0 - 100) considered an adequate
discrepancy (or deviation) when comparing access point 5GHz radio load balances.
The default setting is 1%. Thus, using a default setting of 10% means 10% is
considered inconsequential when comparing access point radio load balances
exclusively on the 5GHz radio band.
Device Configuration 5 - 163
Min. Value to Trigger 5GHz
Channel Balancing
Use the spinner control to define a threshold (from 1 - 100) the access point uses
(when exceeded) to initiate channel load balancing in the 5GHz radio band. Set this
value higher when wishing to keep radio traffic within their current channel
designations. The default is 5%.
Weightage given to Client
Count
Use the spinner control to assign a weight (from 0 - 100%) the access point uses to
prioritize 5GHz radio client count in the 5GHz radio load calculation. Assign this value
higher this 5GHz radio is intended to support numerous clients and their throughput is
secondary to maintaining client association. The default setting is 90%.
Weightage given to
Throughput
Use the spinner control to assign a weight (from 0 - 100%) the access point radio uses
to prioritize 5GHz radio throughput in the load calculation. Assign this value higher if
throughput and radio performance are considered mission critical and more important
than a high client connection count. The default setting is 10%.
10. Set the following AP Load Balancing values within the Advanced Parameters field:
Min Value to Trigger Load
Balancing
Use the spinner control to set the access point radio threshold value (from 0 - 100%)
used to initiate load balancing across other radios. When the radio load exceeds the
defined threshold, load balancing is initiated. The default is 5%.
Max. AP Load Difference
Considered Equal
Use the spinner control to set a value (from 0 - 100%) considered an adequate
discrepancy (or deviation) when comparing access point radio load balances. The
default setting is 1%. Thus, using a default setting of 10% means 10% is considered
inconsequential when comparing access point radio load balances.
Weightage given to Client
Count
Use the spinner control to assign a weight (from 0 - 100%) the access point uses to
prioritize client count in the radio load calculation (on both the 2.4 and 5.0 GHz radio
bands). Assign this value higher if this radio is intended to support numerous clients
and their throughput is secondary to maintaining client association. The default
setting is 90%.
Weightage given to
Throughput
Use the spinner control to assign a weight (from 0 - 100%) the access point radio uses
to prioritize radio throughput in the load calculation (on both the 2.4 and 5.0 GHz radio
bands). Assign this value higher if throughput and radio performance are considered
mission critical and of more importance than a high client connection count. The
default setting is 10%.
11. Select OK to save the changes made to the Client Load Balancing configuration. Select Reset to revert to the last saved
configuration.
5 - 164 WiNG 5.5.3 Access Point System Reference Guide
5.2.13.2 Configuring MINT Protocol
Advanced Profile Configuration
MINT provides the means to secure access point profile communications at the transport layer. Using MINT, an access point
can be configured to only communicate with other authorized (MINT enabled) access points of the same model.
Virtual Controller AP managed access points can communicate with each other exclusively over a MINT security domain. Keys
can also be generated externally using any application (like openssl). These keys must be present on the access point managing
the domain for key signing to be integrated with the UI. A MAP device that needs to communicate with another first negotiates
a security context with that device. The security context contains the transient keys used for encryption and authentication. A
secure network requires users know about certificates and PKI. However, administrators do not need to define security
parameters for access points to be adopted (secure WISPe being an exception, but that isn’t a commonly used feature). Also,
users can replace any device on the network or move devices around and they continue to work. Default security parameters
for MINT are such that these scenarios continue to function as expected, with minimal user intervention required only when a
new network is deployed.
To define an access point profile’s MINT configuration:
1. Select MINT Protocol from the expanded Advanced menu. The Settings tab displays by default.
Figure 5-103 Advanced Profile Configuration - MINT Protocol screen - Settings tab
2. Refer to the Area Identifier field to define the Level 1 Area IDs used by the profile’s MINT configuration.
Level 1 Area ID
Select this option to enable a spinner control for setting the Level 1 Area ID from 1 4,294,967,295. The default value is disabled.
Device Configuration 5 - 165
3. Define the following Device Heartbeat Settings in respect to devices supported by the profile:
Designated IS Priority
Adjustment
Use the spinner control to set a Designated IS Priority Adjustment setting from -255
and 255. This is the value added to the base level DIS priority to influence the
Designated IS (DIS) election. A value of +1 or greater increases DISiness. The default
setting is 0.
4. Select the Latency of Routing Recalculation option (within the Shortest Path First (SPF) field) to enable the spinner
control used for defining a latency period from 0 - 60 seconds. The default setting has the option disabled.
5. Define the following MINT Link Settings in respect to devices supported by the profile:
MLCP IP
Select this option to enable MINT Link Creation Protocol (MLCP) by IP Address. MLCP
by IP is used to create one UDP/IP link from the device to a neighbor. The neighboring
device does not need to be a Virtual Controller, it can be an standalone access point.
MLCP VLAN
Select this option to enable MLCP by VLAN. MLCP by VLAN is used to create one
VLAN link from the device to a neighbor. The neighboring device does not need to be
a Virtual Controller, it can be an standalone access point.
Tunnel MiNT across
extended VLAN
Select this option to enable tunneling MiNT protocol packets across extended VLANs.
6. Select the Tunnel Controller Load Balancing (Level1) option to enable load balancing on the tunnel controller.
7. Define the group name for clustered tunnel controllers in the Preferred Tunnel Controller Name field.
8. Select OK to save the changes made to the Settings tab. Select Reset to revert to the last saved configuration.
9. Select the IP tab to display the link IP network address information shared by the devices managed by the access point’s
MINT configuration. The IP tab displays the IP address, routing level, link cost, hello packet interval and adjacency hold
time settings used by managed devices to securely communicate amongst one another within the IPSec network.
Figure 5-104 Advanced Profile Configuration - MINT Protocol screen - IP tab
10. Select Add to create a new Link IP configuration or Edit to modify an existing MINT configuration.
5 - 166 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-105 Advanced Profile Configuration- MINT Protocol screen - Add IP MiNT Link field
11. Set the following Link IP parameters to complete the MINT network address configuration:
IP
Define the IP address used by peer access points for interoperation when supporting
the MINT protocol.
Port
Select this option to specify a custom port for MiNT links. Use the spinner control to
define the port number (from 1 - 65,535).
Routing Level
Use the spinner control to define a routing level of either 1 or 2.
Listening Link
Specify a listening link of either 0 or 1. UDP/IP links can be created by configuring a
matching pair of links, one on each end point. However, that is error prone and does
not scale. So UDP/IP links can also listen (in the TCP sense), and dynamically create
connected UDP/IP links when contacted.
Forced Link
Select this option to specify the MiNT link as a forced link.
Link Cost
Use the spinner control to define a link cost from 1 - 10,000. The default value is 100.
Hello Packet Interval
Set an interval in either Seconds (1 - 120) or Minutes (1 - 2) for the transmission of
hello packets. The default interval is 15 seconds.
Adjacency Hold Time
Set a hold time interval in either Seconds (2 - 600) or Minutes (1 - 10) for the
transmission of hello packets. The default interval is 46 seconds.
IPSec Secure
Select this option to use a secure link for IPSec traffic. This setting is disabled by
default. When enabled, both the header and the traffic payload are encrypted.
Device Configuration 5 - 167
IPSec GW
Define either an IP address or hostname for the IPSec gateway.
12. Select the VLAN tab to display the link IP VLAN information shared by the devices managed by the MINT configuration.
The VLAN tab displays the VLAN, Routing Level, Link Cost, Hello Packet Interval and Adjacency Hold Time managed devices
use to securely communicate amongst one another.
Figure 5-106 Advanced Profile Configuration - MINT Protocol screen - VLAN tab
13. Select Add to create a new VLAN link configuration or Edit to modify an existing configuration.
NOTE: If creating a mesh link between two access points in Standalone AP mode, you
will need to ensure a VLAN is available to provide the necessary MINT link between the
two Standalone APs.
5 - 168 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-107 Advanced Profile Configuration - MINT Protocol screen - Add/edit VLAN field
14. Set the following parameters to add or modify MINT VLAN configuration:
VLAN
If adding a new VLAN, define a VLAN ID from 1 - 4,094 used by peers for
interoperation when supporting the MINT protocol.
Routing Level
If adding a new VLAN, use the spinner control to define a routing level of either 1 or 2.
Link Cost
Use the spinner control to define a link cost from 1 - 10,000. The default value is 100.
Hello Packet Interval
Set an interval in either Seconds (1 - 120) or Minutes (1 - 2) for the transmission of
hello packets. The default interval is 4 seconds.
Adjacency Hold Time
Set a hold time interval in either Seconds (2 - 600) or Minutes (1 - 10) for the
transmission of hello packets. The default interval is 13 seconds.
15. Select OK to save the updates to the MINT Protocol configuration. Select Reset to revert to the last saved configuration.
Device Configuration 5 - 169
5.2.13.3 Advanced Profile Miscellaneous Configuration
Advanced Profile Configuration
Refer to the advanced profile’s Miscellaneous menu item to set the profile’s NAS configuration. The profile database on the
RADIUS server consists of user profiles for each connected network access server (NAS) port. Each profile is matched to a
username representing a physical port. When the wireless controller authorizes users, it queries the user profile database using
a username representative of the physical NAS port making the connection.
1. Select Miscellaneous from the expanded Advanced menu.
Figure 5-108 Advanced Profile Configuration - Miscellaneous screen
2. Set a NAS-Identifier Attribute up to 253 characters.
This is the RADIUS NAS-Identifier attribute that typically identifies the access point where a RADIUS message originates.
3. Set a NAS-Port-Id Attribute up to 253 characters.
This is the RADIUS NAS port ID attribute which identifies the port where a RADIUS message originates.
4. Select the Turn on LEDs radio button to ensure this access point’s LED remain continuously illuminated. Deployments such
as hospitals prefer to keep their wireless devices from having illuminating LEDs, as they have been reported to disturb their
patients. this setting, however, is enabled by default.
Select the Flash Pattern radio button to enable the access point to blink in a manner that is different from its operational
LED behavior. Enabling this option allows an administrator to validate that the access point has received its configuration
from its managing controller during staging. In the staging process, the administrator adopts the access point to a staging
controller to get an initial configuration before the access point is deployed at its intended location. Once the access point
has received its initial configuration, its LED blinks in a unique pattern to indicate that the initial configuration is complete.
5. Set the appropriate Meshpoint Behavior value by selecting either external (Fixed) or vehicle-mounted from the
drop-down menu. The value vehicle-mounted indicates that the mesh point is mobile. This feature is only available on an
AP7161 model access point.
5 - 170 WiNG 5.5.3 Access Point System Reference Guide
6. Set the appropriate Root Path Monitor Interval value. This setting configures the frequency at which the path to the root
mesh point is monitored.
7. Set the Additional Port value for RADIUS Dynamic Authorization field. Set this value to 1700 to enable a CISCO
Identity Services Engine (ISE) Authentication, Authorization and Accounting (AAA) server, when deployed in the network,
to dynamically authenticate a client.
When a client requests access to the network, the CISCO ISE RADIUS server presents the client with a URL where the
device’s compliance to the networks security such as validity of anti-virus or anti-spyware software is checked for the
validity of their definition files (this checking is called posture). If the client device complies, then it is allowed access to
the network.
8. Set the Aging Time value for Client Bridge. Use the spinner control to set a value in days, hours, minutes and seconds.
9. Select OK to save the changes made to the profile’s Advanced Miscellaneous configuration. Select Reset to revert to the
last saved configuration.
5.2.14 Environmental Sensor Configuration
System Profile Configuration
NOTE: This feature is available on the AP8132 model only.
An AP8132 sensor module is a USB environmental sensor extension to an AP8132 model access point. It provides a variety of
sensing mechanisms, allowing the monitoring and reporting of the access point's radio coverage area. The output of the
sensor's detection mechanisms are viewable using the Environmental Sensor screen.
To set an environmental sensor configuration for an AP8132 model access point:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select System Profile from the options on left-hand side of the UI.
4. Select Environmental Sensor. The Environmental Sensor screen displays.
Device Configuration 5 - 171
Figure 5-109 Profile - Environmental Sensor screen
5. Set the following Light Sensor settings for the access point’s sensor module:.
Enable Light Sensor
Select this option to enable the light sensor on the module. This setting is enabled by
default. The light sensor reports whether the access point has its light sensor powered on
or off.
Polling Time to
Determine if Light is On/
Off
Define an interval in Seconds (2 - 201) or Minutes (1 - 4) for the sensor module to poll its
environment to assess light intensity to determine whether lighting is on or off. The
default polling interval is 10 seconds. Light intensity is used to determine whether the
access point’s deployment location is currently populated with clients.
Shutdown WLAN Radio
at Low Limit of Light
Threshold
Select this option to power off the access point’s radios if the light intensity falls below
the set threshold. If enabled, select All (both radios), radio-1 or radio-2.
Low Limit of Light
Threshold
Set the low threshold limit (from 0 - 1,000 lux) to determine whether the lighting is off in
the access point’s deployment location. The default is 100.
High Limit of Light
Threshold
Set the upper threshold limit (from 100 - 10,000 lux) to determine whether the lighting is
on in the access point’s deployment location. The default is 500.
6. Enable or disable the following Environmental Sensors:
Enable Temperature
Sensor
Select this option to enable the module’s temperature sensor. Results are reported back
to the access point’s Environment screens within the Statistics node. This setting is
enabled by default.
5 - 172 WiNG 5.5.3 Access Point System Reference Guide
Enable Motion Sensor
Select this option to enable the module’s motion sensor. Results are reported back to the
access point’s Environment screens within the Statistics node. This setting is enabled by
default.
Enable Humidity Sensor
Select this option to enable the module’s humidity sensor. Results are reported back to the
access point’s Environment screens within the Statistics node. This setting is enabled by
default.
7. Define or override the following Shared Configuration setting:
Polling Interval for All
Sensors
Set an interval in either Seconds (1 - 100) or Minutes (1 - 2) for the time between all
environmental polling (both light and environment). The default setting is 5 seconds.
8. Select OK to save the changes made to the environmental sensor screen. Select Reset to revert to the last saved
configuration.
Device Configuration 5 - 173
5.3 Managing Virtual Controllers
Device Configuration
Access points set to function as Standalone APs can be re-defined as Virtual Controllers as required, and Virtual Controllers
can reverted back to Standalone APs. Consider setting the access point to a Virtual Controller when more than one access
points (of the same model) are deployed are require management from a centralized access point. Up to 24 Dependent mode
access points can be connected to, and managed by, a single Virtual Controller AP of the same model.
NOTE: If designating the access point as a Standalone AP, Motorola Solutions
recommends the access point’s UI be used exclusively to define its device configuration,
and not the CLI. The CLI provides the ability to define more than one profile, while the UI
only provides one per access point model. Consequently, the two interfaces cannot be
used collectively to manage profiles without an administrator encountering problems.
NOTE: The Motorola Solutions recommended way to administer a network populated by
numerous access points is to configure them directly from the designated Virtual
Controller AP. If an access point’s configuration requires an exception from the Virtual
Controller AP’s assigned profile configuration the administrator should apply a Device
Override to change just that access point’s configuration. For more information on
applying an override to an access point’s Virtual Controller AP assigned configuration
profile, see Device Overrides on page 5-195.
To define a Standalone AP as a Virtual Controller AP:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select Virtual Controller AP.
Figure 5-110 Virtual Controller AP screen
5 - 174 WiNG 5.5.3 Access Point System Reference Guide
4. The Virtual Controller AP screen lists all peer access points within this Virtual Controller’s radio coverage area. Each
listed access point is listed by its assigned System Name, MAC Address and Virtual Controller designation. Only Standalone
APs of the same model can have their Virtual Controller AP designation changed.
5. Either select an access point from those displayed and select Edit, or use the device browser in the lower left-hand side of
the UI to select an access point.
Figure 5-111 Managing Virtual Controller - AP Designation screen
6. Select the Set as Virtual Controller AP radio button to change the selected access point’s designation from Standalone
to Virtual Controller AP. Remember, a Virtual Controller can manage (up to) 24 access points of the same model. Thus, an
administrator should take care to change the designation of a Virtual Controller AP to Standalone AP to compensate for a
new Virtual Controller AP designation.
7. Select the Adopt Unknown APs Automatically option to allow a Virtual Controller to adopt APs it does not recognize.
While this option may help in the administration and management of all the APs in the network, it introduces the risk of
allowing device association to a potential rogue device. Consequently, this setting is disabled by default.
8. Select OK to save the changes. Select Reset to revert to the last saved configuration. Select Delete to remove obsolete
rows as needed.
Device Configuration 5 - 175
5.4 Overriding a Device Configuration
Device Configuration
Devices within the access point managed network can have an override configuration defined and applied. New devices can
also have an override configuration defined and applied once
NOTE: The best way to administer a network populated by numerous access points is to
configure them directly from the designated Virtual Controller AP. If an access point’s
configuration requires an exception from the Virtual Controller AP’s assigned profile
configuration the administrator should apply a Device Override to change just that
access point’s configuration. For more information on applying an override to an access
point’s Virtual Controller AP assigned configuration profile, see Device Overrides on
page 5-195.
Refer to the following configuration overrides, applicable to devices within a access point managed network:
• Basic Configuration
• Certificate Management
• RF Domain Overrides
• Wired 802.1X Overrides
• Device Overrides
5.4.1 Basic Configuration
Overriding a Device Configuration
Applying a basic configuration override to a device entails changing (overriding) the device’s system name, deployment area,
building floor and system clock.
When a device is initially deployed, it requires several basic configuration parameters be set and its deployment location
defined. Additionally, the number of permitted licenses needs to be accessed to determine whether new devices can be
adopted (if in Virtual Controller AP mode).
To override a managed device’s basic configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select Device Overrides.
4. Select a target device MAC address from either the device browser in the lower, left-hand side of the UI or within the Device
Overrides screen.
The Basic Configuration screen displays by default.
5 - 176 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-112 Device Overrides - Basic Configuration screen
5. Set the following Configuration settings for the target device:
System Name
Provide the selected device a system name up to 64 characters in length. This is the
device name that appears within the RF Domain or Profile the access point supports and
is identified by.
Latitude Coordinate
Optionally provide the latitude coordinate where the device is located. The valid value for
this field is in the range -90.0000 degrees to +90.0000 degrees. When provided, this
enables the device to be mapped on the geolocation map.
Longitude Coordinate
Optionally provide the longitude coordinate where the device is located. The valid value
for this field is in the range -180.0000 degrees to +180.0000 degrees. When provided, this
enables the device to be mapped on the geolocation map.
Area
Assign the access point an Area representative of the location the access point is
physically deployed. The name cannot exceed 64 characters. Assigning an area is helpful
when grouping access points in profiles, as access points in the same physical
deployment location may need to share specific configuration parameters in respect to
radio transmission and interference requirements specific to that location.
Floor
Assign the target access point a building Floor name representative of the location the
access point was physically deployed. The name cannot exceed 64 characters. Assigning
a building floor name is helpful when grouping devices in profiles, as devices on the same
physical building floor may need to share specific configuration parameters in respect to
radio transmission and interference requirements specific to that location.
6. Refer to the Device Overrides field to assess whether overrides have been applied to the device’s configuration. Use the
Clear Overrides button to clear all device overrides and reset the configuration to its default values.
7. Refer to the Set Clock field to update the system time.
Device Configuration 5 - 177
Refer to the Device Time parameter to assess the device’s current time. If the device’s time has not been set, the device
time is displayed as unavailable. Select Refresh to update the device’s system time.
Use the New Time parameter to set the calendar day, hour and minute. Use the AM and PM radio buttons to refine whether
the updated time is for the AM or PM. This time can be synchronized with the use of an external NTP resource.
When completed, select Update Clock to commit the updated time to the device.
8. Select OK to save the changes to the basic configuration. Selecting Reset reverts the screen to its last saved configuration.
5.4.2 Certificate Management
Overriding a Device Configuration
A certificate links identity information with a public key enclosed in the certificate.
A certificate authority (CA) is a network authority that issues and manages security credentials and public keys for message
encryption. The CA signs all digital certificates it issues with its own private key. The corresponding public key is contained
within the certificate and is called a CA certificate. A browser must contain this CA certificate in its Trusted Root Library so it
can trust certificates signed by the CA's private key.
Depending on the public key infrastructure, the digital certificate includes the owner's public key, the certificate expiration
date, the owner's name and other public key owner information.
Each certificate is digitally signed by a trustpoint. The trustpoint signing the certificate can be a certificate authority,
corporation or individual. A trustpoint represents a CA/identity pair containing the identity of the CA, CA-specific configuration
parameters, and an association with an enrolled identity certificate.
SSH keys are a pair of cryptographic keys used to authenticate users instead of, or in addition to, a username/password. One
key is private and the other is public key. Secure Shell (SSH) public key authentication can be used by a client to access
resources, if properly configured. A RSA key pair must be generated on the client. The public portion of the key pair resides
with the licensed device, while the private portion remains on the client.
The certificate configuration used by an access point managed device can be changed (overridden) as changes in security
credentials require modification in the management of the device.
To override a managed device’s certificate configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select Device Overrides.
4. Select a target device’s MAC address from the device browser in the lower, left-hand side of the UI.
5. Select Certificates from the Device menu.
5 - 178 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-113 Device Overrides - Certificates screen
6. Set the following Management Security certificate configurations:
HTTPS Trustpoint
Either use the default-trustpoint or select the Stored radio button to enable a drop-down
menu where an existing certificate/trustpoint can be leveraged. To leverage an existing
device certificate for use with this target device, select the Launch Manager button. For
more information, see Manage Certificates on page 5-179.
SSH RSA Key
Either use the default_rsa_key or select the Stored radio button to enable a drop-down
menu where an existing certificate can be leveraged. To leverage an existing key, select
the Launch Manager button. For more information, see RSA Key Management on page 5183.
7. Set the RADIUS Security certificate configuration. Select the Stored radio button to enable a drop-down menu where an
existing certificate/trustpoint can be leveraged. To leverage an existing device certificate for use with this target device,
select the Launch Manager button.
NOTE: Pending trustpoints and RSA keys are typically not verified as existing on a
device.
8. Select OK to save the changes made to the certificate configurations. Selecting Reset reverts the screen to its last saved
configuration.
Device Configuration 5 - 179
For more information on the certification activities, refer to the following:
• Manage Certificates
• RSA Key Management
• Certificate Creation
• Generating a Certificate Signing Request
5.4.2.1 Manage Certificates
Certificate Management
If not wanting to use an existing certificate or key with a selected device, an existing stored certificate can be leveraged from
a different device. Device certificates can be imported and exported to a secure remote location for archive and retrieval as
required for application to other devices.
To configure trustpoints for use with certificates:
1. Select Launch Manager from either the HTTPS Trustpoint, SSH RSA Key, or RADIUS Server Certificate parameters.
Figure 5-114 Certificate Management - Trustpoints screen
The Certificate Management screen displays with the Trustpoints section displayed by default.
5 - 180 WiNG 5.5.3 Access Point System Reference Guide
2. Select a device from amongst those displayed to review its certificate information.
Refer to Certificate Details to review the certificate’s properties, self-signed credentials, validity period and CA
information.
3. To optionally import a certificate, select the Import button from the Certificate Management screen. The Import New
Trustpoint screen displays.
Figure 5-115 Certificate Management - Import New Trustpoint screen
Device Configuration 5 - 181
4. Define the following configuration parameters required for the Import of the trustpoint:
Import
Select the type of Trustpoint to import. The following Trustpoints can be imported:
• Import – Select to import any trustpoint.
• Import CA – Select to import a Certificate Authority (CA) certificate on to the access
point.
• Import CRL – Select to import a Certificate Revocation List (CRL), CRLs are used to
identify and remove those installed certificates that have been revoked or are no longer
valid.
• Import Signed Cert – Select to import a self signed certificate.
Trustpoint Name
Enter the 32 character maximum name assigned to the target trustpoint. The trustpoint
signing the certificate can be a certificate authority, corporation or individual.
A certificate authority (CA) is a network authority that issues and manages security credentials and public keys for message
encryption. The CA signs all digital certificates it issues with its own private key. The corresponding public key is contained
within the certificate and is called a CA certificate.
If a certificate displays within the Certificate Management screen with a CRL, that CRL can be imported. A certificate
revocation list (CRL) is a list of revoked certificates, or certificates no longer valid. A certificate can be revoked if the CA
improperly issued a certificate, or if a private key is compromised. The most common reason for revocation is the user no
longer being in sole possession of the private key.
Signed certificates (or root certificates) avoid the use of public or private CAs. A self-signed certificate is an identity
certificate signed by its own creator, thus the certificate creator also signs off on its legitimacy. The lack of mistakes or
corruption in the issuance of self signed certificates is central.
5. Define the following configuration to import the Trustpoint from a location on the network. To do so, select From Network
and provide the following information.
URL
Provide the complete URL to the location of the trustpoint. This option is available by
default. Click the Advanced link next to this field to display more fields to provide detailed
trustpoint location information.
Protocol
If using Advanced settings, select the protocol used for importing the target trustpoint.
Available options include:
• tftp
• ftp
• sftp
• http
• cf
• usb1
• usb2
• usb3
• usb4
Port
If using Advanced settings, use the spinner control to set the port. This option is not valid
for cf, usb1, usb2, usb3 and usb4.
IP Address
If using Advanced settings, enter IP address of the server used to import the trustpoint.
This option is not valid for cf, usb1, usb2, usb3 and usb4.
5 - 182 WiNG 5.5.3 Access Point System Reference Guide
Host
If using Advanced settings, provide the hostname of the server used to import the
trustpoint. This option is not valid for cf, usb1, usb2, usb3 and usb4.
Username/Password
These fields are enabled if using ftp or sftp protocols. Specify the username and the
password for that username to access the remote servers using these protocols.
Path/File
If using Advanced settings, specify the path to the trustpoint. Enter the complete path to
the file on the server.
6. Select the Cut and Paste option to paste the trustpoint information in text. When this option is selected, the text box next
to it is enabled. Paste the trustpoint details into the text box.
7. Select OK to import the defined trustpoint. Select Cancel to revert the screen to its last saved configuration.
8. To optionally export a trustpoint to a remote location, select the Export button from the Certificate Management screen.
Once a certificate has been generated on the authentication server, export the self-signed certificate.
A digital CA certificate is different from a self-signed certificate. The CA certificate contains the public and private key
pairs. The self certificate only contains a public key. Export the self certificate for publication on a Web server or file server
for certificate deployment or export it in to an Active Directory Group Policy for automatic root-certificate deployment.
Additionally export the key to a redundant RADIUS server so it can be imported without generating a second key. If there’s
more than one RADIUS authentication server, export the certificate and do not generate a second key unless you want to
deploy two root certificates.
Figure 5-116 Certificate Management - Export Trustpoint screen
Device Configuration 5 - 183
9. Define the following configuration parameters to export a trustpoint:
Trustpoint Name
Enter the 32 character maximum name assigned to the target trustpoint. The trustpoint
signing the certificate can be a certificate authority, corporation or individual.
URL
Provide the complete URL to the location of the trustpoint. If needed, select Advanced to
expand the dialog to display network address information to the location of the target
trustpoint. The number of additional fields that populate the screen is dependent on the
selected protocol.
Protocol
Select the protocol used for exporting the target trustpoint. Available options include:
• tftp
• ftp
• sftp
• http
• cf
• usb1
• usb2
• usb3
• usb4
Port
If using Advanced settings, use the spinner control to set the port. This option is not valid
for cf, usb1, usb2, usb3 and usb4.
IP Address
If using Advanced settings, enter IP address of the server used to export the trustpoint.
This option is not valid for cf, usb1, usb2, usb3 and usb4.
Host
If using Advanced settings, provide the hostname of the server used to export the
trustpoint. This option is not valid for cf, usb1, usb2, usb3 and usb4.
Username/Password
These fields are enabled if using ftp or sftp protocols,. Specify the username and the
password for that username to access the remote servers using these protocols.
Path/File
If using Advanced settings, specify the path to the trustpoint. Enter the complete relative
path to the file on the server.
10. Select OK to export the defined trustpoint. Select Cancel to revert the screen to its last saved configuration.
To optionally delete a trustpoint, select the Delete button from within the Certificate Management screen. Provide the
trustpoint name within the Delete Trustpoint screen and optionally select the Delete RSA Key option to remove the RSA
key along with the trustpoint. Select OK to proceed with the deletion, or Cancel to revert to the Certificate Management
screen.
5.4.2.1.1 RSA Key Management
Certificate Management
Refer to the RSA Keys screen to review existing RSA key configurations applied to managed devices. If an existing key does
not meet the needs of a pending certificate request, generate a new key or import or export an existing key to and from a remote
location.
Rivest, Shamir, and Adleman (RSA) is an algorithm for public key cryptography. It’s an algorithm that can be used for certificate
signing and encryption. When a device trustpoint is created, the RSA key is the private key used with the trustpoint.
To review existing device RSA key configurations, generate additional keys or import/export keys to and from remote locations:
5 - 184 WiNG 5.5.3 Access Point System Reference Guide
1. Select the Launch Manager button from either the SSH RSA Key or RADIUS Server Certificate parameters (within the
Certificate Management screen).
2. Select RSA Keys from the upper, left-hand side of the Certificate Management screen.
Figure 5-117 Certificate Management - RSA Keys screen
3. Select a listed device to review its current RSA key configuration.
Each key can have its size and character syntax displayed. Once reviewed, optionally generate a new RSA key, import a key
from a selected device, export a key to a remote location or delete a key from a selected device.
4. Select the Generate Key button to create a new key.
Device Configuration 5 - 185
Figure 5-118 Certificate Management - Generate RSA Key screen
5. Define the following configuration parameters required to generate a key:
Key Name
Enter the 32 character maximum name assigned to the RSA key.
Key Size
Use the spinner control to set the size of the key (from 1,024 - 2,048 bits). Motorola
Solutions recommends leaving this value at the default setting of 1024 to ensure optimum
functionality.
6. Select OK to generate the RSA key. Select Cancel to revert the screen to its last saved configuration.
7. To optionally import a CA certificate, select the Import button from the RSA Keys screen.
Figure 5-119 Certificate Management - Import New RSA Key screen
8. Define the following configuration parameters required to import a RSA key:
Key Name
Enter the 32 character maximum name assigned to the RSA key
5 - 186 WiNG 5.5.3 Access Point System Reference Guide
Key Passphrase
Define the key used by both the access point and the server (or repository) of the target
RSA key. Select the Show option to expose the actual characters used in the passphrase.
Leaving the Show option unselected displays the passphrase as a series of asterisks “*”.
URL
Provide the complete URL to the location of the RSA key.
Protocol
If selecting Advanced, select the protocol used for importing the target key. Available
options include:
• tftp
• ftp
• sftp
• http
• cf
• usb1
• usb2
• usb3
• usb4
Port
If selecting Advanced, use the spinner control to set the port. This option is not valid for
cf, usb1, usb2, usb3 and usb4.
IP Address
If selecting Advanced, enter IP address of the server used to import the RSA key. This
option is not valid for cf, usb1, usb2, usb3 and usb4.
Host
If selecting Advanced, provide the hostname of the server used to import the RSA key.
This option is not valid for cf, usb1, usb2, usb3 and usb4.
Username/Password
These fields are enabled if using ftp or sftp protocols,. Specify the username and the
password for that username to access the remote servers using these protocols.
Path/File
If selecting Advanced, specify the path to the RSA key. Enter the complete relative path
to the key on the server.
9. Select OK to import the defined RSA key. Select Cancel to revert the screen to its last saved configuration.
10. To optionally export a RSA key to a remote location, select the Export button from the RSA Keys screen.
11. Export the key to a RADIUS server so it can be imported without generating a second key. If there are more than one RADIUS
authentication server, export the certificate and do not generate a second key unless you want to deploy two root
certificates.
Device Configuration 5 - 187
Figure 5-120 Certificate Management - Export RSA Key screen
12. Define the following configuration parameters required to export a RSA key:
Key Name
Enter the 32 character maximum name assigned to the RSA key.
Key Passphrase
Define the key passphrase used by both the access point and the server. Select the Show
option to expose the actual characters used in the passphrase. Leaving the Show option
unselected displays the passphrase as a series of asterisks “*”.
URL
Provide the complete URL to the location of the key.
Protocol
If selecting Advanced, select the protocol used for exporting the RSA key. Available
options include:
• tftp
• ftp
• sftp
• http
• cf
• usb1
• usb2
• usb3
• usb4
Port
If selecting Advanced, use the spinner control to set the port. This option is not valid for
cf, usb1, usb2, usb3 and usb4.
5 - 188 WiNG 5.5.3 Access Point System Reference Guide
IP Address
If selecting Advanced, enter the IP address of the server used to export the RSA key. This
option is not valid for cf, usb1, usb2, usb3 and usb4.
Host
If selecting Advanced, provide the hostname of the server used to export the RSA key. This
option is not valid for cf, usb1, usb2, usb3 and usb4.
Username/Password
These fields are enabled if using ftp or sftp protocols,. Specify the username and the
password for that username to access the remote servers using these protocols.
Path/File
If selecting Advanced, specify the path to the key. Enter the complete relative path to the
key on the server.
13. Select OK to export the defined RSA key. Select Cancel to revert the screen to its last saved configuration.
14. To optionally delete a key, select the Delete button from within the RSA Keys screen. Provide the key name within the
Delete RSA Key screen and select the Delete Certificates option to remove the certificate and the supported key. Select
OK to proceed with the deletion, or Cancel to revert back to the Certificate Management screen.
5.4.2.1.2 Certificate Creation
Certificate Management
The Certificate Management screen provides the facility for creating new self-signed certificates. Self-signed certificates
(often referred to as root certificates) do not use public or private CAs. A self-signed certificate is a certificate signed by its
own creator, with the certificate creator responsible for its legitimacy.
To create a self-signed certificate:
1. Select the Launch Manager button from either the SSH RSA Key or RADIUS Server Certificate parameters (within the
Certificate Management screen).
2. Select Create Certificate from the upper, left-hand, side of the Certificate Management screen.
Device Configuration 5 - 189
Figure 5-121 Certificate Management - Create Certificate screen
3. Set the following Create New Self-Signed Certificate configuration parameters:
Certificate Name
Enter the 32 character maximum name assigned to identify the name of the trustpoint
associated with the certificate. A trustpoint represents a CA/identity pair containing the
identity of the CA, CA-specific configuration parameters, and an association with an
enrolled identity certificate.
Use Existing
Select this option to use an existing RSA key. Use the drop-down menu to select the
existing key used by both the device and the server (or repository) of the target RSA key.
Create New
Select this option to create a new RSA key. Provide a 32 character name to identify the
RSA key. Use the spinner control to set the size of the key (from 1,024 - 2,048 bits).
Motorola Solutions recommends leaving this value at the default setting (1024) to ensure
optimum functionality. For more information on creating a new RSA key, see RSA Key
Management on page 5-183.
4. Set the following Certificate Subject Name parameters required for the creation of the certificate:
Certificate Subject Name Select either the auto-generate radio button to automatically create the certificate's
subject credentials or select user-configured to manually enter the credentials of the self
signed certificate. The default setting is auto-generate.
Country (C)
Define the Country of deployment for the certificate. The field can be modified by the user.
This is a required field and must not exceed 2 characters.
5 - 190 WiNG 5.5.3 Access Point System Reference Guide
State (ST)
Enter a State for the state or province name used in the certificate. This is a required field.
City (L)
Enter a City to represent the city name used in the certificate. This is a required field.
Organization (O)
Define an Organization for the organization used in the certificate. This is a required field.
Organizational Unit (OU)
Enter an Organizational Unit for the name of the organization unit used in the certificate.
This is a required field.
Common Name (CN)
If there’s a common name (IP address) for the organizational unit issuing the certificate,
enter it here.
5. Set the following Additional Credentials required for the generation of the self-signed certificate:
Email Address
Provide an E-mail address used as the contact address for issues relating to this
certificate request.
Domain Name
Enter a fully qualified domain name (FQDN) as an unambiguous domain name that
specifies the node's position in the DNS tree hierarchy. To distinguish an FQDN from a
regular domain name, a trailing period is added. For example, somehost.example.com. An
FQDN differs from a regular domain name by its absoluteness, since s a suffix is not
added.
IP Address
Specify the IP address used as the destination for certificate requests.
6. Select the Generate Certificate button at the bottom of the screen to generate the certificate.
5.4.2.1.3 Generating a Certificate Signing Request
Certificate Management
A certificate signing request (CSR) is an application from a requestor to a certificate authority to issue a digitally signed identity
certificate. The CSR is composed of a block of encrypted text generated on the server the certificate will be used on. It contains
information included in the certificate, including organization name, common name (domain name), locality and country.
A RSA key must be either created or applied to the certificate request before the certificate can be generated. A private key is
not included in the CSR, but is used to digitally sign the completed request. The certificate created with a particular CSR only
worked with the private key generated with it. If the private key is lost, the certificate is no longer functional. The CSR can be
accompanied by other identity credentials required by the certificate authority, and the certificate authority maintains the right
to contact the applicant for additional information.
If the request is successful, the CA sends an identity certificate digitally signed with the private key of the CA.
To create a CSR:
1. Select the Launch Manager button from either the SSH RSA Key or RADIUS Server Certificate parameters (within the
Certificate Management screen).
2. Select Create CSR from the upper, left-hand, side of the Certificate Management screen.
Device Configuration 5 - 191
Figure 5-122 Certificate Management - Create CSR screen
3. Set the following Create New Certificate Signing Request (CSR) configuration parameters:
Create New
Select this option to create a new RSA Key. Provide a 32 character name to identify the
RSA key. Use the spinner control to set the size of the key (from 1,024 - 2,048 bits).
Motorola Solutions recommends leaving this value at the default setting (1024) to ensure
optimum functionality. For more information on creating a new RSA key, see RSA Key
Management on page 5-183.
Use Existing
Select this option to use an existing RSA key. Use the drop-down menu to select the
existing key used by both the device and the server (or repository) of the target RSA key.
4. Set the following Certificate Subject Name parameters required for the creation of the certificate:
Certificate Subject Name Select either the auto-generate radio button to automatically create the certificate's
subject credentials or select user-defined to manually enter the credentials of the self
signed certificate. The default setting is auto-generate.
Country (C)
Define the Country used in the CSR. The field can be modified by the user. This is a
required field and must not exceed 2 characters.
State (ST)
Enter a State for the state or province name used in the CSR. This is a required field.
City (L)
Enter a City to represent the city name used in the CSR. This is a required field.
Organization (O)
Define an Organization for the organization used in the CSR. This is a required field.
5 - 192 WiNG 5.5.3 Access Point System Reference Guide
Organizational Unit (OU)
Enter an Organizational Unit for the name of the organization unit used in the CSR. This
is a required field.
Common Name (CN)
If there’s a Common Name (IP address) for the organizational unit issuing the certificate,
enter it here.
5. Select the following Additional Credentials required for the generation of the CSR:
Email Address
Provide an E-mail address used as the contact address for issues relating to this CSR.
Domain Name)
Enter a FQDN as an unambiguous domain name that specifies the node's position in the
DNS tree hierarchy. To distinguish an FQDN from a regular domain name, a trailing period
is added. For example, somehost.example.com. An FQDN differs from a regular domain
name by its absoluteness, since a suffix is not added.
IP Address
Specify the IP address used as the destination for certificate requests.
6. Select the Generate CSR button at the bottom of the Create CSR screen to generate the CSR.
5.4.3 RF Domain Overrides
Overriding a Device Configuration
Use RF Domain Overrides to define settings overriding a target device’s original RF Domain configuration.
An RF Domain allows an administrator to assign configuration data to multiple access points (of the same model) deployed in
a common coverage area (floor, building or site). In such instances, there’s many configuration attributes these devices share
as their general client support roles are quite similar. However, device configurations may need periodic refinement from their
original RF Domain administered design. Unlike a RFS series controller, an access point supports a single RF domain. An access
point RF Domain cannot be used on a different model access point. For example, an AP6532 RF Domain override can only be
applied to another AP6532 model access point.
To define a device’s RF Domain override configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices from the Configuration tab.
3. Select Device Overrides.
4. Select a target device from the device browser in the lower, left-hand, side of the UI.
5. Select RF Domain Overrides.
Device Configuration 5 - 193
Figure 5-123 Device Overrides -RF Domain Overrides screen
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove a device’s override, go to the Basic Configuration screen’s
Device Overrides field, and then select the Clear Overrides button.
6. Refer to the Basic Configuration field to review the basic settings defined for the target device’s RF Domain
configuration, and optionally assign/remove overrides to and from specific parameters.
Location
Set the deployment location for the access point as part of its RF Domain configuration.
Contact
Set the administrative contact for the access point. This should reflect the administrator
responsible for the access point’s configuration and wireless network.
Time Zone
Use the drop-down menu to select the geographic time zone supporting its deployment
location.
Country Code
Use the drop-down menu to select the country code supporting its deployment location.
7. Refer to the Statistics field to set the following:
Window Index
Use the spinner control to set a numerical index used as an identifier for each RF Domain
statistics configuration defined.
Sample Interval
Use the spinner control to define the interval (in seconds) used to capture statistics
supporting the listed RF Domain configuration. The default is 5 seconds.
Window Size
Use the spinner control to set the number of samples used to define RF Domain statistics.
The default value is 3 samples.
8. Click + Add Row button to add up to two (2) rows to the Statistics field.
5 - 194 WiNG 5.5.3 Access Point System Reference Guide
9. Select OK to save the changes and overrides made to the RF Domain configuration. Selecting Reset reverts the screen to
its last saved configuration.
5.4.4 Wired 802.1X Overrides
Overriding a Device Configuration
802.1X provides administrators secure, identity based access control as another data protection option to utilize with a device
profile.
802.1X is an IEEE standard for media-level (Layer 2) access control, offering the capability to permit or deny network
connectivity based on the identity of the user or device.
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select Device Overrides from the options on left-hand side of the UI.
4. Select a target device from the device browser in the lower, left-hand, side of the UI.
5. Select Wired 802.1x.
Figure 5-124 Profile Wired 802.1X screen
6. Set the following Wired 802.1x Settings:
Dot1x Authentication
Control
Select this option to globally enable 802.1x authentication for the access point. This setting
is disabled by default.
Dot1x AAA Policy
Use the drop-down menu to select an AAA policy to associate with the wired 802.1x
traffic. If a suitable AAA policy does not exist, click the Create icon to create a new policy
or the Edit icon to modify an existing policy.
Dot1x Guest VLAN
Control
Select this option to globally enable 802.1x guest VLANs for the selected device. This
setting is disabled by default.
MAC Authentication
AAA Policy
Use the drop-down menu to select an AAA authentication policy for MAC address
authentication. If a suitable MAC AAA policy does not exist, click the Create icon to create
a new policy or the Edit icon to modify an existing policy.
7. Select OK to save the changes to the 802.1x override configuration. Select Reset to revert to the last saved configuration.
Device Configuration 5 - 195
5.4.5 Device Overrides
Overriding a Device Configuration
A profile enables an administrator to assign a common set of configuration parameters and policies to another access point of
the same model. Profiles can be used to assign shared or unique network, wireless and security parameters to access points
across a large, multi segment, site. The configuration parameters within a profile are based on the hardware model the profile
was created to support. The central benefit of a profile is its ability to update devices collectively without having to modify
individual device configurations.
However, device profile configurations may need periodic refinement from their original administered design. Consequently, a
device profile could require modification from a profile configuration shared amongst numerous devices deployed within a
particular site.
Use device overrides to define configurations overriding the parameters set by the target device’s original profile configuration.
To define a general profile override configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices from the Configuration tab.
3. Select Device Overrides.
4. Select a target device from the device browser in the lower, left-hand, side of the UI.
5. Select Device Overrides from the Device menu to expand it into sub menu options.
6. Select General if it does not display by default.
Figure 5-125 Device Overrides - General screen
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
5 - 196 WiNG 5.5.3 Access Point System Reference Guide
7. Select + Add Row below the Network Time Protocol (NTP) table to define (or override) the configurations of NTP server
resources used it obtain system time. Set the following parameters to define the NTP configuration:
AutoKey
Select this option to enable an autokey configuration for the NTP resource. This is a key
randomly generated for use between the access point and its NTP resource. The default
setting is disabled.
Key
If an autokey is not being utilized, you must manually enter a 64 character maximum key
shared for interoperation.
Prefer
Select this option to designate this particular NTP resource as preferred. If designating
multiple NTP resources, preferred resources will be given first opportunity to connect to
and provide NTP calibration.
Server IP
Set the IP address of each server added as a potential NTP resource.
Version
Use the spinner control to specify the version number used by this NTP server resource.
The default setting is 0.
8. Refer to the RF Domain Manager field to configure this device as a RF Domain manager.
9. Select the Capable option to enable or disable this device as a RF Domain manager.
10. Select the Priority option to enable configuring a priority value for this device when election to become a Domain Manager
is conducted. Set a value using the spinner control. Setting a low value increases the chance of this device becoming the
RF Domain manager.
11. Select OK to save the changes and overrides made to the general profile configuration. Select Reset to revert to the last
saved configuration.
Refer to the following to complete the override of the access point’s entire profile configuration:
• Radio Power Overrides
• Adoption Overrides
• Profile Interface Override Configuration
• Overriding the Network Configuration
• WAN Backhaul Overrides
• Overriding a Security Configuration
• Overriding a Services Configuration
• Overriding a Management Configuration
• Overriding an Advanced Configuration
• Overriding Mesh Point Configuration
• Overriding Environmental Sensor Configuration
Device Configuration 5 - 197
5.4.5.1 Radio Power Overrides
Device Overrides
Use the Power screen to set or override one of two power modes (3af or Auto) for an access point. When Automatic is selected,
the access point safely operates within available power. Once the power configuration is determined, the access point
configures its operating power characteristics based on its model and power configuration.
An access point uses a complex programmable logic device (CPLD). The CPLD determines proper supply sequencing, the
maximum power available and other status information. One of the primary functions of the CPLD is to determine the maximum
power budget. When an access point is powered on (or performing a cold reset), the CPLD determines the maximum power
provided by the POE device and the budget available to the access point. The CPLD also determines the access point hardware
SKU (model) and the number of radios. If the access point’s POE resource cannot provide sufficient power to run the access
point (with all intended interfaces enabled), some of the following interfaces could be disabled or modified:
• The access point’s transmit and receive algorithms could be negatively impacted
• The access point’s transmit power could be reduced due to insufficient power
• The access point’s WAN port configuration could be changed (either enabled or disabled)
To define an access point’s power configuration or apply an override to an existing parameter:
1. Select the Configuration tab from the Web UI.
2. Select Devices from the Configuration tab.
3. Select Device Overrides.
4. Select a target device from the device browser in the lower, left-hand, side of the UI.
5. Select Device Overrides from the Device menu to expand it into sub-menu options.
6. Select Power.
A screen displays where an access point’s power configuration can be defined or overridden.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
5 - 198 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-126 Device Overrides - Power screen
7. Use the Power Mode drop-down menu to set or override the Power Mode Configuration on this AP.
NOTE: Single radio model access point’s always operate using a full power
configuration. The power management configurations described in this section do not
apply to single radio models.
When an access point is powered on for the first time, the system determines the power budget available. Using the
Automatic setting, the access point automatically determines the best power configuration based on the available power
budget. Automatic is the default setting.
If 802.3af is selected, the access point assumes 12.95 watts are available. If the mode is changed, the access point requires
a reset to implement the change. If 802.3at is selected, the access point assumes 23 - 26 watts are available.
8. Set or override the access point radio’s 802.3af Power Mode and the radio’s 802.3at Power Mode.
Use the drop-down menu to define a mode of either Range or Throughput.
Select Throughput to transmit packets at the radio’s highest defined basic rate (based on the radio’s current basic rate
settings). This option is optimal in environments where the transmission range is secondary to broadcast/multicast
transmission performance. Select Range when range is preferred over performance for broadcast/multicast (group) traffic.
The data rates used for range are the lowest defined basic rates. Throughput is the default setting for both 802.3af and
802.3at.
9. Select OK to save the changes and overrides made to the access point power configuration. Select Reset to revert to the
last saved configuration
Device Configuration 5 - 199
5.4.5.2 Adoption Overrides
Device Overrides
Use the Adoption screen to define the configuration of a preferred Virtual Controller, wireless controller, or service platform
resource used for access point adoption. A Virtual Controller can adopt up to 24 access points of the same model. The Virtual
Controller must also share its VLAN to peer access points wishing to adopt to it. The Virtual Controllers IP address (or
hostname), pool and routing level must also be defined and made available to connecting peers.
Adoption is the process an access point uses to discover Virtual Controllers available in the network, pick the most desirable
Virtual Controller, establish an association, obtain its configuration and consider itself provisioned.
At adoption, an access point solicits and receives adoption responses from Virtual Controllers available on the network.
To define an access point’s Virtual Controller configuration or apply an override to an existing parameter:
1. Select the Configuration tab from the Web UI.
2. Select Devices from the Configuration tab.
3. Select Device Overrides.
4. Select a target device from the device browser in the lower, left-hand, side of the UI.
5. Select Device Overrides from the Device menu to expand it into sub menu options.
6. Select Adoption.
A screen displays where an access point’s Virtual Controller group, VLAN and network address information can be defined
or overridden for the preferred Virtual Controller resource.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
5 - 200 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-127 Device Overrides - Adoption screen
7. Define a 64 character maximum Preferred Group.
The preferred group is the controller group the access point would prefer to connect upon adoption.
8. Define the Hello Interval value for this device. This is the interval between hello keep alive messages exchanged with the
wireless controller that has adopted this access point. These messages serve as a connection validation mechanism to keep
the access point adopted to its wireless controller. Set a value from 1-120 seconds.
9. Define the Adjacency Hold Time value for this device. This is the amount of time before the preferred controller group is
considered down and unavailable to provide services. Set a value from 2-600 seconds.
10. Use the spinner control to set the Controller VLAN.
This is the VLAN the Virtual Controller is reachable on. Select from 1 - 4094. There is no default value for this setting.
11. Use the + Add Row button to populate the Controller Hostnames table with the following host, pool and routing
parameters for defining the preferred adoption resource.
Host
Use the drop-down menu to specify whether the controller adoption resource is defined
as a (non DNS) IP address or a hostname. Once defined, provide the numerical IP or
hostname. A hostname cannot exceed 64 characters.
Pool
Use the spinner controller to set a pool of either 1 or 2. This is the pool the target Virtual
Controller belongs to. The default setting is 1.
Routing Level
Use the spinner controller to set the routing level for the Virtual Controller link. The
default setting is 1.
Device Configuration 5 - 201
IPSec Support
Select to enable secure communication between the access point and the wireless
controllers.
IPSec GW
Use the drop-down menu to specify if the IPSec Gateway resource is defined as a (non
DNS) IP address or a hostname. Once defined, provide the numerical IP or hostname. A
hostname cannot exceed 64 characters.
Force
Select to enable the link to the adopting controller or the controller group to be created
even when not required.
12. Select OK to save the changes and overrides made to the access point adoption configuration. Select Reset to revert to
the last saved configuration
5 - 202 WiNG 5.5.3 Access Point System Reference Guide
5.4.5.3 Profile Interface Override Configuration
Device Overrides
An access point requires its Virtual Interface be configured for layer 3 (IP) access or layer 3 service on a VLAN. A virtual interface
defines which IP address is associated with each connected VLAN ID.
An interface configuration can have overrides applied to customize the configuration to a unique deployment objective. For
more information, refer to the following:
• Ethernet Port Override Configuration
• Virtual Interface Override Configuration
• Port Channel Override Configuration
• Radio Override Configuration
• WAN Backhaul Overrides
• PPPoE Configuration
5.4.5.3.1 Ethernet Port Override Configuration
Profile Interface Override Configuration
Use an Ethernet Port override to change (modify) parameters of an access point’s Ethernet Port configuration.
The following ports are available on supported access point models:
• AP6511 - fe1, fe2, fe3, fe4, up1
• AP6521 - GE1/POE (LAN)
• AP6522/AP6522M - GE1/POE (LAN)
• AP6532 - GE1/POE (LAN)
• AP6562 - GE1/POE (LAN)
• AP7131 - GE1/POE (LAN), GE2 (WAN)
• AP7161 - GE1/POE (LAN), GE2 (WAN)
• AP7181 - GE1/POE (LAN), GE2 (WAN)
• AP8122/AP8132 - GE1/POE (LAN), GE2 (WAN)
• AP8222/AP8232 - GE1/POE (LAN), GE2 (WAN)
To define an Ethernet port configuration override:
1. Select the Configuration tab from the Web UI.
2. Select Devices from the Configuration tab.
3. Select Device Overrides.
4. Select a target device from the device browser in the lower, left-hand, side of the UI.
5. Select Interface to expand its sub menu options.
6. Select Ethernet Ports.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
Device Configuration 5 - 203
Figure 5-128 Device Overrides - Interface Ethernet Port screen
7. Refer to the following to review port status and assess whether an override is warranted:
Name
Displays the physical port name reporting runtime data and statistics. Supported ports
vary depending on the supported models.
Type
Displays the physical port type. Copper is used on RJ45 Ethernet ports and Optical
materials are used on fiber optic gigabit Ethernet ports.
Description
Displays an administrator defined description for each listed access point port.
Admin Status
A green check mark defines the port as active and currently enabled with the profile. A
red “X” defines the port as currently disabled and not available for use. The interface
status can be modified with the port configuration as required.
Mode
Displays the profile’s current switching mode as either Access or Trunk (as defined within
the Ethernet Port Basic Configuration screen). If Access is selected, the listed port accepts
packets only from the native VLAN. Frames are forwarded out the port untagged with no
802.1Q header. All frames received on the port are expected as untagged and mapped to
the native VLAN. If set to Trunk, the port allows packets from a list of VLANs added to the
trunk. A port configured as Trunk supports multiple 802.1Q tagged VLANs and one Native
VLAN which can be tagged or untagged.
Native VLAN
Lists the numerical VLAN ID (1 - 4094) set for the native VLAN. The native VLAN allows
an Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is
included in the frame. Additionally, the native VLAN is the VLAN untagged traffic is
directed over when using a port in trunk mode.
Tag Native VLAN
A green check mark defines the native VLAN as tagged. A red “X” defines the native VLAN
as untagged. When a frame is tagged, the 12 bit frame VLAN ID is added to the 802.1Q
header so upstream Ethernet devices know which VLAN ID the frame belongs to. The
device reads the 12 bit VLAN ID and forwards the frame to the appropriate VLAN. When
a frame is received with no 802.1Q header, the upstream device classifies the frame using
the default or native VLAN assigned to the Trunk port. A native VLAN allows an Ethernet
device to associate untagged frames to a VLAN when no 802.1Q frame is included in the
frame.
Allowed VLANs
Displays the VLANs allowed to send packets over the listed port. Allowed VLANs are only
listed when the mode has been set to Trunk.
5 - 204 WiNG 5.5.3 Access Point System Reference Guide
Overrides
Click Clear to clear overrides made to this interface. This field is blank if there are no
overrides for this configuration.
8. To edit (or override) the configuration of an existing port, select it from amongst those displayed and select the Edit button.
The Ethernet Port Basic Configuration screen displays by default.
Figure 5-129 Ethernet Ports - Basic Configuration screen
9. Set (or override) the following Ethernet port Properties and CDP/LLDP settings:
Description
Provide a brief description for the access point’s port (64 characters maximum).
Admin Status
Select the Enabled radio button to define this port as active to the profile it supports.
Select the Disabled radio button to disable this physical port in the profile. It can be
activated at any future time when needed.
Speed
Set the speed at which the port can receive and transmit the data. Select either 10 Mbps,
100 Mbps, 1000 Mbps. Select either of these options to establish a 10, 100 or 1000 Mbps
data transfer rate for the selected half duplex or full duplex transmission over the port.
These options are not available if Auto is selected. Select Automatic to enable the port
to automatically exchange information about data transmission speed and duplex
capabilities. Auto negotiation is helpful when in an environment where different devices
are connected and disconnected on a regular basis. Automatic is the default setting.
Device Configuration 5 - 205
Duplex
Select either half, full or automatic as the duplex option. Select Half duplex to send data
over the port, then immediately receive data from the same direction in which the data
was transmitted. Like a full-duplex transmission, a half-duplex transmission can carry
data in both directions, just not at the same time. Select Full duplex to transmit data to
and from the port at the same time. Using full duplex, the port can send data while
receiving data as well. Select Automatic to enable to the access point to dynamically
duplex as port performance needs dictate. Automatic is the default setting.
Cisco Discover Protocol
Receive
Select this option to allow the Cisco discovery protocol for receiving data on this port. If
enabled, the port sends out periodic interface updates to a multicast address to advertise
its presence to neighbors.
Cisco Discover Protocol
Transmit
Select this option to allow the Cisco discovery protocol for transmitting data on this port.
If enabled, the port sends out periodic interface updates to a multicast address to
advertise its presence to neighbors.
Link Layer Discovery
Protocol Receive
Select this option to allow the Link Layer discovery protocol to be received on this port. If
enabled, the port sends out periodic interface updates to a multicast address to advertise
its presence to neighbors. This option is enabled by default.
Link Layer Discovery
Protocol Transmit
Select this option to allow the Link Layer discovery protocol to be transmitted on this port.
If enabled, the port sends out periodic interface updates to a multicast address to
advertise its presence to neighbors.
10. Set (or override) the following Switching Mode parameters to apply to the Ethernet port configuration:
Mode
Select either the Access or Trunk radio button to set the VLAN switching mode over the
port. If Access is selected, the port accepts packets only form the native VLANs. Frames
are forwarded out the port untagged with no 802.1Q header. All frames received on the
port are expected as untagged and are mapped to the native VLAN. If the mode is set to
Trunk, the port allows packets from a list of VLANs you add to the trunk. A port configured
as Trunk supports multiple 802.1Q tagged VLANs and one Native VLAN which can be
tagged or untagged. Access is the default mode.
Native VLAN
Use the spinner control to define a numerical Native VLAN ID from 1 - 4094. The native
VLAN allows an Ethernet device to associate untagged frames to a VLAN when no 802.1Q
frame is included in the frame. Additionally, the native VLAN is the VLAN which untagged
traffic will be directed over when using a port in trunk mode. The default VLAN is 1.
Tag Native VLAN
Select this option to tag the native VLAN. The IEEE 802.1Q specification is supported for
tagging frames and coordinating VLANs between devices. IEEE 802.1Q adds four bytes to
each frame identifying the VLAN ID for upstream devices that the frame belongs. If the
upstream Ethernet device does not support IEEE 802.1Q tagging, it does not interpret the
tagged frames. When VLAN tagging is required between devices, both devices must
support tagging and be configured to accept tagged VLANs. When a frame is tagged, the
12 bit frame VLAN ID is added to the 802.1Q header so upstream Ethernet devices know
which VLAN ID the frame belongs to. The device reads the 12 bit VLAN ID and forwards
the frame to the appropriate VLAN. When a frame is received with no 802.1Q header, the
upstream device classifies the frame using the default or native VLAN assigned to the
Trunk port. The native VLAN allows an Ethernet device to associate untagged frames to a
VLAN when no 802.1Q frame is included in the frame. This feature is disabled by default.
5 - 206 WiNG 5.5.3 Access Point System Reference Guide
Allowed VLANs
Selecting Trunk as the mode enables the Allowed VLANs parameter. Add VLANs that
exclusively send packets over the listed port.
11. Optionally select the Port Channel Membership option and define (or override) a setting from 1 - 8 using the spinner
control. This sets the channel group for the port.
12. Select OK to save the changes made to the Ethernet Port Basic Configuration. Select Reset to revert to the last saved
configuration.
13. Select the Security tab.
Figure 5-130 Ethernet Ports - Security screen
14. Refer to the Access Control field. As part of the port’s security configuration, Inbound IP and MAC address firewall rules
are required. The configuration can be optionally overridden if needed.
15. Use the IP Inbound Firewall Rules and MAC Inbound Firewall Rules drop-down menus to select the firewall rules to
apply to this profile’s Ethernet port configuration.
The firewall inspects IP and MAC traffic flows and detects attacks typically not visible to traditional wired firewall
appliances.
16. If a firewall rule does not exist suiting the data protection needs of the target port configuration, select the Create icon to
define a new rule configuration. For more information, see Wireless Firewall on page 8-2.
17. Refer to the Trust field to define the following:
Trust ARP Responses
Select this option to enable ARP trust on this port. ARP packets received on this port
are considered trusted and information from these packets is used to identify rogue
devices within the network. The default value is disabled.
Device Configuration 5 - 207
Trust DHCP Responses
Select this option to enable DHCP trust on this port. If enabled, only DHCP responses
are trusted and forwarded on this port, and a DHCP server can be connected only to a
DHCP trusted port. The default value is enabled.
ARP header Mismatch
Validation
Select this option to enable a mismatch check for the source MAC in both the ARP and
Ethernet header. The default value is enabled.
Trust 802.1p COS values
Select this option to enable 802.1p COS values on this port. The default value is
enabled.
Trust IP DSCP
Select this option to enable IP DSCP values on this port. The default value is enabled.
NOTE: Some vendor solutions with VRRP enabled send ARP packets with Ethernet
SMAC as a physical MAC and inner ARP SMAC as VRRP MAC. If this configuration is
enabled, a packet is allowed, despite a conflict existing.
18. Refer to the 802.1X Settings field to define the following:
Host Mode
Select the port mode for 802.1X authentication. Select single-host to bridge traffic from a
single authenticated host. Select multi-host to bridge traffic from any host to this port.
Guest VLAN
Set the Guest VLAN on which traffic is bridged from a wired port when the selected port is
considered unauthorized.
Port Control
Set how the port bridges traffic. Select one of the following options:
• Automatic – The port is set to the state as received from the authentication server.
• force-authorized – Any traffic on the port is considered authenticated and is bridged as
configured.
• force-unauthorized – Any traffic on the port is considered unauthenticated and is not
bridged.
Re Authenticate
Select to enable or disable reauthentication. Reauthentication is primarily used to refresh
the current state of the selected port. When enabled the device is forced to reauthenticate.
When this happens, the port is still considered authenticated. If reauthentication fails, the
port is considered unauthorized and devices using the port are denied access.
Max Reauthenticate
Count
Set the number of reauthentication attempts when a port tries to reauthenticate and fails.
Once this count exceeds, the port is considered unauthorized.
Maximum Request
Set the number of times an attempt is made to authenticate with an EAP server before
returning an ‘Authentication Failed’ message to the device seeking to authenticate using
the controlled port.
Quiet Period
Set the duration in seconds where no attempt is made to reauthenticate a controlled port.
Set a value from 0 - 65535 seconds.
Reauthenticate Period
Set the duration after which a controlled port is forced to reauthenticate. Set a value from
0 - 65535 seconds.
19. Select the Enable option within the 802.1x supplicant (client) feature field to enable a username and password pair
used when authenticating users on this port. Select Show to expose the characters comprising the password in the
Password field.
5 - 208 WiNG 5.5.3 Access Point System Reference Guide
20. Select the Spanning Tree tab.
Figure 5-131 Ethernet Ports – Spanning Tree Configuration
Spanning Tree Protocol (STP) (IEEE 802.1D standard) configures a meshed network for robustness by eliminating loops
within the network and calculating and storing alternate paths to provide fault tolerance.
STP calculation happens when a port comes up. As the port comes up and STP calculation happen, the port is set to Blocked
state. In this state, no traffic can pass through the port. Since STP calculations take up to a minute to complete, the port is
not operational thereby effecting the network behind the port. Once the STP calculation is complete, the port’s state is
changed to Forwarding and traffic is allowed.
Rapid Spanning Tree Protocol (RSTP) (IEEE 802.1w standard) is a evolution over the standard STP where the primary aim
was to reduce the time taken to respond to topology changes while being backward compatible with STP. PortFast enables
quickly changing the state of a port from Blocked to Forwarding to enable the port to allow traffic while the STP calculation
happens.
Multiple Spanning Tree Protocol (MSTP) provides an extension to RSTP to optimize the usefulness of VLANs. MSTOP allows
for a separate spanning tree for each VLAN group, and blocks all but one of the possible alternate paths within each
spanning tree topology.
If there is just one VLAN in the access point managed network, a single spanning tree works fine. However, if the network
contains more than one VLAN, the network topology defined by single STP would work, but it is possible to make better
use of the alternate paths available by using an alternate spanning tree for different VLANs or groups of VLANs.
A MSTP supported deployment uses multiple MST regions with multiple MST instances (MSTI). Multiple regions and other
STP bridges are interconnected using one single common spanning tree (CST).
MSTP includes all of its spanning tree information in a single Bridge Protocol Data Unit (BPDU) format. BPDUs are used to
exchange information bridge IDs and root path costs. Not only does this reduce the number of BPDUs required to
communicate spanning tree information for each VLAN, but it also ensures backward compatibility with RSTP. MSTP
encodes additional region information after the standard RSTP BPDU as well as a number of MSTI messages. Each MSTI
Device Configuration 5 - 209
messages conveys spanning tree information for each instance. Each instance can be assigned a number of configured
VLANs. The frames assigned to these VLANs operate in this spanning tree instance whenever they are inside the MST
region. To avoid conveying their entire VLAN to spanning tree mapping in each BPDU, the access point encodes an MD5
digest of their VLAN to an instance table in the MSTP BPDU. This digest is used by other MSTP supported devices to
determine if the neighboring device is in the same MST region as itself.
21. Select the Enable as Edge Port option to enable or disable the port as an edge port. An edge port is a port that is known
to connect to a LAN which has no other bridges connected or is directly connected to a user device.
22. Select either the Point-to-Point or Shared radio button for the Link Type field. When Point-to-Point is selected, it
indicates that the port should be treated as connected to a point-to-point link. Selecting Shared indicates that the port is
shared between multiple devices. An example for Shared connection would be when the port is connected to a hub.
Similarly, an example for a Point-to-Point connection would be when the port is connected to an access point.
23. Select either the Enable or Disable radio button for the CISCO MSTP Interoperability field. This enables or disables
inter operability with CISCO’s implementation of the Multiple Spanning Tree Protocol (MSTP) which is incompatible with
the standard MSTP implementation.
24. Select one of the available choices for Force Protocol Version field. Select STP to use the standard Spanning Tree
Protocol. Select RSTP to use Rapid Spanning Tree Protocol. Select MSTP to use Multiple Spanning Tree Protocol.
Select Not Supported to disable spanning tree protocol for this interface.
25. Select either the None or Root radio button for the Guard field. Root guard is a mechanism to prevent election of roots
other than those designated as roots in a network. When this port receives a better (superior) BPDU, the port state becomes
Blocked. It retains this state till the port no longer receives the better (superior) BPDU and then the state is changed to
Forwarding. Select Root to enable this feature. Select None to disable.
26. Select the Enable Port Fast option to enable or disable PortFast. PortFast enables reducing the time taken for a port to
complete the MSTP state changes from Blocked to Forward. PortFast must only be enabled on ports on the wireless
controller which are directly connected to a Server/Workstation and not to another hub or controller. PortFast can be left
unconfigured on an access point.
27. Set the Enable PortFast BPDU Filter value from the drop-down list. MSTP BPDUs are messages that are exchanged when
controllers gather information about the network topology. When enabled, PortFast enabled ports do not transmit BPDU
messages. When set to 'Default' sets the PortFast BPDU Filter value to the bridge's BPDU filter value.
28. Set the Enable PortFast BPDU Guard value from the drop-down list. MSTP BPDUs are messages that are exchanged
when controllers gather information about the network topology. When enabled, PortFast enabled ports are forced to shut
down when they receive BPDU messages. When set to 'Default' sets the PortFast BPDU Guard value to the bridge's BPDU
guard value.
29. Configure the Spanning Tree Port Cost value. Select the + Add Row button to add a row to the table. Configure an
Instance Index value and its corresponding cost in the Cost column. This is the cost for a packet to traverse the current
network segment. The cost of a path is the sum of all costs of traversal from the source to the destination. The default rule
for the cost of a network segment is, the faster the media, the lower the cost.
30. Configure the Spanning Tree Port Priority value. Select the + Add Row to add a row to the table. Configure an Instance
Index value and its corresponding priority in the Priority column. This is the priority for this port becoming a designated
root. The default rule is, the lower this value, the higher the chance that the port is assigned as a designated root.
31. Select OK to save the changes made to the Ethernet port’s security configuration. Select Reset to revert to the last saved
configuration if you do not wish to commit the overrides.
5.4.5.3.2 Virtual Interface Override Configuration
Profile Interface Override Configuration
A Virtual Interface is required for layer 3 (IP) access or provide layer 3 service on a VLAN. The Virtual Interface defines which
IP address is associated with each VLAN ID. A Virtual Interface is created for the default VLAN (VLAN 1) to enable remote
5 - 210 WiNG 5.5.3 Access Point System Reference Guide
administration. A Virtual Interface is also used to map VLANs to IP address ranges. This mapping determines the destination
networks for routing.
To review existing Virtual Interface configurations and either create a new Virtual Interface configuration, modify (override) an
existing configuration or delete an existing configuration:
1. Select the Configuration tab from the Web UI.
2. Select Devices from the Configuration tab.
3. Select Device Overrides
4. Select a target device from the device browser in the lower, left-hand, side of the UI.
5. Select Interface to expand its sub menu options.
6. Select Virtual Interfaces.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove a device’s override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides.
Figure 5-132 Device Overrides - Virtual Interfaces screen
7. Review the following parameters unique to each Virtual Interface configuration to determine whether a parameter override
is warranted:
Name
Displays the name of each listed Virtual Interface assigned when it was created. The
name is from 1 - 4094, and cannot be modified as part of a Virtual Interface edit.
Type
Displays the type of Virtual Interface for each listed interface.
Description
Displays the description defined for the Virtual Interface when it was either initially
created or edited.
Device Configuration 5 - 211
Admin Status
A green check mark defines the listed Virtual Interface configuration as active and
enabled with its supported profile. A red “X” defines the Virtual Interface as currently
disabled. The interface status can be modified when a new Virtual Interface is created or
an existing one modified.
VLAN
Displays the numerical VLAN ID associated with each listed interface.
IP Address
Defines whether DHCP was used to obtain the primary IP address used by the Virtual
Interface configuration.
Once the configurations of existing Virtual Interfaces have been reviewed, determine whether a new interface requires
creation, or an existing Virtual Interface requires edit (override) or deletion.
8. Select Add to define a new Virtual Interface configuration, Edit to modify or override the configuration of an existing Virtual
Interface or Delete to permanently remove a selected Virtual Interface.
Figure 5-133 Device Overrides - Virtual Interfaces - Basic Configuration screen
9. The Basic Configuration screen displays by default regardless of a whether a new Virtual Interface is being created or
an existing one is being modified.
10. If creating a new Virtual Interface, use the spinner control to define a numeric ID from 1 - 4094.
5 - 212 WiNG 5.5.3 Access Point System Reference Guide
11. Define or override the following parameters from within the Properties field:
Description
Provide or edit a description (up to 64 characters) for the Virtual Interface that helps
differentiate it from others with similar configurations.
Admin Status
Either select the Disabled or Enabled radio button to define this interface’s current status
within the network. When set to Enabled, the Virtual Interface is operational and
available. The default value is disabled.
12. Set or override the following network information from within the IP Addresses field:
Enable Zero
Configuration
Zero Configuration (or Zero Config) is a wireless connection utility included with Microsoft
Windows XP and later as a service that dynamically selects a network to connect based
on a user’s preference and various default settings. Zero config can be used instead of a
wireless network utility from the manufacturer of a computer’s wireless networking
device.
The access point can use Zero Config for IP assignments on an individual virtual interface
basis. Select Primary to use Zero Config as the designated means of providing an IP
address, this eliminates the means to assign one manually. Selecting Secondary is
preferred when wanting the option to either use Zero Config or manual assignments.
Selecting None disables using Zero Config for IP assignments. None is the default setting.
Primary IP Address
Define the IP address for the VLAN associated Virtual Interface.
Use DHCP to Obtain IP
Select this option to allow DHCP to provide the IP address for the Virtual Interface.
Selecting this option disables the Primary IP address field.
Use DHCP to obtain
Gateway/DNS Servers
Select this option to allow DHCP to obtain a default gateway address, and DNS resource
for one virtual interface. This setting is disabled by default and only available when the
Use DHCP to Obtain IP option is selected.
Secondary Addresses
Use the Secondary Addresses parameter to define additional IP addresses to associate
with VLAN IDs. The address provided in this field is used if the primary IP address is
unreachable.
13. Define or override the Network Address Translation (NAT) direction.
Select either the Inside, Outside or None radio buttons.
• Inside - The inside network is transmitting data over the network to its intended destination. On the way out, the source
IP address is changed in the header and replaced by the (public) IP address.
• Outside - Packets passing through the NAT on the way back to the LAN are searched against the records kept by the NAT
engine. There the destination IP address is changed back to the specific private class IP address in order to reach the
LAN over the switch managed network.
• None - No NAT activity takes place. This is the default setting.
NOTE: Refer to Setting the Profile’s NAT Configuration on page 5-123 for instructions on
creating a profile’s NAT configuration.
14. Select OK button to save the changes and overrides to the Basic Configuration screen. Select Reset to revert to the last
saved configuration.
Device Configuration 5 - 213
15. Select the Security tab.
The firewall inspects and packet traffic to and from connected clients.
If a firewall rule does not exist suiting the data protection needs of this Virtual Interface, select the Create icon to define
a new firewall rule configuration or the Edit icon to modify or override an existing configuration. For more information, see
Wireless Firewall on page 8-2.
Figure 5-134 Device Overrides - Virtual Interfaces Security screen
16. Use the IP Inbound Firewall Rules drop-down menu to select the firewall rule configuration to apply to this Virtual
Interface.
17. Use the VPN Crypto Map drop-down menu to define the cryptography map to use with this virtual interface. The VPN
Crypto Map entry defines the type of VPN connection and its parameters. For more information see Defining Profile VPN
Settings on page 5-104.
18. Select the Dynamic Routing tab.
5 - 214 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-135 Device Overrides – Virtual Interfaces Dynamic Routing screen
19. Refer to the following to configure OSPF Settings.
Priority
Select this option to enable or disable OSPF priority settings. Use the spinner to configure
a value from 0 - 255. This option sets the priority of this interface becoming the Designated
Router (DR) for the network. DRs provide routing updates to the network by maintaining a
complete topology table of the network and sends the updates to the other routers in the
network using multicast. Setting a high value increases the chance of this interface
becoming a DR. Setting this value to Zero (0) prevents this interface from being elected a
DR.
Cost
Select this option to enable or disable OSPF cost settings. Use the spinner to configure a
cost value from 1 - 65535. Use this option to set the OSPF cost of this interface. OSPF cost
is the overhead required to send a packet over this interface.
Bandwidth
Select this option to enable or disable OSPF bandwidth settings. Use the spinner to
configure a bandwidth settings from 1 - 10,000,000 KBps. Use this option to set the
bandwidth of this interface in KBps.
20. Configure the OSPF Authentication Type settings by selecting from the drop-down list. The available options are None,
null, simple-password and message-digest.
Device Configuration 5 - 215
21. Refer the following to configure MD5 Authentication keys. Select the + Add Row button to add a row to the table.
Key ID
Set the unique MD5 Authentication key ID. The available key ID range is 1 - 255.
Password
Set the OSPF password. This value is displayed as “asterisk” (*). Select Show to expose the
characters comprising the password.
22. Select the OK button located at the bottom right of the screen to save the changes and overrides to the Security screen.
Select Reset to revert to the last saved configuration.
5.4.5.3.3 Port Channel Override Configuration
Profile Interface Override Configuration
Access points can have their port channel configurations overridden if a portion of the configuration is no longer relevant to
the access point’s deployment objective.
To override a port channel configuration for an access point profile:
1. Select the Configuration tab from the Web UI.
2. Select Devices from the Configuration tab.
3. Select Device Overrides
4. Select a target device from the device browser in the lower, left-hand, side of the UI.
5. Expand the Interface menu and select Port Channels. The following screen displays:
Figure 5-136 Device Overrides - Port Channels screen
6. Refer to the following to review existing port channel configurations and their current status:
Name
Displays the port channel’s numerical identifier assigned to it when it was created. The
numerical name cannot be modified as part of the edit process.
Type
Displays whether the type is port channel.
Description
Lists a a short description (64 characters maximum) describing the port channel or
differentiating it from others with similar configurations.
5 - 216 WiNG 5.5.3 Access Point System Reference Guide
Admin Status
A green check mark defines the listed port channel as active and currently enabled with
the access point’s profile. A red “X” defines the port channel as currently disabled and not
available for use. The interface status can be modified with the port channel configuration
as required
7. To edit the configuration of an existing port channel, select it from amongst those displayed and select the Edit button. The
Port Channel Basic Configuration screen displays by default.
Figure 5-137 Device Overrides - Port Channels - Basic Configuration tab
8. Set the following port channel Properties:
Description
Enter a brief description for the port channel (64 characters maximum). The description
should reflect the port channel’s intended function.
Admin Status
Select the Enabled radio button to define this port channel as active to the profile it
supports. Select the Disabled radio button to disable this port channel configuration
within the profile. It can be activated at any future time when needed. The default setting
is disabled.
Speed
Select the speed at which the port channel can receive and transmit the data. Select
either 10 Mbps, 100 Mbps, 1000 Mbps. Select either of these options to establish a 10,
100 or 1000 Mbps data transfer rate for the selected half duplex or full duplex
transmission over the port. These options are not available if Auto is selected. Select
Automatic to enable the port channel to automatically exchange information about data
transmission speed and duplex capabilities. Auto negotiation is helpful when in an
environment where different devices are connected and disconnected on a regular basis.
Automatic is the default setting.
Device Configuration 5 - 217
Duplex
Select either Half, Full or Automatic as the duplex option. Select Half duplex to send data
over the port channel, then immediately receive data from the same direction in which the
data was transmitted. Like a Full duplex transmission, a Half duplex transmission can
carry data in both directions, just not at the same time. Select Full duplex to transmit data
to and from the port channel at the same time. Using Full duplex, the port channel can
send data while receiving data as well. Select Automatic to enable to the access point to
dynamically duplex as port channel performance needs dictate. Automatic is the default
setting.
9. Use the Port Channel Load Balance drop-down menu within the Client Load Balancing field to define whether port
channel load balancing is conducted using a Source/Destination IP or a Source/Destination MAC as criteria. Source/
Destination IP is the default setting.
10. Define the following Switching Mode parameters to apply to the port channel configuration:
Mode
Select either the Access or Trunk radio button to set the VLAN switching mode over the
port channel. If Access is selected, the port channel accepts packets only form the native
VLANs. Frames are forwarded out the port untagged with no 802.1Q header. All frames
received on the port are expected as untagged and are mapped to the native VLAN. If the
mode is set to Trunk, the port channel allows packets from a list of VLANs you add to the
trunk. A port channel configured as Trunk supports multiple 802.1Q tagged VLANs and
one Native VLAN which can be tagged or untagged. Access is the default setting.
Native VLAN
Use the spinner control to define a numerical ID from 1 - 4094. The native VLAN allows
an Ethernet device to associate untagged frames to a VLAN when no 802.1Q frame is
included in the frame. Additionally, the native VLAN is the VLAN which untagged traffic
will be directed over when using trunk mode. The default value is 1.
Tag the Native VLAN
Select this option to tag the native VLAN. Access points support the IEEE 802.1Q
specification for tagging frames and coordinating VLANs between devices. IEEE 802.1Q
adds four bytes to each frame identifying the VLAN ID for upstream devices that the
frame belongs. If the upstream Ethernet device does not support IEEE 802.1Q tagging, it
does not interpret the tagged frames. When VLAN tagging is required between devices,
both devices must support tagging and be configured to accept tagged VLANs. When a
frame is tagged, the 12 bit frame VLAN ID is added to the 802.1Q header so upstream
Ethernet devices know which VLAN ID the frame belongs to. The device reads the 12 bit
VLAN ID and forwards the frame to the appropriate VLAN. When a frame is received with
no 802.1Q header, the upstream device classifies the frame using the default or native
VLAN assigned to the Trunk port. The native VLAN allows an Ethernet device to associate
untagged frames to a VLAN when no 802.1Q frame is included in the frame. This setting
is disabled by default.
Allowed VLANs
Selecting Trunk as the mode enables the Allowed VLANs parameter. Add VLANs that
exclusively send packets over the port channel.
11. Select OK to save the changes made to the port channel Basic Configuration. Select Reset to revert to the last saved
configuration.
12. Select the Security tab.
5 - 218 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-138 Device Overrides - Port Channels - Security tab
13. Refer to the Access Control field. As part of the port channel’s security configuration, Inbound IP and MAC address
firewall rules are required.
Use the Inbound IP Firewall Rules and Inbound MAC Firewall Rules drop-down menus to select firewall rules to
apply to this profile’s port channel configuration.
The firewall inspects IP and MAC traffic flows and detects attacks typically not visible to traditional wired firewall
appliances.
If a firewall rule does not exist suiting the data protection needs of the target port channel configuration, select the Create
icon to define a new rule configuration or the Edit icon to modify an existing firewall rule configuration. For more
information, see Wireless Firewall on page 8-2.
14. Refer to the Trust field to define the following:
Trust ARP Responses
Select this option to enable ARP trust on this port channel. ARP packets received on this
port are considered trusted and information from these packets is used to identify rogue
devices within the managed network. The default value is disabled.
Trust DHCP Responses
Select this option to enable DHCP trust. If enabled, only DHCP responses are trusted
and forwarded on this port channel, and a DHCP server can be connected only to a
DHCP trusted port. The default value is enabled.
ARP header Mismatch
Validation
Select this option to enable a mismatch check for the source MAC in both the ARP and
Ethernet header. The default value is enabled.
Trust 802.1p COS values
Select this option to enable 802.1p COS values on this port channel. The default value
is enabled.
Device Configuration 5 - 219
Trust IP DSCP
Select this option to enable IP DSCP values on this port channel. The default value is
enabled.
15. Select OK to save the changes to the security configuration. Select Reset to revert to the last saved configuration.
16. Select the Spanning Tree tab.
Figure 5-139 Port Channels - Spanning Tree tab
17. Define the following PortFast parameters for the port channel’s MSTP configuration:
Enable PortFast
PortFast reduces the time required for a port to complete a MSTP state change from
Blocked to Forward. PortFast must only be enabled on ports on the wireless controller
directly connected to a server/workstation and not another hub or controller. PortFast can
be left unconfigured on an access point.
Select this option to enable drop-down menus for both the Enable PortFast BPDU Filter
and Enable PortFast BPDU Guard options. This setting is disabled by default.
Enable PortFast BPDU
Filter
Select Enable to invoke a BPDU filter for this PortFast enabled port channel. Enabling the
BPDU filter feature ensures this port channel does not transmit or receive any BPDUs. The
default setting is None.
Enable PortFast BPDU
Guard
Select Enable to invoke a BPDU guard for this PortFast enabled port channel. Enabling the
BPDU Guard feature means this port will shutdown on receiving a BPDU. Thus, no BPDUs
are processed. The default setting is None.
5 - 220 WiNG 5.5.3 Access Point System Reference Guide
18. Set the following MSTP Configuration parameters for the port channel:
Enable as Edge Port
Select this option to define this port as an edge port. Using an edge (private) port, you
can isolate devices to prevent connectivity over this port channel. This setting is
disabled by default.
Link Type
Select either the Point-to-Point or Shared radio button. Selecting Point-to-Point
indicates the port should be treated as connected to a point-to-point link. Selecting
Shared means this port should be treated as having a shared connection. A port
connected to a hub is on a shared link, while one connected to a access point is a pointto-point link. Point-to-Point is the default setting.
Cisco MSTP
Interoperability
Select either the Enable or Disable radio buttons. This enables interoperability with
Cisco’s version of MSTP, which is incompatible with standard MSTP. This setting is
disabled by default.
Force Protocol Version
Sets the protocol version to either STP(0), Not Supported(1), RSTP(2) or MSTP(3). MSTP
is the default setting.
Guard
Determines whether the port channel enforces root bridge placement. Setting the
guard to Root ensures the port is a designated port. Typically, each guard root port is a
designated port, unless two or more ports (within the root bridge) are connected
together. If the bridge receives superior (BPDUs) on a guard root-enabled port, the guard
root moves the port to a root-inconsistent STP state. This state is equivalent to a
listening state. No data is forwarded across the port. Thus, the guard root enforces the
root bridge position.
19. Refer to the Spanning Tree Port Cost table.
Define an Instance Index using the spinner control and then set the cost. The default path cost depends on the user defined
port speed. The cost helps determine the role of the port channel in the MSTP network. The designated cost is the cost for
a packet to travel from this port to the root in the MSTP configuration. The slower the media, the higher the cost.
Speed
Default Path Cost
<=100000 bits/sec
200000000
<=1000000 bits/sec
20000000
<=10000000 bits/sec
2000000
<=100000000 bits/sec
200000
<=1000000000 bits/sec
20000
<=10000000000 bits/sec
2000
<=100000000000 bits/sec
200
<=1000000000000 bits/sec
20
>1000000000000 bits/sec
2
20. Select + Add Row as needed to include additional indexes.
21. Refer to the Spanning Tree Port Priority table.
Define an Instance Index using the spinner control and then set the Priority. The lower the priority, a greater likelihood
of the port becoming a designated port.
Device Configuration 5 - 221
22. Select + Add Row needed to include additional indexes.
23. Select OK to save the changes made to the Ethernet Port Spanning Tree configuration. Select Reset to revert to the last
saved configuration.
5.4.5.3.4 Radio Override Configuration
Profile Interface Override Configuration
Access points can have their radio profile configurations overridden if a portion of a profile is no longer relevant to the access
point’s deployment objective.
To define a radio configuration override for an access point:
1. Select the Configuration tab from the Web UI.
2. Select Devices from the Configuration tab.
3. Select Device Overrides.
4. Select a target access point from the device browser in the lower, left-hand, side of the UI.
5. Select Interface to expand its sub menu options.
6. Select Radios.
Figure 5-140 Device Overrides - Access Point Radios screen
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
5 - 222 WiNG 5.5.3 Access Point System Reference Guide
7. Review the following radio configuration data to determine whether a radio configuration requires modification or override:
Name
Displays whether the reporting radio is the access point’s radio1, radio2 or radio3. AP7131
models can support up to 3 radios. AP6522, AP6522M, AP6532, AP6562, AP7161, AP7181,
AP81XX and AP82XX models support 2 radios and AP6511 and AP6521 models support a
single radio.
Type
Displays the type as either Radio (for typical client support) or sensor. If setting an AP6511
or AP6521 model access point to function as a sensor, the access point must be rebooted
before it can begin to operate as a sensor.
Description
Displays a brief description of the radio provided by the administrator when the radio’s
configuration was added or modified.
Admin Status
Defines the radio as either enabled or disabled for client or sensor support.
RF Mode
Displays whether each listed radio is operating in the 802.11a/n or 802.11b/g/n radio
band. If the radio is a dedicated sensor, it will be listed as a sensor to define the radio as
not providing typical WLAN support. If the radio is a client bridge, it will be listed as a
client bridge and does not provide typical WLAN support. The radio band is set from
within the Radio Settings tab.
Channel
Lists the channel setting for the radio. Smart is the default setting. If set to smart, the
access point scans non-overlapping channels listening for beacons from other access
points. After the channels are scanned, it selects the channel with the fewest access
points. In the case of multiple access points on the same channel, it will select the
channel with the lowest average power level.
Transmit Power
Lists the transmit power for each radio.
Overrides
Click Clear to clear overrides made to this radio interface. This field is blank if there are
no overrides for this radio.
8. If required, select a radio configuration and select the Edit button to modify or override portions of its configuration.
Device Configuration 5 - 223
Figure 5-141 Device Overrides - Access Point Radio Settings tab
9. The Radio Settings tab displays by default.
10. Define or override the following radio configuration Properties:
Description
Provide or edit a description (1 - 64 characters in length) for the radio that helps
differentiate it from others with similar configurations.
Admin Status
Either select the Active or Shutdown radio button to define this radio’s availability. When
defined as Active, the access point is operational and available for client support,
Shutdown renders it unavailable.
Radio QoS Policy
Use the drop-down menu to specify an existing QoS policy to apply to the access point
radio in respect to its intended radio traffic. If there’s no existing QoS policy suiting the
radio’s intended operation, select the Create icon.
Association ACL
Use the drop-down menu to specify an existing Association ACL policy to apply to the
radio. An Association ACL is a policy-based Access Control List (ACL) that either prevents
or allows wireless clients from connecting to an access point radio. An ACL is a sequential
collection of permit and deny conditions that apply to packets. When a packet is received
on an interface, the fields in the packet are compared to applied ACLs to verify the packet
has the required permissions needed to be forwarded. If a packet does not meet any of
the ACL criteria, the packet is dropped. Select the Create icon to define a new Association
ACL.
5 - 224 WiNG 5.5.3 Access Point System Reference Guide
11. Set or override the following profile Radio Settings for the selected radio:
RF Mode
Set the mode to either 2.4 GHz WLAN or 5.0 GHz WLAN support depending on the radio’s
intended client support. Set the mode to sensor if using the radio for rogue device
detection. Set the mode to client-bridge to configure the radio as a client bridge. A client
bridge enables the access point to connect to a 3rd party access point and bridge frames
to it.
Lock RF Mode
Select this option to lock Smart RF calibration functions for this radio. The default setting
is disabled.
Channel
Use the drop-down menu to select the channel of operation for the radio. Only a trained
installation professional should define the radio channel.Select Smart for the radio to
scan non-overlapping channels to listen for beacons from other access points. Once
channels are scanned, the radio selects the channel with the fewest access points. In
case of multiple access points on the same channel, it will select the channel with the
lowest average power level. The default value is Smart.
Channels with a “w” appended to them are unique to the 40 MHz band. Channels with a
“ww” appended to them are 802.11ac specific, only appear when using an AP8232, and
are unique to the 80 MHz band.
DFS Revert Home
Select this option to enable a radio to return back to its original channel. Dynamic
Frequency Selection (DFS) prevents a radio from operating in a channel where radar
signals are present. When radar signals are detected in a channel, the radio changes its
channel of operation to another channel. The radio cannot use the channel it has moved
from for the next thirty (30) minutes. When selected, the radio can return back to its
original channel of operation once the thirty minute period is over. When not selected, the
radio cannot return back to its original channel of operation ever after the mandatory
thirty minute evacuation period is over.
Transmit Power
Set the transmit power of the selected access point radio. If using a dual or a three radio
model AP7131, each radio should be configured with a unique transmit power in respect
to its intended client support function. Select smart to use Smart RF to determine output
power. smart is the default value.
Antenna Gain
Set the antenna from 0.00 - 30.00 dBm. The access point’s Power Management Antenna
Configuration File (PMACF) automatically configures the access point’s radio transmit
power based on the antenna type, its antenna gain (provided here) and the deployed
country’s regulatory domain restrictions. Once provided, the access point calculates the
power range. Antenna gain relates the intensity of an antenna in a given direction to the
intensity that would be produced ideally by an antenna that radiates equally in all
directions (isotropically), and has no losses. Although the gain of an antenna is directly
related to its directivity, its gain is a measure that takes into account the efficiency of the
antenna as well as its directional capabilities. Motorola Solutions recommends only a
professional installer set the antenna gain. The default value is 0.00.
Antenna Mode
Set the number of transmit and receive antennas on the access point. 1x1 is used for
transmissions over just a single “A” antenna, 1x3 is used for transmissions over the “A”
antenna and all three antennas for receiving. 2x2 is used for transmissions and receipts
over two antennas for dual antenna models. The default setting is dynamic based on the
access point model deployed and its transmit power settings.
Device Configuration 5 - 225
Enable Antenna Diversity Select this option for the radio to dynamically change the number of transmit chains. This
option is enabled by default.
Wireless Client Power
Select this option to enable a spinner control for client radio power transmissions in dBm.
The available range is 0 - 20 dBm.
Dynamic Chain Selection Select this option to allow the access point radio to dynamically change the number of
transmit chains. This setting is disabled by default. The radio uses a single chain/antenna
for frames at non 802.11n data rates.
Data Rate
Once the radio band is provided, the Rate drop-down menu populates with rate options
depending on the 2.4 or 5.0 GHz band selected. If the radio band is set to Sensor or
Detector, the Data Rates drop-down menu is not enabled, as the rates are fixed and not
user configurable. If 2.4 GHz is selected as the radio band, select separate 802.11b,
802.11g and 802.11n rates and define how they are used in combination. If 5.0 GHz is
selected as the radio band, select separate 802.11a and 802.11n rates define how they
are used together. When using 802.11n (in either the 2.4 or 5.0 GHz band), Set a MCS
(modulation and coding scheme) in respect to the radio’s channel width and guard
interval. A MCS defines (based on RF channel conditions) an optimal combination of 8
data rates, bonded channels, multiple spatial streams, different guard intervals and
modulation types. Clients can associate as long as they support basic MCS (as well as
non-11n basic rates).
For more information on 802.11n MCS rates, see MCS Data Rates on page 5-51.
Radio Placement
Use the drop-down menu to specify whether the radio is located Indoors or Outdoors. The
placement should depend on the selected country of operation and its regulatory domain
requirements for radio emissions. The default setting is Indoors.
Max Clients
Use the spinner control to set the maximum permissible client connections for this radio.
Set a value from 0 - 256. AP6522, AP6522M, AP6532, AP6562, AP71XX, AP75XX, AP81XX
and AP82XX model access points can support up to 256 clients per access point or radio.
AP6511 and AP6521 model access points can support up to 128 clients per access point
or radio.
Rate Selection Methods
Use the drop-down menu to specify the algorithm to use for rate selection. Select
Standard to use the standard rate selection algorithm. Select Opportunistic to use the
Opportunistic rate selection algorithm.
NOTE: AP6522, AP6522M, AP6532, AP6562, AP71XX, AP75XX, AP81XX and AP82XX
model access points can support up to 256 client connections to a single access point
radio. AP6511 and AP6521 model access points (both single radio models) can support
up to 128 client connections to a single radio.
5 - 226 WiNG 5.5.3 Access Point System Reference Guide
12. Set or override the following profile WLAN Properties for the selected access point radio.
Beacon Interval
Set the interval between radio beacons in milliseconds (either 50, 100 or 200). A beacon
is a packet broadcast by adopted radios to keep the network synchronized. Included in a
beacon is information such as the WLAN service area, the radio address, the broadcast
destination addresses, a time stamp, and indicators about traffic and delivery such as a
DTIM. Increase the DTIM/beacon settings (lengthening the time) to let nodes sleep longer
and preserve battery life. Decrease these settings (shortening the time) to support
streaming-multicast audio and video applications that are jitter-sensitive.The default
value is 100 milliseconds.
DTIM Interval
Set a DTIM Interval to specify a period for Delivery Traffic Indication Messages (DTIM). A
DTIM is periodically included in a beacon frame transmitted from adopted radios. The
DTIM indicates broadcast and multicast frames (buffered at the access point) are soon to
arrive. These are simple data frames that require no acknowledgement, so nodes
sometimes miss them. Increase the DTIM/ beacon settings (lengthening the time) to let
nodes sleep longer and preserve their battery life. Decrease these settings (shortening
the time) to support streaming multicast audio and video applications that are jittersensitive.
RTS Threshold
Specify a Request To Send (RTS) threshold (from 1 - 2,347 bytes) for use by the WLAN's
adopted access point radios. RTS is a transmitting station's signal that requests a Clear
To Send (CTS) response from a receiving client. This RTS/CTS procedure clears the air
where clients are contending for transmission time. Benefits include fewer data collisions
and better communication with nodes that are hard to find (or hidden) because of other
active nodes in the transmission path.
Control RTS/CTS by setting an RTS threshold. This setting initiates an RTS/CTS exchange
for data frames larger than the threshold, and sends (without RTS/CTS) any data frames
smaller than the threshold.
Consider the trade-offs when setting an appropriate RTS threshold for the WLAN's access
point radios. A lower RTS threshold causes more frequent RTS/CTS exchanges. This
consumes more bandwidth because of additional latency (RTS/CTS exchanges) before
transmissions can commence. A disadvantage is the reduction in data-frame throughput.
An advantage is quicker system recovery from electromagnetic interference and data
collisions. Environments with more wireless traffic and contention for transmission make
the best use of a lower RTS threshold.
A higher RTS threshold minimizes RTS/CTS exchanges, consuming less bandwidth for
data transmissions. A disadvantage is less help to nodes that encounter interference and
collisions. An advantage is faster data-frame throughput. Environments with less
wireless traffic and contention for transmission make the best use of a higher RTS
threshold.
Short Preamble
If using an 802.11bg radio, select this option for the radio to transmit using a short
preamble. Short preambles improve throughput. However, some devices (SpectraLink
phones) require long preambles. The default value is disabled.
Device Configuration 5 - 227
Guard Interval
Use the drop-down menu to specify a Long or Any guard interval. The guard interval is the
space between symbols (characters) being transmitted. The guard interval eliminates
inter-symbol interference (ISI). ISI occurs when echoes or reflections from one symbol
interfere with another symbol. Adding time between transmissions allows echo's and
reflections to settle before the next symbol is transmitted. A shorter guard interval results
in a shorter symbol times which reduces overhead and increases data rates by up to
10%.The default value is Long.
Probe Response Rate
Use the drop-down menu to specify the data transmission rate used for the transmission
of probe responses. Options include, highest-basic, lowest-basic and follow-proberequest (default setting).
Probe Response Retry
Select this option to retry probe responses if they are not acknowledged by the target
wireless client. The default value is enabled.
13. Use the Feed WLAN Packets to Sensor drop-down menu to allow the radio to send WLAN packet to the sensor radio.
Options include Off, Inline and Promiscuous. The default setting is off.
14. Select the WLAN Mapping/Mesh Mapping tab.
Figure 5-142 Device Overrides - WLAN Mapping tab
Refer to the WLAN/BSS Mappings field to set or override WLAN BSSID assignments for an existing access point
deployment. Use the ‘<‘ or ‘>’ buttons to assign WLANs and mesh points to the available BSSIDs.
Administrators can assign each WLAN its own BSSID. If using a single-radio AP6511 or AP6521 access point, there are 8
BSSIDs available. If using a dual-radio AP6532, AP6522, AP6522M, AP6562, AP71XX, AP75XX, AP81XX or AP82XX model
access point, there are 16 BSSIDs for the 802.11b/g/n radio and 16 BSSIDs for the 802.11a/n/c radio.
15. Select OK to save the changes and overrides to the WLAN Mapping. Select Reset to revert to the last saved configuration.
16. Select the Legacy Mesh tab.
5 - 228 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-143 Device Overrides - Access Point Radio - Mesh tab
17. Use the Mesh Legacy screen to define or override how mesh connections are established and the number of links
available amongst access points within the Mesh network.
18. Define the following Mesh Legacy settings:
Mesh
Options include Client, Portal and Disabled. Select Client to scan for mesh portals, or
nodes that have connection to portals, and connect through them. Portal operation begins
beaconing immediately and accepts connections from other mesh supported nodes. In
general, the portal is connected to the wired network. The default value is Disabled.
Mesh Links
Use the spinner control to define the number of mesh links (1 -6) an access point radio will
attempt to create. The default settings is 3 links.
Mesh PSK
Use the field to define the shared key for mesh. From the drop-down, select the type of
the key. Click Show to display the actual characters comprising the key.
19. Refer to the Preferred Peer Devices table and select + Add Row to define MAC addresses representing peer devices
for preferred mesh connection. Use the Priority spinner control to set a priority (1 -6) for connection preference.
20. Select the OK button located at the bottom right of the screen to save the changes to the Mesh configuration. Select Reset
to revert to the last saved configuration.
21. Select the Advanced Settings tab.
Device Configuration 5 - 229
Figure 5-144 Device Overrides - Access Point Radio Advanced Settings tab
22. Refer to the Aggregate MAC Protocol Data Unit (A-MPDU) field to define or override how MAC service frames are
aggregated by the access point radio.
A-MPDU Modes
Use the drop-down menu to define the A-MPDU mode. Options include Transmit Only,
Receive Only, Transmit and Receive and None. The default value is Transmit and Receive.
Using the default value, long frames can be both sent and received (up to 64 KB). When
enabled, define either a transmit or receive limit (or both).
Minimum Gap Between
Frames
Use the drop-down menu to define the minimum gap between A-MPDU frames (in
microseconds). The default value is 4 microseconds.
Received Frame Size
Limit
If a support mode is enable allowing A-MPDU frames to be received, define an advertised
maximum limit for received A-MPDU aggregated frames. Options include 8191, 16383,
32767 or 65535 bytes. The default value is 65535 bytes.
Transmit Frame Size
Limit
Use the spinner control to set limit on transmitted A-MPDU aggregated frames. The
available range is from 0 - 65,535 bytes). The default value is 65535 bytes.
23. Use the Aggregate MAC Service Data Unit (A-MSDU) drop-down menu to set or override the supported A-MSDU mode.
Available modes include Receive Only and Transmit and Receive. Using Transmit and Receive, frames up to 4 KB can be
sent and received. The buffer limit is not configurable.
24. Set or override the following profile Aeroscout Properties for the selected access point radio.
Forward
Select to enable forwarding of Aeroscout packets
MAC to be forwarded
Enter the MAC address that is incorporated in the Aeroscout packets that are forwarded.
5 - 230 WiNG 5.5.3 Access Point System Reference Guide
25. Set or override the following profile Ekahau Properties for the selected access point radio.
Forwarding host
Provide the IP address of the host to which Ekahau packets are forwarded to.
Forwarding Port
Use the spinner to provide the Ekahau forwarding port number.
MAC to be
forwarded
Enter the MAC address that is incorporated in the Ekahau packets that are forwarded.
26. Define a Reduced Interframe Spacing (RIFS) mode using the drop-down menu. This value determines whether interframe
spacing is applied to transmissions or received packets, or both or none. The default mode is Transmit and Receive.
Consider setting this value to None for high priority traffic to reduce packet delay.
27. Set or override the following Non-Unicast Traffic values for the profile’s supported access point radio and its connected
wireless clients:
Non-Unicast Transmit
Rate
Use the Select drop-down menu to launch a sub screen to define the data rate broadcast
and multicast frames are transmitted. Seven different rates are available if the not using
the same rate for each BSSID, each with a separate menu.
Non-Unicast Forwarding
Define whether client broadcast and multicast packets should always follow DTIM, or
only follow DTIM when using Power Save Aware mode. The default setting is Follow
DTIM.
28. Refer to the Sniffer Redirect (Packet Capture) field to define or override the radio’s captured packet configuration.
Host for Redirected
Packets
If packets are re-directed from a access point radio, define an IP address of a resource
(additional host system) used to capture the re- directed packets. This address is the
numerical (non DNS) address of the host used to capture the re-directed packets.
Channel to Capture
Packets
Use the drop-down menu to specify the channel used to capture re-directed packets. The
default value is channel 1.
29. Select the Enable Off-Channel Scan radio button to scan across other channels in the radio band. This setting is disabled
by default.
30. Select the Off-Channel Scan list for 5GHz field and enter the channels on which off channel scan has to be performed
for the 5.0 GHz radio. Similarly select the channels for the Off Channel Scan list for 2.4 GHz radio.
31. Use the Max Multicast spinner to set the maximum number of multicast channels on which to do off channel scan.
32. Use the Scan Interval spinner to set the time duration in DTIM period between 2 off channel scans.
33. Use the Sniffer Redirect field to provide the IP address of the device to which the captured off-channel scan packets are
redirected to.
34. Select OK to save or override the changes to the Advanced Settings screen. Select Reset to revert to the last saved
configuration.
5.4.5.3.5 WAN Backhaul Overrides
Device Overrides
A Wireless Wide Area Network (WWAN) card is a specialized network interface card that allows a network device to connect,
transmit and receive data over a Cellular Wide Area Network. Certain AP7131N model access points have a PCI Express card
slot that supports 3G WWAN cards. The WWAN card uses Point to Point Protocol (PPP) to connect to the Internet Service
Provider (ISP) and gain access to the Internet. PPP is the protocol used for establishing internet links over dial-up modems, DSL
connections, and many other types of point-to-point communications. PPP packages your system’s TCP/IP packets and forwards
them to the serial device where they can be put on the network. PPP is a full-duplex protocol used on various physical media,
Device Configuration 5 - 231
including twisted pair or fiber optic lines or satellite transmission. It uses a variation of High Speed Data Link Control (HDLC)
for packet encapsulation. For a list of supported 3G cards, see WAN Backhaul Configuration on page 5-53.
To define a WAN Backhaul configuration override for a supported access point:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Interface to expand its submenu items.
5. Select WAN Backhaul.
Figure 5-145 Device Overrides - WAN Backhaul screen
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
6. Refer to the WAN (3G) Backhaul configuration to specify WAN card settings:
WAN Interface Name
Displays the WAN Interface name for the WAN 3G Backhaul card.
5 - 232 WiNG 5.5.3 Access Point System Reference Guide
Reset WAN Card
If the WAN card becomes unresponsive or is experiencing other errors click the Reset
WAN Card button to power cycle and reboot the WAN card.
Enable WAN (3G)
Select this option to enable 3G WAN card support on the device. A supported 3G card
must be connected to the device for this feature to work.
7. Define or override the following authentication parameters from within the Basic Settings field:
Username
Provide your username for authentication support by your cellular data carrier.
Password
Provide your password for authentication support by your cellular data carrier.
Access Point Name
(APN)
Enter the name of the cellular data provider if necessary. This setting is needed in areas
with multiple cellular data providers using the same protocols such as Europe, the middle
east and Asia.
Authentication Type
Use the drop-down menu to specify authentication type used by your cellular data
provider. Supported authentication types are None, PAP, CHAP, MSCHAP, and MSCHAPv2.
8. Use the NAT Direction field to specify the NAT direction used with the access point’s WAN card. Options include Inside,
Outside or None. The default is None.
9. Configure the Inbound IP Firewall Rules. Use the drop-down menu to select a firewall (set of IP access connection rules)
to apply to the PPPoE client connection. If a firewall rule does not exist suiting the data protection needs of the PPPoE client
connection, select the Create icon to define a new rule configuration or the Edit icon to modify an existing rule.
10. Select the VPN Crypto Map to use with this WWAN configuration. Use the drop-down menu to apply an existing crypt
map configuration to this WWAN interface.
11. Configure the WWAN Default Route Priority. Use the spinner control to set the Default Route Priority for the WWAN
default route. Select from 1 - 8,000. The default setting is 3,000.
12. Select OK to save or override the changes to the Advanced Settings screen. Select Reset to revert to the last saved
configuration.
5.4.5.3.6 PPPoE Configuration
Profile Interface Configuration
PPP over Ethernet (PPPoE) is a data-link protocol for dialup connections. PPPoE allows the access point to use a broadband
modem (DSL, cable modem, etc.) for access to high-speed data and broadband networks. Most DSL providers are currently
supporting (or deploying) the PPPoE protocol. PPPoE uses standard encryption, authentication, and compression methods as
specified by the PPPoE protocol. PPPoE enables WiNG supported controllers and access points to establish a point-to-point
connection to an ISP over existing Ethernet interface.
To provide this point-to-point connection, each PPPoE session learns the Ethernet address of a remote PPPoE client, and
establishes a session. PPPoE uses both a discover and session phase to identify a client and establish a point-to-point
connection. By using such a connection, a Wireless WAN failover is available to maintain seamless network access if the
access point’s Wired WAN were to fail.
NOTE: Access points with PPPoE enabled continue to support VPN, NAT, PBR and 3G
failover over the PPPoE interface. Multiple PPPoE sessions are supported using a single
user account user account if RADIUS is configured to allow simultaneous access.
Device Configuration 5 - 233
NOTE: PPPoE is supported on AP6522, AP6522M, AP6532, AP6562, AP71XX, AP7522,
AP7532, AP81XX and AP82XX models and is not available on AP6511 and AP6521 model
access points.
When PPPoE client operation is enabled, it discovers an available server and establishes a PPPoE link for traffic slow. When a
wired WAN connection failure is detected, traffic flows through the WWAN interface in fail-over mode (if the WWAN network
is configured and available). When the PPPoE link becomes accessible again, traffic is redirected back through the access
point’s wired WAN link.
When the access point initiates a PPPoE session, it first performs a discovery to identify the Ethernet MAC address of the PPPoE
client and establish a PPPoE session ID. In discovery, the PPPoE client discovers a server to host the PPPoE connection.
To create a PPPoE point-to-point configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Interface to expand its submenu items.
5. Select PPPoE.
5 - 234 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-146 Device Overrides - PPPoE screen
6. Use the Basic Settings field to enable PPPoE and define a PPPoE client:
Enable PPPoE
Select Enable PPPoE to support a high speed client mode point-to-point connection using
the PPPoE protocol. The default setting is disabled.
Service
Enter the 128 character maximum PPPoE client service name provided by the service
provider.
DSL Modem Network
(VLAN)
Use the spinner control to set the PPPoE VLAN (client local network) connected to the DSL
modem. This is the local network connected to DSL modem. The available range is 1 4,094. The default VLAN is VLAN1
Client IP Address
Provide the numerical (non hostname) IP address of the PPPoE client.
Device Configuration 5 - 235
7. Define the following Authentication parameters for PPPoE client interoperation:
Username
Provide the 64 character maximum username used for authentication support by the
PPPoE client.
Password
Provide the 64 character maximum password used for authentication by the PPPoE client.
Select Show to display the actual characters comprising the password.
Authentication Type
Use the drop-down menu to specify authentication type used by the PPPoE client, and
whose credentials must be shared by its peer access point. Supported authentication
options include None, PAP, CHAP, MSCHAP, and MSCHAP-v2.
8. Define the following Connection settings for the PPPoE point-to-point connection with the PPPoE client:
Maximum Transmission
Unit (MTU)
Set the PPPoE client Maximum Transmission Unit (MTU) from 500 - 1,492. The MTU is the
largest physical packet size in bytes a network can transmit. Any messages larger than
the MTU are divided into smaller packets before being sent. A PPPoE client should be able
to maintain its point-to-point connection for this defined MTU size. The default MTU is
1,492.
Client Idle Timeout
Set a timeout in either Seconds (1 - 65,535), Minutes (1 - 1,093) or Hours. The access point
uses the defined timeout so it does not sit idle waiting for input from the PPPoE client and
server that may never come. The default setting is 10 minutes.
Keep Alive
Select this option to ensure the point-to-point connect to the PPPoE client is continuously
maintained and not timed out. This setting is disabled by default.
9. Set the Network Address Translation (NAT) direction for the PPPoE configuration.
Network Address Translation (NAT) converts an IP address in one network to a different IP address or set of IP addresses
in another network. The access point router maps its local (Inside) network addresses to WAN (Outside) IP addresses, and
translates the WAN IP addresses on incoming packets to local IP addresses. NAT is useful because it allows the
authentication of incoming and outgoing requests, and minimizes the number of WAN IP addresses needed when a range
of local IP addresses is mapped to each WAN IP address. The default setting is None (neither inside or outside).
10. Define the following Security Settings for the PPPoE configuration:
Inbound IP Firewall
Rules
Use the drop-down menu to select a firewall (set of IP access connection rules) to apply
to the PPPoE client connection. If a firewall rule does not exist suiting the data protection
needs of the PPPoE client connection, select the Create icon to define a new rule
configuration or the Edit icon to modify an existing rule. For more information, see
Wireless Firewall on page 8-2.
VPN Crypto Map
Use the drop-down menu to apply an existing crypt map configuration to this PPPoE
interface.
11. Use the spinner control to set the Default Route Priority for the default route learnt using PPPoE.
Select from 1 - 8,000. The default setting is 2,000.
12. Select OK to save the changes to the PPPoE screen. Select Reset to revert to the last saved configuration. Saved
configurations are persistent across reloads.
5 - 236 WiNG 5.5.3 Access Point System Reference Guide
5.4.5.4 Overriding the Network Configuration
Device Overrides
Setting a network configuration is a large task comprised of numerous administration activities. Each of the configuration
activities described can have an override applied to the original configuration. Applying an override differentiates the device
from the profile’s configuration and requires careful administration to ensure this one device still supports the deployment
requirements within the network.
A profile’s network configuration process consists of the following:
• Overriding the DNS Configuration
• Overriding an ARP Configuration
• Overriding a L2TPv3 Profile Configuration
• Overriding IGMP Snooping Configuration
• Overriding a Quality of Service (QoS) Configuration
• Overriding a Spanning Tree Configuration
• Overriding a Routing Configuration
• Overriding a Dynamic Routing (OSPF) Configuration
• Overriding a Forwarding Database Configuration
• Overriding a Bridge VLAN Configuration
• Overriding a Cisco Discovery Protocol Configuration
• Overriding a Link Layer Discovery Protocol Configuration
• Overriding a Miscellaneous Network Configuration
• Overriding Alias Configuration
5.4.5.4.1 Overriding the DNS Configuration
Overriding the Network Configuration
Domain Naming System (DNS) DNS is a hierarchical naming system for resources connected to the Internet or a private
network. Primarily, DNS resources translate domain names into IP addresses. If one DNS server doesn't know how to translate
a particular domain name, it asks another one until the correct IP address is returned. DNS enables access to resources using
human friendly notations. DNS converts human friendly domain names into notations used by different networking equipment
for locating resources.
As a resource is accessed (using human-friendly hostnames), it’s possible to access the resource even if the underlying machine
friendly notation name changes. Without DNS you need to remember a series of numbers (123.123.123.123) instead of a
domain name (www.domainname.com).
To define the DNS configuration or apply overrides to an existing configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select DNS.
Device Configuration 5 - 237
Figure 5-147 Device Overrides - Network DNS screen
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s Device
Overrides field and select Clear Overrides. This removes all overrides from the device.
6. Provide or override the default Domain Name used when resolving DNS names. The name cannot exceed 64 characters.
7. Set or override the following Domain Name System (DNS) settings:
Enable Domain Lookup
Select this option to enable DNS on the access point. When enabled, human friendly
domain names can be converted into numerical IP destination addresses. The radio button
is selected by default.
Enable DNS Server
Forwarding
Select this option to enable the forwarding DNS queries to external DNS servers if a DNS
query cannot be processed by the access point’s own DNS resources. This feature is
disabled by default.
8. Provide a list of up to three DNS servers to forward DNS queries if DNS resources are unavailable. The DNS name servers
are used to resolve IP addresses. Use the Clear link next to each DNS server to clear the DNS name server’s IP address from
the list.
9. Select OK to save the changes and overrides made to the DNS configuration. Select Reset to revert to the last saved
configuration.
5.4.5.4.2 Overriding an ARP Configuration
Overriding the Network Configuration
Address Resolution Protocol (ARP) is a protocol for mapping an IP address to a hardware MAC address. ARP provides protocol
rules for making this correlation and providing address conversion in both directions. This ARP assignment can be overridden
5 - 238 WiNG 5.5.3 Access Point System Reference Guide
as needed, but removes the device configuration from the managed profile that may be shared with other similar device
models.
When an incoming packet destined for a host arrives at the access point, the access point’s gateway uses ARP to find a physical
host or MAC address that matches the IP address. ARP looks in its ARP cache and, if it finds the address, provides it so the
packet can be converted to the right packet length and format and sent to the destination. If no entry is found for the IP address,
ARP broadcasts a request packet in a special format to all the machines on the LAN to see if one machine knows it has that IP
address associated with it. A machine that recognizes the IP address as its own returns a reply indicating as such. ARP updates
the ARP cache for future reference and then sends the packet to the MAC address that replied.
To define an ARP supported configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select ARP.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
Figure 5-148 Device Overrides - Network ARP screen
6. Set or override the following parameters to define the ARP configuration:
Switch VLAN Interface
Use the spinner control to select a VLAN (1 - 4094) for an address requiring resolution.
IP Address
Define the IP address used to fetch a MAC address.
MAC Address
Displays the target MAC address that’s subject to resolution. This is the MAC used for
mapping an IP address to a MAC address that’s recognized on the network.
Device Configuration 5 - 239
Device Type
Specify the device type the ARP entry supports (either Host, Router or DHCP Server). Host
is the default setting.
7. Select the OK button to save the changes and overrides to the ARP configuration. Select Reset to revert to the last saved
configuration.
5.4.5.4.3 Overriding a L2TPv3 Profile Configuration
Overriding the Network Configuration
L2TP V3 is an IETF standard used for transporting different types of layer 2 frames in an IP network (and access point profile).
L2TP V3 defines control and encapsulation protocols for tunneling layer 2 frames between two IP nodes.
Use L2TP V3 to create tunnels for transporting layer 2 frames. L2TP V3 enables controllers and access points to create tunnels
for transporting Ethernet frames to and from bridge VLANs and physical ports.
Multiple pseudowires can be created within an L2TP V3 tunnel. WING supported access points support an Ethernet VLAN
pseudowire type exclusively.
NOTE: A pseudowire is an emulation of a layer 2 point-to-point connection over a
packet-switching network (PSN). A pseudowire was developed out of the necessity to
encapsulate and tunnel layer 2 protocols across a layer 3 network.
Ethernet VLAN pseudowires transport Ethernet frames to and from a specified VLAN. One or more L2TP V3 tunnels can be
defined between tunnel end points. Each tunnel can have one or more L2TP V3 sessions. Each tunnel session corresponds to
one pseudowire. An L2TP V3 control connection (a L2TP V3 tunnel) needs to be established between the tunneling entities
before creating a session.
For optimal pseudowire operation, both the L2TP V3 session originator and responder need to know the psuedowire type and
identifier. These two parameters are communicated during L2TP V3 session establishment. An L2TP V3 session created within
an L2TP V3 connection also specifies multiplexing parameters for identifying a pseudowire type and ID.
The working status of a pseudowire is reflected by the state of the L2TP V3 session. If a L2TP V3 session is down, the
pseudowire associated with it must be shut down. The L2TP V3 control connection keep-alive mechanism can serve as a
monitoring mechanism for the pseudowires associated with a control connection.
NOTE: If connecting an Ethernet port to another Ethernet port, the pseudowire type
must be Ethernet port, if connecting an Ethernet VLAN to another Ethernet VLAN, the
pseudowire type must be Ethernet VLAN.
To define or override an L2TPV3 configuration for an access point profile:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5 - 240 WiNG 5.5.3 Access Point System Reference Guide
5. Select L2TP V3.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s Device
Overrides field and select Clear Overrides. This will remove all overrides from the
device.
Figure 5-149 Device Overrides - Network - L2TPv3 screen, General tab
6. Set the following General Settings for an L2TPv3 profile configuration:
Host Name
Define a 64 character maximum hostname to specify the name of the host that sent tunnel
messages. Tunnel establishment involves exchanging 3 message types (SCCRQ, SCCRP
and SCCN) with the peer. Tunnel IDs and capabilities are exchanged during the tunnel
establishment with the host.
Router ID
Set either the numeric IP address or the integer used as an identifier for tunnel AVP
messages. AVP messages assist in the identification of a tunnelled peer.
UDP Listen Port
Select this option to set the port used for listening to incoming traffic. Select a port from
1,024 - 65,353.
Tunnel Bridging
Select this option to enable or disable bridge packets between two tunnel end points. This
setting is disabled by default.
7. Select the L2TP Tunnel tab.
Device Configuration 5 - 241
Figure 5-150 Device Overrides - Network - L2TPv3 screen, T2TP tunnel tab
8. Set the following for an L2TPv3 profile configuration:
Name
Displays the name of each listed L2TPv3 tunnel assigned upon creation.
Local IP Address
Lists the IP address assigned as the local tunnel end point address, not the interface IP
address. This IP is used as the tunnel source IP address. If this parameter is not specified,
the source IP address is chosen automatically based on the tunnel peer IP address.
MTU
Displays the maximum transmission unit (MTU) size for each listed tunnel. The MTU is the
size (in bytes) of the largest protocol data unit that the layer can pass between tunnel
peers.
Use Tunnel Policy
Lists the L2TPv3 tunnel policy assigned to each listed tunnel.
Local Hostname
Lists the tunnel specific hostname used by each listed tunnel. This is the hostname
advertised in tunnel establishment messages.
Local Router ID
Specifies the router ID sent in the tunnel establishment messages.
Establishment Criteria
Specifies the criteria that should be met for a tunnel between two peers to be created and
maintained.
Critical Resource
Specifies the critical resource that should exist for a tunnel between two peers to be
created and maintained. Critical resources are device IP addresses or interface
destinations interpreted as critical to the health of the network. Critical resources allow
for the continuous monitoring of these defined addresses. A critical resource, if not
available, can result in the network suffering performance degradation. A critical resource
can be a gateway, AAA server, WAN interface or any hardware or service on which the
stability of the network depends. Critical resources are pinged regularly. If there’s a
connectivity issue, an event is generated stating a critical resource is unavailable.
Peer IP Address
Displays the IP address of the device at the other end of the L2TPv3 tunnel.
Host Name
Specifies the administrator assigned hostname of the tunnel.
9. Either select Add to create a new L2TPv3 configuration, Edit to modify an existing tunnel configuration or Delete to remove
a tunnel from those available to this profile.
5 - 242 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-151 Device Overrides - Network - L2TPv3 screen, Add T2TP Tunnel Configuration
10. If creating a new tunnel configuration, assign it a 31 character maximum Name.
11. Define the following Settings required for the L2TP tunnel configuration:
Local IP Address
Enter the IP address assigned as the local tunnel end point address, not the interface IP
address. This IP is used as the tunnel source IP address. If this parameter is not specified,
the source IP address is chosen automatically based on the tunnel peer IP address. This
parameter is applicable when establishing the tunnel and responding to incoming tunnel
create requests.
MTU
Set the maximum transmission unit (MTU). The MTU is the size (in bytes) of the largest
protocol data unit the layer can pass between tunnel peers. Define a MTU from
128 - 1,460 bytes. The default setting is 1,460. A larger MTU means processing fewer
packets for the same amount of data.
Device Configuration 5 - 243
Use Tunnel Policy
Select the L2TPv3 tunnel policy. The policy consists of user defined values for protocol
specific parameters which can be used with different tunnels. If none is available a new
policy can be created or an existing one can be modified. For more information, refer to
Configuring Captive Portal Policies on page 9-2.
Local Hostname
Provide the tunnel specific hostname used by this tunnel. This is the hostname advertised
in tunnel establishment messages.
Local Router ID
Specify the router ID sent in tunnel establishment messages with a potential peer device.
Establishment Criteria
Specify the establishment criteria for creating a tunnel. The tunnel is only created if this
device is one of the following:
• vrrp-master
• cluster-master
• rf-domain-manager
The tunnel is always created if Always is selected. This indicates that the device need not
be any one of the above three (3) to establish a tunnel.
VRRP Group
Set the VRRP group value. This is only applicable if the Establishment Criteria specifies
vrrp-master.
Critical Resource
This table lists the critical resources defined for this system. The tunnel is created and
maintained if the critical resources are available. The tunnel is brought down if any one
of the defined critical resource goes down or is unreachable.
12. Refer to the Peer table to review the configurations of the peers available for tunnel connection.
13. Select + Add Row to populate the table with a maximum of two peer configurations.
Figure 5-152 Device Overrides - Network - L2TPv3 screen, Add L2TP Peer Configuration
5 - 244 WiNG 5.5.3 Access Point System Reference Guide
14. Define the following Peer parameters:
Peer ID
Define the primary peer ID used to set the primary and secondary peer for tunnel failover.
If the peer is not specified, tunnel establishment does not occur. However, if a peer tries
to establish a tunnel with this access point, it creates the tunnel if the hostname and/or
router ID matches.
Peer IP Address
Select this option to enter the numeric IP address used as the tunnel destination peer
address for tunnel establishment.
Host Name
Assign the peer a hostname that can be used as matching criteria in the tunnel
establishment process.
Router ID
Specify the router ID sent in tunnel establishment messages with this specific peer.
Encapsulation
Select either IP or UDP as the peer encapsulation protocol. The default setting is IP. UDP
uses a simple transmission model without implicit handshakes.
UDP Port
If UDP encapsulation is selected, use the spinner control to define the UDP encapsulation
port.
IPSec Secure
Enables or disable IPSec security for the tunnel.
IPSec Gateway
If IPSec Secure is enabled, provide the IPSec gateway device’s IP address.
15. Select OK to save the peer configuration and overrides.
16. Refer to the Session table to review the configurations of the peers available for tunnel connection.
17. Select + Add Row to populate the table with configurable session parameters for this tunnel configuration.
18. Define the following Session parameters:
Name
Enter a 31 character maximum session name. There is no idle timeout for a tunnel. A
tunnel is not usable without a session and a subsequent session name. The tunnel is
closed when the last session tunnel session is closed.
Pseudowire ID
Define a psuedowire ID for this session. A pseudowire is an emulation of a layer 2 pointto-point connection over a packet-switching network (PSN). A pseudowire was developed
out of the necessity to encapsulate and tunnel layer 2 protocols across a layer 3 network.
Traffic Source Type
Lists the type of traffic tunnelled in this session.
Traffic Source Value
Define a VLAN range to include in the tunnel session. Available VLAN ranges are from 1
- 4,094.
Native VLAN
Select this option to provide a VLAN ID that will not be tagged in tunnel establishment
and packet transfer.
19. Select OK to save the changes and overrides to the T2TP Tunnel screen. Select Reset to revert the screen to its last saved
configuration.
20. Select the Manual Session tab.
After a successful tunnel connection and establishment, individual sessions can be created. Each session is a single data
stream. After successful session establishment, data corresponding to that session (pseudowire) can be transferred. If a
session is down, the pseudowire associated with it is shut down as well.
Device Configuration 5 - 245
Figure 5-153 Device Overrides - Network - L2TPv3 screen, Manual Session tab
21. Refer to the following manual session configurations to determine whether one should be created or modified:
IP Address
Lists the IP address assigned as the local tunnel end point address, not the interface IP
address. This IP is used as the tunnel source IP address. If this parameter is not specified,
the source IP address is chosen automatically based on the tunnel peer IP address. This
parameter is applicable when establishing the session and responding to incoming
requests.
Local Session ID
Displays the numeric identifier assigned to each listed tunnel session. This is the
pseudowire ID for the session. This pseudowire ID is sent in a session establishment
message to the L2TP peer.
MTU
Displays each sessions’s maximum transmission unit (MTU). The MTU is the size (in bytes)
of the largest protocol data unit the layer can pass between tunnel peers in this session.
A larger MTU means processing fewer packets for the same amount of data.
Name
Lists the name assigned to each listed manual session.
Remote Session ID
Lists the remote session ID passed in the establishment of the tunnel session.
22. Select Add to create a new manual session, Edit to modify an existing session configuration or Delete to remove a
selected manual session.
5 - 246 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-154 Device Overrides - Network - L2TPv3 screen, Add T2TP Peer Configuration
23. Set the following Session parameters:
Name
Define a 31 character maximum name of this tunnel session. After a successful tunnel
connection and establishment, the session is created. Each session name represents a
single data stream.
IP Address
Specify the IP address used to be as tunnel source ip address. If not specified, the tunnel
source IP address is selected automatically based on the tunnel peer IP address. This
address is applicable only for initiating the tunnel. When responding to incoming tunnel
create requests, it would use the IP address on which it had received the tunnel create
request.
IP
Set the IP address of an L2TP tunnel peer. This is the peer allowed to establish the tunnel.
Local Session ID
Set the numeric identifier for the tunnel session. This is the pseudowire ID for the session.
This pseudowire ID is sent in session establishment message to the L2TP peer.
MTU
Define the session maximum transmission unit (MTU) as the size (in bytes) of the largest
protocol data unit the layer can pass between tunnel peers in this session. A larger MTU
means processing fewer packets for the same amount of data.
Remote Session ID
Use the spinner control to set the remote session ID passed in the establishment of the
tunnel session. Assign an ID from 1 - 4,294,967,295.
Device Configuration 5 - 247
Encapsulation
Select either IP or UDP as the peer encapsulation protocol. The default setting is IP. UDP
uses a simple transmission model without implicit handshakes.
UDP Port
If UDP encapsulation is selected, use the spinner control to define the UDP encapsulation
port. This is the port where the L2TP service is running.
Source VLAN
Define the VLAN range (1 - 4,094) to include in the tunnel. Tunnel session data includes
VLAN tagged frames.
Native VLAN
Select this option to define the native VLAN that will not be tagged
24. Select the + Add Row button to set the following:
Cookie Size
Set the size of the cookie field within each L2TP data packet. Options include 0, 4 and 8.
The default setting is 0.
Value 1
Set the cookie value first word.
Value 2
Set the cookie value second word.
End Point
Define whether the tunnel end point is local or remote.
25. Select OK to save the changes and overrides to the session configuration. Select Reset to revert to the last saved
configuration.
5.4.5.4.4 Overriding IGMP Snooping Configuration
Overriding the Network Configuration
Internet Group Management Protocol (IGMP) is a protocol to establish and maintain multicast group memberships to interested
members. Multicasting allows a computer on a network to send content to multiple computers who have registered to receive
the content. IGMP Snooping is the term for listening to IGMP traffic between an IGMP host and routers in the network to
maintain a map of the links that require multicast streams. Multicast traffic is filtered out for those links which do not require
them.
To configure IGMP Snooping:
1. Select the Configuration tab from the Web UI.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select IGMP Snooping.
5 - 248 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-155 Device Overrides - Network - IGMP Snooping Screen
6. Set the following parameters to configure general IGMP Snooping values.
Enable IGMP Snooping
Select the box to enable IGMP Snooping on the access point. This feature is enabled by
default.
Forward Unknown
Multicast Packets
Select this option to enable the access point to forward multicast packets from
unregistered multicast groups. If disabled, the Unknown Multicast Forward feature is
also disabled for the selected VLANs. This is enabled by default.
7. Set the following for IGMP Querier configuration:
Enable IGMP Querier
Select this option to enable IGMP querier. IGMP snoop querier is used to keep host
memberships alive. It is primarily used in a network where there is a multicast streaming
server and hosts subscribed to the server and no IGMP querier present. The controller can
perform the IGMP querier role. An IGMP querier sends out periodic IGMP query packets.
Interested hosts reply with an IGMP report packet. IGMP snooping is only conducted on
wireless radios. IGMP multicast packets are flooded on wired ports. IGMP multicast
packet are not flooded on the wired port. IGMP membership is also learnt on it and only
if present, then forwarded on that port. An AP71XX model access point can also be an
IGMP querier.
IGMP Version
Use the spinner control to set the IGMP version compatibility to one of IGMP version 1,2
or 3. The default IGMP version is 3.
IGMP Query Interval
Sets the IGMP query interval. This parameter will be used only when the querier
functionality is enabled. Define an interval value in Seconds (1 - 18,000), Minutes (1 - 300)
or Hours (1 - 5) up to maximum of 5 hours. The default value is 60 seconds.
IGMP Robustness
Variable
Sets the IGMP robustness variable. The robustness variable is a way of indicating how
susceptible the subnet is to lost packets. IGMP can recover from robustness variable
minus 1 lost IGMP packets. Define a robustness variable from 1 - 7. The default
robustness value is 2.
Device Configuration 5 - 249
Maximum Response Time Specify the maximum time (from 1 - 25 seconds) before sending a responding report.
When no reports are received from a radio, radio information is removed from the IGMP
snooping table. The access point only forwards multicast packets to radios present in the
snooping table. For IGMP reports from wired ports, the controller forwards these reports
to the multicast router ports. The default setting is 10 seconds.
Other Querier Time Expiry Specify an interval in either Seconds (60 - 300) or Minutes (1 - 5) to set a timeout interval
for other querier resources. The default setting is 1 minute.
8. Select OK to save the changes and overrides to the session configuration. Select Reset to revert to the last saved
configuration.
5.4.5.4.5 Overriding a Quality of Service (QoS) Configuration
Overriding the Network Configuration
QoS values are required to provide service priority to packets. For example, VoIP packets get higher priority than data packets
to provide a better quality of service for high priority voice traffic.
The profile QoS screen maps the 6-bit Differentiated Service Code Point (DSCP) code points to the older 3-bit IP Precedent field
located in the Type of Service byte of an IP header. DSCP is a protocol for specifying and controlling network traffic by class so
that certain traffic types get precedence. DSCP specifies a specific per-hop behavior that is applied to a packet. This QoS
assignment can be overridden as needed, but removes the device configuration from the managed profile that may be shared
with other similar access point models.
To define an QoS configuration for DSCP mappings:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select Quality of Service.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
5 - 250 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-156 Device Overrides - Network QoS screen
6. Set or override the following parameters for the IP DSCP mappings for untagged frames:
DSCP
Lists the DSCP value as a 6-bit parameter in the header of every IP packet used for packet
classification.
802.1p Priority
Assign a 802.1p priority as a 3-bit IP precedence value in the Type of Service field of the
IP header used to set the priority. The valid values for this field are 0-7. Up to 64 entries
are permitted. The priority values are:
0 – Best Effort
1 – Background
2 – Spare
3 – Excellent Effort
4 – Controlled Load
5 – Video
6 – Voice
7 – Network Control
7. Use the spinner controls within the 802.1p Priority field for each DSCP row to change or override the priority value.
8. Select the OK button located to save the changes and overrides. Select Reset to revert to the last saved configuration.
5.4.5.4.6 Overriding a Spanning Tree Configuration
Overriding the Network Configuration
The Multiple Spanning Tree Protocol (MSTP) provides an extension to RSTP to optimize the usefulness o f VLANs. MSTOP
allows for a separate spanning tree for each VLAN group, and blocks all but one of the possible alternate paths within each
spanning tree topology.
Device Configuration 5 - 251
If there’s just one VLAN in the access point managed network, a single spanning tree works fine. However, if the network
contains more than one VLAN, the network topology defined by single STP would work, but it’s possible to make better use of
the alternate paths available by using an alternate spanning tree for different VLANs or groups of VLANs.
A MSTP supported deployment uses multiple MST regions with multiple MST instances (MSTI). Multiple regions and other STP
bridges are interconnected using one single common spanning tree (CST).
MSTP includes all of its spanning tree information in a single Bridge Protocol Data Unit (BPDU) format. BPDUs are used to
exchange information bridge IDs and root path costs. Not only does this reduce the number of BPDUs required to communicate
spanning tree information for each VLAN, but it also ensures backward compatibility with RSTP. MSTP encodes additional
region information after the standard RSTP BPDU as well as a number of MSTI messages. Each MSTI messages conveys
spanning tree information for each instance. Each instance can be assigned a number of configured VLANs. The frames
assigned to these VLANs operate in this spanning tree instance whenever they are inside the MST region. To avoid conveying
their entire VLAN to spanning tree mapping in each BPDU, the access point encodes an MD5 digest of their VLAN to an instance
table in the MSTP BPDU. This digest is used by other MSTP supported devices to determine if the neighboring device is in the
same MST region as itself.
To override a profile’s spanning tree configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select Spanning Tree.
5 - 252 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-157 Device Overrides - Network - Spanning Tree screen
6. Set the following MSTP Configuration parameters:
MSTP Enable
Select this option to enable MSTP for this profile. MSTP is disabled by default, so if
requiring different (groups) of VLANs with the profile supported network segment.
Max Hop Count
Define the maximum number of hops the BPDU will consider valid in the spanning tree
topology. The available range is from 7 - 127. The default setting is 20.
MST Config Name
Define a 64 character maximum name for the MST region as an identifier.
MST Revision Level
Set a numeric revision value ID for MST configuration information. Set a value from
0 - 255. The default setting is 0.
Cisco MSTP
Interoperability
Select either the Enable or Disable radio buttons to enable/disable interoperability with
Cisco’s version of MSTP, which is incompatible with standard MSTP. This setting is
disabled by default.
Hello Time
Set a BPDU hello interval from 1 - 10 seconds. BPDUs are exchanged regularly (every 2
seconds by default) and enable supported devices to keep track of network changes and
star/stop port forwarding as required.
Device Configuration 5 - 253
Forward Delay
Set the forward delay time from 4 - 30 seconds. When a device is first attached to a
port, it does not immediately start to forward data. It first processes BPDUs and
determines the network topology. When a host is attached the port always goes into
the forwarding state, after a delay of while it goes through the listening and learning
states. The time spent in the listening and learning states is defined by the forward
delay (15 seconds by default).
Maximum Age
Use the spinner control to set the maximum time (in seconds) to listen for the root
bridge. The root bridge is the spanning tree bridge with the smallest (lowest) bridge ID.
Each bridge has a unique ID and a configurable priority number, the bridge ID contains
both. The available range is from 6 - 40. The default setting is 20.
7. Define the following PortFast parameters for the profile configuration:
PortFast BPDU Filter
Select Enable to invoke a BPDU filter for this portfast enabled port. Enabling the BPDU
filter feature ensures this port channel does not transmit or receive any BPDUs. BPDUs
are exchanged regularly and enable the access point to keep track of network changes
and to start and stop port forwarding as required. The default setting is disabled.
PortFast BPDU Guard
Select Enable to invoke a BPDU guard for the portfast enabled port. Enabling the BPDU
Guard feature means this port will shutdown on receiving a BPDU. Thus, no BPDUs are
processed. BPDUs are exchanged regularly and enable the access point to keep track of
network changes and to start and stop port forwarding as required. The default setting
is disabled.
8. Define the following Error Disable settings:
Enable Recovery
Select this option to enable a error disable timeout resulting from a BPDU guard. This
setting is disabled by default.
Recovery Interval
Define the recovery interval used to enable disabled ports. The available range is from
10 - 1,000,000 seconds with a default setting of 300.
9. Use the Spanning Tree Instance table to add indexes to the spanning tree topology.
10. Add up to 16 indexes and use the Priority setting to define the bridge priority used to determine the root bridge. The lower
the setting defined, the greater the likelihood of becoming the root bridge in the spanning tree topology.
11. Use the Spanning Tree Instance VLANs table to add VLAN instance indexes (by numeric ID) and VLANs to the spanning
tree topology.
12. Select the OK button located at the bottom right of the screen to save the changes and overrides. Select Reset to revert
to the last saved configuration.
5.4.5.4.7 Overriding a Routing Configuration
Overriding the Network Configuration
Routing is the process of selecting IP paths in a network to send access point managed network traffic. Use the Routing screen
to set destination IP and gateway addresses enabling assignment of static IP addresses for requesting clients without creating
numerous host pools with manual bindings. This eliminates the need for a long configuration file and reduces the resource
space required to maintain address pools.
To override a profile’s route configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
5 - 254 WiNG 5.5.3 Access Point System Reference Guide
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select Routing.
Figure 5-158 Device Overrides - Network - Network Routing screen
6. Select the IP Routing option to enable IP routing using static routes provided in the route table. This option is enabled by
default.
7. Select the Policy Based Routing policy to apply to this profile. Click the Create icon to create a policy based route or
click the Edit to edit an existing policy after selecting it in the drop-down list. For more information on policy based routing,
see Policy Based Routing (PBR) on page 7-2.
8. Select Add Row + as needed to include single rows with in the static IPv4 route table.
9. Add IP addresses and network masks in the Network column.
10. Provide the Gateway used to route traffic.
11. Refer to the Default Route Priority field and set the following parameters:
Static Default Route
Priority
Use the spinner control to set the priority value (1 - 8,000) for the default static route.
The default setting is 100.
DHCP Client Default Route
Priority
Use the spinner control to set the priority value (1 - 8,000) for the default route learnt
from the DHCP client. The default setting is 1000.
Device Configuration 5 - 255
Enable Routing Failure
When selected, all default gateways are monitored for activity. The system will failover
to a live gateway if the current gateway becomes unusable. This feature is enabled by
default.
12. Select the OK button located at the bottom right of the screen to save the changes and overrides. Select Reset to revert
to the last saved configuration.
5.4.5.4.8 Overriding a Dynamic Routing (OSPF) Configuration
Overriding the Network Configuration
Open Shortest Path First (OSPF) is a link-state interior gateway protocol (IGP). OSPF routes IP packets within a single routing
domain (autonomous system), like an enterprise LAN. OSPF gathers link state information from neighbor routers and constructs
a network topology. The topology determines the routing table presented to the Internet Layer which makes routing decisions
based solely on the destination IP address found in IP packets.
OSPF detects changes in the topology, like a link failure, and plots a new loop-free routing structure. It computes the shortest
path for each route using a shortest path first algorithm. Link state data is maintained on each router and is periodically updated
on all OSPF member routers.
OSPF uses a route table managed by the link cost (external metrics) defined for each routing interface. The cost could be the
distance of a router (round-trip time), link throughput or link availability. Setting a cost value provides a dynamic way to load
balancing traffic between routes of equal cost.
An OSPF network can be subdivided into routing areas to simplify administration and optimize traffic utilization. Areas are
logical groupings of hosts and networks, including routers having interfaces connected to an included network. Each area
maintains a separate link state database whose information may be summarized towards the rest of the network by the
connecting router. Areas are identified by 32-bit IDs, expressed either in decimal, or octet-based dot-decimal notation. Areas
can defined as:
• stub area - A stub area is an area which does not receive route advertisements external to the autonomous system (AS)
and routing from within the area is based entirely on a default route.
• totally-stub - A totally stubby area does not allow summary routes and external routes. that is, The only way for traffic to
get routed outside of the area is. A default route is the only way to route traffic outside of the area. When there’s only one
route out of the area, fewer routing decisions are needed, lowering system resource utilization.
• non-stub - An area that imports autonomous system external routes and send them to other areas. However. it still cannot
receive external routes from other areas.
• nssa - NSSA is an extension of a stub that allows the injection of limited external routes into a stub area. If selecting NSSA,
no external routes, except a default route, enter the area.
• totally nssa - This an NSSA using 3 and 4 summary routes are not flooded into this type of area. It is also possible to declare
an area both totally stubby and not-so-stubby, which means that the area will receive only the default route from area
0.0.0.0, but can also contain an autonomous system boundary router (ASBR) that accepts external routing information and
injects it into the local area, and from the local area into area 0.0.0.0
A router running OSPF sends hello packets to discover neighbors and elect a designated router. The hello packet includes link
state information and list of neighbors. OSPF is savvy with layer 2 topologies. If on a point-to-point link, OSPF knows it is
sufficient, and the link stays up. If on a broadcast link, the router waits for election before determining if the link is functional.
To override a profile’s dynamic routing configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5 - 256 WiNG 5.5.3 Access Point System Reference Guide
5. Select OSPF.
Figure 5-159 Device Overrides - Network - OSPF Settings screen
6. Enable/disable OSPF and provide the following dynamic routing settings:
Enable OSPF
Select this option to enable OSPF for this access point. OSPF is disabled by default.
Router ID
Select this option to define a router ID (numeric IP address) for this access point. This
ID must be established in every OSPF instance. If not explicitly configured, the highest
logical IP address is duplicated as the router identifier. However, since the router
identifier is not an IP address, it does not have to be a part of any routable subnet in the
network.
Auto-Cost
Select this option to specify the reference bandwidth (in Mbps) used to calculate the
OSPF interface cost if OSPF is either STUB or NSSA. The default setting is 1.
Passive Mode on All
Interfaces
When selected, all layer 3 interfaces are set as an OSPF passive interface. This setting
is disabled by default.
Passive Removed
If enabling Passive Mode on All Interfaces, use the spinner control to select VLANs (by
numeric ID) as OSPF non passive interfaces. Multiple VLANs can be added to the list.
Passive Mode
If disabling Passive Mode on All Interfaces, use the spinner control to select VLANs (by
numeric ID) as OSPF passive interfaces. Multiple VLANs can be added to the list.
Device Configuration 5 - 257
VRRP Mode Check
Select this option to enable checking VRRP state. If the interface’s VRRP state is not
Backup, then the interface is published via OSPF.
7. Set the following OSPF Overload Protection settings:
Number of Routes
Use the spinner controller to set the maximum number of OSPN routes permitted. The
available range is from 1 - 4,294,967,295.
Retry Count
Set the maximum number of retries (OSPF resets) permitted before the OSPS process is
shut down. The available range is from 1 - 32. The default setting is 5.
Retry Time Out
Set the duration (in seconds) the OSPF process remains off before initiating its next
retry. The available range is from 1 - 3,600 seconds. The default is 60 seconds.
Reset Time
Set the reset time (in seconds) that, when exceeded, changes the retry count is zero.
The available range is from 1 - 86,400. The default is 360 seconds.
8. Set the following Default Information:
Originate
Select this option to make the default route a distributed route. This setting is disabled
by default.
Always
Enabling this setting continuously maintains a default route, even when no routes
appear in the routing table. This setting is disabled by default.
Metric Type
Select this option to define the exterior metric type (1 or 2) used with the default route.
Route Metric
Select this option to define route metric used with the default route. OSPF uses path
cost as its routing metric. It’s defined by the speed (bandwidth) of the interface
supporting given route.
9. Refer to the Route Redistribution table to set the types of routes that can be used by OSPF.
10. Select the + Add Row button to populate the table. Set the Route Type used to define the redistributed route. Options
include connected, kernel and static.
11. Select the Metric Type option to define the exterior metric type (1 or 2) used with the route redistribution. Select the
Metric option to define route metric used with the redistributed route.
12. Use the OSPF Network table to define networks (IP addresses) to connect using dynamic routes.
13. Select the + Add Row button to populate the table. Add the IP address and mask of the network(s) participating in OSPF.
Additionally, define the OSPF area (IP address) to which the network belongs.
14. Set an OSPF Default Route Priority (1 - 8,000) as the priority of the default route learnt from OSPF.
15. Click the Clear button next to the Clear OSPF Process field to clear all OSPF routing entries.
16. Select the Area Settings tab.
An OSPF Area contains a set of routers exchanging Link State Advertisements (LSAs) with others in the same area. Areas
limit LSAs and encourage aggregate routes.
5 - 258 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-160 Device Overrides - Network - OSPF Area Settings screen
17. Review existing Area Settings configurations using:
Area ID
Displays either the IP address or integer representing the OSPF area.
Authentication Type
Lists the authentication schemes used to validate the credentials of dynamic route
connections.
Type
Lists the OSPF area type in each listed configuration.
18. Select Add to create a new OSPF configuration, Edit to modify an existing configuration or Delete to remove a
configuration.
Device Configuration 5 - 259
Figure 5-161 Device Overrides - Network - OSPF Area Configuration screen
19. Set the OSPF Area configuration.
Area ID
Use the drop-down menu and specify either an IP address or Integer for the OSPF area.
Authentication Type
Select either None, simple-password or message-digest as credential validation
scheme used with the OSPF dynamic route. The default setting is None.
Type
Set the OSPF area type as either stub, totally-stub, nssa, totally-nssa or non-stub.
Default Cost
Select this option to set the default summary cost advertised if creating a stub. Set a
value from 1 - 16,777,215.
Translate Type
Define how messages are translated. Options include translate-candidate, translatealways and translate-never. The default setting is translate-candidate.
Range
Specify a range of addresses for routes matching address/mask for OSPF
summarization.
20. Select the OK button to save the changes to the area configuration. Select Reset to revert to the last saved configuration.
21. Select the Interface Settings tab.
5 - 260 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-162 Device Overrides - Network - OSPF Interface Settings screen
22. Review existing Interface Settings using:
Name
Displays the name defined for the interface configuration.
Type
Displays the type of interface.
Description
Lists each interface’s 32 character maximum description.
Admin Status
Displays whether Admin Status privileges have been enabled or disabled for the OSPF
route’s virtual interface connection.
VLAN
Lists the VLAN IDs set for each listed OSPF route virtual interface.
IP Address
Displays the IP addresses defined as virtual interfaces for dynamic OSPF routes. Zero
config and DHCP can be used to generate route addresses, or a primary and secondary
address can be manually provided.
23. Select the Add button to define a new set of virtual interface basic settings, or Edit to update the settings of an existing
virtual interface configuration.
Device Configuration 5 - 261
Figure 5-163 Device Overrides - Network - OSPF Virtual Interface - Basic Configuration screen
24. Within the Properties field, enter a 32 character maximum Description to help differentiate the virtual interface
configuration used with this OSPF route. Enable/disable admin privileges as need. They’re disabled by default.
25. Use the IP Addresses Area to set how route addresses are created for the virtual configuration.
Zero Configuration can be enabled and set as the Primary or Secondary means of providing IP addresses for the OSPF virtual
route. Zero configuration (or zero config) is a wireless connection utility included with Microsoft Windows XP and later as
a service dynamically selecting a network to connect based on a user's preferences and various default settings. Zero config
can be used instead of a wireless network utility from the manufacturer of a computer's wireless networking device. The
drivers for the wireless adapter query the NDIS Object IDs and pass the available network names (SSIDs) to the service.
The service then lists them in the user interface on the Wireless Networks tab in the connection's Properties or in the
Wireless Network Connection dialog box accessible from the notification area. A checked build version of the WZC service
can be used by developers to obtain additional diagnostic and tracing information logged by the service.
26. Select Use DHCP to Obtain IP to use a the access point’s DHCP server resource as the means of providing requested IP
addresses to the OSPF route’s virtual interface.
27. Select Use DHCP to Obtain Gateway/DNS Servers to learn default gateway, name servers and the domain name on
just this interface. Once selected, specify an IP address and mask in dot decimal format.
28. Define the NAT Direction as either Inside, Outside or None.
• Inside - The inside network is transmitting data over the network its intended destination. On the way out, the source IP
address is changed in the header and replaced by the (public) IP address.
5 - 262 WiNG 5.5.3 Access Point System Reference Guide
• Outside - Packets passing through the NAT on the way back to the LAN are searched against the records kept by the NAT
engine. There the destination IP address is changed back to the specific internal private class IP address in order to reach
the LAN over the network.
• None - No NAT activity takes place. This is the default setting.
29. Select OK to save the changes to the basic configuration. Select Reset to revert to the last saved configuration.
30. Select the Security tab.
Figure 5-164 OSPF Virtual Interface - Security screen
31. Use the Inbound IP Firewall Rules drop-down menu to select the IP access and deny rules to apply to the OSPF dynamic
route.
32. Either select an existing IP firewall policy or use the default set of IP firewall rules. The firewall inspects OSPF route traffic
flows and detects potential attacks on the dynamic route not visible to traditional wired firewall appliances. Select the
Create icon to define a new set of IP firewall rules that can be applied to the OSPF route configuration. Selecting Edit
allows for the modification of an existing IP firewall rules configuration. For more information, see Wireless Firewall on
page 8-2.
33. Select the VPN Crypto Map to use with this VLAN configuration. Use the drop-down menu to apply an existing crypto map
configuration to this VLAN interface. Use the Create icon to create a new VPN Crypto Map or use the Edit icon to edit an
existing VPN Crypto Map configuration before applying it to this VLAN.
Crypto Map entries are sets of configuration parameters for encrypting packets passing through the VPN Tunnel. If a Crypto
Map configuration does not exist suiting the needs of this virtual interface, select the Create icon to define a new Crypto
Map configuration or the Edit icon to modify an existing configuration.
34. Select OK to save the changes to the OSPF route security configuration. Select Reset to revert to the last saved
configuration.
35. Select the Dynamic Routing tab.
Device Configuration 5 - 263
Figure 5-165 OSPF Virtual Interface - Dynamic Routing screen
36. Refer to the following to configure OSPF Settings:
Priority
Select to enable or disable OSPF priority settings. Use the spinner to configure a value in
the range 0-255. This option sets the priority of this interface becoming the Designated
Router (DR) for the network. DRs provide routing updates to the network by maintaining a
complete topology table of the network and sends the updates to the other routers in the
network using multicast. Setting a high value increases the chance of this interface
becoming a DR. Setting this value to Zero (0) prevents this interface from being elected a
DR.
Cost
Select to enable or disable OSPF cost settings. Use the spinner to configure a cost value in
the range 1-65535. Use this option to set the OSPF cost of this interface. OSPF cost is the
overhead required to send a packet over this interface.
Bandwidth
Select to enable or disable OSPF bandwidth settings. Use the spinner to configure a
bandwidth settings in the range 1-10,000,000 KBps. Use this option to set the bandwidth
of this interface in KBps.
5 - 264 WiNG 5.5.3 Access Point System Reference Guide
37. Configure the OSPF Authentication Type settings by selecting from the drop-down list. The available options are None,
Null, simple-password and message-digest.
38. Refer the following to configure MD5 Authentication keys. Click the + Add Row button to add a row to the table.
Key ID
Set the unique MD5 Authentication key ID. The available key ID range is 1-255.
Password
Set the OSPF password. This value is displayed as “asterisk” (*). Select Show to display the
actual characters comprising the password.
39. Select OK to save the changes to the OSPF route security configuration. Select Reset to revert to the last saved
configuration.
5.4.5.4.9 Overriding a Forwarding Database Configuration
Overriding the Network Configuration
A Forwarding Database is used by a bridge to forward or filter packets. The bridge reads the packet’s destination MAC address
and decides to either forward the packet or drop (filter) it. If it’s determined the destination MAC is on a different network
segment, it forwards the packet to the segment. If the destination MAC is on the same network segment, the packet is dropped
(filtered). As nodes transmit packets through the bridge, the bridge updates its forwarding database with known MAC
addresses and their locations on the network. This information is then used to decide to filter or forward the packet.
This forwarding database assignment can be overridden as needed, but removes the device configuration from the managed
profile that may be shared with other similar device models.
To define or override a forwarding database configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select Forwarding Database.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s Device
Overrides field and select Clear Overrides. This will remove all overrides from the
device.
Device Configuration 5 - 265
Figure 5-166 Device Overrides - Network Forwarding Database screen
6. Define or override a Bridge Aging Time from 0, 10-1,000,000 seconds.
The aging time defines the length of time an entry will remain in the a bridge’s forwarding table before being deleted due
to lack of activity. If an entry replenishments a destination generating continuous traffic, this timeout value will never be
invoked. However, if the destination becomes idle, the timeout value represents the length of time that must be exceeded
before an entry is deleted from the forwarding table. The default setting is 300 seconds.
7. Define or override the L3e Lite Entry Aging Time from 10 - 1,000,000 seconds.
8. Use the + Add Row button to create a new row within the MAC address table.
9. Set or override a destination MAC Address address. The bridge reads the packet’s destination MAC address and decides
to forward the packet or drop (filter) it. If it’s determined the destination MAC is on a different network, it forwards the
packet to the segment. If the destination MAC is on the same network segment, the packet is dropped (filtered).
10. Define or override the target VLAN ID if the destination MAC is on a different network segment.
11. Provide an Interface Name used as the target destination interface for the target MAC address.
12. Select OK to save the changes and overrides. Select Reset to revert to the last saved configuration.
5.4.5.4.10Overriding a Bridge VLAN Configuration
Overriding the Network Configuration
A Virtual LAN (VLAN) is separately administrated virtual network within the same physical. VLANs are broadcast domains to
allow control of broadcast, multicast, unicast, and unknown unicast within a Layer 2 device.
For example, say several computers are used into conference room X and some into conference Y. The systems in conference
room X can communicate with one another, but not with the systems in conference room Y. The creation of a VLAN enables the
systems in conference rooms X and Y to communicate with one another even though they are on separate physical subnets.
The systems in conference rooms X and Y are managed by the same single entity, but ignore the systems that aren't using same
VLAN ID.
5 - 266 WiNG 5.5.3 Access Point System Reference Guide
Administrators often need to route traffic to interoperate between different VLANs. Bridging VLANs are only for non-routable
traffic, like tagged VLAN frames destined to some other device which will untag it. When a data frame is received on a port,
the VLAN bridge determines the associated VLAN based on the port of reception. Using forwarding database information, the
Bridge VLAN forwards the data frame on the appropriate port(s). VLAN's are useful to set separate networks to isolate some
computers from others, without actually having to have separate cabling and Ethernet switches.
To define a bridge VLAN configuration or override for a device profile:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select Bridge VLAN.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
Figure 5-167 Device Overrides - Network Bridge VLAN screen
6. Review the following VLAN configuration parameters to determine whether an override is warranted:
VLAN
Lists the numerical identifier defined for the Bridge VLAN when it was initially created.
The available range is from 1 - 4094. This value cannot be modified during the edit
process.
Description
Lists a 64 character maximum description of the VLAN assigned when it was created or
modified. The description should be unique to the VLAN’s specific configuration and
help differentiate it from other VLANs with similar configurations.
Device Configuration 5 - 267
Edge VLAN Mode
Defines whether the VLAN is currently in edge VLAN mode. An edge VLAN is the VLAN
where hosts are connected. For example, if VLAN 10 is defined with wireless clients
and VLAN 20 is where the default gateway resides, VLAN 10 should be marked as an
edge VLAN and VLAN 20 shouldn’t be marked as an edge VLAN. When defining a VLAN
as edge VLAN, the firewall enforces additional checks on hosts in that VLAN. For
example, a host cannot move from an edge VLAN to another VLAN and still keep
firewall flows active.
Trust ARP Response
When ARP trust is enabled, a green check mark displays. When disabled, a red “X”
displays. Trusted ARP packets are used to update the IP-MAC Table to prevent IP spoof
and arp-cache poisoning attacks.
Trust DHCP Responses
When DHCP trust is enabled, a green check mark displays. When disabled, a red “X”
displays. When enabled, DHCP packets from a DHCP server are considered trusted and
permissible within the network. DHCP packets are used to update the DHCP Snoop
Table to prevent IP spoof attacks.
7. Select Add to define a new Bridge VLAN configuration, Edit to modify or override an existing Bridge VLAN configuration
or Delete to remove a VLAN configuration.
Figure 5-168 Device Overrides - Add Network Bridge VLAN screen
8. If adding a new bridge VLAN configuration, use the spinner control to define or override a VLAN ID from 1 - 4094. This value
must be defined and saved before the General tab can become enabled and the remainder of the settings defined.
5 - 268 WiNG 5.5.3 Access Point System Reference Guide
9. If creating a new Bridge VLAN, provide a Description (up to 64 characters) unique to the VLAN’s specific configuration to
help differentiate it from other VLANs with similar configurations.
10. Select the Per VLAN Firewall option to enable firewall on this interface. Firewalls, generally, are configured for all
interfaces on a device. When configured, firewalls generate a large amount of flow tables that store information on the
traffic that is allowed to traverse through the firewall. These flow tables occupy a large portion of the limited memory on
the device that could be used for other critical purposes. With the Per VLAN firewall feature enabled on an interface, flow
tables are only generated for that interface, Flow tables are not generated for those interfaces where this feature is not
enabled. This frees up memory that can be used for other purposes.
Firewall can be switched off for those interfaces which are known to carry trusted traffic and only enabled on the interfaces
that can provide a vector for an attack on the network.
11. Select the L2 Tunnel Broadcast Optimization option to prevent flooding of ARP packets on this bridge interface.
Broadcast optimization prevents flooding of ARP packets over the virtual interface. Based on the learned information, ARP
packets are filtered.
12. Set or override the following Extended VLAN Tunnel parameters:
Bridging Mode
Specify one of the following bridging mode for use on the VLAN.
• Automatic: Select Automatic mode to let the controller determine the best bridging
mode for the VLAN.
• Local: Select Local to use local bridging mode for bridging traffic on the VLAN.
• Tunnel: Select Tunnel to use a shared tunnel for bridging traffic on the VLAN. Tunnel
must be selected to successfully create a mesh connection between two Standalone
APs.
• isolated-tunnel: Select isolated-tunnel to use a dedicated tunnel for bridging traffic
on the VLAN.
IP Outbound Tunnel ACL
Select an IP Outbound Tunnel ACL for outbound traffic from the drop-down menu. If an
appropriate outbound IP ACL is not available click the create button to make a new one.
MAC Outbound Tunnel ACL Select a MAC Outbound Tunnel ACL for outbound traffic from the drop-down menu. If
an appropriate outbound MAC ACL is not available click the create button to make a
new one.
NOTE: If creating a mesh connection between two access points in Standalone AP
mode, Tunnel must be selected as the bridging mode to successfully create the mesh link
between the two access points.
13. Select Tunnel Over Level 2 to tunnel extended VLAN traffic over level 2 links.
14. Set or override the following Layer 2 Firewall parameters:
Trust ARP Responses
Select this option to use trusted ARP packets to update the DHCP snoop table to prevent
IP spoof and arp-cache poisoning attacks. This feature is disabled by default.
Trust DHCP Responses
Select this option to use DHCP packets from a DHCP server as trusted and permissible
within the network. DHCP packets are used to update the DHCP snoop table to prevent
IP spoof attacks. This feature is disabled by default.
Device Configuration 5 - 269
Edge VLAN Mode
Select this option to enable edge VLAN mode. When selected, the IP address in the
VLAN is not used for normal operations, as its now designated to isolate devices and
prevent connectivity. This feature is enabled by default.
15. Click the IGMP Snooping tab to set or override the IGMP snooping configuration.
Figure 5-169 Device Overrides - Network Bridge VLAN - IGMP Snooping screen
16. Set the following parameters to configure IGMP Snooping values:
Enable IGMP Snooping
Select this option to enable IGMP snooping. If disabled, snooping on this bridge VLAN is
disabled. This feature is enabled by default. If disabled, the settings under bridge
configuration are overridden.
Forward Unknown
Multicast Packets
Select this option to enable the access point to forward multicast packets from
unregistered multicast groups. If disabled, the Unknown Multicast Forward feature is
also disabled for the selected VLANs. This settings is enabled by default.
17. Set the following parameters for Multicast Router configuration:
Interface Name
Select the interface used for IGMP snooping over a multicast router. Multiple interfaces
can be selected.
Multicast Router Learn
Mode
Set the learning mode to either pim-dvmrp or static.
5 - 270 WiNG 5.5.3 Access Point System Reference Guide
18. Set the following parameters for IGMP Querier configuration:
Enable IGMP Querier
Select this option to enable IGMP querier. IGMP snoop querier is used to keep host
memberships alive. It is primarily used in a network where there is a multicast streaming
server and hosts subscribed to the server and no IGMP querier present. The controller can
perform the IGMP querier role. An IGMP querier sends out periodic IGMP query packets.
Interested hosts reply with an IGMP report packet. IGMP snooping is only conducted on
wireless radios. IGMP multicast packets are flooded on wired ports. IGMP multicast
packet are not flooded on the wired port. IGMP membership is also learnt on it and only
if present, then forwarded on that port.
Source IP Address
Define an IP address applied as the source address in the IGMP query packet. This
address is used as the default VLAN querier IP address.
IGMP Version
Use the spinner control to set the IGMP version compatibility to IGMP version 1, 2 or 3.
The default IGMP version is 3.
Maximum Response Time Specify the maximum time (from 1 - 25 seconds) before sending a responding report.
When no reports are received from a radio, radio information is removed from the IGMP
snooping table. The access point only forwards multicast packets to radios present in the
snooping table. For IGMP reports from wired ports, the controller forwards these reports
to the multicast router ports. The default setting is 10 seconds.
Other Querier Time Expiry Specify an interval in either Seconds (60 - 300) or Minutes (1 - 5) to set a timeout interval
for other querier resources. The default setting is 1 minute.
19. Select the OK button to save the changes and overrides to the IGMP Snooping tab. Select Reset to revert to the last saved
configuration.
5.4.5.4.11Overriding a Cisco Discovery Protocol Configuration
Overriding the Network Configuration
The Cisco Discovery Protocol (CDP) is a proprietary data link layer protocol implemented in Cisco networking equipment. It's
primarily used to obtain IP addresses of neighboring devices and discover their platform information. CDP is also used to obtain
information about the interfaces the access point uses. CDP runs only over the data link layer enabling two systems that support
different network-layer protocols to learn about each other.
To override a profile’s CDP configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select Cisco Discovery Protocol.
Device Configuration 5 - 271
Figure 5-170 Cisco Discovery Protocol (CDP) screen
6. Enable/disable CDP and set the following timer settings:
Enable CDP
Select this option to enable CDP and allow for network address discovery of Cisco
supported devices and operating system version. This setting is enabled by default.
Hold Time
Set a hold time (in seconds) for the transmission of CDP packets. Set a value from 10 1,800. The default setting is 180.
Timer
Use the spinner control to set the interval for CDP packet transmissions. The default
setting is 60 seconds.
7. Select the OK button located at the bottom right of the screen to save the changes and overrides to the CDP configuration.
Select Reset to revert to the last saved configuration.
5.4.5.4.12Overriding a Link Layer Discovery Protocol Configuration
Overriding the Network Configuration
The Link Layer Discovery Protocol (LLDP) provides a standard way for a controller or access point to advertise information about
themselves to networked neighbors and store information they discover from their peers.
LLDP is neighbor discovery protocol that defines a method for network access devices using Ethernet connectivity to advertise
information about them to peer devices on the same physical LAN and store information about the network. It allows a device
to learn higher layer management and connection endpoint information from adjacent devices.
Using LLDP, an access point is able to advertise its own identification, capabilities and media-specific configuration information
and learn the same information from connected peer devices.
LLDP information is sent in an Ethernet frame at a fixed interval. Each frame contains one Link Layer Discovery Protocol Data
Unit (LLDP PDU). A single LLDP PDU is transmitted in a single 802.3 Ethernet frame.
To override a profile’s LLDP configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
5 - 272 WiNG 5.5.3 Access Point System Reference Guide
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Network to expand its sub menu options.
5. Select Link Layer Discovery Protocol.
Figure 5-171 Link Layer Discovery Protocol (LLDP) screen
6. Set the following LLDP parameters for the profile configuration:
Enable LLDP
Select this option to enable LLDP on the access point. LLDP is enabled by default. When
enabled, an access point advertises its identity, capabilities and configuration information
to connected peers and learns the same from them.
Hold Time
Use the spinner control to set the hold time (in seconds) for transmitted LLDP PDUs. Set a
value from 10 - 1,800. The default hold time is 180 seconds.
Timer
Set the interval used to transmit LLDP PDUs. Define an interval from 5 - 900 seconds. The
default setting is 60 seconds.
Inventory Management
Discovery
Select this option to include LLPD-MED inventory management discovery TLV in LLDP
PDUs. This setting is enabled by default.
Extended Power via MDI
Discovery
Select this option to include LLPD-MED extended power via MDI discovery TLV in LLDP
PDUs. This setting is disabled by default.
7. Select the OK button to save the changes and overrides to the LLDP configuration. Select Reset to revert to the last saved
configuration.
5.4.5.4.13Overriding a Miscellaneous Network Configuration
Overriding the Network Configuration
An access point profile can be configured to include a hostname in a DHCP lease for a requesting device and its profile. This
helps an administrator track the leased DHCP IP address by hostname for a device profile. When numerous DHCP leases are
assigned, an administrator can better track the leases when hostnames are used instead of devices.
Device Configuration 5 - 273
To include a hostnames in DHCP request:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand side of the UI.
4. Select Network to expand its sub menu options.
5. Select Miscellaneous.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s Device
Overrides field and select Clear Overrides. This will remove all overrides from the
device.
Figure 5-172 Device Overrides - Network Miscellaneous screen
6. Select the Include Hostname in DHCP Request option to include a hostname in a DHCP lease for a requesting device.
This feature is enabled by default.
7. Select the DHCP Persistent Lease option to retain the last DHCP lease used across a reboot if the access point’s
designated DHCP server is unavailable. This feature is enabled by default.
8. Select the OK button to save the changes and overrides. Select Reset to revert to the last saved configuration.
5 - 274 WiNG 5.5.3 Access Point System Reference Guide
5.4.5.4.14Overriding Alias Configuration
Overriding the Network Configuration
With large deployments, the configuration of remote sites utilizes a set of shared attributes, of which a small set of attributes
are unique for each location. For such deployments, maintaining separate configuration (WLANs, profiles, policies and ACLs)
for each remote site is complex. Migrating any global change to a particular configuration item to all the remote sites is a
complex and time consuming operation.
Also, this practice does not scale gracefully for quick growing deployments.
An alias enables an administrator to define a configuration item, such as a hostname, as an alias once and use the defined
alias across different configuration items such as multiple ACLs.
Once a configuration item, such as an ACL, is utilized across remote locations, the alias used in the configuration item (ACL) is
modified to meet local deployment requirement. Any other ACL or other configuration items using the modified alias also get
modified, simplifying maintenance at the remote deployment.
Aliases have scope depending on where the Alias is defined. Alias are defined with the following scopes:
• Global aliases are defined from the Configuration > Network > Alias screen. Global aliases are available for use globally
across all devices, profiles and RF Domains in the system.
• Profiles aliases are defined from Configuration > Devices > System Profile > Network > Alias screen. These aliases
are available for use to a specific group of wireless controllers or access points. Alias values defined in this profile override
alias values defined within global aliases.
• RF Domain aliases are defined from Configuration > Devices > RF Domain > Alias screen. These aliases are available
for use for a site as a RF Domain is site specific. RF Domain alias values override alias values defined in a global alias or a
profile alias configuration.
• Device aliases are defined from Configuration > Devices > Device Overrides > Network > Alias screen. Device alias
are utilized by a single device only. Device alias values override alias values defined in a global alias, profiles alias or RF
Domain alias configuration.
Using an alias, configuration changes made at a remote location override any updates at the management center. For example,
if an Network Alias defines a network range as 192.168.10.0/24 for the entire network, and at a remote deployment location,
the local network range is 172.16.10.0/24, the Network Alias can be overridden at the deployment location to suit the local
requirement. For the remote deployment location, the Network Alias works with the 172.16.10.0/24 network. Existing ACLs
using this Network Alias need not be modified and will work with the local network for the deployment location. This simplifies
ACL definition and management while taking care of specific local deployment requirements.
Alias can be classified as:
• Network Basic Alias
• Network Group Alias
• Network Service Alias
5.4.5.4.15Network Basic Alias
Overriding Alias Configuration
A basic alias is a set of configurations that consist of VLAN, host, network and address range alias configurations. VLAN
configuration is a configuration for optimal VLAN re-use and management for local and remote deployments. A host alias
configuration is for a particular host device’s IP address. A network alias configuration is utilized for an IP address on a
particular network. An address range alias is a configuration for a range of IP addresses.
A basic alias configuration can contain multiple instances for each of the five (5) alias types.
To override a basic alias configuration:
1. Select Devices from the Configuration tab.
Device Configuration 5 - 275
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand side of the UI.
4. Select Network to expand it and display its sub menus.
5. Select the Alias item, the Basic Alias screen displays.
Figure 5-173 Network - Basic Alias screen
6. Select + Add Row to define VLAN Alias settings.
Use the VLAN Alias field to create unique aliases for VLANs that can be used at different deployments. For example, if a
named VLAN is defined as 10 for the central network, and the VLAN is set at 26 at a remote location, the VLAN can be
overridden at the deployment location with an alias. At the remote deployment location, the network is functional with a
VLAN ID of 26 but utilizes the name defined at the centrally managed network. A new VLAN need not be created specifically
for the remote deployment.
Name
If adding a new VLAN Alias, provide it a distinguishing name up to 32 characters. The alias
name always starts with a dollar sign ($).
VLAN
Use the spinner control to set a numeric VLAN from 1 - 4094.
A VLAN alias can be used to replace VLANs in the following locations:
• Bridge VLAN
• IP Firewall Rules
• L2TPv3
5 - 276 WiNG 5.5.3 Access Point System Reference Guide
• Switchport
• Wireless LANs
7. Select + Add Row to define Host Alias settings.
Use the Host Alias field to create aliases for hosts that can be utilized at different deployments. For example, if a central
network DNS server is set a static IP address, and a remote location’s local DNS server is defined, this host can be
overridden at the remote location. At the remote location, the network is functional with a local DNS server, but uses the
name set at the central network. A new host need not be created at the remote location. This simplifies creating and
managing hosts and allows an administrator to better manage specific local requirements
Name
If adding a new Host Alias, provide it a distinguishing name up to 32 characters. The alias name
always starts with a dollar sign ($).
Host
Set the IP address of the host machine.
A host alias can be used to replace hostnames in the following locations:
• IP Firewall Rules
• DHCP
8. Select + Add Row to define Address Range Alias settings.
Use the Address Range Alias field to create aliases for IP address ranges that can be utilized at different deployments.
For example, if an ACL defines a pool of network addresses as 192.168.10.10 through 192.168.10.100 for an entire network,
and a remote location’s network range is 172.16.13.20 through 172.16.13.110, the remote location’s ACL can be overridden
using an alias. At the remote location, the ACL works with the 172.16.13.20-110 address range. A new ACL need not be
created specifically for the remote deployment location.
Name
If adding a new Address Alias, provide it a distinguishing name up to 32 characters. The
alias name always starts with a dollar sign ($).
Start IP
Set a starting IP address used with a range of addresses utilized with the address range
alias.
End IP
Set a ending IP address used with a range of addresses utilized with the address range
alias.
An address range alias can be used to replace an IP address range in IP firewall rules.
9. Select + Add Row to define Network Alias settings.
Use the Network Alias field to create aliases for IP networks that can be utilized at different deployments. For example,
if a central network ACL defines a network as 192.168.10.0/24, and a remote location’s network range is 172.16.10.0/24,
the ACL can be overridden at the remote location to suit their local (but remote) requirement. At the remote location, the
ACL functions with the 172.16.10.0/24 network. A new ACL need not be created specifically for the remote deployment.
This simplifies ACL definition and allows an administrator to better manage specific local requirements.
Name
If adding a new Network Alias, provide it a distinguishing name up to 32 characters. The alias
name always starts with a dollar sign ($).
Network
Provide a network address in the form of host/mask.
A network alias can be used to replace network declarations in the following locations:
• IP Firewall Rules
• DHCP
Device Configuration 5 - 277
10. Select + Add Row to define String Alias settings.
Use the String Alias field to create aliases for strings that can be utilized at different deployments. For example, if the
main domain at a remote location is called loc1.domain.com and at another deployment location it is called
loc2.domain.com, the alias can be overridden at the remote location to suit the local (but remote) requirement. At one
remote location, the alias functions with the loc1.domain.com domain and at the other with the loc2.domain.com domain.
Name
If adding a new String Alias, provide it a distinguishing name up to 32 characters. The alias
name always starts with a dollar sign ($).
Value
Provide a string value to use in the alias.
A string alias can be used to replace domain name strings in DHCP.
11. Select OK when completed to update the basic alias rules. Select Reset to revert the screen back to its last saved
configuration.
5.4.5.4.16Network Group Alias
Overriding Alias Configuration
A network group alias is a set of configurations that consist of host and network configurations. Network configurations are
complete networks in the form 192.168.10.0/24 or IP address range in the form 192.168.10.10-192.168.10.20. Host
configuration is in the form of single IP address, 192.168.10.23.
A network group alias can contain multiple definitions for host, network, and IP address range. A maximum of eight (8) Host
entries, eight (8) Network entries and eight (8) IP addresses range entries can be configured inside a network group alias. A
maximum of 32 network group alias entries can be created.
A network group alias is used in IP firewall rules to substitute hosts, subnets and IP address ranges:
To edit or delete a network alias configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand side of the UI.
4. Select Network to expand it and display its sub menus.
5. Select the Alias item, the Basic Alias screen displays.
6. Select the Network Group Alias tab.
5 - 278 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-174 Network - Alias - Network Group Alias screen
Name
Displays the administrator assigned name of the Network Group Alias.
Host
Displays all host aliases configured in this network group alias. Displays a blank column if no
host alias is defined.
Network
Displays all network aliases configured in this network group alias. Displays a blank column if
no network alias is defined.
7. Select Edit to modify the attributes of an existing policy or Delete to remove obsolete policies from the list of those
available. Select Add to create a new Network Group Alias. Copy to copy an existing policy or Rename to rename an
existing policy.
Device Configuration 5 - 279
Figure 5-175 Network - Alias - Network Group Alias Add screen
8. If adding a new Network Group Alias, provide it a name of up to 32 characters.
NOTE: The Network Group Alias Name always starts with a dollar sign ($).
9. Define the following network group alias parameters:
Host
Specify the host IP address for up to eight IP addresses supporting network aliasing. Select the
down arrow to add the IP address to the table.
Network
Specify the netmask for up to eight IP addresses supporting network aliasing. Subnets can
improve network security and performance by organizing hosts into logical groups. Applying the
subnet mask to an IP address separates the address into a host address and an extended
network address. Select the down arrow to add the mask to the table.
10. Within the Range table, use the + Add Row button to specify the Start IP address and End IP address for the alias range
or double-click on an existing an alias range entry to edit it.
11. Select OK when completed to update the network group alias rules. Select Reset to revert the screen back to its last saved
configuration.
5 - 280 WiNG 5.5.3 Access Point System Reference Guide
5.4.5.4.17Network Service Alias
Overriding Alias Configuration
Network Service Alias is a set of configurations that consist of protocol and port mappings. Both source and destination ports
are configurable. For each protocol, up to 2 source port ranges and up to 2 destination port ranges can be configured. A
maximum of 4 protocol entries can be configured per Network Service Alias.
Use a service alias to associate more than one IP address to a network interface, providing multiple connections to a network
from a single IP node.
A network service alias can be used in IP firewall rules to substitute protocols and ports:
To edit or delete a service alias configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand side of the UI.
4. Select Network to expand it and display its sub menus.
5. Select the Alias item, the Basic Alias screen displays.
6. Select the Network Service Alias tab.
Figure 5-176 Network - Alias - Network Service Alias screen
7. Select Edit to modify the attributes of an existing policy or Delete to remove obsolete policies from the list of those
available. Select Add to create a new Network Service Alias.
Device Configuration 5 - 281
Figure 5-177 Network - Alias - Network Service Alias Add screen
8. If adding a new Network Service Alias, provide it a name up to 32 characters.
NOTE: The Network Service Alias Name always starts with a dollar sign ($).
9. Within the Range field, use the + Add Row button to specify the Start IP address and End IP address for the service alias
range or double-click on an existing service alias range entry to edit it.
Protocol
Specify the protocol for which the alias has to be created. Use the drop down to select the
protocol from eigrp, gre, icmp, igmp, ip, vrrp, igp, ospf, tcp and udp. Select other if the protocol
is not listed. When a protocol is selected, its protocol number is automatically selected.
Source Port
(Low and High)
Note: Use this field only if the protocol is tcp or udp.
Specify the source ports for this protocol entry. A range of ports can be specified. Select the
Enter Range button next to the field to enter a lower and higher port range value. Up to eight
(8) such ranges can be specified.
Destination Port
(Low and High)
Note: Use this field only if the protocol is tcp or udp.
Specify the destination ports for this protocol entry. A range of ports can be specified. Select
the Enter Range button next to the field to enter a lower and higher port range value. Up to eight
(8) such ranges can be specified.
10. Select OK when completed to update the network service alias rules. Select Reset to revert the screen back to its last
saved configuration.
5.4.5.5 Overriding a Security Configuration
Device Overrides
A profile can have its own firewall policy, wireless client role policy, WEP shared key authentication, NAT policy and VPN policy
applied. If an existing firewall, client role or NAT policy is unavailable create the required security policy configuration. Once
created, a configuration can have an override applied as needed to meet the changing data protection requirements of a
5 - 282 WiNG 5.5.3 Access Point System Reference Guide
device’s deployed environment. However, in doing so this device must now be managed separately from the profile
configuration shared by other identical models within the network.
For more information on applying an override to an existing device profile, refer to the following sections:
• Overriding General Security Settings
• Overriding a Certificate Revocation List (CRL) Configuration
• Overriding a Profile’s NAT Configuration
5.4.5.5.1 Overriding VPN Configuration using Wizards
Overriding a Security Configuration
VPN can be overridden by using either the inbuilt wizards or by manually configuring the required parameters. This section
describes how to use the inbuilt wizards to override the VPN parameters. The user interface provides two (2) wizards that
provide different levels of configuration. The following screen displays:
Figure 5-178 Security Configuration Wizard screen
The following options are available:
• Quick Setup Wizard – Use this wizard to setup basic VPN Tunnel on the device. This wizard is aimed at novice users and
enables them to setup a basic VPN with minimum effort. This wizard uses default values for most of the parameters.
• Step By Step Wizard – Use this wizard to setup a VPN Tunnel step by step. This wizard is aimed at intermediate users
who require the ability to customize some of the parameters.
• Advanced Configuration – Use this option to configure the VPN parameters manually.
Click the Start button to display the next screen for the wizards or when Advanced Configuration is selected, to display the
VPN screen.
Device Configuration 5 - 283
5.4.5.5.2 Quick Setup Wizard
Overriding General Security Settings
The Quick Setup Wizard creates a VPN connection with minimum manual configuration. Default values are retained for most
of the parameters.
Figure 5-179 VPN Quick Setup Wizard
1. Provide the following information to configure a VPN tunnel:
Tunnel Name
Provide a name for the tunnel. Tunnel name must be such that it easily identifies the tunnel
uniquely.
Tunnel Type
Configure the tunnel type as one of the following:
• Site-to-Site – Provides a secured connection between two sites
• Remote Access – Provides access to a network to remote devices.
5 - 284 WiNG 5.5.3 Access Point System Reference Guide
Select Interface
Configure the interface for creating the tunnel. The following options are available:
• VLAN – Configures the tunnel over a Virtual LAN interface. Use the spinner to configure
the VLAN number.
• WWLAN – Configures the tunnel over the WWLAN interface.
• PPPoE – Configures the tunnel over the PPPoE interface.
Traffic Selector (ACL)
Configure ACLs that manage the traffic passing through the VPN Tunnel.
• Source – Provide the source network along with its mask
• Destination – Provide the destination network along with its mask.
Peer
Configures the peer for this tunnel. The peer device can be specified either by its
hostname or by its IP address.
Authentication
Configure the authentication used to identify peers. The following can be configured:
• Certificate – Use a certificate to authenticate
• Pre-Shared Key – Use a pre-shared key to authenticate.
Local Identity
Configure the local identity used with peer configuration for an IKE exchange with the
target VPN IPSec peer. Options include IP Address, Distinguished Name, FQDN, email and
string. The default setting is string.
Remote Identity
Configure the access point remote identifier for an IKE exchange with the target VPN
IPSec peer. Options include IP Address, Distinguished Name, FQDN, email and string. The
default setting is string.
IKE Policy
Configure the IKE policy to use. IKE is used to exchange authentication keys. Select from
one of the following:
• All – Uses any IKE policy.
• IKE1 – Uses IKE 1 only
• IKE2 – Uses IKE 2 only
Transform Set
Configure the transform set used to specify how traffic is protected within the crypto ACL
defining the traffic that needs to be protected. Select the appropriate traffic set from the
drop-down menu.
2. Click the Save button to save the VPN Tunnel configuration. To exit without saving, click Cancel.
5.4.5.5.3 Step By Step Wizard
Overriding General Security Settings
The Quick Setup Wizard creates a VPN connection with minimum manual configuration. Default values are retained for most
of the parameters.
The Step-By-Step wizard creates a VPN connection with more manual configuration than the Quick Setup Wizard. Use this
wizard to manually configure Access Control Lists, IKE Policy, and Transform Sets to customize the VPN Tunnel.
1. Select the Step-By-Step Wizard option from the VPN screen.
2. Click the Start button. The following screen displays:
Device Configuration 5 - 285
Figure 5-180 VPN Step-By-Step Wizard - Step 1
3. Define the following:
Tunnel Name
Provide a name for the tunnel in the Tunnel Name field.
Tunnel Type
Select the tunnel type being created. Two types of tunnels can be created. Site to Site is used
to create a tunnel between two remote sites as indicated in the image. Remote Access is used
to create a tunnel between an user device and a network as indicated in the image.
Interface
Select the interface to use. Interface can be a Virtual LAN (VLAN) or WWAN or PPPoE
depending on the interfaces available on the device.
Traffic Selector (ACL) This field creates the Access Control List (ACL) that is used to control who uses the network.
Provide the Source and Destination IP address ranges with their net mask. Click the Add Rule
button to add the rule into the ACL.
4. Click the Next button to go to Step 2.
5 - 286 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-181 VPN Step-By-Step Wizard - Step 2
5. In Step 2 screen, configure the following parameters:
Peer
Select the type of peer for this device when forming a tunnel. Peer information can be either
IP Address or Host Name. Provide the IP address or the hostname of the peer device.
Authentication
Configure how the devices authenticate with each other.
• Certificate – The devices use certificates to validate credentials.
• Pre-Shared Key – The devices use pre-shared key to authenticate.
Local Identity
Configure the local identity for the VPN Tunnel.
• IP Address – The local identity is an IP address.
• FQDN – The local identity is a Fully Qualified Domain Name (FQDN).
• Email – The local identity is an E-mail address.
Remote Identity
Configure the remote identity for the VPN Tunnel.
• IP Address – The remote identity is an IP address.
• FQDN – The remote identity is a Fully Qualified Domain Name (FQDN).
• Email – The remote identity is an E-mail address.
IKE Policy
Configure the IKE policy to use when creating this VPN Tunnel. The following options are
available:
• Use Default – Click this option to use the default IKE profiles. Select one of ike1-default or
ike2-default.
• Create new Policy – Click this option to create a new IKE policy.
Device Configuration 5 - 287
6. Click the Add Peer button to add the Tunnel peer information into the Peer(s) table. This table lists all the peers configured
for the VPN Tunnel.
7. Click the Next button to go to the next configuration screen. Use the Back button to go to the previous step.
Figure 5-182 VPN Step-By-Step Wizard - Step 3
8. Configure the following IPSec parameters:
Transform Set
Transform set is a set of configurations exchanged for creating the VPN tunnel and impose a
security policy.The transform set is comprised of the following:
• Encryption – The encryption to use for creating the tunnel.
• Authentication – The authentication used to identify tunnel peers
• Mode – The mode of the tunnel. This is how the tunnel will operate.
From the drop-down, select any pre-configured Transform Set or click the Create New Policy
to create a new transform set.
Encryption
This field is enabled when Create New Policy is selected in Transform Set field. This is the
encryption that is used on data traversing through the tunnel. Select from esp-null, des, 3des,
aes, aes-192 and aes-256 algorithms.
Authentication
This field is enabled when Create New Policy is selected in Transform Set field. This is the
method peers authenticate as the source of the packet to other peers after a VPN Tunnel has
been created. Select from MD5 or SHA.
5 - 288 WiNG 5.5.3 Access Point System Reference Guide
Mode
This field is enabled when Create New Policy is selected in Transform Set field. The mode
indicates how packets are transported through the tunnel.
• Tunnel – Use this mode when the tunnel is between two routers or servers.
• Transport – Use this mode when the tunnel is created between a client and a server.
Security Association
Configures the lifetime of a security association (SA). Keys and SAs should be periodically
renewed to maintain security of the tunnel.
• Lifetime – Duration in seconds after which the keys should be changed. Set a value in from
500 - 2,147,413,646 seconds.
• Data – The key is changed after this quantity of data has be encrypted/decrypted. Set a
value from 500 - 2,147,413,646 KBs.
9. Click the Next button to go to the next configuration screen. Use the Back button to go to the previous step.
Figure 5-183 VPN Step-By-Step Wizard - Step 4
10. Review the configuration and click the Done button to create the VPN tunnel. Use the Back button to go back to previous
screen for making modifications to the configuration. Click Close to close the wizard without creating a VPN Tunnel.
5.4.5.5.4 Overriding Auto IPSec Tunnel Settings
Overriding a Security Configuration
IPSec tunnels are established to secure traffic, data and management traffic, from access points to remote wireless controllers.
Secure tunnels must be established between access points and the wireless controller with minimum configuration pushed
through DHCP option settings.
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
Device Configuration 5 - 289
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Security to expand its sub menu options.
5. Select Auto IPSec Tunnel to configure its parameters.
Figure 5-184 Device Overrides - Security – Auto IPSec Tunnel screen
6. Refer to the following table to override the Auto IPSec tunnel settings:
Group ID
Configure the ID string used for IKE authentication. String length can be between 1-64
characters
Authentication Type
Set the IPSec Authentication Type. Options include PSK (Pre Shared Key) or rsa.
Authentication Key
Set the common key for authentication between the remote tunnel peer. Key length is
between 8-21 characters
IKE Version
Configure the IKE version to use. The available options are ikev1-main, ikev1-aggr and
ikev2.
Enable NAT after IPSec
Select this option to enable NAT after IPSec. Enable this if there are NATted networks
behind VPN tunnels.
Use Unique ID
In scenarios where different access points behind different NAT boxes/routers have the
same IP address, it is not possible to create a tunnel between the wireless controller
and access point, as the wireless controller fails to identify the access point uniquely.
When selected, each access point behind a same NAT box/router will have an unique
ID which is used to create the VPN tunnel.
7. Select OK to save the updates made to the Auto IPSec Tunnel screen. Selecting Reset reverts the screen to its last saved
configuration.
5.4.5.5.5 Overriding General Security Settings
Overriding a Security Configuration
A profile can leverage existing firewall, wireless client role and WIPS policies and configurations and apply them to the
configuration. This affords a profile a truly unique combination of data protection policies. However, as deployment
requirements arise, an individual access point may need some or all of its general security configuration overridden from that
applied in the profile.
To define a profile’s security settings and overrides:
1. Select Devices from the Configuration tab.
5 - 290 WiNG 5.5.3 Access Point System Reference Guide
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Security to expand its sub menu options.
5. Select Settings.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
Figure 5-185 Device Overrides - Security Settings screen
6. Refer to the General field to assign or override the following:
Firewall Policy
Select the firewall policy used by devices with this profile. Use the icons next to this
field to create or add new firewall policies.
Wireless Client Role
Policy
Select the Wireless Client Role Policy used by devices with this profile. Use the icons
next to this field to create or add new role policies.
WEP Shared Key
Authentication
Select this option to require devices using this profile to use a WEP key to access the
network using this profile. Clients without Motorola Solutions adapters need to use
WEP keys manually configured as hexadecimal numbers. This option is disabled by
default.
7. Select OK to save the changes or overrides. Select Reset to revert to the last saved configuration.
Device Configuration 5 - 291
5.4.5.5.6 Overriding a Certificate Revocation List (CRL) Configuration
Overriding a Security Configuration
A certificate revocation list (CRL) is a list of certificates that have been revoked or are no longer valid. A certificate can be
revoked if the certificate authority (CA) had improperly issued a certificate, or if a private-key is compromised. The most
common reason for revocation is the user no longer being in sole possession of the private key.
To define a Certificate Revocation configuration or override:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Security to expand its sub menu options.
5. Select Certificate Revocation.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
Figure 5-186 Device Overrides - Certificate Revocation screen
6. Select the + Add Row button to add a column within the Certificate Revocation List (CRL) Update Interval table to
quarantine certificates from use in the network.
Additionally, a certificate can be placed on hold for a user defined period. If, for instance, a private key was found and
nobody had access to it, its status could be reinstated.
7. Provide the name of the trustpoint in question within the Trustpoint Name field. The name cannot exceed 32 characters.
8. Enter the resource ensuring the trustpoint’s legitimacy within the URL field.
5 - 292 WiNG 5.5.3 Access Point System Reference Guide
9. Use the spinner control within the Hours field to specify an interval (in hours) after which the access point copies a CRL
file from an external server and associates it with a trustpoint.
10. Select OK to save the changes and overrides made within the Certificate Revocation screen. Select Reset to revert to
the last saved configuration.
5.4.5.5.7 Overriding a Profile’s NAT Configuration
Overriding a Security Configuration
Network Address Translation (NAT) is a technique to modify network address information within IP packet headers in transit
across a traffic routing device. This enables mapping one IP address to another to protect network address credentials. With
typical deployments, NAT is used as an IP masquerading technique to hide private IP addresses behind a single, public facing,
IP address.
NAT is a process of modifying network address information in IP packet headers while in transit across a traffic routing device
for the purpose of remapping one IP address to another. In most deployments, NAT is used in conjunction with IP masquerading
which hides RFC1918 private IP addresses behind a single public IP address.
NAT provides outbound Internet access to wired and wireless hosts. Many-to-one NAT is the most common NAT technique for
outbound Internet access. Many-to-one NAT allows the access point to translate one or more private IP addresses to a single,
public facing, IP address assigned to a 10/100/1000 Ethernet port or 3G card.
To define a NAT configuration or override that can be applied to a profile:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Security to expand its sub menu options.
5. Select NAT.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
Device Configuration 5 - 293
Figure 5-187 Device Overrides - NAT Pool screen
6. The NAT Pool tab displays by default. The NAT Pool screen lists those NAT policies created thus far. Any of these policies
can be selected and applied to a profile.
7. Select Add to create a new NAT policy that can be applied to a profile. Select Edit to modify or override the attributes of
a existing policy or select Delete to remove obsolete NAT policies from the list of those available to a profile.
Figure 5-188 Device Overrides - Security - NAT Pool screen
5 - 294 WiNG 5.5.3 Access Point System Reference Guide
8. If adding a new NAT policy or editing the configuration of an existing policy, define the following parameters:
Name
If adding a new NAT policy, provide a name to help distinguish it from others with
similar configurations. The length cannot exceed 64 characters.
IP Address Range
Define a range of IP addresses hidden from the public Internet. NAT modifies network
address information in the defined IP range while in transit across a traffic routing
device. NAT only provides IP address translation and does not provide a firewall. A
branch deployment with NAT by itself will not block traffic from being potentially routed
through a NAT device. Consequently, NAT should be deployed with a stateful firewall.
9. Select the + Add Row button as needed to append additional rows to the IP Address Range table.
10. Select OK to save the changes or overrides made to the profile’s NAT Pool configuration. Select Reset to revert to the last
saved configuration.
11. Select the Static NAT tab. The Source tab displays by default.
The Source tab displays existing static NAT configurations. Existing static NAT configurations are not editable, but new
configurations can be added or existing ones deleted as they become obsolete.
Static NAT creates a permanent, one-to-one mapping between an address on an internal network and a perimeter or
external network. To share a Web server on a perimeter interface with the Internet, use static address translation to map
the actual address to a registered IP address. Static address translation hides the actual address of the server from users
on insecure interfaces. Casual access by unauthorized users becomes much more difficult. Static NAT requires a dedicated
address on the outside network for each host.
Figure 5-189 Device Overrides - Static NAT screen
To map a source IP address from an internal network to a NAT IP address click the Add button. The following screen
displays:
Device Configuration 5 - 295
Figure 5-190 Device Overrides - Add NAT Source screen
12. Define the following Source NAT parameters:
Protocol
Select the protocol for use with static translation. TCP, UDP and Any are the available
options. Transmission Control Protocol (TCP) is a transport layer protocol used by
applications requiring guaranteed delivery. It’s a sliding window protocol handling both
timeouts and retransmissions. TCP establishes a full duplex virtual connection between
two endpoints. Each endpoint is defined by an IP address and a TCP port number. The User
Datagram Protocol (UDP) offers only a minimal transport service, non-guaranteed
datagram delivery, and provides applications direct access to the datagram service of the
IP layer. UDP is used by applications not requiring the level of service of TCP or are using
communications services (multicast or broadcast delivery) not available from TCP. The
default setting is Any.
Source IP
Enter the address used at the (internal) end of the static NAT configuration. This address
(once translated) will not be exposed to the outside world when the translation address is
used to interact with the remote destination.
Source Port
Use the spinner control to set the local port number used at the (internal) end of the static
NAT configuration. The default value is port 1.
NAT IP
Enter the IP address of the matching packet to the specified value. The IP address modified
can be either source or destination based on the direction specified.
5 - 296 WiNG 5.5.3 Access Point System Reference Guide
NAT Port
Enter the port number of the matching packet to the specified value. This option is valid
only if the direction specified is destination.
Network
Select Inside or Outside NAT as the network direction. The default setting is Inside.
Select Inside to create a permanent, one-to-one mapping between an address on an
internal network and a perimeter or external network. To share a Web server on a
perimeter interface with the Internet, use static address translation to map the actual
address to a registered IP address. Static address translation hides the actual address of
the server from users on insecure interfaces. Casual access by unauthorized users
becomes much more difficult. Static NAT requires a dedicated address on the outside
network for each host. Inside NAT is the default setting.
13. Select the Destination tab to view destination NAT configurations and define packets passing through the NAT on the way
back to the LAN are searched against to the records kept by the NAT engine. The destination IP address is changed back to
the specific internal private class IP address to reach the LAN over the network.
Figure 5-191 Device Overrides - NAT Destination screen
14. Select Add to create a new NAT destination configuration. or Delete to permanently remove a NAT destination. Existing
NAT destination configurations are not editable.
Device Configuration 5 - 297
Figure 5-192 Device Overrides - Add Destination NAT screen
15. Set or override the following Destination configuration parameters:
16. Static NAT creates a permanent, one-to-one mapping between an address on an internal network and a perimeter or
external network. To share a Web server on a perimeter interface with the Internet, use static address translation to map
the actual address to a registered IP address. Static address translation hides the actual address of the server from users
on insecure interfaces. Casual access by unauthorized users becomes much more difficult. Static NAT requires a dedicated
address on the outside network for each host.
Protocol
Select the protocol for use with static translation. TCP, UDP and Any are available options.
TCP is a transport layer protocol used by applications requiring guaranteed delivery. It’s a
sliding window protocol handling both timeouts and retransmissions. TCP establishes a
full duplex virtual connection between two endpoints. Each endpoint is defined by an IP
address and a TCP port number. The User Datagram Protocol (UDP) offers only a minimal
transport service, non-guaranteed datagram delivery, and provides applications direct
access to the datagram service of the IP layer. UDP is used by applications not requiring
the level of service of TCP or are using communications services (multicast or broadcast
delivery) not available from TCP. The default setting is Any.
Destination IP
Enter the local address used at the (source) end of the static NAT configuration. This
address (once translated) will not be exposed to the outside world when the translation
address is used to interact with the remote destination.
Destination Port
Use the spinner control to set the local port number used at the (source) end of the static
NAT configuration. The default value is port 1.
NAT IP
Enter the IP address of the matching packet to the specified value. The IP address modified
can be either source or destination based on the direction specified.
NAT Port
Select this option and enter the port number of the matching packet to the specified value.
This option is valid only if the direction specified is destination.
5 - 298 WiNG 5.5.3 Access Point System Reference Guide
Network
Select Inside or Outside NAT as the network direction. Inside is the default setting.
Select Inside to create a permanent, one-to-one mapping between an address on an
internal network and a perimeter or external network. To share a Web server on a
perimeter interface with the Internet, use static address translation to map the actual
address to a registered IP address. Static address translation hides the actual address of
the server from users on insecure interfaces. Casual access by unauthorized users
becomes much more difficult. Static NAT requires a dedicated address on the outside
network for each host. Inside NAT is the default setting.
17. Select OK to save the changes or overrides made to the static NAT configuration. Select Reset to revert to the last saved
configuration.
18. Select the Dynamic NAT tab.
Dynamic NAT translates the IP address of packets going out from one interface to another interface based on configured
conditions. Dynamic NAT requires packets be switched through a NAT router to generate translations in the translation
table.
Figure 5-193 Device Overrides - Dynamic NAT screen
19. Refer to the following to determine whether a new Dynamic NAT configuration requires creation, edit or deletion:
Source List ACL
Lists an ACL to define the packet selection criteria for the NAT configuration. NAT is
applied only on packets which match a rule defined in the access-list. These addresses
(once translated) are not exposed to the outside world when the translation address is
used to interact with the remote destination.
Device Configuration 5 - 299
Network
Displays Inside or Outside NAT as the network direction for the dynamic NAT
configuration.
Interface
Lists the VLAN (from 1 - 4094) used as the communication medium between the source
and destination points within the NAT configuration.
Overload Type
Options include NAT Pool, One Global Address and Interface IP Address. Interface IP
Address is the default setting.
NAT Pool
Displays the name of an existing NAT pool used with the dynamic NAT configuration.
Overload IP
If One Global IP Address is selected as the Overload Type, define an IP address used as a
filter address for the IP ACL rule.
ACL Precedence
Lists the administrator assigned priority set for the listed source list ACL. The lower the
value listed, the higher the priority assigned to this ACL rule.
20. Select Add to create a new Dynamic NAT configuration, Edit to modify or override an existing configuration or Delete to
permanently remove a configuration.
Figure 5-194 Device Overrides - Security - NAT - Source ACL List screen
21. Set or override the following to define the Dynamic NAT configuration:
Source List ACL
Use the drop-down menu to select an ACL name to define the packet selection criteria for
NAT. NAT is applied only on packets which match a rule defined in the access-list. These
addresses (once translated) will not be exposed to the outside world when the translation
address is used to interact with the remote destination.
Network
Select Inside or Outside NAT as the network direction for the dynamic NAT configuration.
Inside is the default setting.
ACL Precedence
Set the priority (from 1 - 5000) for the source list ACL. The lower the value, the higher the
priority assigned to the ACL rule.
5 - 300 WiNG 5.5.3 Access Point System Reference Guide
Interface
Select the VLAN (from 1 - 4094) or WWAN used as the communication medium between
the source and destination points within the NAT configuration. Ensure the VLAN selected
adequately supports the intended network traffic within the NAT supported configuration.
Overload Type
Define the overload type utilized when Several internal addresses are NATed to only one
or a few external addresses. Options include NAT Pool, One Global Address and Interface
IP Address. Interface IP Address is the default setting.
NAT Pool
Provide the name of an existing NAT pool for use with the dynamic NAT configuration.
Overload IP
If One Global IP Address is selected as the Overload Type, define an IP address used a
filter address for the IP ACL rule.
22. Select OK to save the changes or overrides made to the dynamic NAT configuration. Select Reset to revert to the last saved
configuration.
5.4.5.5.8 Overriding the Profile’s Bridge NAT Configuration
Profile Security Configuration
Use Bridge NAT to manage Internet traffic originating at a remote site. In addition to traditional NAT functionality, Bridge NAT
provides a means of configuring NAT for bridged traffic through an access point. NAT rules are applied to bridged traffic through
the access point, and matching packets are NATed to the WAN link instead of being bridged on their way to the router.
Using Bridge NAT, a tunneled VLAN (extended VLAN) is created between the NoC and a remote location. When a remote client
needs to access the Internet, Internet traffic is routed to the NoC, and from there routed to the Internet. This increases the
access time for the end user on the client.
To resolve latency issues, Bridge NAT identifies and segregates traffic heading towards the NoC and outwards towards the
Internet. Traffic towards the NoC is allowed over the secure tunnel. Traffic towards the Internet is switched to a local WLAN
link with access to the Internet.
NOTE: Bridge NAT supports single AP deployments only. This feature cannot be used in
a branch deployment with multiple access points.
To define a Bridge NAT configuration that can be applied to a profile:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select Device Overrides from the options on left-hand side of the UI.
4. Expand the Security menu and select Bridge NAT.
Device Configuration 5 - 301
Figure 5-195 Profile Override - Security - Bridge NAT screen
5. Review the following Bridge NAT configurations to determine whether a new Bridge NAT configuration requires creation
or an existing configuration overridden or removed:
ACL
Lists the ACL applying IP address access/deny permission rules to the Bridge NAT configuration.
Interface
Lists the communication medium (outgoing layer 3 interface) between source and destination
points. This is either the access point’s pppoe1 or w wan1 interface or the VLAN used as the
redirection interface between the source and destination.
NAT Pool
Lists the names of existing NAT pools used with the Bridge NAT configuration. This displays only
when Overload Type is NAT Pool.
Overload IP
Lists the address used globally and collectively for numerous local addresses.
Overload Type
Lists the overload type used with the listed IP ACL rule. Set as either NAT Pool, One Global
Address or Interface IP Address.
ACL Precedence
Lists the administrator assigned priority set for the ACL. The lower the value listed, the higher
the priority assigned to this ACL.
6. Select Add to create a new Bridge VLAN configuration, Edit to modify or override an existing configuration or Delete to
remove a configuration.
5 - 302 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-196 Profile Security - Dynamic NAT screen
7. Select the ACL whose IP rules are applied to this policy based forwarding rule. A new ACL can be defined by selecting the
Create icon, or an existing set of IP ACL rules can be modified by selecting the Edit icon.
8. Use the spinner to select the ACL Precedence. The lower the precedence value, the higher the priority assigned to this
Dynamic NAT policy rule.
9. Use the IP Address Range table to configure IP addresses and address ranges that can used to access the Internet.
Interface
Lists the outgoing layer 3 interface on which traffic is re-directed. The interface can be an
access point WWAN or PPPoE interface. Traffic can also be redirected to a designated
VLAN.
NAT Pool
Displays the NAT pool used by this Bridge NAT entry. A value is only displayed only when
Overload Type has been set to NAT Pool.
Overload IP
Lists whether the single global address supporting numerous local addresses.
Overload Type
Displays the override type for this policy based forwarding rule.
10. Select + Add Row to set the IP address range settings for the Bridge NAT configuration.
Device Configuration 5 - 303
Figure 5-197 Profile Security - Source Dynamic NAT screen - Add Row field
11. Select OK to save the changes made within the Add Row and Dynamic NAT screens. Select Reset to revert to the last
saved configuration.
5 - 304 WiNG 5.5.3 Access Point System Reference Guide
5.4.5.6 Overriding the Virtual Router Redundancy Protocol (VRRP) Configuration
System Profile Configuration
A default gateway is a critical resource for connectivity. However, it’s prone to a single point of failure. Thus, redundancy for
the default gateway is required by the access point. If WAN backhaul is available on an AP7131, and a router failure occurs,
then the access point should act as a router and forward traffic on to its WAN link.
Define an external Virtual Router Redundancy Protocol (VRRP) configuration when router redundancy is required in a wireless
network requiring high availability.
Central to the configuration of VRRP is the election of a VRRP master. A VRRP master (once elected) performs the following
functions:
• Responds to ARP requests
• Forwards packets with a destination link layer MAC address equal to the virtual router MAC address
• Rejects packets addressed to the IP address associated with the virtual router, if it is not the IP address owner
• Accepts packets addressed to the IP address associated with the virtual router, if it is the IP address owner or accept
mode is true
Those nodes that lose the election process enter a backup state. In the backup state they monitor the master for any failures,
and in case of a failure one of the backups, in turn, becomes the master and assumes the management of the designated virtual
IPs. A backup does not respond to an ARP request, and discards packets destined for a virtual IP resource.
NOTE: VRRP support is available only on AP7131 model access point, and is not
available on other models.
To define the configuration of a VRRP group:
1. Select the Configuration tab from the Web UI.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select VRRP.
Device Configuration 5 - 305
Figure 5-198 Device Overrides - VRRP screen - VRRP tab
5. Review the following VRRP configuration data to assess if a new VRRP configuration is required or if an existing VRRP
configuration requires modification or removal:
Virtual Router ID
Lists a numerical index (from 1 - 254) used to differentiate VRRP configurations. The index
is assigned when a VRRP configuration is initially defined. This ID identifies the virtual
router a packet is reporting status for.
Description
Displays a description assigned to the VRRP configuration when it was either created or
modified. The description is implemented to provide additional differentiation beyond the
numerical virtual router ID.
Virtual IP Addresses
Lists the virtual interface IP address used as the redundant gateway address for the
virtual route.
Interface
Displays the interfaces selected on the access point to supply VRRP redundancy failover
support.
Priority
Lists a numerical value (from 1 - 254) used for the virtual router master election process.
The higher the numerical value, the higher the priority in the election process.
6. Select the Version tab to define the VRRP version scheme used with the configuration.
5 - 306 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-199 Device Overrides - VRRP screen - Version tab
VRRP version 3 (RFC 5798) and 2 (RFC 3768) are selectable to set the router redundancy. Version 3 supports sub-second
(centisecond) VRRP failover and support services over virtual IP. For more information on the VRRP protocol specifications
(available publicly) refer to http://www.ietf.org/rfc/rfc3768.txt (version 2) and http://www.ietf.org/rfc/rfc5798.txt (version
3).
7. From within the VRRP tab, select Add to create a new VRRP configuration or Edit to modify the attributes of an existing
VRRP configuration. If necessary, existing VRRP configurations can be selected and permanently removed by selecting
Delete.
Device Configuration 5 - 307
Figure 5-200 Device Overrides - VRRP screen
8. If creating a new VRRP configuration, assign a Virtual Router ID from 1 - 255. In addition to functioning as numerical
identifier, the ID identifies the access point’s virtual router a packet is reporting status for.
9. Define the following VRRP General parameters:
Description
In addition to an ID assignment, a virtual router configuration can be assigned a textual
description (up to 64 characters) to further distinguish it from others with a similar
configuration.
Priority
Use the spinner control to set a VRRP priority setting from 1 - 254. The access point uses
the defined setting as criteria in selection of a virtual router master. The higher the value,
the greater the likelihood of this virtual router ID being selected as the master.
5 - 308 WiNG 5.5.3 Access Point System Reference Guide
Virtual IP Addresses
Provide up to 8 IP addresses representing the Ethernet switches, routers or security
appliances defined as virtual router resources to the AP7131 access point.
Advertisement Interval
Unit
Select either seconds, milliseconds or centiseconds as the unit used to define VRRP
advertisements. Once an option is selected, the spinner control becomes enabled for that
Advertisement Interval option. The default interval unit is seconds. If changing the VRRP
group version from 2 to 3, ensure the advertisement interval is in centiseconds. Use VRRP
group version 2 when the advertisement interval is either in seconds or milliseconds.
Advertisement Interval
Once the Advertisement Interval Unit has been selected, use the spinner control to set the
interval at which the VRRP master sends out advertisements on each of its configured
VLANs. The default setting is 1 second.
Preempt
Select this option to ensure a high priority backup router is available to preempt a lower
priority backup router resource. The default setting is enabled. When selected, the
Preempt Delay option becomes enabled to set the actual delay interval for pre-emption.
This setting determines if a node with a higher priority can takeover all the Virtual IPs from
the nodes with a lower priority.
Preempt Delay
If the Preempt option is selected, use the spinner control to set the delay interval (in
seconds) for preemption.
Interface
Select this value to enable/disable VRRP operation and define the AP7131 VLAN
(1 - 4,094) interface where VRRP will be running. These are the interfaces monitored to
detect a link failure.
10. Refer to the Protocol Extension field to define the following:
Sync Group
Select this option to assign a VRRP sync group to this VRRP ID’s group of virtual IP
addresses. This triggers VRRP failover if an advertisement is not received from the virtual
masters that are part of this VRRP sync group. This setting is disabled by default.
Network Monitoring:
Local Interface
Select wwan1, pppoe1 and VLAN ID(s) as needed to extend VRRP monitoring to these
local access point interfaces. Once selected, these interfaces can be assigned an
increasing or decreasing level or priority for virtual routing within the VRRP group.
Network Monitoring:
Critical Resources
Assign the priority level for the selected local interfaces. Backup virtual routers can
increase or decrease their priority in case the critical resources connected to the master
router fail, and then transition to the master state themselves. Additionally, the master
virtual router can lower its priority if the critical resources connected to it fails, so the
backup can transition to the master state. This value can only be set on the backup or
master router resource, not both. Options include None, increment-priority, and
decrement priority.
Network Monitoring:
Delta Priority
Use this setting to decrement the configured priority (by the set value) when the
monitored interface is down. When critical resource monitoring, the configured value is
incremented by the value defined.
11. Select OK to save the changes made to the VRRP configuration. Select Reset to revert to the last saved configuration.
Device Configuration 5 - 309
5.4.5.7 Profile Critical Resources
System Profile Configuration
Critical resources are device IP addresses or interface destinations on the network interoperated as critical to the health of the
network. The critical resource feature allows for the continuous monitoring of these addresses. A critical resource, if not
available, can result in the network suffering performance degradation. A critical resource can be a gateway, a AAA server, a
WAN interface or any hardware or service on which the stability of the network depends. Critical resources are pinged regularly
by the access point. If there’s a connectivity issue, an event is generated stating a critical resource is unavailable. By default,
there’s no enabled critical resource policy, and one needs to be created and implemented.
Critical resources can be monitored directly through the interfaces on which they’re discovered. For example, a critical resource
on the same subnet as the access point can be monitored by its IP address. However, a critical resource located on a VLAN
must continue to monitored on that VLAN.
Critical resources can be configured for access points and wireless controllers using their respective profiles.
To define critical resources:
1. Select the Configuration tab from the Web UI.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Critical Resources.
Figure 5-201 Device Overrides - Critical Resources screen - List of Critical Resources tab
The screen lists the destination IP addresses or interfaces (VLAN, WWAN, or PPPoE) used for critical resource connection.
IP addresses can be monitored directly by the access point or controller, whereas a VLAN, WWAN or PPPoE must be
monitored behind an interface.
5. Select the Add button at the bottom of the screen to add a new critical resource and connection method, or select and
existing resource and select Edit to update the resource’s configuration.
5 - 310 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-202 Device Overrides - Critical Resources screen - Adding a Critical Resource
6. Use the Offline Resource Detection drop-down menu to define how critical resource event messages are generated.
Options include Any and All. If selecting Any, an event is generated when the state of any single critical resource changes.
If selecting All, an event is generated when the state of all monitored critical resources change.
7. Select the IP option (within the Monitor Via field at the top of the screen) to monitor a critical resource directly (within
the same subnet) using the provided critical resource IP address as a network identifier.
8. Select the Interface option (within the Monitor Via field at the top of the screen) to monitor a critical resource using either
the critical resource’s VLAN, WWAN1 or PPPoE1 interface. If VLAN is selected, a spinner control is enabled to define the
destination VLAN ID used as the interface for the critical resource.
9. Select + Add Row to define the following for critical resource configurations:
IP Address
Provide the IP address of the critical resource. This is the address used by the access point to ensure
the critical resource is available. Up to four addresses can be defined.
Mode
Set the ping mode used when the availability of a critical resource is validated. Select from:
• arp-only – Use the Address Resolution Protocol (ARP) for only pinging the critical resource. ARP
is used to resolve hardware addresses when only the network layer address is known.
• arp-and-ping – Use both ARP and Internet Control Message Protocol (ICMP) for pinging the critical
resource and sending control messages (device not reachable, requested service not available,
etc.).
Port
Provide the port on which the critical resource is available. Use the spinner control to set the port
number.
VLAN
Define the VLAN on which the critical resource is available using the spinner control.
Device Configuration 5 - 311
10. Select the Monitor Interval tab.
Figure 5-203 Device Overrides - Critical Resources screen - Monitor Interval tab
11. Set the duration between two successive pings from the access point to critical resource. Define this value in seconds from
5 - 86,400. The default setting is 30 seconds.
12. Configure the IP address for Port-Limited Monitoring in the Source IP for Port-Limited Monitoring field. Sets the IP
address used as the source address in ARP packets used to detect a critical resource on a layer 2 interface. Generally, the
source address 0.0.0.0 is used in the APR packets used to detect critical resources. However, some devices do not support
the above IP address and drop the ARP packets. Use this field to provide an IP address specifically used for this purpose.
The IP address used for Port-Limited Monitoring must be different from the IP address configured on the device.
13. Select OK to save the changes to the critical resource configuration and monitor interval. Select Reset to revert to the last
saved configuration.
5 - 312 WiNG 5.5.3 Access Point System Reference Guide
5.4.5.8 Overriding a Services Configuration
Device Overrides
A profile can contain specific guest access (captive portal), DHCP server and RADIUS server configurations. These access, IP
assignment and user authorization resources can be defined uniquely as profile requirements dictate.
To define or override a profile’s services configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Services.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
Figure 5-204 Device Overrides - Services screen
5. Refer to the Captive Portal Hosting field to set or override a guest access configuration (captive portal) for use with this
profile.
A captive portal is guest access policy for providing temporary and restrictive access to the network. The primary means of
securing such guest access is a captive portal.
A captive portal configuration provides secure authenticated access using a standard Web browser. A captive portal
provides authenticated access by capturing and re-directing a user's Web browser session to a captive portal login page
where the user must enter valid credentials to access to the network. Once logged into the captive portal, additional
Agreement, Welcome and Fail pages provide the administrator with a number of options on the captive portal’s screen flow
and user appearance.
Device Configuration 5 - 313
Either select an existing captive portal policy, use the default captive portal policy or select the Create link to create a new
captive portal configuration that can be applied to a profile. For more information, see Configuring Captive Portal Policies
on page 9-2.
6. Select OK to save the changes or overrides made to the profile’s services configuration. Select Reset to revert to the last
saved configuration.
5.4.5.9 Overriding a Management Configuration
Device Overrides
There are mechanisms to allow/deny management access to the network for separate interfaces and protocols (HTTP, HTTPS,
Telnet, SSH or SNMP). These management access configurations can be applied strategically to profiles as resource
permissions dictate for the profile. Additionally, overrides can be applied to customize a device’s management configuration,
if deployment requirements change and a devices configuration must be modified from its original device profile configuration.
Additionally, an administrator can define a profile with unique configuration file and device firmware upgrade support.
To define or override a profile’s management configuration:
1. Select Devices from the Configuration tab.
2. Select Device Overrides from the Device menu to expand it into sub menu options.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Management.
NOTE: A blue override icon (to the left of a parameter) defines the parameter as having
an override applied. To remove an override, go to the Basic Configuration screen’s
Device Overrides field and select Clear Overrides. This will remove all overrides
from the device.
5 - 314 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-205 Device Overrides - Management Settings screen
5. Refer to the Message Logging field to define how the profile logs system events. It’s important to log individual events to
discern an overall pattern that may be negatively impacting performance.
Enable Message Logging
Select this option to enable the profile to log system events to a user defined log file
or a syslog server. Selecting this radio button enables the rest of the parameters
required to define the profile’s logging configuration. This option is disabled by
default.
Remote Logging Host
Use this table to define numerical (non DNS) IP addresses for up to three external
resources where logged system events can be sent on behalf of the profile. Select
Clear as needed to remove an IP address.
Facility to Send Log
Messages
Use the drop-down menu to specify the local server facility (if used) for the profile
event log transfer.
Syslog Logging Level
Event severity coincides with the syslog logging level defined for the profile. Assign a
numeric identifier to log events based on criticality. Severity levels include
0 - Emergency, 1 - Alert, 2 - Critical, 3 - Errors, 4 - Warning, 5 - Notice, 6 - Info
and 7 - Debug. The default logging level is 4.
Device Configuration 5 - 315
Console Logging Level
Event severity coincides with the console logging level defined for the profile. Assign
a numeric identifier to log events based on criticality. Severity levels include
0 - Emergency, 1 - Alert, 2 - Critical, 3 - Errors, 4 - Warning, 5 - Notice, 6 - Info
and 7 - Debug. The default logging level is 4.
Buffered Logging Level
Event severity coincides with the buffered logging level defined for the profile. Assign
a numeric identifier to log events based on criticality. Severity levels include
0 - Emergency, 1 - Alert, 2 - Critical, 3 - Errors, 4 - Warning, 5 - Notice, 6 - Info and
7 - Debug. The default logging level is 4.
Time to Aggregate Repeated
Messages
Define the increment (or interval) system events are logged on behalf of this profile.
The shorter the interval, the sooner the event is logged. Either define an interval in
Seconds (0 - 60) or Minutes (0 -1). The default value is 0 seconds.
Forward Logs to Controller
Select this option to define a log level for forwarding event logs to the control. Log
levels include Emergency, Alert, Critical, Error, Warning, Notice, Info and Debug. The
default logging level is Error.
6. Refer to the System Event Messages field to define or override how system messages are logged and forwarded on
behalf of the profile.
7. Select the Enable System Events radio button to allow the profile to capture system events and append them to a log
file. It’s important to log individual events to discern an overall pattern that may be negatively impacting performance. This
settings is enabled by default.
8. Select the Enable System Event Forwarding radio button to enable the forwarding of system events. This setting is
enabled by default.
9. Refer to the Events E-mail Notification field to define or override how system event notification E-mails are sent.
SMTP Server
Specify either the Hostname or IP Address of the outgoing SMTP server where
notification E-mails are originated.
Port of SMTP
If a non-standard SMTP port is used on the outgoing SMTP server select this option
and specify a port from 1 - 65,535 for the outgoing SMTP server to use.
Sender E-mail Address
Specify the E-mail address that notification E-mails will be sent from. This will be the
from address on notification E-mails.
Recipient’s E-mail Address
Specify the E-mail address(es) of recipients for E-mail notifications.
Username for SMTP Server
Specify the username of the sender on the outgoing SMTP server. Many SMTP servers
require users to authenticate with an username and password before sending E-mail
through the server.
Password for SMTP Server
Specify the password associated with the username of the sender on the outgoing
SMTP server. Many SMTP servers require users to authenticate with an username and
password before sending E-mail through the server.
10. Use the Configure drop-down menu within the Persist Configuration Across Reloads field to define whether the
access point saves a configuration received from a Virtual Controller AP to flash memory. The configuration would then be
made available if the this access point reboots and the Virtual Controller AP is not reachable. Options include Enabled,
Disabled and secure.
11. Use the HTTP Analytics section to define how data for analysis by an external engine is sent. Select Compress to
compress the data before sending. Use the Update Interval field to set the duration and set the time interval in minutes,
seconds or hours when the collected data is sent to the external analytics engine.
5 - 316 WiNG 5.5.3 Access Point System Reference Guide
12. Select OK to save the changes and overrides made to the profile’s Management Settings. Select Reset to revert to the last
saved configuration.
13. Select the Firmware tab from the Management menu.
Figure 5-206 Device Overrides - Management Firmware screen
14. Refer to the Auto Install via DHCP Option field to define automatic configuration file and firmware updates.
Enable Configuration Update Select this option to enable automatic configuration file updates for the controller
profile from a location external to the access point.
If enabled (the setting is disabled by default), provide a complete path to the target
configuration file used in the update.
Enable Firmware Update
Select this option to enable automatic firmware updates from a user defined remote
location. This value is disabled by default.
15. Use the parameters within the Automatic Adopted AP Firmware Upgrade field to define an automatic firmware
upgrade from a controller based file.
Enable Controller Upgrade
of AP Firmware
Select the access point model to upgrade using its associated Virtual Controller AP’s
most recent firmware file for that model. This parameter is enabled by default.
Number of Concurrent
Upgrades.
Use the spinner control to define the maximum number (1 - 20) of adopted APs that
can receive a firmware upgrade at the same time. Keep in mind during a firmware
upgrade, the access point is offline and unable to perform its normal wireless client
support function until the upgrade process is complete.
16. Select OK to save the changes and overrides made to the profile’s Management Firmware configuration. Select Reset to
revert to the last saved configuration.
17. Select Heartbeat from the Management menu.
Device Configuration 5 - 317
Figure 5-207 Device Overrides - Management Heartbeat screen
18. Select the Service Watchdog option to implement heartbeat messages to ensure other associated devices are up and
running and capable of effectively interoperating. The Service Watchdog is enabled by default.
19. Select OK to save the changes and overrides made to the profile maintenance Heartbeat tab. Select Reset to revert to the
last saved configuration.
5.4.5.10 Overriding Mesh Point Configuration
Device Overrides
The access point can be configured to be a part of a meshed network. A mesh network is one where each node in the network
is be able to communicate with other nodes in the network and where the node can maintain more than one path to its peers.
Mesh network provides robust, reliable and redundant connectivity to all the members of the network. When one of the
participant node in a mesh network becomes unavailable, the other nodes in the network are still able to communicate with
each other either directly or through intermediate nodes.
Mesh Point is the name given to a device that is a part of a meshed network.
Use the Mesh Point screen to configure or override the parameters that set how this device behaves as a part of the mesh
network.
To override Mesh Point configuration:
1. Select Devices from the Configuration menu.
2. Select Device Overrides to expand its menu items.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Mesh Point.
5 - 318 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-208 Device Overrides - Mesh Point screen
5. Select Add to create a new mesh point configuration or Edit to override an existing one. Select Delete to delete a mesh
point configuration after selecting it.
Device Configuration 5 - 319
Figure 5-209 Device Overrides - Add Mesh Point screen
6. Refer to the following to configure Mesh Point general parameters:
Mesh Connex Policy
Provide a name for the Mesh Connex Policy. Use the Create icon to create a new Mesh
Connex Policy. To edit an existing policy, select it from the drop-down and click the Edit
icon. For more information on creating or editing a Mesh Connex Policy, see MeshConnex
Policy on page 6-85.
Is Root
From the drop-down menu, select the root behavior of this access point. Select True to
indicate this access point is a root node for this mesh network. Select False to indicate
this access point is not a root node for this mesh network.
A Root Mesh Point is defined as a mesh point that is connected to the WAN and provides
a wired backhaul to the network.
Root Selection Method
Use the drop-down menu to determine whether this mesh point is the root or non-root
mesh point. Select either None (the default setting) or auto-mint.
Set as Root
Select this option to set the mesh point as the cost root for mesh point root selection. This
setting is disabled by default.
5 - 320 WiNG 5.5.3 Access Point System Reference Guide
Monitor Critical
Resources
Select this option to enable critical resource monitoring for this mesh point.
Monitor Primary Port
Link
Select to enable monitoring of primary port link is enabled for this mesh connex policy. If
the primary port link is not present and if the device is a mesh root, it is automatically
changed to a non-root device. When the primary port link becomes available again, the
non-root device is changed back to a root device.
Wired Peer Exclude
Select this option to exclude wired peers when creating mesh links.
Path Method
From the drop-down menu, select the method to use for path selection in a mesh network.
The available options are:
• None – Select this to indicate no criteria used in root path selection.
• uniform – Select this to indicate that the path selection method is uniform. When
selected, two paths will be considered equivalent if the average value is the same for
these paths.
• mobile-snr-leaf – Select this if this access point is mounted on a vehicle or a mobile
platform (AP7161 models only). When selected, the path to the route will be selected
based on the Signal To Noise Ratio (SNR) to the neighbor device.
• snr-leaf – Select this to indicate that the path with the best signal to noise ratio is
always selected.
Minimum Threshold
Enter the minimum value for SNR above which a candidate for the next hop in a dynamic
mesh network is considered. This field along with Signal Strength Delta and Sustained
Time Period are used to dynamically select the next hop in a dynamic mesh network.
Signal Strength Delta
Enter a delta value in dB. A candidate for selection as a next hop in a dynamic mesh
network must have a SNR higher than the value configured here. This field along with the
Minimum Threshold and Sustained Time Period are used to dynamically select the next
hop in a dynamic mesh network.
Sustained Time Period
Enter the time duration in seconds (0 - 600) or minutes (0 - 10). This indicates the duration
that a signal must sustain the constraints specified in the Minimum Threshold and Signal
Strength Delta path hysteresis values. These values are used to dynamically select the
next hop in a dynamic mesh network.
SNR Delta Range
Select the root selection method hysteresis (from 1 - 100dB) SNR delta range a candidate
must sustain. The default setting is 1 dB.
7. Refer to the following to configure Mesh Point Root Path Preference parameters:
Preferred Neighbor
Enter the MAC address of the preferred neighbor for this mesh point.
Preferred Root
Enter the MAC address of the preferred mesh root for this mesh point.
Preferred Interface
Select the preferred Interface for this mesh point. Select None to set no preferences. The
other interface choices are 2.4 GHz and 5 GHz.
NOTE: With this release of Motorola Solutions WiNG software, an AP7161 model
access point can be deployed as a Vehicle Mounted Modem (VMM) to provide wireless
network access to a mobile vehicle (car, train, etc.). A VMM provides layer 2 mobility for
connected devices. VMM does not provide layer 3 services, such as IP mobility. For
VMM deployment considerations, see Vehicle Mounted Modem (VMM) Deployment
Consideration.
Device Configuration 5 - 321
8. Click the Auto Channel Selection tab to configure the parameters for the Mesh Connex Auto Channel Selection policy.
The following screen displays:
Figure 5-210 Mesh Point Auto Channel Selection screen
9. By default, the Dynamic Root Selection screen displays.
This screen provides configuration for the 2.4 GHz and 5.0/4.9 GHz frequencies. Refer to the following for more information
on the Auto Channel Selection Dynamic Root Selection screen. These descriptions are common for configuring the 2.4 GHZ
and 5.0/4.9 GHz frequencies
Channel Width
Configure the channel width that mesh point automatic channel scan should assign to the
selected radio. The available options are:
• Automatic – Indicates the channel width is calculated automatically. This is the
default value.
• 20 MHz – Indicates the width between two adjacent channels is 20 MHz.
• 40 MHz – Indicates the width between two adjacent channels is 40 MHz.
5 - 322 WiNG 5.5.3 Access Point System Reference Guide
Priority Meshpoint
Configure the mesh point to be monitored for automatic channel scan. This is the mesh
point that given priority over other available mesh points. When configured, a mesh is
created with this mesh point. When not configured, a mesh point is automatically
selected.
Off Channel Duration
Configure the duration in the range of 20 - 250 milliseconds for the Off Channel Duration
field. This is the duration that the scan dwells on each channel when performing an off
channel scan.
Off Channel Scan
Frequency
Configure the time duration in seconds between two consecutive Off Channel Scans. Set
a duration between 1 - 60 seconds.
Meshpoint Root - Sample
Count
Configure the number of scans to be performed for data collection before a mesh channel
is selected. Set a value between 1 - 10 scans.
Meshpoint Root - Channel
Hold Time
Configure the minimum duration to stay on a selected channel before the channel
conditions are reassessed for a possible channel change. Set a value between 0 - 1440
minutes. Set this value to ‘Zero’ (0) to prevent a automatic channel selection from
happening.
10. Select the Path Method SNR tab to configure the signal to noise ratio when selecting the path to the mesh point root.
Figure 5-211 Mesh Point Auto Channel Selection Path Method SNR screen
Device Configuration 5 - 323
Refer to the following for more information on the Path Method SNR screen. These descriptions apply to both the 2.4 GHz
and 5.0/4.9 GHz frequencies.
Channel Width
Configure the channel width that mesh point automatic channel scan should assign to the
selected radio. The available options are:
• Automatic – Indicates the channel width is calculated automatically. This is the
default value.
• 20 MHz – Indicates the width between two adjacent channels is 20 MHz.
• 40 MHz – Indicates the width between two adjacent channels is 40 MHz.
Priority Meshpoint
Configure the mesh point to be monitored for automatic channel scan. This is the mesh
point that given priority over other available mesh points. When configured, a mesh is
created with this mesh point. When not configured, a mesh point is automatically
selected.
SNR Delta
Configure the signal to noise ratio delta value for path selection.
When path selection occurs, this set value is considered for selecting the optimal path.
A better candidate on a different channel must have a signal strength that exceeds this
delta value when compared to the signal strength of the next hop in the mesh network.
SNR Threshold
Configure the signal to noise threshold value for path selection.
When the signal strength of the next hop in the mesh network goes below this value, a
scan is triggered to select a better next hop.
Off-channel Duration
Configure the duration in the range of 20 - 250 milliseconds for the Off Channel Duration
field. This is the duration that the scan dwells on each channel when performing an off
channel scan.
11. Select the Path Method Root Path Metric tab to configure the parameters controlling the calculation of the root path
metrics.
5 - 324 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-212 Mesh Point Auto Channel Selection Path Method Root Path Metric screen
12. Refer to the following for more information on the Path Method Root Path Metric screen. These descriptions apply to both
the 2.4 GHz and 5.0/4.9 GHz frequencies.
Channel Width
Configure the channel width that mesh point automatic channel scan should assign to the
selected radio. The available options are:
• Automatic – Indicates the channel width is calculated automatically. This is the
default value.
• 20 MHz – Indicates the width between two adjacent channels is 20 MHz.
• 40 MHz – Indicates the width between two adjacent channels is 40 MHz.
Device Configuration 5 - 325
Priority Meshpoint
Configure the mesh point to be monitored for automatic channel scan. This is the mesh
point that given priority over other available mesh points. When configured, a mesh is
created with this mesh point. When not configured, a mesh point is automatically
selected.
Meshpoint: Path
Minimum
Configure the minimum path metric value for a mesh connection. Set a value between
100 - 20,000.
Meshpoint: Path Metric
Threshold
Configure a minimum threshold value for triggering an automatic channel selection for
mesh point selection. Set a value in between 800 - 65535.
Meshpoint: Tolerance
Period
Configure the time duration in seconds to wait before triggering a automatic channel
selection for the next hop.
Meshpoint: Root Sample
Count
Configure the number of scans to be performed for data collection before a mesh point
root is selected. Set a value between 1 - 10 scans.
Meshpoint: Root Offchannel Duration
Configure the duration in the range of 20 - 250 milliseconds for the Off Channel Duration
field when scanning for mesh point root. This is the duration that the scan dwells on each
channel when performing an off channel scan.
Meshpoint: Root Channel
Switch Delta
Configure the delta value in dBm in the range 5 - 35 dBm which when crossed triggers a
mesh point root automatic channel selection.
Meshpoint: Root Offchannel Scan Frequency
Configure the duration in seconds between two consecutive Off Channel Scans for mesh
point root. Set a duration between 1 - 60 seconds.
Meshpoint: Root Channel
Hold Time
Configure the minimum duration to stay on a selected channel before the channel
conditions are reassessed for a possible channel change for mesh point root. Set a value
between 0 - 1440 minutes. Set this value to ‘Zero’ (0) to prevent a automatic channel
selection from happening.
13. Select OK to save the changes. Select Reset to revert to the last saved configuration. Select Exit to exit this screen.
14. Select OK to save the changes made to the profile’s mesh point configuration. Select Reset to revert to the last saved
configuration.
5.4.5.10.1Vehicle Mounted Modem (VMM) Deployment Consideration
Mesh Point Configuration
Before defining a VMM configuration (mounting an AP7161 mesh point on a moving vehicle), refer to the following deployment
guidelines to ensure the configuration is optimally effective:
• Disable layer 2 stateful packet inspection from the firewall policy.
• Set the RTS threshold value to 1 on all mesh devices. The default value is 2347. For more information on defining radio
settings, see Access Point Radio Configuration.
• Use Opportunistic as the rate selection settings for the AP7161 radio The default is Standard. For more information on
defining this settings, see Radio Override Configuration.
• Disable Dynamic Chain Selection (radio setting). The default value is enabled. This setting is disabled from the Command
Line Interface (CLI) using the dynamic-chain-selection command, or, in the UI (refer Radio Override Configuration.
• Disable A-MPDU Aggregation if the intended vehicular speed is greater than 30 mph. For more information, see Radio
Override Configuration.
5 - 326 WiNG 5.5.3 Access Point System Reference Guide
5.4.5.11 Overriding an Advanced Configuration
Device Overrides
Advanced device settings sets or overrides a profile’s MiNT and/or NAS configurations.
MINT secures controller profile communications at the transport layer. Using MINT, a device can be configured to only
communicate with other authorized (MINT enabled) devices. access point managed devices can communicate with each other
exclusively over a MINT security domain. Keys can also be generated externally using any application (like openssl). These keys
must be present on the managed device managing the domain for key signing to be integrated with the UI. A MAP device that
needs to communicate with another first negotiates a security context with that device. The security context contains the
transient keys used for encryption and authentication. A secure network requires users to know about certificates and PKI.
However, administrators do not need to define security parameters for access points to be adopted (secure WISPe being an
exception, but that isn’t a commonly used feature). Also, users can replace any device on the network or move devices around
and they continue to work. Default security parameters for MiNT are such that these scenarios continue to function as
expected, with minimal user intervention required only when a new network is deployed.
The profile database on the RADIUS server consists of user profiles for each connected Network Access Server (NAS) port.
Each profile is matched to a username representing a physical port. When users are authorized, it queries the user profile
database using a username representative of the physical NAS port making the connection.
To set or override an advanced configuration:
1. Select Devices from the Configuration menu.
2. Select Device Overrides to expand its menu items.
3. Select a target device from the device browser in the lower, left-hand, side of the UI.
4. Select Advanced to expand its sub menu items.
5. Select Client Load Balancing.
Device Configuration 5 - 327
Figure 5-213 Device Overrides - Client Load Balancing
6. Use the drop-down to set a value for SBC strategy. Options include Prefer 5GHz, Prefer 2.4 GHz, and distribute-by-ratio.
The default value is Prefer 5GHz.
7. Refer to the following Neighbor Selection Strategies fields to configure or override it:
Using probes from
common clients
Select this option to enable neighbor selection using probe requests from common
clients between the neighbor device and this device.
Using notifications from
roamed clients
Select this option to enable neighbor selection using notifications from clients roamed
from other devices.
Using smart-rf neighbor
detection
Select this option to enable neighbor selection using Smart RF neighbor detection
algorithm.
8. Select Balance Band Loads by Ratio to configure or override Band Load Balancing configuration.
9. Refer to the following Channel Load Balancing fields to configure or override it:
Balance 2.4 GHz Channel
Loads
Select this option to balance the access point’s 2.4GHz radio load across the channels
supported within the country of deployment. This can prevent congestion on the 2.4GHz
radio if a channel is over utilized.
5 - 328 WiNG 5.5.3 Access Point System Reference Guide
Balance 5 GHz Channel
Loads
Select this option to balance the access point’s 5 GHz radio load across the channels
supported within the country of deployment. This can prevent congestion on the 5 GHz
radio if a channel is over utilized.
10. Select Balance AP Loads to configure or override AP Load Balancing configuration.
AP Loads are balance by balancing the radio load, by assigning a ratio to both the 2.4 and 5GHz bands. Balancing radio load
by band ratio allows an administrator to assign a greater weight to radio traffic on either the 2.4 or 5 GHz band.
11. Refer to the following Advanced Parameters:
Max 2.4 GHz Load
Difference Considered
Equal
Use the spinner control to set a value (between 0 - 100) considered an adequate
discrepancy when comparing 2.4 GHz load between APs load and load on this access
point. The default setting is 1%. Thus, using a default setting of 1% means 1% is
considered inconsequential when comparing load balances between access points.
Min. Value to Trigger 2.4GHz
Channel Balancing
Use the spinner control to define a threshold (between 1 - 100) the access point uses
(when exceeded) to initiate access point load balancing in the 2.4GHz radio band. Set
this value higher when wishing to keep radio traffic within the current access point.
The default is 70%.
Weightage given to Client
Count
Use the spinner control to assign a weight (between 0 - 100) the access point uses to
prioritize 2.4 and 5 GHz radio client count in the overall 2.4 and 5GHZ radio load
calculation. Assign this value higher if this access point is intended to support
numerous clients and their throughput is interpreted as secondary to maintaining client
association. The default setting is 90%.
Weightage given to
Throughput
Use the spinner control to assign a weight (between 0 - 100) the access point uses to
prioritize 2.4 and 5 GHz radio throughput in the overall access point load calculation.
Assign this value higher if throughput and radio performance are considered mission
critical within the access point managed network. The default setting is 10%.
Max 5 GHz Load Difference
Considered Equal
Use the spinner control to set a value (between 0 - 100) considered an adequate
discrepancy when comparing 5 GHz load between APs load and load on this access
point. The default setting is 1%. Thus, using a default setting of 1% means 1% is
considered inconsequential when comparing load balances between access points.
Min. Value to Trigger 5 GHz
Channel Balancing
Use the spinner control to define a threshold (between 1 - 100) the access point uses
(when exceeded) to initiate access point load balancing in the 5GHz radio band. Set
this value higher when wishing to keep radio traffic within the current access point.
The default is 70%.
Weightage given to Client
Count
Use the spinner control to assign a weight (between 0 - 100) the access point uses to
prioritize 2.4 and 5 GHz radio client count in the overall 2.4 and 5GHZ radio load
calculation. Assign this value higher if this access point is intended to support
numerous clients and their throughput is interpreted as secondary to maintaining client
association. The default setting is 90%.
Weightage given to
Throughput
Use the spinner control to assign a weight (between 0 - 100) the access point uses to
prioritize 2.4 and 5 GHz radio throughput in the overall access point load calculation.
Assign this value higher if throughput and radio performance are considered mission
critical within the access point managed network. The default setting is 10%.
Device Configuration 5 - 329
12. Refer to the following AP Load Balancing fields to configure or override them:
Min Value to Trigger
Load Balancing
Use the spinner control to set the access point radio threshold value (from 0 - 100%) used
to initiate load balancing across other access point radios. When this radio load exceeds
the defined threshold, load balancing is initiated. The default is 70%.
Max. AP Load
Difference Considered
Equal
Use the spinner control to set a value (between 0 - 100) considered an adequate discrepancy
when comparing access point radio load balances. The default setting is 1%. Thus, using a
default setting of 1% means 1% is considered inconsequential when comparing access
point radio load balances.
Weightage given to
Client Count
Use the spinner control to assign a weight (between 0 - 100) the access point uses to
prioritize 2.4 and 5 GHz radio client count in the overall 2.4 and 5GHZ radio load calculation.
Assign this value higher if this access point is intended to support numerous clients and
their throughput is interpreted as secondary to maintaining client association. The default
setting is 90%.
Weightage given to
Throughput
Use the spinner control to assign a weight (between 0 - 100) the access point uses to
prioritize throughput in the access point load calculation. Assign this value higher if
throughput and radio performance are considered mission critical within the access point
managed network. The default setting is 10%.
13. Refer to the following Band Control parameters to configure or override them:
Max. Band Load
Difference Considered
Equal
Use the spinner control to set a value (between 0 - 100) considered an adequate discrepancy
when comparing 2.4 and 5GHz radio band load balances on this access point. The default
setting is 10%. Thus, using a default setting of 1% means 1% is considered inconsequential
when comparing 2.4 and 5 GHz load balances on this access point.
Band Ratio (2.4GHz)
Use the spinner control to set a loading ratio (between 0 - 10) the access point 2.4 GHz radio
uses in respect to radio traffic load on the 2.4 GHz band. This allows an administrator to
weight client traffic load if wishing to prioritize client traffic load on the 2.4 GHz radio band.
The higher the value set, the greater the weight assigned to radio traffic load on the 2.4 GHz
radio band. The default setting is 1.
Band Ratio (5 GHz)
Use the spinner control to set a loading ratio (between 0 - 10) the access point 5 GHz radio
uses in respect to radio traffic load on the 5 GHz band. This allows an administrator to
weight client traffic load if wishing to prioritize client traffic load on the 5 GHz radio band.
The higher the value set, the greater the weight assigned to radio traffic load on the 5 GHz
radio band. The default setting is 1.
5 GHz load which both
bands enable
Use the spinner control to set a load percentage (between 0 - 100) that enables the other
band (2.4 GHz) to share load with the current band.
2.4 GHz load which
both bands enable
Use the spinner control to set a load percentage (between 0 - 100) that enables the other
band (5 GHz) to share load with the current band.
14. Refer to the following Neighbor Selection parameters to configure or override them:
Minimum signal
strength for common
clients
Use the spinner to set the minimum signal strength require to learn about neighbors from
clients that are common with the neighbor access point.
Minimum number of
clients seen
Use the spinner to set the minimum number of common clients seen before the neighbor is
learnt.
5 - 330 WiNG 5.5.3 Access Point System Reference Guide
Max confirmed
Neighbors
Use the spinner to set the maximum number of learned neighbors stored at this device.
Minimum signal
strength for smart-rf
neighbors
Use the spinner to set the minimum signal strength of neighbor devices that are learnt
through Smart RF before being recognized as neighbors.
15. Select MINT Protocol. The MINT Protocol screen displays the Settings tab by default.
Figure 5-214 Device Overrides - Advanced Profile Overrides MINT screen - Settings tab
16. Refer to the Area Identifier field to define or override the Level 1 and Level 2 Area IDs used by the profile’s MINT
configuration.
Level 1 Area ID
Select this option to enable a spinner control for setting the Level 1 Area ID from 1 4,294,967,295. The default value is disabled.
17. Define or override the following Priority Adjustment settings:
Designated IS Priority
Adjustment
Use the spinner control to set a Designated IS Priority Adjustment setting from -255 +255. This is the value added to the base level DIS priority to influence the Designated
IS (DIS) election. A value of +1 or greater increases DISiness. The default setting is 0.
18. Select the Latency of Routing Recalculation option (within the Shortest Path First (SPF) field) to enable the spinner
control used for defining or overriding a latency period from 0 - 60 seconds. The default setting has the option disabled.
Device Configuration 5 - 331
19. Define or override the following MINT Link Settings:
MLCP IP
Select this option to enable MINT Link Creation Protocol (MLCP) by IP Address. MINT
Link Creation Protocol is used to create one UDP/IP link from the device to a neighbor.
That neighboring device can be another AP.
MLCP VLAN
Select this option to enable MLCP by VLAN. MLCP is used to create one VLAN link
from the device to a neighbor. That neighboring device can be another AP.
Tunnel MiNT across
extended VLAN
Select this option to enable tunneling MiNT protocol packets across extended VLANs.
20. Select the Tunnel Controller Load Balancing (Level1) option to enable load balancing on the tunnel controller.
21. Define the group name of clustered tunnel controllers in the Preferred Tunnel Controller Name field.
22. Select OK to save the changes and overrides made to the Settings tab. Select Reset to revert to the last saved
configuration.
23. Select the IP tab to display the link IP network address information shared by the devices managed by the MINT
configuration.
Figure 5-215 Device Overrides - Advanced Profile MINT screen - IP tab
The IP tab displays the IP address, Routing Level, Listening Link, Port, Forced Link, Link Cost, Hello Packet Interval and
Adjacency Hold Time managed devices use to securely communicate amongst one another.
24. Select Add to create a new Link IP configuration or Edit to override an existing MINT configuration.
5 - 332 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-216 Device Overrides - Advanced Profile MINT screen - IP (Add)
25. Set the following Link IP parameters to complete the MINT network address configuration:
IP
Define or override the IP address used by peer access points for interoperation when
supporting the MINT protocol.
Routing Level
Use the spinner control to define or override a routing level of either 1 or 2.
Listening Link
Specify a listening link of either 0 or 1. UDP/IP links can be created by configuring a
matching pair of links, one on each end point. However, that is error prone and doesn’t
scale. So UDP/IP links can also listen (in the TCP sense), and dynamically create
connected UDP/IP links when contacted.
Port
To specify a custom port for MiNT links, select this option and use the spinner control
to define or override the port number from 1 - 65,535.
Forced Link
Select this option to specify the MiNT link as a forced link. This setting is disabled by
default.
Link Cost
Use the spinner control to define or override a link cost from 1 - 10,000. The default
value is 100.
Hello Packet Interval
Set or override an interval in either Seconds (1 - 120) or Minutes (1 - 2) for the
transmission of hello packets. The default interval is 15 seconds.
Device Configuration 5 - 333
Adjacency Hold Time
Set or override a hold time interval in either Seconds (2 - 600) or Minutes
(1 - 10) for the transmission of hello packets. The default interval is 46 seconds.
IPSec Secure
Select this option to use a secure link for IPSec traffic. This setting is disabled by
default. When enabled, both the header and the traffic payload are encrypted.
IPSec GW
Define either an IP address or hostname for the IPSec gateway.
26. Select the VLAN tab to display the link IP VLAN information shared by the access points managed by the MINT
configuration.
Figure 5-217 Device Overrides - Advanced Profile MINT screen - VLAN tab
The VLAN tab displays the VLAN, Routing Level, Link Cost, Hello Packet Interval and Adjacency Hold Time managed devices
use to securely communicate amongst one another.
27. Select Add to create a new VLAN link configuration or Edit to override an existing MINT configuration.
NOTE: If creating a mesh link between two access points in Standalone AP mode, you’ll
need to ensure a VLAN is available to provide the necessary MINT link between the two
Standalone APs.
5 - 334 WiNG 5.5.3 Access Point System Reference Guide
Figure 5-218 Device Overrides - Advanced Profile MINT screen - Add VLAN screen
28. Set the following VLAN parameters to complete the MINT configuration:
VLAN
Define a VLAN ID from 1 - 4,094 used by peer controllers for interoperation when
supporting the MINT protocol.
Routing Level
Use the spinner control to define or override a routing level of either 1 or 2.
Link Cost
Use the spinner control to define or override a link cost from 1 - 10,000. The default
value is 100.
Hello Packet Interval
Set or override an interval in either Seconds (1 - 120) or Minutes (1 - 2) for the
transmission of hello packets. The default interval is 4 seconds.
Adjacency Hold Time
Set or override a hold time interval in either Seconds (2 - 600) or Minutes (1 - 10) for
the transmission of hello packets. The default interval is 13 seconds.
29. Select OK to save the updates and overrides to the MINT Protocol configuration. Select Reset to revert to the last saved
configuration.
30. Select the Advanced Miscellaneous menu item.
Device Configuration 5 - 335
Figure 5-219 Device Overrides - Miscellaneous screen
31. Set a NAS-Identifier Attribute up to 253 characters in length. This is the RADIUS NAS-Identifier attribute that typically
identifies where a RADIUS message originates
32. Set a NAS-Port-Id Attribute up to 253 characters in length. This is the RADIUS NAS port ID attribute which identifies the
device port where a RADIUS message originates
33. Refer to the Turn on LEDs option to enable an adopted access point’s LEDs. This feature is enabled by default.
34. Select the Flash Pattern radio button to enable the access point to blink in a manner different from its operational LED
behavior. Enabling this option allows an administrator to validate that the access point has received its configuration from
its managing controller during staging. In the staging process, the administrator adopts the access point to a staging
controller to get an initial configuration before the access point is deployed at its intended location. Once the access point
has received its initial configuration, its LED blinks in a unique pattern to indicate the initial configuration is complete.
35. Use the drop-down menu to configure the access point’s Meshpoint Behavior. This field configures the access point’s
mobility behavior. The default is External (fixed) and indicates that the mesh point is fixed. The value vehicle-mounted
indicates that the mesh point is mobile. This feature is only available on an AP7161 model access point.
36. Use the Root Path Monitor Interval to configure the interval to monitor path to the root node.
37. Set the Additional Port value for RADIUS Dynamic Authorization field. Set this value to 1700 to enable a CISCO
Identity Services Engine (ISE) Authentication, Authorization and Accounting (AAA) server, when deployed in the network,
to dynamically authenticate a client.
When a client requests access to the network, the CISCO ISE RADIUS server presents the client with a URL where the
device’s compliance to the networks security such as validity of anti-virus or anti-spyware software is checked for the
validity for their definition files (this checking is called posture). If the client device complies, then it is allowed access to
the network.
38. Set the Aging Time value for Client Bridge. Use the spinner control to set a value in days, hours, minutes and seconds.
39. Select OK to save the changes made to the profile’s Advanced Miscellaneous configuration. Select Reset to revert to the
last saved configuration.
5 - 336 WiNG 5.5.3 Access Point System Reference Guide
5.4.5.12 Overriding Environmental Sensor Configuration
Overriding a Device Configuration
NOTE: This feature is available on the AP8132 model only.
An AP8132 sensor module is a USB environmental sensor extension to an AP8132 model access point. It provides a variety of
sensing mechanisms, allowing the monitoring and reporting of the AP8132's radio coverage area. The output of the sensor's
detection mechanisms are viewable using the Environmental Sensor screen.
To set an environmental sensor configuration for an AP8132 model access point:
1. Select the Configuration tab from the Web UI.
2. Select Devices.
3. Select Device Overrides from the options on left-hand side of the UI.
4. Select Environmental Sensor. The Environmental Sensor screen displays.
Figure 5-220 Profile - Environmental Sensor screen
5. Override or set the following Light Sensor settings for the AP8132’s sensor module:.
Enable Light Sensor
Select this option to enable the light sensor on the module. This setting is enabled by
default.
Polling Time to
Determine if Light is On/
Off
Define an interval in Seconds (2 - 201) or Minutes (1 - 4) for the sensor module to poll its
environment to assess light intensity to determine whether lighting is on or off. The
default polling interval is 11 seconds. Light intensity is used to determine whether the
access point’s deployment location is currently populated with clients.
Shutdown WLAN Radio
at Low Limit of Light
Threshold
Select this option to power off the AP8132’s radio’s if the light intensity falls below the set
threshold. If enabled, select All (both AP8132 radios), radio-1 or radio-2.
Device Configuration 5 - 337
Low Limit of Light
Threshold
Set the low threshold limit (from 0 - 1,000 lux) to determine whether the lighting is off in
the AP8132’s deployment location. The default is 100.
High Limit of Light
Threshold
Set the upper threshold limit (from 100 - 10,000 lux) to determine whether the lighting is
on in the AP8132’s deployment location. The default is 500.
6. Enable or disable the following Environmental Sensors:
Enable Temperature
Sensor
Select this option to enable the module’s temperature sensor. Results are reported back
to the access point’s Environment screens within the Statistics node. This setting is
enabled by default.
Enable Motion Sensor
Select this option to enable the module’s motion sensor. Results are reported back to the
access point’s Environment screens within the Statistics node. This setting is enabled by
default.
Enable Humidity Sensor
Select this option to enable the module’s humidity sensor. Results are reported back to the
access point’s Environment screens within the Statistics node. This setting is enabled by
default.
7. Define or override the following Shared Configuration setting:
Polling Interval for All
Sensors
Set an interval in either Seconds (1 - 100) or Minutes (1 - 2) for the time between all
environmental polling (both light and environment). The default setting is 5 seconds.
8. Select OK to save the changes made to the environmental sensor screen. Select Reset to revert to the last saved
configuration.
5 - 338 WiNG 5.5.3 Access Point System Reference Guide
5.5 Managing an Event Policy
Device Configuration
Event Policies enable an administrator to create specific notification mechanisms using one, some or all of the SNMP, syslog,
controller forwarding or E-mail notification options available to the controller. Each listed event can have customized
notification settings defined and saved as part of an event policy. Thus, policies can be configured and administrated in respect
to specific sets of client association, authentication/encryption and performance events. Once policies are defined, they can
be mapped to device profiles strategically as the likelihood of an event applies to particular devices. By default, there’s no
enabled event policy and one needs to be created and implemented.
When initially displayed, the Event Policy screen lists the access point interfaces. Existing policies can have their event
notification configurations modified as device profile requirements warrant.
To define an access point event policy:
1. Select Devices from the Configuration menu.
2. Select Event Policy.
Figure 5-221 Event Policy screen
3. Ensure the Activate Event Policy option is selected to enable the screen for configuration. This option needs to remain
selected to apply the event policy configuration to the access point profile.
4. Refer to the Select Event Module drop-down menu on the top right-hand side of the screen and select an event module
used to track the occurrence of each list event.
5. Review each event and select (or deselect) the SNMP, Syslog, Forward to Switch or Email Notification option as required
for the event. Map an existing policy to a device profile as needed. Select Profile from the Map drop-down menu in the
lower-left hand side of the screen. Expand the list of device profiles available, and apply the event policy as required.
6. Select OK to save the changes. Select Reset to revert to the last saved configuration. Delete obsolete rows as needed.
CHAPTER 6
WIRELESS CONFIGURATION
A Wireless Local Area Network (WLAN) is a data-communications system and wireless local area network that flexibly extends
the functionality of a wired LAN. A WLAN links two or more computers or devices using spread-spectrum or OFDM modulation
based technology. WLANs do not require lining up devices for line-of-sight transmission, and are thus, desirable for wireless
networking. Roaming users can be handed off from one access point to another, like a cellular phone system. WLANs can
therefore be configured around the needs of specific user groups, even when they are not in physical proximity.
WLANs can provide an abundance of services, including data communications (allowing mobile devices to access applications),
E-mail, file and print services or even specialty applications (such as guest access control and asset tracking).
Each WLAN configuration contains encryption, authentication and QoS policies and conditions for user connections. Connected
access point radios transmit periodic beacons for each BSS. A beacon advertises the SSID, security requirements, supported
data rates of the wireless network to enable clients to locate and connect to the WLAN.
WLANs are mapped to radios on each access point. A WLAN can be advertised from a single access point radio or can span
multiple access points and radios. WLAN configurations can be defined to provide service to specific areas of a site. For
example, a guest access WLAN may only be mapped to a 2.4 GHz radio in a lobby or conference room providing limited
coverage, while a data WLAN is mapped to all 2.4 GHz and 5.0 GHz radios at the branch site to provide complete coverage.
The wireless configuration is comprised of the following policies:
• Wireless LANs
• WLAN QoS Policy
• Radio QoS Policy
• Association ACL
• SMART RF
• MeshConnex Policy
• Mesh QoS Policy
• Passpoint Policy
6-2
WiNG 5.5.3 Access Point System Reference Guide
Figure 6-1 Configuration > Wireless menu
Wireless Configuration
6-3
6.1 Wireless LANs
Wireless Configuration
To review the attributes of existing WLANs and, if necessary, modify their configurations:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
Figure 6-2 Wireless LANs screen
4. Refer to the following (read-only) information to assess the attributes of each available WLAN:
WLAN
Displays the name of each WLAN available to the access point. Each WLAN can be
selected and its SSID and client management properties modified. Each access point can
support up to 16 WLANs per radio.
SSID
Displays the name of the SSID assigned to the WLAN when it was created or last
modified. Optionally, select a WLAN and select the Edit button to update the SSID
designation.
Description
Displays the brief description assigned to each listed WLAN when it was either created
or modified.
WLAN Status
Lists each WLAN’s status as either Active or Shutdown. A green check mark defines the
WLAN as available to clients on all radios where it has been mapped. A red “X” defines
the WLAN as shutdown, meaning even if the WLAN is mapped to radios, it’s not available
for clients to associate.
VLAN Pool
Lists each WLAN’s current VLAN mapping. When a client associates with a WLAN, the
client is assigned a VLAN by means of load-balance distribution. The VLAN is picked from
a pool assigned to the WLAN. However, typical deployments only map a single VLAN to
a WLAN. The use of a pool is strictly optional.
Bridging Mode
Lists each WLAN’s current bridging mode as either Local or Tunnel. Tunnel is the default
mode. Local infers VLAN traffic is bridged locally, Tunnel uses a shared tunnel for bridging
the WLAN’s VLAN traffic.
6-4
WiNG 5.5.3 Access Point System Reference Guide
DHCP Option 82
Displays if DHCP Option 82 is enabled or not. DHCP option 82 provides additional
information on the physical attachment of a client
Authentication Type
Displays the name of the authentication scheme used by each listed WLAN to secure
client transmissions. None is listed if authentication is not used within a WLAN. In case
of no authentication, refer to the Encryption Type column to verify if there is some sort of
data protection used with the WLAN, or risk using this WLAN with no protection at all.
Encryption Type
Displays the name of the encryption scheme used by each listed WLAN to secure client
membership transmissions. None is listed if encryption is not used within this WLAN. In
case of no encryption, refer to the Authentication Type column to verify if there is some
sort of data protection used with the WLAN or risk using this WLAN with no protection
at all.
QoS Policy
Lists the QoS policy applied to each listed WLAN. A QoS policy needs to be custom
selected (or created) for each WLAN in respect to the WLAN’s intended client traffic, and
the voice, video or normal data traffic it supports.
Association ACL
Lists the Association ACL policy applied to each listed WLAN. An Association ACL is a
policy-based Access Control List (ACL) that either prevents or allows wireless clients from
connecting to a access point managed WLAN. The mapping of an Association ACL is
strictly optional.
Use the sequential set of WLAN screens to define a unique configuration for each WLAN. Refer to the following to set WLAN
configurations:
• Basic WLAN Configuration
• Configuring WLAN Security
• Configuring WLAN Firewall Support
• Configuring Client Settings
• Configuring WLAN Accounting Settings
• Configuring Service Monitoring Settings
• Configuring Client Load Balancing
• Configuring Advanced WLAN Settings
• Configuring Auto Shutdown Settings
Wireless Configuration
6-5
6.1.1 Basic WLAN Configuration
Wireless LANs
When creating or modifying a WLAN, the Basic Configuration screen is the first screen that displays as part of the WLAN
configuration screen flow. Use this screen to enable a WLAN, and define its SSID, client behavior and VLAN assignments.
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or select Edit to modify selected WLAN’s properties. WLANs can also
be removed as they become obsolete by selecting Delete.
Figure 6-3 WLAN Basic Configuration screen
5. Refer to the WLAN Configuration field to define the following:
WLAN
If adding a new WLAN, enter its name in the space provided. Spaces between words are
not permitted. The name could be a logical representation of the WLAN coverage area
(engineering, marketing etc.). If editing an existing WLAN, the WLAN’s name appears at
the top of the screen and cannot be modified. The name cannot exceed 32 characters.
SSID
Enter or modify the Services Set Identification (SSID) associated with the WLAN. The
WLAN name is auto-generated using the SSID until changed by the user. The maximum
number of characters for the SSID is 32.
6-6
WiNG 5.5.3 Access Point System Reference Guide
Description
Provide a textual description for the WLAN to help differentiate it from others with similar
configurations. A description can be up to 64 characters.
WLAN Status
Select the Enabled radio button to ensure this WLAN is active and available to clients on
the radios where it has been mapped. Select the Disabled radio button to make this
WLAN inactive, meaning even if the WLAN is mapped to radios, it is not available for
clients to associate.
QoS Policy
Use the drop-down menu to assign an existing QoS policy to the WLAN. If needed, select
the Create icon to define a new QoS policy or select the Edit icon to modify the
configuration of a selected QoS Policy. QoS helps ensure each WLAN receives a fair share
of the overall bandwidth, either equally or per the proportion configured. For information
on creating a QoS policy that can be applied to a WLAN, see WLAN QoS Policy on page
6-46.
Bridging Mode
Use the drop-down menu to specify the WLAN’s bridging mode as either Local or Tunnel.
Select Local to bridge VLAN traffic locally, or Tunnel to use a shared tunnel for bridging
the WLAN’s VLAN traffic. Local is the default setting.
DHCP Option 82
Select this option to enable DHCP Option 82. DHCP option 82 provides additional
information on the physical attachment of a client This setting is disabled by default
6. Refer to the Other Settings field to define broadcast behavior within this specific WLAN.
Broadcast SSID
Select this radio button to broadcast SSIDs within beacons. If a hacker tries to isolate and
hack a client SSID via a client, the ESSID displays since the ESSID is in the beacon. This
feature is enabled by default.
Answer Broadcast
Probes
Select this radio button to associate a client with a blank SSID (regardless of which SSID
the wireless controller is currently using). This feature is enabled by default.
7. Refer to the VLAN Assignment field to add or remove VLANs for the selected WLAN, and define the number of clients
permitted. Remember, users belonging to separate VLANs can share the same WLAN. It’s not necessary to create a new
WLAN for every VLAN in the network.
Single VLAN
Select this radio button to assign just one VLAN to this WLAN. Enter the VLAN ID that
displays when the Single VLAN radio button is selected. Utilizing a single VLAN per
WLAN is a more typical deployment scenario than using a VLAN pool.
8. Select Allow RADIUS Override to allow the access point to override the client VLAN assignment and use the VLAN
assigned by a RADIUS Server instead. If, as part of the authentication process, the RADIUS server returns a client’s
VLAN ID in a RADIUS Access-Accept packet, and this feature is enabled, all client traffic is forwarded on that VLAN. If
disabled, the RADIUS server returned VLAN ID is ignored and the VLAN configuration (defined in the preceding step) is
used.
If RADIUS authentication fails, the VLAN defined is the VLAN assigned to the WLAN.
9. Select OK when completed to update the WLAN’s basic configuration. Select Reset to revert the screen back to the last
saved configuration.
Wireless Configuration
6-7
6.1.1.1 WLAN Basic Configuration Deployment Considerations
Basic WLAN Configuration
Before defining a WLAN’s basic configuration, refer to the following deployment guidelines to ensure the configuration is
optimally effective:
• Deploy separate VLAN for providing secure WLAN access.
• Define separate VLAN for each WLAN providing guest access.
6.1.2 Configuring WLAN Security
Wireless LANs
Assign WLANs unique security configurations supporting authentication, captive portal (hotspot), self registration or encryption
schemes as data protection requirements dictate.
Figure 6-4 WLAN Security screen
6-8
WiNG 5.5.3 Access Point System Reference Guide
Authentication ensures only known and trusted users or devices access an access point managed WLAN. Authentication is
enabled per WLAN to verify the identity of both users and devices. Authentication is a challenge and response procedure for
validating user credentials such as user name, password and secret-key information.
A client must authenticate to an access point to receive resources from the network. 802.1x EAP, 802.1x EAP-PSK, MAC and
PSK/None authentication options are supported.
Refer to the following to configure a WLAN’s authentication scheme:
• 802.1x EAP, EAP-PSK and EAP MAC
• MAC Authentication
• PSK / None
Secure guest access to the network is referred to as captive portal. A captive portal is guest access policy for providing
temporary and restrictive access to the access point managed wireless network. Existing captive portal policies can be applied
to a WLAN to provide secure guest access.
A captive portal policy provides secure authenticated access using a standard Web browser. A captive portal provides
authenticated access by capturing and re-directing a wireless user's Web browser session to a login page, where a user must
enter valid credentials to access the network. Once logged into the captive portal, additional Agreement, Welcome and Fail
pages provide an administrator with a number of options for the screen flow and appearance.
Refer to Captive Portal on page 6-11 for information on assigning a captive portal policy to a WLAN.
MAC Registration enables returning captive portal users faster authentication and access to the captive portal service. When
the user connects to the captive portal for the first time, the MAC address of the user is recorded once the authentication is
successful. The next time the device is used to access the captive portal, MAC Registration allows the device and the user to
be authenticated faster.
Refer to MAC Registration on page 6-12 for information on enabling and configuring MAC Registration.
Encryption is essential for WLAN security, as it provides data privacy for traffic forwarded over a WLAN. When the 802.11
specification was introduced, Wired Equivalent Privacy (WEP) was the primary encryption mechanism. WEP has since been
interpreted as flawed in many ways, and is not considered an effective standalone scheme for securing a WLAN. WEP is
typically used with WLAN deployments supporting legacy clients. New deployments should use either WPA or WPA2
encryption.
Encryption applies a specific algorithm to alter its appearance and prevent unauthorized hacking. Decryption applies the
algorithm in reverse, to restore the data to its original form. A sender and receiver must employ the same encryption/decryption
method to interoperate. When both TKIP and CCMP are both enabled a mix of clients are allowed to associate with the WLAN.
Some use TKIP, others use CCMP. Since broadcast traffic needs to be understood by all clients, the broadcast encryption type
in this scenario is TKIP.
Refer to the following to configure a WLAN’s encryption scheme:
• WPA/WPA2-TKIP
• WPA2-CCMP
• WEP 64
• WEP 128 and KeyGuard
6.1.2.1 802.1x EAP, EAP-PSK and EAP MAC
Configuring WLAN Security
The Extensible Authentication Protocol (EAP) is the de-facto standard authentication method used to provide secure
authenticated access to WLANs. EAP provides mutual authentication, secured credential exchange, dynamic keying and strong
encryption. 802.1X EAP can be deployed with WEP, WPA or WPA2 encryption schemes to further protect user information
forwarded over wireless controller managed WLANs.
Wireless Configuration
6-9
The EAP process begins when an unauthenticated supplicant (client device) tries to connect with an authenticator (in this case,
the authentication server). An access point passes EAP packets from the client to an authentication server on the wired side
of the access point. All other packet types are blocked until the authentication server (typically, a RADIUS server) verifies the
client’s identity.
802.1X EAP provides mutual authentication over the WLAN during authentication. The 802.1X EAP process uses credential
verification to apply specific policies and restrictions to WLAN users to ensure access is only provided to specific wireless
controller resources.
802.1X requires a 802.1X capable RADIUS server to authenticate users and a 802.1X client installed on each devices accessing
the EAP supported WLAN. An 802.1X client is included with most commercial operating systems, including Microsoft
Windows, Linux and Apple OS X.
The RADIUS server authenticating 802.1X EAP users resides externally to the access point. User account creation and
maintenance can be provided centrally using RFMS or individually maintained on each device. If an external RADIUS server is
used, EAP authentication requests are forwarded.
When using PSK with EAP, packets are sent requesting a secure link using a pre-shared key. The access point and
authenticating device must use the same authenticating algorithm and passcode. EAP-PSK is useful when transitioning from a
PSK network to one that supports EAP. The only encryption types supported with this are TKIP, CCMP and TKIP-CCMP.
To configure EAP on a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or select an existing WLAN and Edit to modify its security properties.
5. Select Security.
6. Select EAP, EAP-PSK or EAP MAC as the Authentication Type.
Either authentication type enables the radio buttons for various encryption options as an additional measure of security
with the WLAN that can be used with EAP.
Either select an existing AAA Policy from the drop-down menu, select the Create icon to the right of the AAA Policy
parameter to create a new AAA policy, or select the Edit icon to modify the selected AAA policy’s configuration.
Authentication, authorization, and accounting (AAA) is a framework for intelligently controlling access to the network,
enforcing user authorization policies and auditing and tracking usage. These combined processes are central for securing
wireless client resources and wireless network data flows. For information on defining a new AAA policy, see AAA Policy
on page 7-12.
7. Select the Reauthentication radio button to force EAP supported clients to reauthenticate. Use the spinner control set the
number of seconds (from 30 - 86,400) that, once exceeded, forces the EAP supported client to reauthenticate to use the
resources supported by the WLAN.
8. Select OK to update the WLAN’s EAP configuration. Select Reset to revert back to the last saved configuration.
EAP, EAP-PSK and EAP MAC Deployment Considerations
802.1x EAP, EAP-PSK and EAP MAC
Before defining a 802.1x EAP, EAP-PSK or EAP MAC supported configuration on a WLAN, refer to the following deployment
guidelines to ensure the configuration is optimally effective:
• Motorola Solutions recommends a valid certificate be issued and installed on devices providing 802.1X EAP. The certificate
should be issued from an Enterprise or public certificate authority to allow 802.1X clients to validate the identity of the
authentication server prior to forwarding credentials.
6 - 10 WiNG 5.5.3 Access Point System Reference Guide
• If using an external RADIUS server for EAP authentication, Motorola Solutions recommends the round trip delay over the
WAN does not exceed 150 ms. Excessive delay over a WAN can cause authentication and roaming issues and impact
wireless client performance.
6.1.2.2 MAC Authentication
Configuring WLAN Security
MAC is a device-level authentication method used to augment other security schemes. MAC can be used open, with WEP 64
or WEP 128, KeyGuard, TKIP or CCMP.
MAC authentication enables device-level authentication by permitting WLAN access based on device MAC address. MAC
authentication is typically used to augment WLAN security options that do not use authentication (such as static WEP,
WPA-PSK and WPA2-PSK). MAC authentication can also be used to assign VLAN memberships, Firewall policies and time and
date access restrictions.
MAC authentication can only identify devices, not users. MAC authentication only references a client’s wireless interface card
MAC address when authenticating the device, it does not distinguish the device’s user credentials. MAC authentication is
somewhat poor as a standalone data protection technique, as MAC addresses can be easily spoofed by hackers who can mimic
a trusted device within the network.
MAC authentication is enabled per WLAN, augmented with the use of a RADIUS server to authenticate each device. A device’s
MAC address can be authenticated against an access point’s local RADIUS server (if supported) or centrally (from a datacenter).
For RADIUS server compatibility, the format of the MAC address can be forwarded to the RADIUS server in non-delimited and
or delimited formats:
To configure MAC authentication on a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or select an existing WLAN and Edit to modify its security properties.
5. Select Security.
6. Select MAC as the Authentication Type.
Selecting MAC enables the radio buttons for the Open, WEP 64, WEP 128, WPA/WPA2-TKIP, WPA2-CCMP and Keyguard
encryption options as additional measures for the WLAN.
7. Either select an existing AAA Policy from the drop-down menu or select the Create icon to the right of the AAA Policy
parameter to display a screen where new AAA policies can be created. A default AAA policy is also available if configuring
a WLAN for the first time and there’s no existing policies. Select the Edit icon to modify the configuration of a selected
AAA policy.
Authentication, Authorization, and Accounting (AAA) is a framework for intelligently controlling access to the wireless
client managed network, enforcing user authorization policies and auditing and tracking usage. These combined processes
are central for securing wireless client resources and wireless network data flows. For information on defining a new AAA
policy, see AAA Policy on page 7-12.
8. Select the Reauthentication radio button to force MAC supported clients to reauthenticate. Use the spinner control set
the number of minutes (from 30 - 86,400) that, once exceeded, forces the EAP supported client to reauthenticate.
9. Select OK when completed to update the WLAN’s MAC configuration. Select Reset to revert the screen back to the last
saved configuration.
Wireless Configuration 6 - 11
MAC Authentication Deployment Considerations
MAC Authentication
Before defining a MAC authentication configuration on a WLAN, refer to the following deployment guidelines to ensure the
configuration is optimally effective:
• MAC authentication can only be used to identify end-user devices, not the users themselves.
• MAC authentication is somewhat poor as a standalone data protection technique, as MAC addresses can be easily spoofed
by hackers who can provision a MAC address on their device to mimic a trusted device.
6.1.2.3 PSK / None
Configuring WLAN Security
Open-system authentication can be referred to as no authentication, since no actual authentication and user credential
validation takes place. When selecting PSK/None, a client requests (and is granted) authentication with no credential
exchange.
NOTE: Although None implies no authentication, this option is also used when
pre-shared keys are used for encryption (thus the /PSK in the description).
6.1.2.4 Captive Portal
Configuring WLAN Security
A captive portal is guest access policy that provides temporary and restrictive access to the wireless network. The primary
means of securing such guest access is the use of a captive portal. For an overview of the captive portal process and
information on how to define a captive portal policy that can be applied to a WLAN, see Configuring Captive Portal Policies on
page 9-2.
To assign a captive portal policy to a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN or select an existing WLAN and Edit to modify the properties of an
existing WLAN.
5. Select Security.
6. Refer to the Captive Portal field within the WLAN security screen.
Select the Captive Portal Enable option if authenticated guess access is required with the selected WLAN. This feature
is disabled by default.
7. Select the Captive Portal if Primary Authentication Fails option to enable the captive portal policy if the primary
authentication is unavailable
8. Select the Captive Portal Policy to use with the WLAN from the drop-down menu. If no relevant policies exist, select the
Create icon to define a new policy to use with this WLAN or the Edit icon to update the configuration of an existing captive
portal policy. For more information, see Configuring Captive Portal Policies on page 9-2.
9. Select OK when completed to update the captive portal configuration. Select Reset to revert the screen back to the last
saved configuration.
6 - 12 WiNG 5.5.3 Access Point System Reference Guide
6.1.2.5 Passpoint Policy
Configuring WLAN Security
A Passpoint policy provides an interoperable platform for streamlining Wi-Fi access to access points deployed as public
hotspots. Passpoint is supported across a wide range of wireless network deployment scenarios and client devices.
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or select an existing WLAN and Edit to modify its properties.
5. Select Security.
6. Refer to the Passpoint field within the WLAN Policy security screen.
7. Select an existing Passpoint Policy from the drop down menu to apply it to the WLAN. If no relevant policies exist, select
the Create icon to define a new policy to use with this WLAN or the Edit icon to update the configuration of an existing
passpoint policy.
8. Select OK when completed to update the Captive Portal configuration. Select Reset to revert the WLAN Policy Security
screen back to the last saved configuration.
6.1.2.6 MAC Registration
Configuring WLAN Security
The MAC Registration feature provides returning captive portal users quicker access to the captive portal.
When a user accesses the captive portal for the first time, user information is gathered and stored. This information is matched
with the MAC address of the device accessing the captive portal. This information is stored on board the access point.
The next time the user accesses the captive portal service using the same device, he/she is authenticated immediately as the
MAC address of the device is available in the access point’s database along with the user’s identification information. The user
saves time as identification information is not collected again speeding the logon.
The MAC Registration feature must be enabled for each captive portal WLAN.
To enable MAC Registration:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or select an existing WLAN and Edit to modify its properties.
5. Select Security.
6. Refer to the MAC Registration field within the WLAN security screen.
Select the MAC Registration Enable option if quick access is required with the selected WLAN. This feature is disabled
by default.
7. Select the RADIUS group name from the Radius Group Name drop-down list. A RADIUS group is a collection of user
accounts that have same permissions.
8. Select Expiry Time. This is the duration for which MAC addresses are stored on the access point’s database. Once this
time expires, the user information is purged from the database. The user then has to provide login credentials as well as
identification information again.
9. Set the Agreement Refresh as the amount of time before the agreement page is displayed if the user has not been logged
during the specified period. The default setting is 0 days.
Wireless Configuration 6 - 13
10. Select OK when completed to update the MAC Registration configuration. Select Reset to revert the screen back to the
last saved configuration.
6.1.2.7 External Controller
Configuring WLAN Security
External controller configuration enables this WLAN to be managed by a remote wireless controller. This feature is disabled
by default.
To configure the external server information:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or select an existing WLAN and Edit to modify its properties.
5. Select Security.
6. Refer to the External Controller field within the WLAN security screen.
7. Select the Enable option to enable this WLAN to be managed by an external controller.
8. Use the Host field to enter a hostname/IP address of the remote wireless controller. Use the spinner control to select the
type of the remote controller.
9. Use the Proxy Mode drop-down to configure the proxy mode for accessing remote resources.
10. Select OK when completed to update the External Controller configuration. Select Reset to revert the screen back to the
last saved configuration.
6.1.2.8 WPA/WPA2-TKIP
Configuring WLAN Security
Wi-Fi Protected Access (WPA) is an encryption scheme specified in the IEEE Wireless Fidelity (Wi-Fi) standard, 802.11i. WPA
provides more sophisticated data encryption than WEP. WPA is designed for corporate networks and small-business
environments where more wireless traffic allows quicker discovery of encryption keys by an unauthorized person.
The encryption method is Temporal Key Integrity Protocol (TKIP). TKIP addresses WEP’s weaknesses with a re-keying
mechanism, a per-packet mixing function, a message integrity check, and an extended initialization vector, however TKIP also
has vulnerabilities.
Wi-Fi Protected Access 2 (WPA2) is an enhanced version of WPA. WPA2 uses the Advanced Encryption Standard (AES) instead
of TKIP. AES supports 128-bit, 192-bit and 256-bit keys. WPA/WPA2 also provide strong user authentication based on 802.1x
EAP.
To configure WPA/WPA2 encryption on a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN or select an existing WLAN and select Edit to modify its properties.
5. Select Security.
6. Select the WPA/WPA2-TKIP radio button from within the Select Encryption field.
The screen populates with the parameters required to define a WPA/WPA2-TKIP configuration for the WLAN.
6 - 14 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-5 WLAN Security - WPA/WPA2-TKIP screen
7. Define the Key Settings.
Pre-Shared Key
Enter either an alphanumeric string of 8 to 63 ASCII characters or 64 HEX characters as the
primary string both transmitting and receiving authenticators must share. The
alphanumeric string allows character spaces. The access point converts the string to a
numeric value. This passphrase saves the administrator from entering the 256-bit key each
time keys are generated.
8. Define Key Rotation values.
Unicast messages are addressed to a single device on the network. Broadcast messages are addressed to multiple devices.
When using WPA2, a wireless client can use 2 keys: one unicast key, for its own traffic to and from an access point, and
one broadcast key, the common key for all clients in that subnet.
Motorola Solutions recommends rotating these keys so a potential hacker would not have enough data using a single key
to attack the deployed encryption scheme.
Unicast Rotation Interval
Define an interval for unicast key transmission interval from 30 - 86,400 seconds. Some
clients have issues using unicast key rotation, so ensure you know which kind of clients
are impacted before using unicast keys. This feature is disabled by default.
Broadcast Rotation
Interval
When enabled, the key indices used for encrypting/decrypting broadcast traffic is
alternatively rotated based on the defined interval. Define a broadcast key transmission
interval from 30 - 86,400 seconds. Key rotation enhances the broadcast traffic security on
the WLAN. This feature is disabled by default.
Wireless Configuration 6 - 15
9. Define the Fast Roaming configuration used only with 802.1x EAP-WPA/WPA2 authentication.
NOTE: Fast Roaming is available only when the authentication is EAP or EAP-PSK and
the selected encryption is either WPA/WPA2-TKIP or WPA-CCMP.
Using 802.11i can speed up the roaming process from one access point to another. Instead of doing a complete 802.1x
authentication each time a client roams between access points, 802.11i allows a client to re-use previous PMK
authentication credentials and perform a four-way handshake. This speeds up the roaming process. In addition to reusing
PMKs on previously visited access points, Opportunistic Key Caching allows multiple access points to share PMKs
amongst themselves. This allows a client to roam to an access point it has not previously visited and reuse a PMK from
another access point to skip 802.1x authentication.
Pre-Authentication
Selecting this option enables an associated client to carry out an 802.1x authentication
with another access point before it roams to it. This enables a roaming client to send and
receive data sooner by not having to conduct an 802.1x authentication after roaming.
With pre-authentication, a client can perform an 802.1X authentication with other
detected access points while still connected to its current access point. When a device
roams to a neighboring access point, the device is already authenticated on the access
point, thus providing faster re-association.
Pairwise Master Key
(PMK) Caching
Pairwise Master Key (PMK) Caching is a technique for sidestepping the need to
re-establish security each time a client roams to a different switch. Using PMK caching,
clients and switches cache the results of 802.1X authentications. Therefore, access is
much faster when a client roams back to a switch to which the client is already
authenticated.
Opportunistic Key
Caching
This option enables the access point to use a PMK derived with a client on one access
point, with the same client when it roams over to another access point. Upon roaming,
the client does not have to do 802.1x authentication and can start sending and receiving
data sooner.
10. Set the following Advanced settings for the WPA/WPA2-TKIP encryption scheme:
TKIP Countermeasure
Hold Time
The TKIP Countermeasure Hold Time is the time a WLAN is disabled, if TKIP
countermeasures have been invoked on the WLAN. Use the drop-down menu to define a
value in either Hours (0-18), Minutes (0-1,092) or Seconds (0-65,535). The default setting
is 60 seconds.
Exclude WPA2-TKIP
Select this option to advertise and enable support for only WPA-TKIP. This option can be
used if certain older clients are not compatible with newer WPA2-TKIP information
elements. Enabling this option allows backwards compatibility for clients that support
WPA-TKIP and WPA2-TKIP, but do not support WPA2-CCMP. Motorola Solutions
recommends enabling this feature if WPA-TKIP or WPA2-TKIP supported clients operate
in a WLAN populated by WPA2-CCMP enabled clients. This feature is disabled by default.
Use SHA256
Select this option to enable SHA-256 authentication key management suite. This suite
consists of a set of algorithms for key agreement, key derivation, key wrapping, and
content encryption and provide a minimum cryptographic security level of 128 bits.
6 - 16 WiNG 5.5.3 Access Point System Reference Guide
11. Select OK when completed to update the WLAN’s WPA/WPA2-TKIP encryption configuration. Select Reset to revert the
screen back to its last saved configuration.
NOTE: WPA-TKIP is not supported on radios configured to exclusively use 802.11n.
WPA-TKIP Deployment Considerations
Before defining a WPA-TKIP supported configuration on a WLAN, refer to the following deployment guidelines to ensure the
configuration is optimally effective:
• Though TKIP offers better security than WEP, it can be vulnerable to certain attacks.
• When both TKIP and CCMP are enabled, a mix of clients are allowed to associate with the WLAN. Some use TKIP, others
use CCMP. Since broadcast traffic needs to be understood by all clients, the broadcast encryption type in this scenario is
TKIP.
6.1.2.9 WPA2-CCMP
Configuring WLAN Security
WPA2 is a newer 802.11i standard that provides even stronger wireless security than Wi-Fi Protected Access (WPA) and WEP.
CCMP is the security standard used by the Advanced Encryption Standard (AES). AES serves the same function TKIP does for
WPA-TKIP. CCMP computes a Message Integrity Check (MIC) using the proven Cipher Block Chaining (CBC) technique. Changing
just one bit in a message produces a totally different result.
WPA2/CCMP is based on the concept of a Robust Security Network (RSN), which defines a hierarchy of keys with a limited
lifetime (similar to TKIP). Like TKIP, the provided keys are used to derive other keys. Messages are encrypted using a 128-bit
secret key and a 128-bit block of data. The end result is an encryption scheme as secure as any for associated clients.
To configure WPA2-CCMP encryption on a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or select an existing WLAN and Edit to modify the properties of an
existing WLAN.
5. Select Security.
6. Select the WPA2-CCMP radio button from within the select Select Encryption field.
The screen populates with the parameters required to define a WPA2-CCMP configuration for the WLAN.
Wireless Configuration 6 - 17
Figure 6-6 WLAN Security - WPA2-CCMP screen
7. Define Key Settings.
Pre-Shared Key
Enter either an alphanumeric string of 8 to 63 ASCII characters or 64 HEX characters as
the primary string both transmitting and receiving authenticators must share. The
alphanumeric string allows character spaces. The access point converts the string to a
numeric value. This passphrase saves the administrator from entering the 256-bit key
each time keys are generated.
8. Define Key Rotation values.
Unicast messages are addressed to a single device on the network. Broadcast messages are addressed to multiple devices.
When using WPA2-CCMP, a wireless client can use 2 keys: one unicast key, for its own traffic to and from an access point,
and one broadcast key, the common key for clients in that subnet.
Motorola Solutions recommends rotating these keys so a potential hacker would not have enough data using a single key
to attack the deployed encryption scheme.
Unicast Rotation Interval Define a unicast key transmission interval from 30 - 86,400 seconds. Some clients have
issues using unicast key rotation, so ensure you know which clients are impacted before
using unicast keys. This value is disabled by default.
6 - 18 WiNG 5.5.3 Access Point System Reference Guide
Broadcast Rotation
Interval
When enabled, the key indices used for encrypting/decrypting broadcast traffic will be
alternatively rotated based on the defined interval. Define a broadcast key transmission
interval from 30 - 86,400 seconds. Key rotation enhances the broadcast traffic security on
the WLAN. This value is disabled by default.
9. Define the Fast Roaming configuration used only with 802.1x EAP-WPA/WPA2 authentication.
NOTE: Fast Roaming is available only when the authentication is EAP or EAP-PSK and
the selected encryption is either WPA/WPA2-TKIP or WPA-CCMP.
802.11i can speed up the roaming process from one access point to another. Instead of doing a complete 802.1x
authentication each time a client roams between access points, 802.11i allows a client to re-use previous PMK
authentication credentials and perform a four-way handshake. This speeds up the roaming process. In addition to reusing
PMKs on previously visited access points, Opportunistic Key Caching allows multiple access points to share PMKs amongst
themselves. This allows a client to roam to an access point it has not previously visited and reuse a PMK to skip 802.1x
authentication.
Pre-Authentication
Selecting this option enables an associated client to carry out an 802.1x authentication
with another access point before it roams to it. This enables a roaming client to send and
receive data sooner by not having to conduct an 802.1x authentication after roaming.
With pre-authentication, a client can perform an 802.1X authentication with other
detected access points while still connected to its current access points. When a device
roams to a neighboring access points, the device is already authenticated, thus providing
faster re-association.
Pairwise Master Key
(PMK) Caching
Pairwise Master Key (PMK) Caching is a technique for sidestepping the need to
re-establish security each time a client roams to a different switch. Using PMK caching,
clients and switches cache the results of 802.1X authentications. Therefore, access is
much faster when a client roams back to a switch to which the client is already
authenticated.
Opportunistic Key
Caching
This option enables the access point to use a PMK derived with a client on one access
point, with the same client when it roams over to another access point. Upon roaming,
the client does not have to do 802.1x authentication and can start sending and receiving
data sooner.
10. Set the following Advanced for the WPA2-CCMP encryption scheme:
TKIP Countermeasure
Hold Time
The TKIP Countermeasure Hold Time is the time a WLAN is disabled, if TKIP
countermeasures have been invoked on the WLAN. Use the drop-down menu to define a
value in either Hours (0-18), Minutes (0-1,092) or Seconds (0-65,535). The default setting
is 60 seconds.
Exclude WPA2-TKIP
Select this option to advertise and enable support for only WPA-TKIP. This option can be
used if certain older clients are not compatible with newer WPA2-TKIP information
elements. Enabling this option allows backwards compatibility for clients that support
WPA-TKIP and WPA2-TKIP, but do not support WPA2-CCMP. Motorola Solutions
recommends enabling this feature if WPA-TKIP or WPA2-TKIP supported clients operate
in a WLAN populated by WPA2-CCMP enabled clients. This feature is disabled by default.
Wireless Configuration 6 - 19
Use SHA256
Select this option to enable SHA-256 authentication key management suite. This suite
consists of a set of algorithms for key agreement, key derivation, key wrapping, and
content encryption and provide a minimum cryptographic security level of 128 bits.
11. Select OK when completed to update the WLAN’s WPA2-CCMP encryption configuration. Select Reset to revert back to its
last saved configuration.
WPA2-CCMP Deployment Considerations
WPA2-CCMP
Before defining a WPA2-CCMP supported configuration on a WLAN, refer to the following deployment guidelines to ensure the
configuration is optimally effective:
• Motorola Solutions recommends WPA2-CCMP be configured for all new (non visitor) WLANs requiring encryption, as it’s
supported by the majority of the hardware and client vendors using Motorola Solutions wireless networking equipment.
• WPA2-CCMP supersedes WPA-TKIP and implements all the mandatory elements of the 802.11i standard. WPA2-CCMP
introduces a new AES-based algorithm called CCMP, which replaces TKIP and WEP and is considered significantly more
secure.
6.1.2.10 WEP 64
Configuring WLAN Security
Wired Equivalent Privacy (WEP) is a security protocol specified in the IEEE Wireless Fidelity (Wi -Fi) standard. WEP is designed
to provide a WLAN with a level of security and privacy comparable to that of a wired LAN.
WEP can be used with open, shared, MAC and 802.1 X EAP authentications. WEP is optimal for WLANs supporting legacy
deployments when also used with 802.1X EAP authentication to provide user and device authentication and dynamic WEP key
derivation and periodic key rotation. 802.1X provides authentication for devices and also reduces the risk of a single WEP key
being deciphered.
WEP 64 uses a 40 bit key concatenated with a 24-bit initialization vector (IV) to form the RC4 traffic key. WEP 64 is a less robust
encryption scheme than WEP 128 (containing a shorter WEP algorithm for a hacker to potentially duplicate), but networks that
require more security are at risk from a WEP flaw. WEP is only recommended if there are client devices incapable of using
higher forms of security. The existing 802.11 standard alone offers administrators no effective method to update keys.
To configure WEP 64 encryption on a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or select Edit to modify the properties of an existing wireless
controller WLAN.
5. Select Security.
6. Select the WEP 64 radio button from within the Select Encryption field.
The screen populates with the parameters required to define a WEP 64 configuration for the WLAN.
6 - 20 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-7 WLAN Security - WEP 64 screen
7. Configure the following WEP 64 settings:
Generate Keys
Specify a 4 to 32 character pass key and select the Generate button. The pass key can be
any alphanumeric string. The wireless controller, other proprietary routers, and Motorola
Solutions clients use the algorithm to convert an ASCII string to the same hexadecimal
number. Clients without Motorola Solutions adapters need to use WEP keys manually
configured as hexadecimal numbers.
Keys 1-4
Use the Key #1-4 fields to specify key numbers. For WEP 64 (40-bit key), the keys are 10
hexadecimal characters in length. Select one of these keys for default activation by
selecting its radio button. Select Show to display the actual characters comprising the key.
Restore Default WEP
Keys
Select this radio button to restore the WEP algorithm back to its default settings.
Default WEP 64 keys are as follows:
• Key 1 1011121314
• Key 2 2021222324
• Key 3 3031323334
• Key 4 4041424344
8. Select OK when completed to update the WLAN’s WEP 64 encryption configuration. Select Reset to revert the screen back
to its last saved configuration.
Wireless Configuration 6 - 21
WEP 64 Deployment Considerations
Before defining a WEP 64 supported configuration on a WLAN, refer to the following deployment guideline to ensure the
configuration is optimally effective:
• Motorola Solutions recommends additional layers of security (beyond WEP 64) be enabled to minimize the likelihood of data
loss and security breaches. WEP enabled WLANs should be mapped to an isolated VLAN with Firewall policies restricting
access to hosts and suspicious network applications.
6.1.2.11 WEP 128 and KeyGuard
Configuring WLAN Security
Wired Equivalent Privacy (WEP) is a security protocol specified in the IEEE Wireless Fidelity (Wi -Fi) standard. WEP is designed
to provide a WLAN with a level of security and privacy comparable to that of a wired LAN.
KeyGuard is a Motorola Solutions encryption option used with legacy clients capable of supporting it. It closely resembled WEP
128 in key structure.
WEP can be used with open, shared, MAC and 802.1 X EAP authentications. WEP is optimal for WLANs supporting legacy
deployments when also used with 802.1X EAP authentication to provide user and device authentication and dynamic WEP key
derivation and periodic key rotation. 802.1X provides authentication for devices and also reduces the risk of a single WEP key
being deciphered. If 802.1X support is not available on the legacy device, MAC authentication should be enabled to provide
device level authentication.
WEP 128 and KeyGuard use a 104 bit key which is concatenated with a 24-bit initialization vector (IV) to form the RC4 traffic
key. WEP may be all a small-business user needs for the simple encryption of wireless data. However, networks that require
more security are at risk from a WEP flaw. WEP is only recommended if there are client devices that are incapable of using
higher forms of security. The existing 802.11 standard alone offers administrators no effective method to update keys.
WEP 128 or Keyguard provide a more robust encryption algorithm than WEP 64 by requiring a longer key length and pass key.
Thus, making it harder to hack through the replication of WEP keys.
To configure WEP 128 encryption on a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or select Edit to modify the properties of an existing WLAN.
5. Select Security.
6. Select either the WEP 128 or Keyguard radio button from within the Select Encryption field.
The screen populates with the parameters required to define a WEP 128 or KeyGuard configuration for the WLAN.
6 - 22 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-8 WLAN Security - WEP 128 screen
7. Configure the following WEP 128 or Keyguard settings:
Generate Keys
Specify a 4 to 32 character pass key and select the Generate button. The pass key can be
any alphanumeric string. The access point, other proprietary routers, and Motorola
Solutions clients use the algorithm to convert an ASCII string to the same hexadecimal
number. Clients without Motorola Solutions adapters need to use WEP keys manually
configured as hexadecimal numbers.
Keys 1-4
Use the Key #1-4 areas to specify key numbers. For WEP 128 (104-bit key), the keys are 26
hexadecimal characters in length. Select one of these keys for default activation by
selecting its radio button. Select Show to display the actual characters comprising the key.
Restore Default WEP
Keys
If you feel it necessary to restore the WEP algorithm back to its default settings, select the
Restore Default WEP Keys button.
Default WEP 128 or Keyguard keys are as follows:
• Key 1 101112131415161718191A1B1C
• Key 2 202122232425262728292A2B2C
• Key 3 303132333435363738393A3B3C
• Key 4 404142434445464748494A4B4C
8. Select OK when completed to update the WLAN’s WEP 128 encryption configuration. Select Reset to revert the screen
back to its last saved configuration.
Wireless Configuration 6 - 23
WEP 128 and Keyguard Deployment Considerations
WEP 128 and KeyGuard
Before defining a WEP 128 supported configuration on a WLAN, refer to the following deployment guidelines to ensure the
configuration is optimally effective:
• Motorola Solutions recommends additional layers of security (beyond WEP) be enabled to minimize the likelihood of data
loss and security breaches. WEP enabled WLANs should be mapped to an isolated VLAN with Firewall policies restricting
access to hosts and suspicious network applications.
• WEP enabled WLANs should only be permitted access to resources required by legacy devices.
• KeyGuard is not supported on AP6511 model access points.
• If WEP support is needed for WLAN legacy device support, 802.1X EAP authentication should be also configured in order
for the WLAN to provide authentication and dynamic key derivation and rotation.
6.1.3 Configuring WLAN Firewall Support
Wireless LANs
A Firewall is a mechanism enforcing access control, and is considered a first line of defense in protecting proprietary
information within an access point managed WLAN. The means by which this is accomplished varies, but in principle, a Firewall
is a mechanism that blocks and permits data traffic. For a Firewall overview, see Wireless Firewall on page 8-2.
WLANs use Firewalls like Access Control Lists (ACLs) to filter/mark packets based on the WLAN from which they arrive, as
opposed to filtering packets on Layer 2 ports. An ACL contains an ordered list of Access Control Entries (ACEs). Each ACE
specifies an action and a set of conditions (rules) a packet must satisfy to match the ACE. The order of conditions in the list is
critical because the access point stops testing conditions after the first match.
IP based Firewall rules are specific to source and destination IP addresses and the unique rules and precedence orders
assigned. Both IP and non-IP traffic on the same Layer 2 interface can be filtered by applying both an IP ACL and a MAC.
A MAC Firewall rule uses source and destination MAC addresses for matching operations, where the result is a typical allow,
deny or mark designation to WLAN packet traffic.
Keep in mind, IP and non-IP traffic on the same Layer 2 interface can be filtered by applying both an IP ACL and a MAC ACL to
the interface.
To review existing Firewall configurations, create a new Firewall configuration or edit the properties of a WLAN’s existing
Firewall:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create a new WLAN or Edit to modify the properties of an existing wireless controller WLAN.
5. Select Firewall from the WLAN options.
6 - 24 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-9 WLAN Security - WLAN Firewall screen
6. Select an existing Inbound IP Firewall Rules or Outbound IP Firewall Rules using the drop-down menu. If no rules
exist, select the Create icon to create a new firewall rule configuration. Select the Edit icon to modify the configuration of
a selected firewall.
If creating a new rule, provide a name up to 32 characters long.
7. Select the Add button.
Wireless Configuration 6 - 25
Figure 6-10 WLAN Security - IP Firewall Rules screen
8. IP Firewall rule configurations can either be modified as a collective group of variables or selected and updated individually
as their filtering attributes require a more refined update.
a. Select the Edit Rule icon to the left of a particular IP Firewall rule configuration to update its parameters collectively.
Figure 6-11 WLAN Security - IP Firewall Rules - Edit Rule screen
b. Click the icon within the Description column (top right-hand side of the screen) and select IP filter values as needed
to add criteria into the configuration of the IP ACL.
6 - 26 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-12 WLAN Security - IP Firewall Rules - IP Firewall Rules Add Criteria screen
NOTE: Only those selected IP ACL filter attributes display. Each value can have its
current settings adjusted by selecting that IP ACL’s column to display a pop-up to adjust
that one value.
9. Define the following parameters for either inbound or outbound IP firewall rules:
Precedence
Specify or modify a precedence for this IP policy between 1-1500. Rules with lower
precedence are always applied to packets first. If modifying a precedence to apply a
higher integer, it will move down the table to reflect its lower priority.
Action
Every IP firewall rule is made up of matching criteria rules. The action defines what to do
with the packet if it matches the specified criteria. The following actions are supported:
• Deny - Instructs the firewall to prohibit a packet from proceeding to its destination.
• Allow - Instructs the firewall to allow a packet to proceed to its destination.
Source
Select the source IP address or network group configuration used as a basis matching
criteria for this IP ACL rule. Source options include:
• Any – Indicates any host device in any network.
• Network – Indicates all hosts in a particular network. Subnet mask information has to
be provided for filtering based on network.
• Host – Indicates a single host with a specific IP address.
• Alias – Indicates a collection of IP addresses or hostnames or IP address ranges which
are configured as a single unit. This is for ease of configuration of ACLs. When
selected, all IP addresses or hostnames or IP address ranges are used in this ACL.
Destination
Select the destination IP address or network group configuration used as a basis matching
criteria for this IP ACL rule. Destination options include:
• Any – Indicates any host device in any network.
• Network – Indicates all hosts in a particular network. Subnet mask information has to
be provided for filtering based on network.
• Host – Indicates a single host with a specific IP address.
• Alias – Indicates a collection of IP addresses or hostnames or IP address ranges which
are configured as a single unit. This is for ease of ACL configuration. When selected,
all IP addresses or hostnames or IP address ranges are used in this ACL.
Wireless Configuration 6 - 27
Network Service Alias
The service alias is a set of configurations consisting of protocol and port mappings. Both
source and destination ports are configurable. Set an alphanumeric service alias
(beginning with a $ character and containing one special character) and include the
protocol as relevant. Selecting either tcp or udp displays an additional set of specific TCP/
UDP source and destinations port options.
Source Port
If using either tcp or udp as the protocol, define whether the source port for incoming IP
ACL rule application is any, equals or an administrator defined range. If not using tcp or
udp, this setting displays as N/A. This is the data local origination virtual port designated
by the administrator. Selecting equals invokes a spinner control for setting a single
numeric port. Selecting range displays spinner controls for Low and High numeric range
settings. A source port cannot be a destination port.
Destination Port
If using either tcp or udp as the protocol, define whether the destination port for incoming
IP ACL rule application is any, equals or an administrator defined range. If not using tcp or
udp, this setting displays as N/A. This is the data local origination virtual port designated
by the administrator. Selecting equals invokes a spinner control for setting a single
numeric port. Selecting range displays spinner controls for Low and High numeric range
settings.
ICMP Type
Selecting ICMP as the protocol for the IP rule displays an additional set of ICMP specific
options for ICMP type and code. The Internet Control Message Protocol (ICMP) uses
messages identified by numeric type. ICMP messages are used for packet flow control or
generated in IP error responses. ICMP errors are directed to the source IP address of the
originating packet. Assign an ICMP type from 1-10.
ICMP Code
Selecting ICMP as the protocol for the IP rule displays an additional set of ICMP specific
options for ICMP type and code. Many ICMP types have a corresponding code, helpful for
troubleshooting network issues (0 - Net Unreachable, 1- Host Unreachable, 2 - Protocol
Unreachable etc.).
Start VLAN
Select a Start VLAN icon within a table row to set (apply) a start VLAN range for this IP
ACL filter. Start VLAN represents the virtual LAN beginning numeric identifier arriving
packets must adhere to in order to have the IP ACL rules apply.
End VLAN
Select an End VLAN icon within a table row to set (apply) an end VLAN range for this IP
ACL filter. End VLAN represents the virtual LAN end numeric identifier arriving packets
must adhere to in order to have the IP ACL rules apply.
Protocol
Select the protocol to filter for this ACL. Use the drop down to select from a list of
predefined protocol or use the spinner control to set a particular protocol number.
Mark
Select this option to mark certain fields inside a packet before allowing them. Mark is only
applicable for Allow rules. Mark sets the rule’s 802.1p or dscp level (from 0 - 7)
Log
Select this option to create a log entry that a firewall rule has allowed a packet to be
either denied or allowed.
Enabled
Select this option to enable or disable this particular IP Firewall rule in this rule set.
Description
Lists the administrator assigned description applied to the IP ACL rule. Select a
description within the table to modify its character string as filtering changes warrant.
Select the icon within the Description table header to launch a Select Columns screen
used to add or remove IP ACL criteria from the table.
6 - 28 WiNG 5.5.3 Access Point System Reference Guide
The Precedence column sets the priority of a IP Firewall rule within its rule set. Click on this column and drag the rule to
its appropriate place in the ruleset to set its precedence.
10. Click the OK button to save all changes made to the IP Firewall Rules dialog. Click Exit to close the dialog and return to
the previous screen.
11. Select existing inbound or outbound MAC Firewall Rules using the drop-down menu. If no rules exist, select Create to
display a screen where Firewall rules can be created.
12. Select the + Add Row button.
13. Select the added row to expand it into configurable parameters.
Figure 6-13 WLAN Security - MAC Firewall Rules screen
14. Define the following parameters for either the inbound or outbound MAC Firewall Rules:
Allow
Every MAC firewall rule is made up of matching criteria rules. The action defines what to
do with the packet if it matches the specified criteria. The following actions are supported:
• Deny - Instructs the firewall to prohibit a packet from proceeding to its destination.
• Permit - Instructs the firewall to allow a packet to proceed to its destination.
Wireless Configuration 6 - 29
Source and Destination
MAC
Enter both Source and Destination MAC addresses. The access point uses the source IP
address, destination MAC address as basic matching criteria. Provide a subnet mask if
using a mask.
Action
The following actions are supported:
• Log - Creates a log entry that a Firewall rule has allowed a packet to either be denied
or permitted.
• Mark - Modifies certain fields inside the packet, and then permits them. Therefore,
mark is an action with an implicit permit.
• Mark, Log - Conducts both mark and log functions.
Precedence
Use the spinner control to specify a precedence for this MAC Firewall rule from
1-1500. Access policies with lower precedence are always applied first to packets.
VLAN ID
Enter a VLAN ID representative of the shared SSID each user employs to interoperate
within the network (once authenticated by the access point’s local RADIUS server). Set the
VLAN form 1 - 4094.
Match 802.1P
Configures IP DSCP to 802.1p priority mapping for untagged frames. Use the spinner
control to define a setting from 0 - 7.
Ethertype
Use the drop-down menu to specify an Ethertype of either ipv6, arp, wisp or monitor
8021q. An Ethertype is a two-octet field within an Ethernet frame. It is used to indicate
which protocol is encapsulated in the payload of an Ethernet frame.
Description
Provide a description (up to 64 characters) for this rule to help differentiate it from others
with similar configurations.
15. Save the changes to the new MAC rule, or reset to the last saved configuration as needed.
16. Define the following parameters for Association ACL. An Association ACL defines the rules used to allow/deny
association to devices for this wireless LAN. If no Association ACL exists, select the Create button to display a new
window where new ACL can be created.
17. Select the + Add Row button.
18. Define the following parameters for Association ACL:
Precedence
Enter a numerical value indicating the precedence of rule execution.
Starting MAC Address
Enter a MAC address to define the start of range. This field is mandatory.
Ending MAC Address
Enter a MAC address to define the end of range.
Allow/Deny
Every Association ACL rule consists of matching criteria rules. The action defines what to
do with the device if it matches the specified criteria. The following actions are supported:
• Deny - Instructs the Firewall to not to allow the device to associate with this WLAN.
• Permit - Instructs the Firewall to allow the device to associate with this WLAN.
19. Set the following Trust Parameters:
ARP Trust
Select this radio button to enable ARP trust on this WLAN. ARP packets received on this
WLAN are considered trusted and information from these packets is used to identify rogue
devices within the network. This setting is disabled by default.
6 - 30 WiNG 5.5.3 Access Point System Reference Guide
Validate ARP Header
Mismatch
Select this radio button to check for a source MAC mismatch in the ARP header and
Ethernet header. This setting is enabled by default.
DHCP Trust
Select this radio button to enable DHCP trust on this WLAN. This setting is disabled by
default.
20. Set the following Wireless Client Deny configuration:
Wireless Client Denied
Traffic Threshold
If enabled, any associated client, exceeding the thresholds configured for storm traffic, is
either deauthenticated or blacklisted depending on the selected action. The threshold
range is from 1- 1000000 packets per second. This feature is disabled by default.
Action
If enabling a wireless client threshold, use the drop-down menu to determine whether
clients are deauthenticated when the threshold is exceeded, or blacklisted from
connectivity for a user-defined interval. Selecting None applies no consequence to an
exceeded threshold.
Blacklist Duration
Select this option and define a setting from 0 - 86,400 seconds. Offending clients can
reauthenticate, once this blacklist duration has been exceeded.
21. Set a Firewall Session Hold Time in either Seconds (1 - 300) or Minutes (1 - 5). This is the hold time for caching user
credentials and Firewall state information when a client roams. The default setting is 30 seconds.
22. Select OK when completed to update this WLAN’s Firewall settings. Select Reset to revert the screen back to its last saved
configuration.
WLAN Firewall Deployment Considerations
Before defining an access control configuration on a WLAN, refer to the following deployment guideline to ensure the
configuration is optimally effective:
• IP and non-IP traffic on the same Layer 2 interface can be filtered by applying both an IP ACL and a MAC ACL to the interface.
Wireless Configuration 6 - 31
6.1.4 Configuring Client Settings
Wireless LANs
Each WLAN can maintain its own client setting configuration. These settings include wireless client inactivity timeouts and
broadcast configurations. AP6562, AP6532, AP6522, AP6522M, AP71XX, AP75XX, AP81XX and AP82XX model access points
can support up to 256 clients per access point. AP6511 and AP6521 models can support up to 128 clients per access point.
Client load balancing can be enforced for the WLAN as more and more WLANs are deployed.
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create a new WLAN, or select an existing WLAN and Edit to modify its properties.
5. Select the Client Settings tab.
Figure 6-14 WLAN - Client Settings screen
6 - 32 WiNG 5.5.3 Access Point System Reference Guide
6. Define the following Client Settings for the WLAN:
Enable
Client-to-Client
Communication
Select this option to allow client to client communication within this WLAN. The default
is enabled, meaning clients are allowed to exchange packets with other clients. Disabling
this setting does not necessarily prevent clients on other WLANs from sending packets to
this WLAN, but as long as this setting is disabled on the other WLAN, clients are not
permitted to interoperate.
Wireless Client Power
Use this parameter to set the maximum transmit power (from 0 - 20 dBm) available to
wireless clients for transmission. The default value is 20 dBm.
Wireless Client Idle Time Set the maximum amount of time wireless clients are allowed to be idle within this
WLAN. Set the idle time in either Seconds (60 - 86,400), Minutes (1 - 1,440), Hours
(0 - 24) or Days (0 - 1). When this setting is exceeded, the client is no longer able to access
resources and must re-authenticate. The default value is 1,800 seconds.
Max Firewall Sessions
per Client
Select this option to set the maximum number of sessions (from 10 - 10,000 clients) over
the Firewall. When enabled, this parameter limits the number of simultaneous sessions
allowed by the Firewall per wireless client. This feature is disabled by default.
Max Clients Allowed Per
Radio
Select this option to set the maximum number of clients (from 1- 256 clients) allowed to
connect using a single radio. When enabled, this parameter limits the number of clients
that are allowed to connect to a single radio. This feature is set to 256 by default.
Radio Resource
Measurement
Select this option to enable radio resource measurement capabilities (IEEE 802.11k) on
this WLAN. 802.11k improves how traffic is distributed. In a WLAN, each device normally
connects to an access point with the strongest signal. Depending on the number and
locations of the clients, this arrangement can lead to excessive demand on one access
point and under utilization of others, resulting in degradation of overall network
performance. With 802.11k, if the access point with the strongest signal is loaded to its
capacity, a client connects to a under utilized access point. Even if the signal is weaker,
the overall throughput is greater since it's an efficient use of the network's resources. This
setting is disabled by default.
Radio Resource
Measurement Channel
Report
Select this option to enable radio resource measurement channel reporting (IEEE 802.11k)
on this WLAN. This setting is enabled by default.
Enforce Client Load
Balancing
Select this option to distribute clients evenly amongst associated access point radios.
This feature is disabled by default. An AP6562, AP6532, AP6522, AP6522M, AP71XX,
AP75XX, AP81XX or AP82XX model access point can support up to 256 clients per access
point. An AP6511 or AP6521 model can support up to 128 clients per access point. Client
load balancing can be enforced for the WLAN as more and more WLANs are deployed.
Loads are balanced by ignoring association and probe requests. Probes and association
requests are not responded to forcing a client to associate with another access point.
Enforce DHCP Client Only Select this option to enforce that the access point only allows packets from clients using
DHCP to obtain an IP address, disallowing static IP addresses. This feature is disabled by
default.
Proxy ARP Mode
Use the drop-down menu to define the proxy ARP mode as either Strict or Dynamic. Proxy
ARP is the technique used by the AP to answer ARP requests intended for another system.
By faking its identity, the AP accepts responsibility for routing packets to the actual
destination. Dynamic is the default value.
Wireless Configuration 6 - 33
Enforce DHCP-Offer
Validation
Select this option to enforce DHCP offer validation. The default setting is disabled.
7. Define the following Motorola Solutions Client Extensions for the WLAN:
Move Operations
Select the option to enable the use of Motorola Solutions Fast Roaming (HFSR) for clients
on this WLAN. This feature applies only to certain Motorola Solutions client devices. This
feature is disabled by default.
Smart Scan
Enable a smart scan to refine a clients channel scans to just a few channels as opposed
to all available channels. This feature is disabled by default.
Symbol Information
Element
Select this option to support the Symbol Information Element with legacy Symbol
Technology clients. The default setting is enabled.
WMM Load Information
Element
Select this option to support a WMM Load Information Element in radio transmissions
with legacy Motorola Solutions clients. The default setting is disabled.
8. Define the following Timeout Settings for the WLAN:
Credential Cache
Timeout
Set a timeout period for the credential cache in Days (0-1), Hours (0-24), Minutes (1-1440)
or Seconds (60-86,4000). The default setting is 1 day.
VLAN Cache Timeout
Set a timeout period for the VLAN cache in Days (0-1), Hours (0-24), Minutes (1-1440) or
Seconds (60-86,4000). The default setting is 1 hour.
9. Select Controller Assisted Mobility to use a controller or service platform's mobility database to assist in roaming
between RF Domains. This feature is disabled by default.
10. Select OK when completed to update the WLAN’s client setting configuration. Select Reset to revert the screen back to
the last saved configuration.
6.1.5 Configuring WLAN Accounting Settings
Wireless LANs
Accounting is the method of collecting and sending security server information for billing, auditing, and reporting user data;
such as start and stop times, executed commands (such as PPP), number of packets and number of bytes. Accounting enables
wireless network administrators to track the services users are accessing and the network resources they are consuming.
When accounting is enabled, the network access server reports and logs user activity to a RADIUS security server in the form
of accounting records. The data can be analyzed for network management, client billing, and/or auditing. Accounting methods
must be defined through AAA.
Accounting can be enabled and applied to managed WLANs, to uniquely log accounting events specific to the WLAN.
Accounting logs contain information about the use of remote access services by users. This information is of great assistance
in partitioning local versus remote users and how to best accommodate each. Remote user information can be archived to a
remote location for periodic network and user permission administration.
To configure WLAN accounting settings:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or Edit to modify the properties of an existing WLAN.
5. Select Accounting.
6 - 34 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-15 WLAN Accounting screen
6. Set the following Syslog Accounting information:
Enable System Log
Accounting
Select this option for the access point to generate accounting records in standard syslog
format (RFC 3164). The feature is disabled by default.
Syslog Host
Specify the IP address (or hostname) of the external syslog host where accounting records
are routed.
Syslog Port
Use the spinner control to set the destination UDP port of the external syslog host where
accounting records are routed. The default port is 514.
Proxy Mode
Use the drop-down menu to define how syslog accounting is conducted. Options include
None, Through Wireless Controller and Through RF Domain Manager.
Format
Select the format used to include (pack) the MAC address in a syslog request. Options
include No Delimiter (aabbccddeeff), Colon Delimiter (aa:bb:cc:dd:ee:ff), Dash Delimiter
(aa-bb-cc-dd-ee-ff), Dot Delimiter per four (aabb.ccdd.eef) and Middle Dash Delimiter
(aabbcc-ddeeff). The default setting is Dash Delimiter (aa-bb-cc-dd-ee-ff).
Case
Use the drop-down menu to specify whether the MAC address format supplied is
specified in upper or lower case. The default setting is upper case.
7. Select Enable RADIUS Accounting to use an external RADIUS resource for AAA accounting. When the radio button is
selected, a AAA Policy field displays. Either use the default AAA policy with the WLAN, or select Create to define a new
AAA configuration that can be applied to the WLAN. This setting is disabled by default.
8. Select OK when completed to update this WLAN’s accounting settings. Select Reset to revert the screen back to its last
saved configuration.
Wireless Configuration 6 - 35
Accounting Deployment Considerations
Before defining a AAA configuration on a WLAN, refer to the following deployment guidelines to ensure the configuration is
optimally effective:
• When using RADIUS authentication, Motorola Solutions recommends the WAN port round trip delay not exceed 150 ms.
Excessive delay over a WAN can cause authentication and roaming issues. When excessive delays exist, a distributed
RADIUS service should be used.
• Motorola Solutions recommends authorization policies be implemented when users need to be restricted to specific
WLANs, or time and date restrictions need to be applied.
• Authorization policies can also apply bandwidth restrictions and assign Firewall policies to users and devices.
6.1.6 Configuring Service Monitoring Settings
Wireless LANs
When a captive portal goes offline for any reason, the Service Monitoring feature enables the captive portal administrators to
indicate to all users that the service is temporarily unavailable. As the service unavailable information is immediately displayed
to the users, users are less likely to complain.
The reasons a captive portal service becomes unavailable can be broadly classified as:
• When the RADIUS authentication server becomes unavailable. The RADIUS server could be on board the device (the
wireless controller or the access point) or external to the device.
• When the configured external captive portal service is unavailable for any reason.
• In the case of an access point, if the wireless controller to which the access point is adopted becomes unavailable.
• When a monitored DHCP server becomes unavailable.
To configure Service Monitoring settings:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or Edit to modify the properties of an existing WLAN.
5. Select Service Monitoring. The following screen displays:
6 - 36 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-16 WLAN – Service Monitoring screen
6. Refer the following for more information on Service Monitoring fields.
AAA Server Monitoring
Select to enable monitoring the configured RADIUS server. Configure a RADIUS server
through an AAA Policy. See AAA Policy on page 7-12 for more information.
Captive Portal External
Server Monitoring
Select to enable monitoring the configured external captive portal server.
Adoption Monitoring Enable
Select this option to verify if the device is adopted to its controller. When the connection
to its controller is lost, all captive portal users are automatically migrated to the VLAN
defined in the Adoption Monitoring:VLAN field.
Adoption Monitoring VLAN
Use the spinner control to select the VLAN that users are migrated to when a device's
connection to its adopting controller is lost.
DHCP Server Monitoring
- Enable
Select to enable monitoring the configured DHCP Server. When the connection to the
monitored DHCP server is lost, all captive portal are automatically migrated to the VLAN
defined in the DHCP Server Monitoring:VLAN field.
DHCP Server Monitoring
- VLAN
Use the spinner control to select the VLAN that users are migrated to when the configured
DHCP becomes unavailable.
DHCP Server Monitoring
- CRM Name
Configure the DHCP server to monitor. When this DHCP server becomes unavailable, the
device falls back to the VLAN configured in the DHCP Server Monitoring:VLAN field. This
VLAN has a DHCP server that provides a pool of IP addresses with a lease time lesser than
the main DHCP server.
7. Select OK when completed to update this WLAN’s service monitoring settings. Select Reset to revert the screen back to
its last saved configuration.
Wireless Configuration 6 - 37
6.1.7 Configuring Client Load Balancing
Wireless LANs
Client load balance settings can be defined generically for both the 2.4 GHz and 5.0 GHz bands, and specifically for either of
the 2.4 GHz or 5.0 GHz bands.
To configure client load balancing settings on an access point managed WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or Edit to modify the properties of an existing WLAN.
5. Select Client Load Balancing.
Figure 6-17 WLAN - Client Load Balancing screen
6. Set the following Load Balance Settings generic to both the 2.4 GHz and 5.0 GHz bands:
Enforce Client Load
Balancing
Select this radio button to enforce a client load balance distribution on this WLAN. This
setting is disabled by default.
Loads are balanced by ignoring association and probe requests. Probes and association
requests are not responded to, forcing a client to associate with another access point.
Band Discovery Interval
Define a value in either Seconds (0 - 10,000), Minutes (0 -166) or Hours (0 -2) the access
point uses to discover a client’s band capabilities before associating. The default is 10
seconds.
Capability Ageout Time
Define a value in either Seconds (0 - 10,000), Minutes (0 -166) or Hours (0 -2) to ageout a
client’s capabilities from the access point’s internal table. The default is 1 hour.
6 - 38 WiNG 5.5.3 Access Point System Reference Guide
7. Set the following Load Balancing Settings (2.4 GHz):
Single Band Clients
Select this option to enable single band client associations on the 2.4 GHz frequency, even
if load balancing is available. The default setting is enabled.
Max Probe Requests
Enter a value (from 0 - 10,000) for the maximum number of probe requests for client
associations on the 2.4 GHz frequency. The default value is 60.
Probe Request Interval
Enter a value in seconds (from 0 - 10,000) to set an interval for client probe requests,
beyond which association is allowed for clients on the 2.4 GHz frequency. The default
setting is 10 seconds.
8. Set the following Load Balancing Settings (5 GHz):
Single Band Clients
Select this option to enable single band client associations on the 5.0 GHz frequency, even
if load balancing is available. The default setting is enabled.
Max Probe Requests
Enter a value (from 0 - 10,000) for the maximum number of probe requests for client
associations on the 5.0 GHz frequency. The default value is 60.
Probe Request Interval
Enter a value in seconds (from 0 - 10,000) to set an interval for client probe requests,
beyond which association is allowed for clients on the 5.0 GHz frequency. The default
setting is 10 seconds.
9. Select OK when completed to update this WLAN’s client load balance settings. Select Reset to revert the screen back to
its last saved configuration.
6.1.8 Configuring Advanced WLAN Settings
Wireless LANs
To configure advanced RADIUS configuration and radio rate settings for a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or Edit to modify the properties of an existing WLAN.
5. Select Advanced.
Wireless Configuration 6 - 39
Figure 6-18 WLAN - Advanced Configuration screen
6. Refer to the Advanced RADIUS Configuration field to set the WLAN’s NAS configuration and RADIUS Dynamic
Authorization.
NAS Identifier
Specify what is included in the RADIUS NAS-Identifier field for authentication and
accounting packets. This is an optional setting, and defaults are used if no values are
provided.
NAS Port
The profile database on the RADIUS server consists of user profiles for each connected
network access server (NAS) port. Each profile is matched to a user name representing a
physical port. When the access point authorizes users, it queries the user profile database
using a user name representative of the physical NAS port making the connection.
RADIUS Dynamic
Authorization
Select this radio button to enable the RADIUS protocol to support unsolicited messages
sent from the RADIUS server. These messages allow administrators to issue change of
authorization (CoA) messages, which affect session authorization, or Disconnect Message
(DM), which cause a session to terminate immediately. This feature is disabled by default.
7. Refer to the Radio Rates field to define selected data rates for both the 2.4 GHz and 5.0 GHz bands.
6 - 40 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-19 Advanced WLAN - Rate Settings 2.4 GHz-WLAN screen
8. For 2.4 GHz WLAN radio transmission rate settings, define the minimum Basic and Supported rates in the 802.11b Rates,
802.11g Rates and 802.11n Rates sections. These rates are applicable to client traffic associated with this WLAN only.
If supporting 802.11n, select a Supported MCS index. Set a MCS (modulation and coding scheme) in respect to the radio’s
channel width and guard interval. A MCS defines (based on RF channel conditions) an optimal combination of 8 data rates,
bonded channels, multiple spatial streams, different guard intervals and modulation types. Clients can associate as long as
they support basic MCS (as well as non-11n basic rates).
Wireless Configuration 6 - 41
Figure 6-20 Advanced WLAN - Rate Settings 5 GHz-WLAN screen
9. For 5.0 GHz WLAN radio transmission rate settings, define the minimum Basic and Supported rates in the 802.11a Rates,
and 802.11n Rates sections. These rates are applicable to client traffic associated with this WLAN only.
If supporting 802.11n, select a Supported MCS index. Set a MCS (modulation and coding scheme) in respect to the radio’s
channel width and guard interval. A MCS defines (based on RF channel conditions) an optimal combination of 8 data rates,
bonded channels, multiple spatial streams, different guard intervals and modulation types. Clients can associate as long as
they support basic MCS (as well as non-11n basic rates).
802.11n MCS rates are defined as follows both with and without short guard intervals (SGI):
Table 6.1 MCS-1Stream
Number of
Streams
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
0
1
6.5
7.2
13.5
15
1
1
13
14.4
27
30
2
1
19.5
21.7
40.5
45
3
1
26
28.9
54
60
4
1
39
43.4
81
90
5
1
52
57.8
108
120
6
1
58.5
65
121.5
135
7
1
65
72.2
135
150
6 - 42 WiNG 5.5.3 Access Point System Reference Guide
Table 6.2 MCS-2Stream
Number of
Streams
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
0
2
13
14.4
27
30
1
2
26
28.9
54
60
2
2
39
43.4
81
90
3
2
52
57.8
108
120
4
2
78
86.7
162
180
5
2
104
115.6
216
240
6
2
117
130
243
270
7
2
130
144.4
270
300
Table 6.3 MCS-3Stream
Number of
Streams
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
0
3
19.5
21.7
40.5
45
1
3
39
43.3
81
90
2
3
58.5
65
121.5
135
3
3
78
86.7
162
180
4
3
117
130.7
243
270
5
3
156
173.3
324
360
6
3
175.5
195
364.5
405
7
3
195
216.7
405
450
802.11ac MCS rates are defined as follows both with and without short guard intervals (SGI):
Table 6.4 MCS-802.11ac (theoretical throughput for single spatial streams)
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
80 MHz
No SGI
80MHz
With SGI
0
6.5
7.2.
13.5
15
29.3
32.5
1
13
14.4
27
30
58.5
65
2
19.5
21.7
40.5
45
87.8
97.5
3
26
28.9
54
60
117
130
4
39
43.3
81
90
175.5
195
5
52
57.8
108
120
234
260
Wireless Configuration 6 - 43
Table 6.4 MCS-802.11ac (theoretical throughput for single spatial streams)
MCS Index
20 MHz
No SGI
20 MHz
With SGI
40 MHz
No SGI
40MHz
With SGI
80 MHz
No SGI
80MHz
With SGI
6
58.5
65
121.5
135
263.3
292.5
7
65
72.2
135
150
292.5
325
8
78
86.7
162
180
351
390
9
n/a
n/a
180
200
390
433.3
10. Select the Fast BSS Transition option to enable 802.11r fast BSS transition support.
Fast BSS (802.11r) is an attempt to undo the burden that security and QoS added to the handoff process, and restore it back
to an original four message exchange process. The central application for the 802.11r standard is VOIP using mobile phones
within wireless Internet networks.
11. Select Enable to enable HTTP analysis.
12. Set the following HTTP Analysis Forward to Syslog Server configuration:
Enable
Select this option to forward logging messages to an external syslog server.
Host
Use the field to provide a hostname/IP address of the remote syslog server. Use the dropdown menu to select the type of host address.
Port
Use the spinner control to configure the port on which the external syslog server can be
reached.
Proxy Mode
Use the drop-down menu to select the proxy configuration.
13. Set the following Filter configuration for filtering specific contents from the information sent to a remote syslog server for
HTTP analysis:
Filter Out Images
Select this option to filter images from the information logged to the remote syslog server.
Filter Post
Select this option to filter HTTP POST information from the information logged to the
remote syslog server.
Strip Query String
Select this option to strip the query string in the information logged to the remote syslog
server.
14. Select OK when completed to update this WLAN’s Advanced settings. Select Reset to revert to the last saved
configuration.
6 - 44 WiNG 5.5.3 Access Point System Reference Guide
6.1.9 Configuring Auto Shutdown Settings
Wireless LANs
Auto shutdown provides a mechanism to regulate the availability of a WLAN based on time. WLANs can be enabled or disabled
depending on the day of the week and time of day.
A WLAN can be made available during a particular time of the day to prevent misuse and reduce the vulnerability of the
wireless network. WLANs can be disabled when there are no users on the network, such as after hours or during the weekends/
holidays. This enables the network administrator to have more time to manage the network as the mundane task of shutting
down/staring up a WLAN is automated.
You can also use the Auto Shutdown screen to configure network parameters, which if not met, can force the WLAN to shut
down. These parameters are:
• Shutdown on Mesh Point Loss – If an access point is a member in a meshed network and its connection to the mesh is lost,
then all WLANs on the access point that have this option enabled are shut down.
• Shutdown on Primary Port Link Loss – When there is a loss of link on the primary wired link on the access point, all the
WLANs on the access point that have this option enabled are shut down.
• Shutdown on Critical Resource Down – If critical resource monitoring is enabled on the access point and one or all of the
monitored critical resource goes down, the all WLANs on the access point that have this option enabled are shut down.
• Shutdown on Unadoption – If the access point is unadopted from its wireless controller, then all WLANs on the access point
that have this option enabled are shut down.
To configure auto shutdown parameters for the selected WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LANs to display a high level display of existing WLANs.
4. Select the Add button to create an additional WLAN, or Edit to modify the properties of an existing WLAN.
5. Select Auto Shutdown.
Figure 6-21 WLAN - Auto Shutdown screen
Wireless Configuration 6 - 45
6. Refer to the following to configure Auto Shutdown parameters:
Shutdown on Mesh Point
Loss
Select to enable the WLAN to shutdown if the access point’s connection to the mesh
network is lost. This setting is disabled by default.
Shutdown on Primary
Port Link Loss
Select to enable the WLAN to shutdown if the access point’s connection on its primary
wired port is lost. This setting is disabled by default.
Shutdown on Critical
Resource Down
Select to enable the WLAN to shutdown if any one or all of the access point’s configured
critical resources are not reachable or available. This setting is disabled by default.
Shutdown on
Unadoption
Select to enable the WLAN to shutdown if the access point is unadopted from its wireless
controller. This setting is disabled by default.
7. Select the + Add Row button to add time based access configuration for the WLAN.
8. Refer to the following to configure Time Based Access parameters:
Days
Configure the days on which the WLAN is accessible. Select from one of the following:
• All – Select this option to make the WLAN available on all days of the week.
• Weekends – Select this option to make the WLAN available only during weekends
(Saturday and Sunday).
• Weekdays – Select this option to make the WLAN available only during weekdays
(from Monday to Friday).
• Sunday/Monday/Tuesday/Wednesday/Thursday/Friday/Saturday – Select a week day
to make the WLAN available only during that specific day.
Start Time
Configure the time when the WLAN is available. Start time is configured as HH:MM AM/
PM.
End Time
Configure the time when the WLAN is unavailable. End time is configured as HH:MM AM/
PM.
9. Select OK when completed to update this WLAN’s Advanced settings. Select Reset to revert to the last saved
configuration. Select Exit to exit the screen.
6 - 46 WiNG 5.5.3 Access Point System Reference Guide
6.2 WLAN QoS Policy
Wireless Configuration
QoS provides a data traffic prioritization scheme that reduces congestion from excessive traffic. If there is enough bandwidth
for all users and applications (unlikely because excessive bandwidth comes at a very high cost), then applying QoS has very
little value. When bandwidth is shared by different users and applications, QoS provides policy enforcement for mission-critical
applications and/or users with critical bandwidth requirements.
QoS ensures each WLAN receives a fair share of the overall bandwidth, either equally or in the configured proportion. Packets
directed towards clients are classified into categories such as Video, Voice and Data. Packets within each category are
processed based on the weights defined for each WLAN.
The Quality of Service screen displays a list of QoS policies available to WLANs. If none of the exiting QoS policies supports
an ideal QoS configuration for the intended data traffic for this WLAN, select the Add button to create new policy. Select the
radio button of an existing WLAN and select OK to map the QoS policy to the WLAN displayed in the banner of the screen.
Use the WLAN Quality of Service (QoS) screen to add a new QoS policy or edit an existing policy. Each access point model
supports up to 32 WLAN QoS policies, with the exception of AP6511 and AP6521 models that support 16 WLAN QoS policies.
NOTE: WLAN QoS configurations differ significantly from QoS policies configured for
radios. WLAN QoS configurations are designed to support the data requirements of
wireless clients, including the data types they support and their network permissions.
Radio QoS policies are specific to the transmit and receive characteristics of the
connected radio’s themselves, independent from the wireless clients the access point’s
radios support.
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless QoS Policy to display a high level display of existing WLAN QoS policies.
Figure 6-22 WLAN - WLAN Quality of Service (QoS) screen
Wireless Configuration 6 - 47
4. Refer to the following read-only information to determine whether an existing policy can be used as is, an existing policy
requires edit or a new policy requires creation:
WLAN QoS Policy
Displays the name assigned to each listed WLAN QoS. The policy name cannot be edited.
Wireless Client
Classification
Lists each policy’s Wireless Client Classification as defined for this WLAN's intended
traffic. The Classification Categories are the different WLAN-WMM options available to
a radio. Classification types include:
• WMM – Implies WiFi Multimedia QoS extensions are enabled on this radio. This
allows different traffic streams between the wireless client and the access point to be
prioritized according to the type of traffic (voice, video etc). The WMM classification is
required to support the high throughput data rates required of 802.11n device support.
• Voice – Optimized for voice traffic. Implies all traffic on this WLAN is prioritized as
voice traffic on the radio.
• Video – Optimized for video traffic. Implies all traffic on this WLAN is prioritized as
video traffic on the radio.
• Normal – Optimized for best effort traffic. Implies all traffic on this WLAN is prioritized
as best effort traffic on the radio.
• Low – Optimized for background traffic. Implies all traffic on this WLAN is low priority
on the radio.
SVP Prioritization
A green check mark defines the policy as having Spectralink Voice Prioritization (SVP)
enabled to allow the access point to identify and prioritize traffic from Spectralink/
Polycomm phones using the SVP protocol. Phones using regular WMM and SIP are not
impacted by SVP prioritization. A red “X” defines the QoS policy as not supporting SVP
prioritization.
WMM Power Save
Enables support for the WMM based power-save mechanism, also known as Unscheduled
Automatic Power Save Delivery (U-APSD). This is primarily used by WMM capable voice
devices. The default setting is enabled.
Multicast Mask Primary
Displays the primary multicast mask defined for each listed QoS policy. Normally all
multicast and broadcast packets are buffered until the periodic DTIM interval (indicated
in the 802.11 beacon frame), when clients in power save mode wake to check for frames.
However, for certain applications and traffic types, an administrator may want the frames
transmitted immediately, without waiting for the DTIM interval. By configuring a primary
and secondary multicast mask, an administrator can indicate which frames are
transmitted immediately. Setting masks is optional, and only needed if there are traffic
types requiring special handling.
Multicast Mask
Secondary
Displays the secondary multicast mask defined for each listed QoS policy.
NOTE: When using a wireless client classification other than WMM, only legacy rates
are supported on that WLAN.
6 - 48 WiNG 5.5.3 Access Point System Reference Guide
5. Either select the Add button to define a new WLAN QoS policy, or select an existing WLAN QoS policy and Edit its
configuration. Existing QoS policies can also be selected and deleted as needed.
A Quality of Service (QoS) policy screen displays for the new or selected WLAN. The screen displays the WMM tab by
default, but additional tabs also display for WLAN and wireless client rate limit configurations. For more information, refer
to the following:
• Configuring QoS WMM Settings
• Configuring a WLAN’s QoS Rate Limit Settings
• Configuring Multimedia Optimizations
6.2.1 Configuring QoS WMM Settings
WLAN QoS Policy
Using WMM, end-user satisfaction is maintained in a wider variety of environments and traffic conditions. WMM makes it
possible for both home networks and Enterprises to decide which data streams are most important and assign them a higher
priority.
WMM’s prioritization capabilities are based on four access categories. The higher the access category, the higher the
probability to transmit this kind of traffic over the access point managed WLAN. ACs were designed to correspond to 802.1d
priorities to facilitate interoperability with QoS policy management mechanisms. WMM enabled access points coexist with
legacy devices (not WMM-enabled).
Packets not assigned to a specific access category are categorized by default as having best effort priority. Applications assign
each data packet to a given access category packets are then added to one of four independent transmit queues (one per access
category - voice, video, best effort or background) in the client. The client has a collision resolution mechanism to address
collision among different queues, which selects the frames with the highest priority to transmit.
The same mechanism deals with external collision, to determine which client should be granted the opportunity to transmit
(TXOP). The collision resolution algorithm responsible for traffic prioritization is probabilistic and depends on two timing
parameters that vary for each access category.
• The minimum inter-frame space, or Arbitrary Inter-Frame Space Number (AIFSN)
• The contention window, sometimes referred to as the random backoff wait
Both values are smaller for high-priority traffic. The value of the contention window varies through time. Initially the contention
window is set to a value that depends on the AC. As frames with the highest AC tend to have the lowest backoff values, they
are more likely to get a TXOP.
After each collision the contention window is doubled until a maximum value (also dependent on the AC) is reached. After
successful transmission, the contention window is reset to its initial, AC dependant value. The AC with the lowest backoff
value gets the TXOP.
To configure a WMM configuration for a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LAN QoS Policy to display a high level display of existing WLANs QoS policies.
4. Select the Add button to create a new QoS policy, or Edit to modify the properties of an existing WLAN QoS policy.
The WMM tab displays by default.
Wireless Configuration 6 - 49
Figure 6-23 WLAN - WLAN QoS Policy screen - WMM tab
5. Configure the following Settings in respect to the WLAN’s intended WMM radio traffic and user requirements:
Wireless Client
Classification
Use the drop-down menu to select the Wireless Client Classification for this WLAN's
intended traffic. The Classification Categories are the different WLAN-WMM options
available to the radio. The Wireless Client Classification types are:
• WMM – Implies WiFi Multimedia QoS extensions are enabled on this radio. This
allows different traffic streams between the wireless client and the access point to be
prioritized according to the type of traffic (voice, video etc). The WMM classification is
required to support the high throughput data rates required of 802.11n device support.
• Voice – Optimized for voice traffic. Implies all traffic on this WLAN is prioritized as
voice traffic on the radio.
• Video – Optimized for video traffic. Implies all traffic on this WLAN is prioritized as
video traffic on the radio.
• Normal – Optimized for best effort traffic. Implies all traffic on this WLAN is prioritized
as best effort traffic on the radio.
• Low – Optimized for background traffic. Implies all traffic on this WLAN is low priority
on the radio.
6 - 50 WiNG 5.5.3 Access Point System Reference Guide
Non-Unicast
Classification
Use this drop-down menu to define how traffic matching multicast masks is classified
relative to prioritization on the radio. Options include Video, Voice, Normal, Low and
Default. The default setting is Default.
Enable Voice
Prioritization
Select this option if Voice traffic is prioritized on the WLAN. This gives priority to voice
and voice management packets and is supported only on certain legacy Motorola
Solutions VOIP phones. This feature is disabled by default.
Enable SVP Prioritization Enabling Spectralink Voice Prioritization (SVP) allows the access point to identify and
prioritize traffic from Spectralink/Polycomm phones. This gives priority to voice, with voice
management packets supported only on certain legacy Motorola VOIP phones. If the
Wireless Client Classification is WMM, non-WMM devices recognized as voice devices
have all their traffic transmitted at voice priority. Devices are classified as voice, when
they emit SIP, SCCP or H323 traffic. Thus, selecting this option has no effect on devices
supporting WMM. This feature is disabled by default.
Enable WMM Power
Save
Enables support for the WMM based power-save mechanism, also known as Unscheduled
Automatic Power Save Delivery (U-APSD). This is primarily used by WMM capable voice
devices. This feature is enabled by default.
Enable QBSS Load IE
Select this option to enable support for WMM QBSS load information element in beacons
and probe response packets. This feature is enabled by default.
Configure Non WMM
Client Traffic
Use the drop-down menu to specify how non-WMM client traffic is classified on this
access point WLAN if the Wireless Client Classification is set to WMM. Options include
Video, Voice, Normal and Low. The default setting is Normal.
6. Set the following Video Access settings for the WLAN’s QoS policy:
Transmit Ops
Use the slider to set the maximum duration a device can transmit after obtaining a
transmit opportunity. The default value is 94.
AIFSN
Set the current Arbitrary Inter-frame Space Number (AIFSN) from 2 - 15. Higher-priority
video categories should have lower AIFSNs than lower-priority traffic categories. This will
cause lower-priority traffic to wait longer before attempting access. The default value is 2.
ECW Min
ECW Min is combined with ECW Max to create the contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Lower values are used for higher priority traffic (like video). The available
range is from 0-15. The default value is 3.
ECW Max
ECW Max is combined with ECW Min to create the contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Lower values are used for higher priority traffic (like video). The available
range is from 0-15. The default value is 4.
7. Set the following Voice Access settings for the WLAN’s QoS policy:
Transmit Ops
Use the slider to set the maximum duration a device can transmit after obtaining a
transmit opportunity. The default value is 47.
AIFSN
Set the current Arbitrary Inter-frame Space Number (AIFSN) from 2 - 15. Higher-priority
voice categories should have lower AIFSNs than lower-priority traffic categories. This will
cause lower-priority traffic to wait longer before attempting access. The default value is 2.
Wireless Configuration 6 - 51
ECW Min
ECW Min is combined with ECW Max to create the contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Lower values are used for higher priority traffic. The available range is from
0-15. The default value is 2.
ECW Max
ECW Max is combined with ECW Min to create the contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Lower values are used for higher priority traffic. The available range is from
0-15. The default value is 3.
8. Set the following Normal (Best Effort) Access settings for the WLAN’s QoS policy:
Transmit Ops
Use the slider to set the maximum duration a device can transmit after obtaining a
transmit opportunity. The default value is 0.
AIFSN
Set the current Arbitrary Inter-frame Space Number (AIFSN) from 2 - 15. The default value
is 3. Lower priority traffic categories should have higher AIFSNs than higher priority traffic
categories. This will cause lower priority traffic to wait longer before attempting access.
ECW Min
The ECW Min is combined with the ECW Max to create the contention value in the form
of a numerical range. From this range, a random number is selected for the back off
mechanism. Higher values are used for lower priority traffic. The available range is from
0-15. The default value is 4.
ECW Max
The ECW Max is combined with the ECW Min to create the contention value in the form
of a numerical range. From this range, a random number is selected for the back off
mechanism. Higher values are used for lower priority traffic. The available range is from
0-15. The default value is 10.
9. Set the following Low (Background) Access settings for the WLAN’s QoS policy:
Transmit Ops
Use the slider to set the maximum duration a device can transmit after obtaining a
transmit opportunity. For higher-priority traffic categories, this value should be set to a low
number. The default value is 0.
AIFSN
Set the current AIFSN from 2 - 15. The default value is 7. Lower priority traffic categories
should have higher AIFSNs than higher priority traffic categories. This will cause lower
priority traffic to wait longer before attempting access.
ECW Min
ECW Min is combined with ECW Max to create the contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Higher values are used for lower priority traffic. The available range is from
0-15. The default value is 4.
ECW Max
ECW Max is combined with ECW Min to create the contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Higher values are used for lower priority traffic. The available range is from
0-15. The default value is 10.
10. Set the following Other Settings for the WLAN’s QoS policy:
Trust IP DSCP
Select this option to trust IP DSCP values for WLANs. This feature is enabled by default.
Trust 802.11 WMM QoS
Select this option to trust 802.11 WMM QoS values for WLANs.This feature is enabled by
default.
6 - 52 WiNG 5.5.3 Access Point System Reference Guide
11. Select OK when completed to update this WLAN’s QoS settings. Select Reset to revert the screen back to its last saved
configuration.
6.2.2 Configuring a WLAN’s QoS Rate Limit Settings
WLAN QoS Policy
Excessive traffic can cause performance issues or bring down the network entirely. Excessive traffic can be caused by numerous
sources including network loops, faulty devices or malicious software such as a worm or virus that has infected on one or more
devices at the branch. Rate limiting limits the maximum rate sent to or received from the wireless network (and WLAN) per
wireless client. It prevents any single user from overwhelming the wireless network. It can also provide differential service for
service providers. The uplink and downlink rate limits are usually configured on a RADIUS server using vendor specific
attributes. An administrator can set separate QoS rate limit configurations for data transmitted from the access point
(upstream) and data transmitted from a WLAN’s wireless clients back to their associated access point radios (downstream).
AP6511 and AP6521 model access points do not support rate limiting on an individual client basis.
Before defining rate limit thresholds for WLAN upstream and downstream traffic, Motorola Solutions recommends you define
the normal number of ARP, broadcast, multicast and unknown unicast packets that typically transmit and receive from each
supported WMM access category. If thresholds are defined too low, normal network traffic (required by end-user devices) is
dropped, resulting in intermittent outages and performance problems.
To configure a QoS rate limit configuration for a WLAN and connected clients:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Wireless LAN QoS Policy to display a high level display of existing WLANs QoS policies.
4. Either select the Add button to define a new WLAN QoS policy, or select an existing WLAN QoS policy and Edit to modify
its configuration.
5. Select the Rate Limit tab.
Wireless Configuration 6 - 53
Figure 6-24 WLAN - WLAN QoS Policy screen - Rate Limit tab
6. Configure the following intended Upstream Rate Limit parameters for the selected WLAN:
Enable
Select this radio button to enable rate limiting for data transmitted from access point
radios to associated clients on this WLAN. Enabling this option does not invoke rate
limiting for data traffic in the downstream direction. This feature is disabled by default.
Rate
Define an upstream rate limit from 50 - 1,000,000 kbps. This limit constitutes a threshold
for the maximum number of packets transmitted or received over the WLAN (from all
access categories). Traffic exceeding the defined rate is dropped and a log message is
generated. The default setting is 5000 kbps.
6 - 54 WiNG 5.5.3 Access Point System Reference Guide
Maximum Burst Size
Set a maximum burst size from 2 - 1024 kbytes. The smaller the burst, the less likely the
upstream packet transmission will result in congestion for the WLAN’s wireless client
destinations. By trending the typical number of ARP, broadcast, multicast and unknown
unicast packets over a period of time, the average rate for each access category can be
obtained. Once a baseline is obtained, administrators should then add a minimum of a
10% margin to allow for traffic bursts at the site. The default burst size is 320 kbytes.
7. Set the following Upstream Random Early Detection Threshold settings for each access category. An early random
drop is conducted when the amount of tokens for a traffic stream falls below the set threshold for the selected WLAN.
Background Traffic
Set a percentage for WLAN background traffic in the upstream direction. This is a
percentage of the maximum burst size for low priority traffic. Background traffic exceeding
the defined threshold is dropped and a log message is generated. Background traffic
consumes the least bandwidth of any access category, so this value can be set to a lower
value once a general upstream rate is known by the network administrator (using a time
trend analysis). The default threshold is 50%.
Best Effort Traffic
Set a percentage for WLAN best effort traffic in the upstream direction. This is a
percentage of the maximum burst size for normal priority traffic. Best effort traffic
exceeding the defined threshold is dropped and a log message is generated. Best effort
traffic consumes little bandwidth, so this value can be set to a lower value, once a general
upstream rate is known by the network administrator (using a time trend analysis). The
default threshold is 50%.
Video Traffic
Set a percentage for WLAN video traffic in the upstream direction. This is a percentage of
the maximum burst size for video traffic. Video traffic exceeding the defined threshold is
dropped and a log message is generated. Video traffic consumes significant bandwidth,
so this value can be set to a higher value once a general upstream rate is known by the
network administrator (using a time trend analysis). The default threshold is 25%.
Voice Traffic
Set a percentage for WLAN voice traffic in the upstream direction. This is a percentage of
the maximum burst size for voice traffic. Voice traffic exceeding the defined threshold is
dropped and a log message is generated. Voice applications consume significant
bandwidth, so this value can be set to a higher value once a general upstream rate is
known by the network administrator (using a time trend analysis). The default threshold is
0%.
8. Configure the following parameters in respect to the WLAN’s intended Downstream Rate Limit, or traffic from wireless
clients to associated access point radios:
Enable
Select this radio button to enable rate limiting for data transmitted from access point
radios to associated wireless clients. Enabling this option does not invoke rate limiting for
data traffic in the upstream direction. This feature is disabled by default.
Rate
Define an upstream rate limit from 50 - 1,000,000 kbps.This limit constitutes a threshold
for the maximum the number of packets transmitted or received over the WLAN (from all
access categories). Traffic that exceeds the defined rate is dropped and a log message is
generated. The default setting is 5,000 kbps.
Wireless Configuration 6 - 55
Maximum Burst Size
Set a maximum burst size from 2 - 1024 kbytes. The smaller the burst, the less likely the
downstream packet transmission will result in congestion for the WLANs wireless client
destinations. By trending the typical number of ARP, broadcast, multicast and unknown
unicast packets over a period of time, the average rate for each access category can be
obtained. Once a baseline is obtained, administrators should then add a minimum of a
10% margin to allow for traffic bursts at the site. The default burst size is 320 kbytes.
9. Set the following Downstream Random Early Detection Threshold settings for each access category. An early random
drop is conducted when a traffic stream falls below the set threshold for the selected WLAN.
Background Traffic
Set a percentage for WLAN background traffic in the downstream direction. This is a
percentage of the maximum burst size for low priority traffic. Background traffic
exceeding the defined threshold is dropped and a log message is generated. Background
traffic consumes the least bandwidth of any access category, so this value can be set to
a lower value once a general downstream rate is known by the network administrator
(using a time trend analysis). The default threshold is 50%.
Best Effort Traffic
Set a percentage for WLAN best effort traffic in the downstream direction. This is a
percentage of the maximum burst size for normal traffic. Best effort traffic exceeding the
defined threshold is dropped and a log message is generated. Best effort traffic consumes
little bandwidth, so this value can be set to a lower value once a general downstream rate
is known by the network administrator (using a time trend analysis). The default threshold
is 50%.
Video Traffic
Set a percentage for WLAN video traffic in the downstream direction. This is a percentage
of the maximum burst size for video traffic. Video traffic exceeding the defined threshold
is dropped and a log message is generated. Video traffic consumes significant bandwidth,
so this value can be set to a higher value once a general downstream rate is known by the
network administrator (using a time trend analysis). The default threshold is 25%.
Voice Traffic
Set a percentage for WLAN voice traffic in the downstream direction. This is a percentage
of the maximum burst size for voice traffic. Voice traffic exceeding the defined threshold
is dropped and a log message is generated. Voice applications consume significant
bandwidth, so this value can be set to a higher value once a general upstream rate is
known by the network administrator (using a time trend analysis). The default threshold
is 0%. 0% means no early random drops will occur.
10. Configure the following intended Upstream Rate Limit parameters for wireless client traffic:
Enable
Select this radio button to enable rate limiting for data transmitted from access point
radios to associated clients. Enabling this option does not invoke rate limiting for data
traffic in the downstream direction. This feature is disabled by default.
Rate
Define an upstream rate limit from 50 - 1,000,000 kbps. This limit constitutes a threshold
for the maximum the number of packets transmitted or received from clients (from all
access categories). Traffic exceeding the defined rate is dropped and a log message is
generated. The default setting is 1000 kbps.
6 - 56 WiNG 5.5.3 Access Point System Reference Guide
Maximum Burst Size
Set a maximum burst size from 2 - 1024 kbytes. The smaller the burst, the less likely the
upstream packet transmission will result in congestion for wireless client traffic. By
trending the typical number of ARP, broadcast, multicast and unknown unicast packets
over a period of time, the average rate for each access category can be obtained. Once a
baseline is obtained, administrators should then add a minimum of a 10% margin to allow
for traffic bursts at the site. The default burst size is 64 kbytes.
11. Set the following Upstream Random Early Detection Threshold settings for each access category. An early random
drop is conducted when the amount of tokens for a traffic stream falls below the set threshold for wireless client traffic.
Background Traffic
Set a percentage for client background traffic in the upstream direction. This is a
percentage of the maximum burst size for low priority traffic. Background traffic
exceeding the defined threshold is dropped and a log message is generated. Background
traffic consumes the least bandwidth of any access category, so this value can be set to
a lower value once a general upstream rate is known by the network administrator (using
a time trend analysis). The default threshold is 50%.
Best Effort Traffic
Set a percentage for client best effort traffic in the upstream direction. This is a
percentage of the maximum burst size for normal priority traffic. Best effort traffic
exceeding the defined threshold is dropped and a log message is generated. Best effort
traffic consumes little bandwidth, so this value can be set to a lower value, once a general
upstream rate is known by the network administrator (using a time trend analysis). The
default threshold is 50%.
Video Traffic
Set a percentage for client video traffic in the upstream direction. This is a percentage of
the maximum burst size for video traffic. Video traffic exceeding the defined threshold is
dropped and a log message is generated. Video traffic consumes significant bandwidth,
so this value can be set to a higher value once a general upstream rate is known by the
network administrator (using a time trend analysis). The default threshold is 25%.
Voice Traffic
Set a percentage for WLAN voice traffic in the upstream direction. This is a percentage of
the maximum burst size for voice traffic. Voice traffic exceeding the defined threshold is
dropped and a log message is generated. Voice applications consume significant
bandwidth, so this value can be set to a higher value once a general upstream rate is
known by the network administrator (using a time trend analysis). The default threshold
is 0%.
12. Configure the following intended Downstream Rate Limit parameters for wireless client traffic:
Enable
Select this radio button to enable rate limiting for data transmitted from access point
radios to associated wireless clients. Enabling this option does not invoke rate limiting for
data traffic in the upstream direction. This feature is disabled by default.
Rate
Define an upstream rate limit from 50 - 1,000,000 kbps. This limit constitutes a threshold
for the maximum the number of packets transmitted or received from clients. Traffic that
exceeds the defined rate is dropped and a log message is generated. The default setting
is 1,000 kbps.
Wireless Configuration 6 - 57
Maximum Burst Size
Set a maximum burst size from 2 - 1024 kbytes. The smaller the burst, the less likely the
downstream packet transmission will result in congestion for wireless client traffic. By
trending the typical number of ARP, broadcast, multicast and unknown unicast packets
over a period of time, the average rate for each access category can be obtained. Once a
baseline is obtained, administrators should then add a minimum of a 10% margin to allow
for traffic bursts at the site. The default burst size is 64 kbytes.
13. Set the following Downstream Random Early Detection Threshold settings for each access category. An early random
drop is conducted when the amount of tokens for a traffic stream falls below the set threshold for wireless client traffic.
Background Traffic
Set a percentage for client background traffic in the downstream direction. This is a
percentage of the maximum burst size for low priority traffic. Background traffic exceeding
the defined threshold is dropped and a log message is generated. Background traffic
consumes the least bandwidth of any access category, so this value can be set to a lower
value once a general downstream rate is known by the network administrator (using a
time trend analysis). The default threshold is 50%.
Best Effort Traffic
Set a percentage for client best effort traffic in the downstream direction. This is a
percentage of the maximum burst size for normal traffic. Best effort traffic exceeding the
defined threshold is dropped and a log message is generated. Best effort traffic consumes
little bandwidth, so this value can be set to a lower value once a general downstream rate
is known by the network administrator (using a time trend analysis). The default threshold
is 50%.
Video Traffic
Set a percentage for client video traffic in the downstream direction. This is a percentage
of the maximum burst size for video traffic. Video traffic exceeding the defined threshold
is dropped and a log message is generated. Video traffic consumes significant bandwidth,
so this value can be set to a higher value once a general downstream rate is known by the
network administrator (using a time trend analysis). The default threshold is 25%.
Voice Traffic
Set a percentage for client voice traffic in the downstream direction. This is a percentage
of the maximum burst size for voice traffic. Voice traffic exceeding the defined threshold
is dropped and a log message is generated. Voice applications consume significant
bandwidth, so this value can be set to a higher value once a general upstream rate is
known by the network administrator (using a time trend analysis). The default threshold is
0%. 0% means no early random drops will occur.
6.2.3 Configuring Multimedia Optimizations
WLAN QoS Policy
To configure multimedia optimizations for a WLAN:
1. Select Configuration.
2. Select Wireless.
3. Select Wireless LAN QoS Policy to display a high level display of existing WLANs QoS policies.
4. Either select the Add button to define a new WLAN QoS policy, or select an existing WLAN QoS policy and Edit to modify
its configuration.
5. Select the Multimedia Optimizations tab.
6 - 58 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-25 WLAN - WLAN QoS Policy Screen - Multimedia Optimizations
6. Configure the following parameters in respect to the intended Multicast Mask:
Multicast Mask Primary
Configure the primary multicast mask for each listed QoS policy. Normally all multicast
and broadcast packets are buffered until the periodic DTIM interval (indicated in the
802.11 beacon frame), when clients in power save mode wake to check for frames.
However, for certain applications and traffic types, an administrator may want the frames
transmitted immediately, without waiting for the DTIM interval. By configuring a primary
and secondary multicast mask, an administrator can indicate which frames are
transmitted immediately. Setting masks is optional and only needed if there are traffic
types requiring special handling.
Multicast Mask
Secondary
Set a secondary multicast mask for the WLAN QoS policy. Normally all multicast and
broadcast packets are buffered until the periodic DTIM interval (indicated in the 802.11
beacon frame), when clients in power save mode wake to check for frames. However, for
certain applications and traffic types, an administrator may want the frames transmitted
immediately, without waiting for the DTIM interval. By configuring a primary and
secondary multicast mask, an administrator can indicate which frames are transmitted
immediately. Setting masks is optional and only needed if there are traffic types requiring
special handling.
7. Set the following Accelerated Multicast settings:
Disable Multicast
Streaming
Select this option to disable all Multicast Streaming on the WLAN.
Wireless Configuration 6 - 59
Automatically Detect
Multicast Streams
Select this option to convert multicast packets to unicast to provide better overall airtime
utilization and performance. The administrator can either have the system automatically
detect multicast streams and convert all detected multicast streams to unicast, or specify
which multicast streams are converted to unicast. When the stream is converted and
queued for transmission, there are a number of classification mechanisms that can be
applied to the stream and the administrator can select what type of classification they
want.
Manually Configure
Multicast Addresses
Select this option and specify a list of multicast addresses and classifications. Packets are
accelerated when the destination addresses matches.
8. Select OK when completed to update this WLAN’s Multimedia Optimizations settings. Select Reset to revert the screen
back to its last saved configuration.
6.2.3.1 WLAN QoS Deployment Considerations
Before defining a QoS configuration on a WLAN, refer to the following deployment guidelines to ensure the configuration is
optimally effective:
• WLAN QoS configurations differ significantly from QoS policies configured for associated access point radios. WLAN QoS
configurations are designed to support the data requirements of wireless clients, including the data types they support and
their network permissions. Radio QoS policies are specific to the transmit and receive characteristics of the connected
radio’s themselves, independent from the wireless clients these access point radios support.
• Enabling WMM support on a WLAN only advertises WMM capability to wireless clients. The wireless clients must be also
able to support WMM and use the parameters correctly while accessing the wireless network to truly benefit.
• Rate limiting is disabled by default on WLANs. To enable rate limiting, a threshold must be defined for WLAN.
• Before enabling rate limiting on a WLAN, a baseline for each traffic type should be performed. Once a baseline has been
determined, a minimum 10% margin should be added to allow for traffic bursts.
• The bandwidth required for real-time applications such as voice and video are very fairly easy to calculate as the bandwidth
requirements are consistent and can be realistically trended over time. Applications such as Web, database and E-mail are
harder to estimate, since bandwidth usage varies depending on how the applications are utilized.
6 - 60 WiNG 5.5.3 Access Point System Reference Guide
6.3 Radio QoS Policy
Wireless Configuration
Without a dedicated QoS policy, a network operates on a best-effort delivery basis, meaning all traffic has equal priority and
an equal chance of being delivered in a timely manner. When congestion occurs, all traffic has an equal chance of being
dropped!
When configuring a QoS policy for a radio, select specific network traffic, prioritize it, and use congestion-management and
congestion-avoidance techniques to provide deployment customization best suited to each QoS policy’s intended wireless
client base.
Motorola Solutions access point radios and wireless clients support several Quality of Service (QoS) techniques enabling realtime applications (such as voice and video) to co-exist simultaneously with lower priority background applications (such as web,
E-mail and file transfers). A well designed QoS policy should:
• Classify and mark data traffic to accurately prioritize and segregate it (by access category) throughout the network.
• Minimize the network delay and jitter for latency sensitive traffic.
• Ensure high priority traffic has a better likelihood of delivery in the event of network congestion.
• Prevent the ineffective utilization of access points degrading session quality by configuring admission control mechanisms
within each radio QoS policy.
Within a Motorola Solutions wireless network, wireless clients supporting low and high priority traffic contend with one
another for data resources. The IEEE 802.11e amendment has defined Enhanced Distributed Channel Access (EDCA)
mechanisms stating high priority traffic can access the network sooner then lower priority traffic. The EDCA defines four traffic
classes (or access categories); voice (highest), video (next highest), best effort and background (lowest).The EDCA has defined
a time interval for each traffic class, known as the Transmit Opportunity (TXOP). The TXOP prevents traffic of a higher priority
from completely dominating the wireless medium, thus ensuring lower priority traffic is still supported by connected radios.
IEEE 802.11e includes an advanced power saving technique called Unscheduled Automatic Power Save Delivery (U-APSD) that
provides a mechanism for wireless clients to retrieve packets buffered by an access point. U-APSD reduces the amount of
signaling frames sent from a client to retrieve buffered data from an access point. U-APSD also allows access points to deliver
buffered data frames as bursts, without backing-off between data frames. These improvements are useful for voice clients, as
they improve battery life and call quality.
The Wi-Fi alliance has created Wireless Multimedia (WMM) and WMM Power Save (WMM-PS) certification programs to
ensure interoperability between 802.11e WLAN infrastructure implementations and wireless clients. An access point managed
wireless network supports both WMM and WMM-Power Save techniques. WMM and WMM-PS (U-APSD) are enabled by
default in each WLAN profile.
Enabling WMM support on a WLAN just advertises the WLAN’s WMM capability and radio configuration to wireless clients.
The wireless clients must be also able to support WMM and use the values correctly while accessing WLAN to benefit.
WMM includes advanced parameters (CWMin, CWMax, AIFSN and TXOP) specifying back-off duration and inter-frame spacing
when accessing the network. These parameters are relevant to both connected access point radios and their wireless clients.
Parameters impacting access point transmissions to their clients are controlled using per radio WMM settings, while
parameters used by wireless clients are controlled by a WLAN’s WMM settings.
Access points support static QoS mechanisms per WLAN to provide prioritization of WLAN traffic when legacy (non WMM)
clients are deployed. An access point allows flexible WLAN mapping with a static WMM access control value. When enabled
on a WLAN, traffic forwarded from to a client is prioritized and forwarded based on the WLAN’s WMM access control setting.
NOTE: Statically setting a WLAN WMM access category value only prioritizes traffic to
the client.
Wireless Configuration 6 - 61
Wireless network administrators can also assign weights to each WLAN in relation to user priority levels. The lower the
weight, the lower the priority. Use a weighted round robin technique to achieve different QoS levels across WLANs.
Optionally rate-limit bandwidth for WLAN sessions. This form of per-user rate limiting enables administrators to define uplink
and downlink bandwidth limits for users and clients. This sets the level of traffic a user or client can forward and receive over
the WLAN. If the user or client exceeds the limit, excessive traffic is dropped.
Rate limits can be applied externally from a RADIUS server using Vendor Specific Attributes (VSAs). Rate limits can be applied
to users authenticating using 802.1X, captive portal authentication and devices using MAC authentication.
6.3.1 Configuring a Radio’s QoS Policy
Radio QoS Policy
To configure an access point radio’s QoS policy:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Radio QoS Policy to display a high level display of existing Radio QoS policies.
Figure 6-26 Radio Quality of Service (QoS) screen
4. Refer to the following information for a radio QoS policy:
Radio QoS Policy
Displays the name of each radio QoS policy. This is the name set for each listed policy
when it was created and cannot be modified as part of the policy edit process.
Firewall detection traffic
(e.g., SIP)
A green check mark defines the policy as applying radio QoS settings to traffic detected
by the firewall used with the radio QoS policy. A red “X” defines the policy as having
firewall detection disabled. When enabled, the firewall simulates the reception of frames
for voice traffic when voice traffic was originated via SIP or SCCP control traffic. If a client
exceeds configured values, the call is stopped and/or received voice frames are forwarded
at the next non admission controlled traffic class priority. This applies to clients that do
not send TPSEC frames only.
6 - 62 WiNG 5.5.3 Access Point System Reference Guide
Implicit TPSEC
A green check mark defines the policy as requiring wireless clients to send their traffic
specifications to an access point before they can transmit or receive data. If enabled, this
setting applies to just this radio’s QoS policy. When enabled, the access point simulates
the reception of frames for any traffic class by looking at the amount of traffic the client
is receiving and sending. If a client sends more traffic than configured for an admission
controlled traffic class, the traffic is forwarded at the priority of the next non admission
controlled traffic class. This applies to clients that do not send TPSEC frames only.
Voice
A green check mark indicates voice prioritization QoS is enabled on the radio. A red X
indicates voice prioritization QoS is disabled on the radio.
Best Effort
A green check mark indicates best effort QoS is enabled on the radio. A red X indicates
best effort QoS is disabled on the radio.
Video
A green check mark indicates video prioritization QoS is enabled on the radio. A red X
indicates video prioritization QoS is disabled on the radio.
Background
A green check mark indicates background prioritization QoS is enabled on the radio. A red
X indicates that background prioritization QoS is disabled on the radio.
5. Either select Add to create a new radio QoS policy, or select an existing policy and select Edit to modify its configuration.
Figure 6-27 Radio QoS Policy screen - WMM tab
The Radio QoS Policy screen displays the WMM tab by default. Use the WMM tab to define the access category
configuration (CWMin, CWMax, AIFSN and TXOP values) in respect to the type of wireless data planned for this new or
updated radio QoS policy.
Wireless Configuration 6 - 63
6. Set the following Voice Access settings for the radio QoS policy:
Transmit Ops
Use the slider to set the maximum duration a device can transmit after obtaining a
transmit opportunity. When resources are shared between a Voice over IP (VoIP) call and
a low priority file transfer, bandwidth is normally exploited by the file transfer, thus
reducing call quality or even causing the call to disconnect. With voice QoS, a VoIP call (a
real-time session), receives priority, maintaining a high level of voice quality. For higherpriority traffic categories (like voice), the Transmit Ops value should be set to a low
number. The default value is 47.
AIFSN
Set the current AIFSN value from 1 - 15. Higher-priority traffic voice categories should
have lower AIFSNs than lower-priority traffic categories. This will cause lower-priority
traffic to wait longer before attempting access. The default value is 1.
ECW Min
ECW Min is combined with ECW Max to create a contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Lower values are used for higher priority traffic. The available range is from
0 - 15. The default value is 2.
ECW Max
ECW Max is combined with ECW Min to create a contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Lower values are used for higher priority traffic. The available range is from
0 - 15. The default value is 3.
7. Set the following Normal (Best Effort) Access settings for the radio QoS policy:
Transmit Ops
Use the slider to set the maximum duration a device can transmit after obtaining a
transmit opportunity. For higher-priority traffic categories, this value should be set to a low
number. The default value is 0.
AIFSN
Set the current AIFSN from1 - 15. Higher-priority traffic voice categories should have
lower AIFSNs than lower-priority traffic categories. This will cause lower-priority traffic to
wait longer before attempting access. The default value is 3.
ECW Min
ECW Min is combined with ECW Max to create a contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Higher values are used for lower priority traffic (like normal). The available
range is from 0-15. The default value is 4.
ECW Max
ECW Max is combined with ECW Min to create a contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Higher values are used for lower priority traffic (like normal). The available
range is from 0-15. The default value is 6.
8. Set the following Video Access settings for the radio QoS policy:
Transmit Ops
Use the spinner control to set the maximum duration a radio can transmit after obtaining
a transmit opportunity. For higher-priority traffic categories (like video), this value should
be set to a low number. The default value is 94.
AIFSN
Set the current AIFSN from 1 - 15. Higher-priority traffic video categories should have
lower AIFSNs than lower-priority traffic categories. This will cause lower-priority traffic to
wait longer before attempting access. The default value is 1.
6 - 64 WiNG 5.5.3 Access Point System Reference Guide
ECW Min
ECW Min is combined with ECW Max to create a contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Lower values are used for higher priority traffic (like video). The available
range is from 0-15. The default value is 3.
ECW Max
ECW Max is combined with ECW Min to create a contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Lower values are used for higher priority traffic (like video). The available
range is from 0-15. The default value is 4.
9. Set the following Low (Background) Access settings for the radio QoS policy:
Transmit Ops
Use the slider to set the maximum duration a device can transmit after obtaining a
transmit opportunity. For higher-priority traffic categories, this value should be set to a low
number. The default value is 0.
AIFSN
Set the current AIFSN from 1- 15. Higher-priority traffic voice categories should have
lower AIFSNs than lower-priority traffic categories. This will cause lower-priority traffic to
wait longer before attempting access. The default value is 7.
ECW Min
ECW Min is combined with ECW Max to create a contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Higher values are used for lower priority traffic (like low). The available range
is from 0-15. The default value is 4.
ECW Max
ECW Max is combined with ECW Min to create a contention value in the form of a
numerical range. From this range, a random number is selected for the back off
mechanism. Lower values are used for higher priority traffic (like video). The available
range is from 0-15. The default value is 10.
10. Select OK when completed to update the radio QoS settings for this policy. Select Reset to revert back to last saved
configuration.
11. Select the Admission Control tab to configure an admission control configuration for selected radio QoS policy. Admission
control requires clients send their traffic specifications (TSPEC) to a managed access point before they can transmit or
receive data within the access point managed network.
The name of the radio QoS policy, for which the admission control settings apply, displays in the banner of the QoS Policy
screen.
Wireless Configuration 6 - 65
Figure 6-28 Radio QoS Policy screen - Admission Control tab
12. Select the Enable admission control for firewall detected traffic (e.g, SIP) option to apply radio QoS settings to
traffic detected by the access point’s firewall. This feature is enabled by default.
13. Select the Implicit TPSEC option to require wireless clients to send their traffic specifications to the access point before
they can transmit or receive data. This feature is enabled by default.
14. Set the following Voice Access admission control settings for the radio QoS policy:
Enable Voice
Select this option to enable admission control for voice traffic. Only voice traffic admission
control is enabled, not any of the other access categories (each access category must be
separately enabled and configured). This feature is disabled by default.
Maximum Airtime
Set the maximum airtime (in the form of a percentage of the radio’s bandwidth) allotted
to admission control for voice supported client traffic. The available percentage range is
from 0 - 150%, with 150% being available to account for over-subscription. This value
ensures the radio’s bandwidth is available for high bandwidth voice traffic (if anticipated
on the wireless medium) or other access category traffic if voice support is not prioritized.
Voice traffic requires longer radio airtime to process, so set a longer airtime value if the
radio is intended to support voice. The default is 75%.
Maximum Wireless
Clients
Set the number of voice supported wireless clients allowed to exist (and consume
bandwidth) within the radio’s QoS policy. Select from an available range of 0 - 256 clients.
Consider setting this value proportionally to the number of other QoS policies supporting
the voice access category, as wireless clients supporting voice use a greater proportion of
resources than lower bandwidth traffic (like low and best effort categories). The default
is 100.
Maximum Roamed
Wireless Clients
Set the number of voice supported wireless clients allowed to roam to a different access
point radio. Select from 0 - 256 clients. The default value is 10.
6 - 66 WiNG 5.5.3 Access Point System Reference Guide
Reserved for Roam
Set the roam utilization (in the form of a percentage of the radio’s bandwidth) allotted to
admission control for voice supported clients who have roamed to a different access point
radio. The available percentage range is from 0 - 150%, with 150% available to account
for over-subscription. The default value is 10%.
15. Set the following Normal (Best Effort) Access admission control settings for the radio QoS policy:
Enable Best Effort
Select this option to enable admission control for video traffic. Only normal background
traffic admission control is enabled, not any of the other access categories (each access
category must be separately enabled and configured). This feature is disabled by default.
Maximum Airtime
Set the maximum airtime (in the form of a percentage of the radio’s bandwidth) allotted
to admission control for normal background client traffic. The available percentage range
is from 0 - 150%, with 150% being available to account for over-subscription. This value
helps ensure the radio’s bandwidth is available for lower bandwidth normal traffic (if
anticipated to proliferate the wireless medium). Normal background traffic only needs a
short radio airtime to process, so set an intermediate airtime value if the radio QoS policy
is reserved for background data support. The default value is 75%.
Maximum Wireless
Clients
Set the number of wireless clients supporting background traffic allowed to exist (and
consume bandwidth) within the radio’s QoS policy. Select from 0 - 256 clients. The default
value is 100.
Maximum Roamed
Wireless Clients
Set the number of normal background supported wireless clients allowed to roam to a
different managed access point radio. Select from 0 - 256 clients. The default value is 10.
Reserved for Roam
Set the roam utilization (in the form of a percentage of the radio’s bandwidth) allotted to
admission control for normal background supported clients who have roamed to a
different managed radio. The available percentage range is from 0 - 150%, with 150%
available to account for over-subscription. The default value is 10%.
16. Set the following Video Access admission control settings for the radio QoS policy:
Enable Video
Select this option to enable admission control for video traffic. Only video traffic
admission control is enabled, not any of the other access categories (each access category
must be separately enabled and configured). This feature is disabled by default.
Maximum Airtime
Set the maximum airtime (in the form of a percentage of the radio’s bandwidth) allotted
to admission control for video supported client traffic. The available percentage range is
from 0 - 150%, with 150% being available to account for over-subscription. This value
helps ensure the radio’s bandwidth is available for high bandwidth video traffic (if
anticipated on the wireless medium) or other access category traffic if video support is not
prioritized. Video traffic requires longer radio airtime to process, so set a longer airtime
value if the radio QoS policy is intended to support video. The default value is 75%.
Maximum Wireless
Clients
Set the number of video supported wireless clients allowed to exist (and consume
bandwidth) within the radio’s QoS policy. Select from an available range of 0-256 clients.
Consider setting this value proportionally to the number of other QoS policies supporting
the video access category, as wireless clients supporting video use a greater proportion
of resources than lower bandwidth traffic (like low and best effort categories). The default
value is 100.
Maximum Roamed
Wireless Clients
Set the number of video supported wireless clients allowed to roam to a different access
point radio. Select from 0-256 clients. The default value is 10.
Wireless Configuration 6 - 67
Reserved for Roam
Set the roam utilization (in the form of a percentage of the radio’s bandwidth) allotted to
admission control for video supported clients who have roamed to a different managed
radio. The available percentage range is from 0 - 150%, with 150% accounting for oversubscription. The default value is 10%.
17. Set the following Low (Background) Access admission control settings for the radio QoS policy:
Enable Background
Select this option to enable admission control for lower priority traffic. Only low traffic
admission control is enabled, not any of the other access categories (each access category
must be separately enabled and configured).
Maximum Airtime
Set the maximum airtime (in the form of a percentage of the radio’s bandwidth) allotted
to admission control for low client traffic. The available percentage range is from
0 - 150%, with 150% being available to account for over-subscription. Best effort traffic
only needs a short radio airtime to process, so set an intermediate airtime value if the
radio QoS policy is reserved to support background data. The default value is 75%.
Maximum Wireless
Clients
Set the number of low priority wireless clients allowed to exist (and consume bandwidth)
within the radio’s QoS policy. Select from 0 - 256 clients. The default value is 100.
Maximum Roamed
Wireless Clients
Set the number of low priority supported wireless clients allowed to roam to a different
access point radio. Select from 0-256 clients. The default value is 10.
Reserved for Roam
Set the roam utilization (in the form of a percentage of the radio’s bandwidth) allotted to
admission control for clients who have roamed to a different access point radio. The
available percentage range is from 0 - 150%, with 150% available to account for oversubscription. The default value is 10%.
18. Select the Multimedia Optimization tab to configure advanced multimedia QoS configuration and Smart Aggregation
configuration for the radio’s QoS policy.
6 - 68 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-29 Radio QoS Policy screen - Multimedia Optimizations tab
19. Set the following Accelerated Multicast settings:
Maximum number of
Specify the maximum number of wireless clients (from 0 - 256) allowed to use accelerated
wireless clients allowed multicast. The default value is 25.
When wireless client
count exceeds the above
limit
When the wireless client count using accelerated multicast exceeds the maximum
number set the radio to either Reject new wireless clients or to Revert existing clients to
a non-accelerated state. The default setting is Reject.
Maximum multicast
streams per client
Specify the maximum number of multicast streams (from 1 - 4) wireless clients can use.
The default value is 2.
Packets per second for
multicast flow for it to be
accelerated
Specify the threshold of multicast packets per second (from 1 - 500) that triggers
acceleration for wireless clients. The default value is 25.
Timeout for wireless
clients
Specify a timeout value in seconds (from 5 - 6,000) for wireless clients to revert back to a
non-accelerated state. The default value is 60.
20. Set the following Smart Aggregation settings.
Smart Aggregation enhances the existing implementation of frame aggregation by dynamically selecting the time when the
aggregated frame is transmitted. In the normal implementation of frame aggregation, an aggregated frame is sent when it
meets one of these conditions:
• When a preconfigured number of frames to aggregate is reached.
• When a preconfigured interval of time has elapsed since the first frame - of a set of frames to be aggregated - was
received.
Wireless Configuration 6 - 69
• When a preconfigured interval has elapsed since the last frame, not necessarily the final frame, - of a set of frames to
be aggregated - was received.
In this enhancement to the standard frame aggregation, the time delay for aggregation is set individually for each traffic
class. For example, voice traffic might not be aggregated but sent immediately, whereas, background data traffic is set a
time delay for aggregating frames and these aggregated frames are sent.
Smart Aggregation
Select to enable Smart Aggregation and dynamically set the time when an aggregated
frame is transmitted.
Max Delay for Best Effort
Specify the maximum time in milliseconds to delay best effort traffic. The default setting
is 150 millisecond.
Max Delay for
Background
Specify the maximum time in milliseconds to delay background traffic. The default setting
is 250 millisecond.
Max Delay for Streaming
Video
Specify the maximum time in milliseconds to delay streaming video traffic. The default
setting is 150 millisecond.
Max Delay for Video
Conferencing
Specify the maximum time in milliseconds to delay video conferencing traffic. The default
setting is 40 millisecond.
Max Delay for Voice
Specify the maximum time in milliseconds to delay voice traffic. The default setting is 0
millisecond.
Minimum frames per
Aggregate limit
Specify the minimum number of frames to aggregate in a frame before it is transmitted.
The default setting is 8 frames.
Max Mesh Links
Specify the maximum number of mesh links for Smart Aggregation. The default setting is
3.
21. Select OK to update radio QoS multimedia optimization settings Select Reset to revert to the last saved configuration.
6 - 70 WiNG 5.5.3 Access Point System Reference Guide
Radio QoS Configuration and Deployment Considerations
Radio QoS Policy
Before defining a radio QoS policy, refer to the following deployment guidelines to ensure the configuration is optimally
effective:
• To support QoS, each multimedia application, wireless client and WLAN is required to support WMM.
• WMM enabled clients can co-exist with non-WMM clients on the same WLAN. Non-WMM clients are always assigned a
best effort access category.
• Motorola Solutions recommends default WMM values be used for all deployments. Changing these values can lead to
unexpected traffic blockages, and the blockages might be difficult to diagnose.
• Overloading an access point radio with too much high priority traffic (especially voice) degrades the overall service quality
for all users.
• TSPEC admission control is only available with newer voice over WLAN phones. Many legacy voice devices do not support
TPSEC or even support WMM traffic prioritization.
Wireless Configuration 6 - 71
6.4 Association ACL
Wireless Configuration
An Association ACL is a policy-based Access Control List (ACL) that either prevents or allows wireless clients from connecting
to a WLAN.
An Association ACL allows an administrator to grant or restrict client access by specifying a wireless client MAC address or
range of MAC addresses to either include or exclude from connectivity.
Association ACLs are applied to WLANs as an additional access control mechanism. They can be applied to WLANs from within
a WLAN Policy’s Advanced configuration screen. For more information on applying an existing Association ACL to a WLAN, see
Configuring Advanced WLAN Settings on page 6-38.
Each supported access point model can support up to 32 Association ACLs, with the exception of AP6511 and AP6521 models
that support 16 WLAN Association ACLs.
To define an Association ACL deployable with a WLAN:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select Association ACL to display a high level display of existing Association ACL policies.
The Association Access Control List (ACL) screen lists existing Association ACL policies. Any of these policies can be
selected and applied.
Figure 6-30 Association Access Control List (ACL) screen
4. Select Add to define a new ACL configuration, Edit to modify an existing ACL configuration or Delete to remove an existing
one.
An Association ACL screen displays for defining a new ACL or modifying a selected ACL.
6 - 72 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-31 Association ACL screen
5. Select the + Add Row button to add an association ACL template.
6. If creating a new Association ACL, provide a name specific to its function. Avoid naming it after a WLAN it may support.
The name cannot exceed 32 characters.
7. Set the following parameters for the creation or modification of the Association ACL:
Precedence
The rules within a WLAN's ACL are applied to packets based on their precedence values.
Every rule has a unique sequential precedence value you define. You cannot add two
rules’s with the same precedence value. The default precedence is 1, so be careful to
prioritize ACLs accordingly as they are added.
Starting MAC Address
Provide a starting client MAC address for non unicast and multicast packet transmissions.
Ending MAC Address
Provide an ending MAC address for non unicast and multicast packet transmissions.
Allow/Deny
Use the drop-down menu to either Allow or Deny access if a MAC address matches this
rule.
8. Select the + Add Row radio button to add MAC address ranges and allow/deny designations.
9. Select OK to update the Association ACL settings. Select Reset to revert to the last saved configuration.
Wireless Configuration 6 - 73
6.4.1 Association ACL Deployment Considerations
Association ACL
Before defining an Association ACL configuration and applying it to a WLAN, refer to the following deployment guidelines to
ensure the configuration is optimally effective:
• Motorola Solutions recommends using the Association ACL screen strategically to name and configure ACL policies
meeting the requirements of the particular WLANs they may map to. However, be careful not to name ACLs after specific
WLANs, as individual ACL policies can be used by more than one WLAN.
• You cannot apply more than one MAC based ACL to a Layer 2 interface. If a MAC ACL is already configured on a Layer 2
interface, and a new MAC ACL is applied to the interface, the new ACL replaces the previously configured one.
6 - 74 WiNG 5.5.3 Access Point System Reference Guide
6.5 SMART RF
Wireless Configuration
Self Monitoring At Run Time RF Management (SMART RF) is a Motorola Solutions innovation designed to simplify RF
configurations for new deployments, while (over time) providing on-going deployment optimization radio performance
improvements.
Smart RF can reduce deployment costs by scanning the RF environment to determine the best channel and transmit power
configuration for each managed radio.
Smart RF centralizes the decision process and makes intelligent RF configuration decisions using information obtained from
the RF environment. Smart RF helps reduce ongoing management and maintenance costs through periodic re-calibration of the
network. Re-calibration can be initiated manually or can be automatically scheduled to ensure the RF configuration is optimized
to factor for RF environment changes (such as new sources of interference, or neighboring access points).
NOTE: Unlike a controller or service platform, an access point utilizes a single Smart RF
configuration it can use with other access points of the same model. However, the Smart
RF policy needs to be activated from any one of the Smart RF screens. Numerous Smart
RF policies cannot be defined on behalf of the access point.
Smart RF also provides self-healing functions by monitoring the network in real-time and provides automatic mitigation from
potentially problematic events such as radio interference, coverage holes and radio failures. Smart RF employs self-healing to
enable a WLAN to better maintain wireless client performance and site coverage during dynamic RF environment changes,
which typically require manual reconfiguration to resolve.
Motorola Solutions recommends you keep in mind that if a Smart RF managed radio is operating in WLAN mode on a channel
requiring DFS, it will switch channels if radar is detected.
• If Smart RF is enabled, the radio picks a channel defined in the Smart RF policy.
• If Smart RF is disabled, but a Smart RF policy is mapped, the radio picks a channels specified in the Smart RF policy
• If no SMART RF policy is mapped, the radio selects a random channel
If the radio is a dedicated sensor, it stops termination on that channel if a neighboring access point detects radar. The access
point attempts to come back to its original channel (statically configured or selected by Smart RF) after the channel evacuation
period has expired.
Change this behavior using a no dfs-rehome command from the CLI. This keeps the radio on the newly selected channel
and prevents the radio from coming back to the original channel, even after the channel evacuation period.
NOTE: RF planning must be performed to ensure overlapping coverage exists at a
deployment site for Smart RF to be a viable network performance tool. Smart RF can only
provide recovery when access points are deployed appropriately. Smart RF is not a
solution, it's a temporary measure. Administrators need to determine the root cause of
RF deterioration and fix it. Smart RF history/events can assist.
!
CAUTION: The access point’s Smart RF feature is not able to detect a voice call in
progress, and will switch to a different channel resulting in voice call reconnections and
communication disruptions.
To define the Smart RF configuration:
1. Select the Configuration tab from the Web UI.
Wireless Configuration 6 - 75
2. Select Wireless.
3. Select Smart RF.
The Basic Configuration screen displays by default.
4. Select the Activate SMART RF Policy option to enable the parameters on the screen for configuration. The configuration
cannot be applied to the access point profile unless this settings is selected and remains enabled.
Figure 6-32 SMART RF - Basic Configuration screen
5. Refer to the Basic Settings field to enable a Smart RF policy and define its sensitivity and detector status.
Sensitivity
Select the radio button corresponding to the desired Smart RF sensitivity. Options include
Low, Medium, High and Custom. The default setting is Medium.
SMART RF Policy Enable Select this radio button to enable Smart RF for immediate inclusion within a RF Domain.
Smart RF is enabled by default.
Interference Recovery
Select this radio button to enable compensations from neighboring radios when radio
interference is detected. When interference is detected, Smart RF first determines the
power increase needed based on the signal to noise ratio for a client (as seen by the
access point radio). If a client’s signal to noise value is above the threshold, the transmit
power is increased until the signal to noise rate falls below the threshold. This setting is
enabled by default.
Coverage Hole Recovery
Select this radio button to enable coverage compensation from neighboring radios when
a radio coverage hole is detected within the Smart RF supported radio coverage area.
When coverage hole is detected, Smart RF first determines the power increase needed
based on the signal to noise ratio for a client as seen by the access point radio. If a client’s
signal to noise value is above the threshold, the transmit power is increased until the
signal to noise rate falls below the threshold.
Neighbor Recovery
Select this radio button to enable automatic recovery by instructing neighboring APs to
increase their transmit power to compensate for the coverage loss.
6 - 76 WiNG 5.5.3 Access Point System Reference Guide
6. Refer to the Calibration Assignment field to define whether Smart RF Calibration and radio grouping is conducted by the
floor the access point is deployed on or building in its entirety. Both options are disabled by default.
7. Select OK to update the access point’s Smart RF Basic configuration. Select Reset to revert to the last saved configuration.
The Smart RF policy can be invoked at any point in the configuration process by selecting Activate SMART RF Policy
from the upper, left-hand side, portion of the access point user interface.
8. Select Channel and Power. Ensure the Activate SMART RF Policy remains selected so the screen’s parameters can be
updated.
Use the Channel and Power screen to refine Smart RF power settings over both the 5.0 GHz and 2.4 GHz radio bands and
select channel settings in respect to the access point’s channel usage.
NOTE: The Power Settings and Channel Settings parameters are only enabled
when Custom is selected as the Sensitivity setting from the Basic Configuration screen.
Figure 6-33 SMART RF - Channel and Power screen
9. Refer to the Power Settings field to define Smart RF recovery settings for the access point’s 5.0 GHz (802.11a) and 2.4
GHz (802.11bg) radio.
5 GHz Minimum Power
Use the spinner control to select a 1 - 20 dBm minimum power level for Smart RF to assign
to a radio in the 5.0 GHz band. The default setting is 4 dBm.
5 GHz Maximum Power
Use the spinner control to select a 1 - 20 dBm maximum power level Smart RF can assign
a radio in the 5.0 GHz band. The default setting is 17 dBm.
Wireless Configuration 6 - 77
2.4 GHz Minimum Power
Use the spinner control to select a 1 - 20 dBm minimum power level Smart RF can assign
a radio in the 2.4 GHz band. The default setting is 4 dBm.
2.4 GHz Maximum Power Use the spinner control to select a 1 - 20 dBm maximum power level Smart RF can assign
a radio in the 2.4 GHz band. The default setting is 17 dBm.
10. Set the following Channel Settings for the access point’s 5.0 GHz and 2.4 GHz radio bands:
5 GHz Channels
Use the Select drop-down menu to select the 5.0 GHz channels used in Smart RF scans.
5 Channel Width
20 MHz and 40 MHz channel widths are supported by the 802.11a radio. 20/40 MHz
operation (the default setting for the 5 GHz radio) allows the access point to receive
packets from clients using 20 MHz of bandwidth while transmitting a packet using 40 MHz
bandwidth. This mode is supported for 11n users on both 2.4 GHz and 5.0 GHz radios. If
an 11n user selects two channels (a Primary and Secondary channel), the system is
configured for dynamic 20/40 operation. When 20/40 is selected, clients can take
advantage of “wider channels.” 802.11n clients experience improved throughput using
40 MHz while legacy clients (either 802.11a or 802.11b/g depending on the radio selected)
can still be serviced without interruption using 20 MHz. Select Automatic to enable the
automatic assignment of channels to working radios to avoid channel overlap and avoid
interference from external RF sources. The default setting is 40 MHz.
2.4 GHz Channels
Use the Select drop-down menu to select the 2.4 GHz channels used in Smart RF scans.
2.4 GHz Channel Width
20 and 40 MHz channel widths are supported by the 802.11a radio. 20 MHz is the default
setting for 2.4 GHz radios. 20/40 MHz operation (the default setting for the 5 GHz radio)
allows the access point to receive packets from clients using 20 MHz of bandwidth while
transmitting a packet using 40 MHz bandwidth. This mode is supported for 11n users on
both 2.4 GHz and 5.0 GHz radios. If an 11n user selects two channels (a Primary and
Secondary channel), the system is configured for dynamic 20/40 operation. When 20/40
is selected, clients can take advantage of “wider channels.” 802.11n clients experience
improved throughput using 40 MHz while legacy clients (either 802.11a or 802.11b/g
depending on the radio selected) can still be serviced without interruption using 20 MHz.
Select Automatic to enable automatic assignment of channels to working radios to avoid
channel overlap and avoid interference from external RF sources. 20 MHz is the default
setting.
11. Select the +Add Row button to add Area Based Channel Settings.
12. Set the following Area Based Channel Settings for the access point:
Area
Use the text area to provide a name for the area being configured.
Band
Use the drop-down menu to select the radio band to use in the area being configured.
Channel List
Use the Select drop-down menu to select the channels used in Smart RF area based
channel settings.
13. Select OK to update the Smart RF Channel and Power settings for this policy. Select Reset to revert to the last saved
configuration. The Smart RF policy can be invoked at any point in the configuration process by selecting Activate SMART
RF Policy from the upper, left-hand side, of the access point user interface.
14. Select Scanning Configuration. Ensure Activate SMART RF Policy remains selected so the screen’s parameters can
be updated. Additionally, the Smart RF configuration cannot be applied to the access point profile unless this setting
remains selected.
6 - 78 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-34 SMART RF - Scanning Configuration screen
NOTE: The monitoring and scanning parameters within the Scanning Configuration
screen are only enabled when Custom is selected as the Sensitivity setting from the
Basic Configuration screen.
15. Enable or disable Smart Monitoring Enable by selecting the option. The feature is enabled by default.
When enabled, detector radios monitor their coverage areas for potential failed peers or coverage area holes requiring
transmission adjustments for coverage compensation.
16. Select this option and specify a threshold number between 10 and 10,000. When this threshold is reached, awareness
settings will be overridden with the values specified.
17. Select an index value from 1-3 for awareness overrides. The overrides are executed based on index as defined in the table,
with the lowest index being executed first.
Day
Use the drop-down menu to select a day of the week to apply the override. Selecting All
will apply the policy every day. Selecting weekends will apply the policy on Saturdays and
Sundays only. Selecting weekdays will apply the policy on Monday, Tuesday, Wednesday,
Thursday and Friday. Selecting individual days of the week will apply the policy only on
the selected day.
Start Time
This value sets the starting time of day(s) that the overrides will be activated. Use the
spinner controls to select the hour and minute, in 12h time format. Then use the radio
button to choose AM or PM.
Wireless Configuration 6 - 79
End Time
This value sets the ending time of day(s) the overrides will be disabled. Use the spinner
controls to select the hour and minute, in 12h time format. Then use the radio button to
choose AM or PM.
18. Set the following Scanning Configurations for both the 2.4 GHZ and 5.0 GHz radio bands:
Duration
Set a channel scan duration (from 20 - 150 milliseconds) access point radios use to
monitor devices within the network and, if necessary, perform self healing and neighbor
recovery to compensate for coverage area losses within a RF Domain. The default setting
is 50 milliseconds for both 2.4 GHz and 5.0 GHz bands.
Frequency
Set the scan frequency using the drop-down menu. Set a scan frequency in either Seconds
(1 - 120) or Minutes (0 - 2). The default setting is 6 seconds for both 2.4 GHz and 5.0 GHz
bands.
Extended Scan
Frequency
Use the spinner control to set an extended scan frequency from 0 - 50. This is the
frequency radios scan channels on non-peer radios. The default setting is 5 for both 2.4
GHz and 5.0 GHz bands.
Sample Count
Use the spinner control to set a sample scan count value from 1 - 15. This is the number
of radio RF readings gathered before data is sent to the Smart RF master. The default
setting is 5 for both 2.4 GHz and 5.0 GHz bands.
Client Aware Scanning
Use the spinner control to set a client awareness count (1 - 255) during off channel scans
for either the 2.4 or 5.0 GHz radio. The default setting is 1 for both radio bands.
Power Save Aware
Scanning
Select either the Dynamic, Strict or Disable radio button to define how power save
scanning is set for Smart RF. Strict disables smart monitoring as long as a power save
capable client is associated to a radio. Dynamic disables smart monitoring as long as
there is data buffered for a power save client at the radio. The default setting is Dynamic
for both 2.4 GHz and 5.0 GHz bands.
Voice Aware Scanning
Select either Dynamic, Strict or Disable to define how voice aware recognition is set for
Smart RF. Strict disables smart monitoring as long as a voice client is associated to a radio.
Dynamic disables smart monitoring as long as there is data buffered for a voice client at
the radio. The default setting is Dynamic for both 2.4 GHz and 5.0 GHz bands.
19. Select OK to update the Smart RF Scanning Configuration settings. Select Reset to revert to the last saved configuration.
20. Select Recovery.
The Neighbor Recovery tab displays by default. Use the Neighbor, Interference and Coverage Hole recovery tabs to define
how 2.4 and 5.0 GHz radios compensate for failed neighbor radios, interference, coverage holes and loss of root path
requiring neighbor radio intervention.
6 - 80 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-35 SMART RF Recovery Configuration screen - Neighbor Recovery tab
Power Hold Time
Defines the minimum time between two radio power changes during neighbor recovery.
Set the time in either Seconds (0 - 3,600), Minutes (0 - 60) or Hours (0 - 1). The default
setting is 0 seconds.
21. Set the following Neighbor Recovery variables for the Smart RF configuration:
NOTE: The recovery parameters within the Neighbor Recovery, Interference and
Coverage Hole Recovery tabs are only enabled when Custom is selected as the
Sensitivity setting from the Smart RF Basic Configuration screen.
5GHz Neighbor Power
Threshold
Use the spinner control to set a value from -85 to -55 dBm the access point’s 5.0 GHz radio
uses as a maximum power increase threshold if the radio is required to increase its output
power to compensate for a failed radio within the access point’s radio coverage area. The
default value is -70 dBm.
2.4 GHz Neighbor Power
Threshold
Use the spinner control to set a value from -85 to -55 dBm the access point’s 2.4 GHz radio
uses as a maximum power increase threshold if the radio is required to increase its output
power to compensate for a failed radio within the access point’s radio coverage area. The
default value is -70 dBm.
Wireless Configuration 6 - 81
22. Set the following Dynamic Sample Recovery parameters:
Dynamic Sample
Enabled
Select this option to enable dynamic sampling. Dynamic sampling enables an
administrator to define how Smart RF adjustments are triggered by locking retry and
threshold values. This setting is disabled by default.
Dynamic Sample Retries
Use the spinner control to set the number of retries (1 - 10) before a power change is
allowed to compensate for a potential coverage hole. The default setting is 3.
Dynamic Sample
Threshold
Use the spinner control to set the number of sample reports (1 - 30) used before dynamic
sampling is invoked for a potential power change adjustment. The default setting is 5.
23. Select OK to update the Smart RF Neighbor Recovery settings. Select Reset to revert to the last saved configuration.
24. Select the Interference Recovery tab.
Figure 6-36 SMART RF Recovery Configuration screen - Interference Recovery tab
25. Set the following Interference Recovery parameters:
Interference
Select this radio button to allow Smart RF to scan for excess interference from supported
radio devices. WLANs are susceptible to sources of interference, such as neighboring
radios, cordless phones, microwave ovens and Bluetooth devices. When interference for
WiFi sources is detected, Smart RF supported devices can change the channel and move to
a cleaner channel. This feature is enabled by default.
Noise
Select this radio button to allow Smart RF to scan for excess noise from WiFi devices. When
detected, Smart RF supported access points can change their channel and move to a cleaner
channel. This feature is enabled by default.
6 - 82 WiNG 5.5.3 Access Point System Reference Guide
Channel Hold Time
Defines the minimum time between channel changes during neighbor recovery. Set the time
in either Seconds (0 - 86,400), Minutes (0 - 1,440) or Hours (0 - 24) or Days (0 - 1). The default
setting is 30 minutes.
Client Threshold
Use the spinner to set a client threshold from 1 - 255. If the threshold defined number of
clients are connected to a radio, the radio does not change its channel, even though
required, based on the interference recovery determination made by the smart master. The
default setting is 50.
5 GHz Channel Switch
Delta
Use the spinner to set a channel switch delta (from 5 - 35 dBm) for the 5.0 GHz radio. This
parameter is the difference between noise levels on the current channel and a prospective
channel. If the difference is below the configured threshold, the channel will not change.
The default setting is 20 dBm.
2.4 GHz Channel
Switch Delta
Use the spinner to set a channel switch delta (from 5 - 35 dBm) for the 2.4 GHz radio. This
parameter is the difference between noise levels on the current channel and a prospective
channel. If the difference is below the configured threshold, the channel will not change.
The default setting is 20 dBm.
26. Select OK to update the Smart RF Interference Recovery settings. Select Reset to revert to the last saved configuration.
27. Select the Coverage Hole Recovery tab.
Figure 6-37 SMART RF Recovery Configuration screen - Coverage Hole Recovery tab
Wireless Configuration 6 - 83
28. Set the following Coverage Hole Recovery for 5.0 GHz and 2.4 GHz parameters:
Client Threshold
Use the spinner to set a client threshold from 1 - 255. This is the minimum number of
clients a radio should have associated for coverage hole recovery to trigger. AP6522,
AP6522M, AP6532, AP6562, AP71XX, AP75XX, AP81XX and AP82XX model access points
can support up to 256 clients per access point or radio. AP6511 and AP6521 model access
points can support up to 128 clients per access point or radio. The default setting is 1.
SNR Threshold
Use the spinner control to set a signal to noise (SNR) threshold (from 1 - 75 dB). This is the
SNR threshold for an associated client as seen by its associated AP radio. When
exceeded, the radio increases its transmit power to increase coverage for the associated
client. The default value is 20 dB.
Coverage Interval
Define the interval when coverage hole recovery should be initiated after a coverage hole
is detected. The default is 10 seconds for both 2.4 GHz and 5.0 GHz radios.
Interval
Define the interval coverage hole recovery should be conducted after a coverage hole is
detected. The default is 30 seconds for both 2.4 GHz and 5.0 GHz radios.
29. Select OK to update the Smart RF Coverage Hole Recovery settings for this policy. Select Reset to revert to the last saved
configuration.
6 - 84 WiNG 5.5.3 Access Point System Reference Guide
6.5.1 Smart RF Configuration and Deployment Considerations
SMART RF
Before defining a Smart RF supported configuration, refer to the following deployment guidelines to ensure the configuration
is optimally effective:
• Smart RF is not able to detect a voice call in progress, and will switch to a different channel resulting in voice call
reconnections
• The Smart RF calibration process impacts associated users and should not be run during business or production hours. The
calibration process should be performed during scheduled maintenance intervals or non-business hours.
• For Smart RF to provide effective recovery, RF planning must be performed to ensure overlapping coverage exists at the
deployment site. Smart RF can only provide recovery when access points are deployed appropriately. Smart RF is not a
solution, it's a temporary measure. Administrators need to determine the root cause of RF deterioration and fix it. Smart RF
history/events can assist.
Motorola Solutions recommends that if a Smart RF managed radio is operating in WLAN mode on a channel requiring DFS, it
will switch channels if radar is detected.
• If Smart RF is enabled, the radio picks a channel defined in the Smart RF policy.
• If Smart RF is disabled, but a Smart RF policy is mapped, the radio picks a channels specified in the Smart RF policy
• If no SMART RF policy is mapped, the radio selects a random channel
If the radio is a dedicated sensor, it stops termination on that channel if a neighboring access point detects radar. The access
point attempts to come back to its original channel (statically configured or selected by Smart RF) after the channel evacuation
period has expired.
Change this behavior using a no dfs-rehome command from the CLI. This keeps the radio on the newly selected channel
and prevents the radio from coming back to the original channel, even after the channel evacuation period.
Wireless Configuration 6 - 85
6.6 MeshConnex Policy
Wireless Configuration
MeshConnex is a mesh networking technology comparable to the 802.11s mesh networking specification. MeshConnex
meshing uses a hybrid proactive/on-demand path selection protocol, similar to Ad hoc On Demand Distance Vector (AODV)
routing protocols. This allows it to form efficient paths using multiple attachment points to a distribution WAN, or form purely
ad-hoc peer-to-peer mesh networks in the absence of a WAN. Each device in the MeshConnex mesh proactively manages its
own path to the distribution WAN, but can also form peer-to-peer paths on demand to improve forwarding efficiency.
MeshConnex is not compatible with WiNG 5 MiNT Based meshing, though the two technologies can be enabled
simultaneously in certain circumstances.
MeshConnex is designed for large-scale, high-mobility outdoor mesh deployments. MeshConnex continually gathers data from
beacons and transmission attempts to estimate the efficiency and throughput of each MP-to-MP link. MeshConnex uses this
data to dynamically form and continually maintain paths for forwarding network frames.
In MeshConnex systems, a Mesh Point (MP) is a virtual mesh networking instance on a device, similar to a WLAN AP. On each
device, up to 4 MPs can be created and 2 can be created per radio. MPs can be configured to use one or both radios in the
device. If the MP is configured to use both radios, the path selection protocols will continually select the best radio to reach
each destination. Each MP participates in a single mesh network, defined by the MeshID. The MeshID is typically a descriptive
network name, similar to the SSID of a WLAN. All MPs configured to use the same MeshID will attempt to form a mesh and
interoperate. The MeshID allows overlapping mesh networks to discriminate and disregard MPs belonging to different
networks.
To define a MeshConnex policy:
1. Select the Configuration tab from the Web UI.
2. Select Wireless.
3. Select MeshConnex Policy to display existing MeshConnex policies.
Figure 6-38 MeshConnex Policy screen
4. Refer to the following configuration data for existing MeshConnex policies:
Mesh Point Name
Displays the names of all configured mesh points.
6 - 86 WiNG 5.5.3 Access Point System Reference Guide
Mesh ID
Displays the IDs of all mesh identifiers for the configured mesh points.
Mesh Point Status
Specifies the status of each configured mesh point, either Enabled or Disabled.
Descriptions
Displays any descriptive text entered for each of the configured mesh points.
Control VLAN
Displays VLAN number for the control VLAN on each of the configured mesh points.
Allowed VLANs
Displays the list of VLANs allowed on each of the configured mesh points.
Security Mode
Displays the security for each of the configured mesh points. The field will display none
for no security or psk for pre-shared key authentication.
Mesh QoS Policy
Displays the list of Mesh Quality of Service policies associated with each of the
configured mesh points.
5. Select Add to create a new MeshConnex policy, Edit to modify the attributes of a existing policy or Delete to remove
obsolete policies from the list of those available. Use Copy to create a copy of an existing policy for further modification.
Use Rename to rename an existing MeshConnex policy.
The Configuration screen displays by default for the new or modified MeshConnex policy.
Figure 6-39 MeshConnex - Basic Configuration screen
6. Refer to the Basic Configuration section to define a MeshConnex profile.
Mesh Point Name
Specify a name for the new mesh point. The name should be descriptive of the mesh point
to easily differentiate it from other mesh points. This field is mandatory.
Mesh ID
Specify a mesh identifier for this mesh point. This field is optional.
Wireless Configuration 6 - 87
Mesh Point Status
To enable this mesh point, select the Enabled radio button. To disable the mesh point
select the Disabled button. The default value is enabled.
Mesh QoS Policy
Use the drop-down menu to specify the mesh QoS policy to use on this mesh point. This
value is mandatory. If no suitable Mesh QoS policies exist, click the create icon to create
a new Mesh QoS policy.
Beacon Format
Use the drop-down menu to specify the format that beacons from the mesh point are sent.
To use access point style beacons select access-point from the drop-down menu. To use
mesh point style beacons select mesh-point from the drop-down menu. The default value
is mesh-point.
Is Root
Select this option to specify the mesh point as a root.
Control VLAN
Use the spinner control to specify a VLAN to carry mesh point control traffic. The valid
range for control VLAN is from 1 - 4094. The default value is VLAN 1.
Allowed VLAN
Specify the VLANs allowed to pass traffic on the mesh point. Separate all VLANs with a
comma. To specify a range of allowed VLANs separate the starting VLAN and the ending
VLAN with a hyphen.
Neighbor Inactivity
Timeout
Specify a Neighbor Inactivity Timeout in seconds, minutes, hours or days, up to a
maximum of 1 day. Neighbor Inactivity Timeout is the allowed amount of time between
frames received from a neighbor before their client privileges are revoked. The default
value is 2 minutes.
Description
Enter any descriptive text about the mesh point.
7. Select OK to update the MeshConnex Configuration settings for this policy. Select Reset to revert to the last saved
configuration.
8. Select the Security tab.
6 - 88 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-40 MeshConnex - Security screen
9. Refer to the Select Authentication field to define an authentication method for the mesh policy.
Security Mode
Select a security authentication mode for the mesh-point. Select none to set no
authentication for the mesh point. Select psk to set a pre-shared key as the authentication
for the mesh-point. If psk is selected enter a pre-shared key in the Key Settings field.
10. Set the following Key Settings for the mesh point:
Pre-Shared Key
When the security mode is set as psk, enter a 64 character HEX or an 8-63 ASCII character
passphrase used for authentication on the mesh point.
11. Set the following Key Rotation for the mesh point:
Unicast Rotation Interval Define an interval for unicast key transmission in seconds (30 - 86,400).
Broadcast Rotation
Interval
When enabled, the key indices used for encrypting/decrypting broadcast traffic will be
alternatively rotated based on the defined interval. Define an interval for broadcast key
transmission in seconds (30 - 86,400). Key rotation enhances the broadcast traffic security
on the WLAN.
12. Select OK to save the changes made to the configuration. Select Reset to revert to the last saved configuration.
13. Select the Radio Rates tab.
Wireless Configuration 6 - 89
14. Set the following Radio Rates for both the 2.4 and 5.0 GHz radio bands:
2.4 GHz Mesh Point
Choose the Select button to configure radio rates for the 2.4 GHz band. Define both
minimum Basic and optimal Supported rates as required for the 802.11b rates, 802.11g
rates and 802.11n rates supported by the 2.4 GHz band.
If supporting 802.11n, select a Supported MCS index. Set a MCS (modulation and coding
scheme) in respect to the radio’s channel width and guard interval. A MCS defines (based
on RF channel conditions) an optimal combination of 8 data rates, bonded channels,
multiple spatial streams, different guard intervals and modulation types. Mesh points can
communicate as long as they support the same basic MCS (as well as non-11n basic
rates).
The selected rates apply to associated client traffic within this mesh point only.
5.0 GHz Mesh Point
Choose the Select button to configure radio rates for the 5.0 GHz band. Define both
minimum Basic and optimal Supported rates as required for 802.11a and 802.11n rates
supported by the 5.0 GHz radio band.
If supporting 802.11n, select a Supported MCS index. Set a MCS (modulation and coding
scheme) in respect to the radio’s channel width and guard interval. A MCS defines (based
on RF channel conditions) an optimal combination of 8 data rates, bonded channels,
multiple spatial streams, different guard intervals and modulation types. Mesh points can
communicate as long as they support the same basic MCS (as well as non-11n basic
rates).
The selected rates apply to associated client traffic within this mesh point only.
Figure 6-41 Advanced Rate Settings 2.4 GHz screen
6 - 90 WiNG 5.5.3 Access Point System Reference Guide
Figure 6-42 Advanced Rate Settings 5 GHz screen
15. Define both minimum Basic and optimal Supported rates as required for the 802.11b rates, 802.11g rates and 802.11n rates
supported by the 2.4 GHz band and 802.11a and 802.11n rates supported by the 5.0 GHz radio band. These are the rates
wireless client traffic is supported within this mesh point.
If supporting 802.11n, select a Supported MCS index. Set a MCS (modulation and coding scheme) in respect to the radio’s
channel width and guard interval. A MCS defines (based on RF channel conditions) an optimal combination of 8 data rates,
bonded channels, multiple spatial streams, different guard intervals and modulation types. Clients can associate as long as
they support basic MCS (as well as non-11n basic rates).
16. Select OK to save the changes made to the configuration. Select Reset to revert to the last saved configuration.
Wireless Configuration 6 - 91
6.7 Mesh QoS Policy
Wireless Configuration
Mesh QoS provides a data traffic prioritization scheme that reduces congestion from excessive traffic. If there is enough
bandwidth for all users and applications (unlikely because excessive bandwidth comes at a very high cost), then applying QoS
has very little value. QoS provides policy enforcement for mission-critical applications and/or users that have critical bandwidth
requirements when the wireless controller’s bandwidth is shared by different users and applications.
Mesh QoS helps ensure each mesh point on the network receives a fair share of the overall bandwidth, either equally or as per
the proportion configured. Packets directed towards clients are classified into categories such as video, voice and data. Packets
within each category are processed based on the weights defined for each mesh point.
The Quality of Service screen displays a list of Mesh QoS policies available to mesh points. Each Mesh QoS policy can be
selected to edit its properties. If none of the exiting Mesh QoS policies supports an ideal QoS configuration for the intended
data traffic of this mesh point, select the Add button to create new policy. Select an existing Mesh QoS policy and select Edit
to change the properties of the Mesh QoS policy.
To define a Mesh QoS policy:
1. Select Configuration.
2. Select Wireless.
3. Select Mesh QoS Policy to display existing Mesh QoS policies.
Figure 6-43 Mesh QoS Policy (QoS) screen
4. Refer to the following configuration data for existing Smart RF policies:
Mesh QoS Policy
Displays the name of each configured mesh QoS policy.
Mesh Tx Rate Limit
Displays whether or not a Mesh Tx Rate Limit is enabled for each Mesh QoS policy. This
indicates rate limiting is enabled or disabled for all data received from any mesh point in
the mesh. When the rate limit is enabled a green check mark is displayed, when it is
disabled a red X is displayed.
6 - 92 WiNG 5.5.3 Access Point System Reference Guide
Mesh Rx Rate Limit
Displays whether or not a Mesh Rx Rate Limit is enabled for each Mesh QoS policy. This
indicates rate limiting is enabled or disabled for all data transmitted by the device to any
mesh point in the mesh. When the rate limit is enabled a green check mark is displayed,
when it is disabled a red X is displayed.
Neighbor Tx Rate Limit
Displays whether a NeighborTx Rate Limit is enabled for each Mesh QoS policy. This
indicates rate limiting is enabled for data transmitted from connected wireless clients.
When the rate limit is enabled a green check mark is displayed, when it is disabled a red
X is displayed.
Neighbor Rx Rate Limit
Displays whether a NeighborRx Rate Limit is enabled for each Mesh QoS policy. This
indicates rate limiting is enabled or disabled for data transmitted from the client to its
associated access point radio and connected wireless controller. When the rate limit is
enabled a green check mark is displayed, when it is disabled a red X is displayed.
Classification
Displays the forwarding QoS classification for each Mesh QoS policy.
5. Select the Add button to define a new Mesh QoS policy, or select an existing Mesh QoS policy and select Edit to modify
its existing configuration. Existing QoS policies can be selected and deleted as needed.
The Rate Limit screen displays by default for the new or modified QoS policy.
Excessive traffic can cause performance issues or bring down the network completely. Excessive traffic can be caused by
numerous sources including network loops, faulty devices or malicious software such as a worm or virus that has infected
on one or more devices at the branch. Rate limiting limits the maximum rate sent to or received from the wireless network
(and mesh point) per neighbor. It prevents any single user from overwhelming the wireless network. It can also provide
differential service for service providers. An administrator can set separate QoS rate limit configurations for data
transmitted from the managed network and data transmitted from a mesh point’s neighbor back to their associated access
point radios and controller.
Before defining rate limit thresholds for mesh point transmit and receive traffic, Motorola Solutions recommends you define
the normal number of ARP, broadcast, multicast and unknown unicast packets that typically transmit and receive from each
supported WMM access category. If thresholds are defined too low, normal network traffic (required by end-user devices)
will be dropped resulting in intermittent outages and performance problems.
A connected neighbor can also have QoS rate limit settings defined in both the transmit and receive direction.
Wireless Configuration 6 - 93
Figure 6-44 Mesh QoS Policy - Rate Limit screen
6. Configure the following parameters in respect to the intended From Air Upstream Rate Limit, or traffic from the controller
to associated access point radios and their associated neighbor:
Mesh Tx Rate Limit
Select this option to enable rate limiting for all data received from any mesh point in the
mesh. This feature is disabled by default.
Rate
Define a receive rate limit from 50 - 1,000,000 kbps. This limit constitutes a threshold for
the maximum the number of packets transmitted or received over the mesh point (from all
access categories). Traffic that exceeds the defined rate is dropped and a log message is
generated. The default setting is 5000 kbps.
6 - 94 WiNG 5.5.3 Access Point System Reference Guide
Maximum Burst Size
Set a maximum burst size from 2 - 1024 kbytes. The smaller the burst, the less likely the
transmit packet transmission will result in congestion for the mesh point’s client
destinations. By trending the typical number of ARP, broadcast, multicast and unknown
unicast packets over a period of time, the average rate for each access category can be
obtained. Once a baseline is obtained, administrators should then add a 10% margin
(minimally) to allow for traffic bursts at the site. The default burst size is 320 kbytes.
7. Set the following Receive Random Early Detection Threshold settings for each access category. An early random drop
is done when a traffic stream falls below the set threshold.
Background Traffic
Set a percentage value for background traffic in the transmit direction. This is a
percentage of the maximum burst size for low priority traffic. Background traffic exceeding
the defined threshold is dropped and a log message is generated. Background traffic
consumes the least bandwidth of any access category, so this value can be set to a lower
value once a general transmit rate is known by the network administrator (using a time
trend analysis). The default threshold is 50%.
Best Effort Traffic
Set a percentage value for best effort traffic in the transmit direction. This is a percentage
of the maximum burst size for normal priority traffic. Best effort traffic exceeding the
defined threshold is dropped and a log message is generated. Best effort traffic consumes
little bandwidth, so this value can be set to a lower value once a general transmit rate is
known by the network administrator (using a time trend analysis). The default threshold is
50%.
Video Traffic
Set a percentage value for video traffic in the transmit direction. This is a percentage of
the maximum burst size for video traffic. Video traffic exceeding the defined threshold is
dropped and a log message is generated. Video traffic consumes significant bandwidth,
so this value can be set to a higher value once a general transmit rate is known by the
network administrator (using a time trend analysis). The default threshold is 25%.
Voice Traffic
Set a percentage value for voice traffic in the transmit direction. This is a percentage of
the maximum burst size for voice traffic. Voice traffic exceeding the defined threshold is
dropped and a log message is generated. Voice applications consume significant
bandwidth, so this value can be set to a higher value once a general upstream rate is
known by the network administrator (using a time trend analysis). The default threshold is
0%.
8. Configure the following parameters in respect to the intended To Air Downstream Rate Limit, or traffic from neighbors
to associated access point radios and the controller:
Mesh Rx Rate Limit
Select this option to enable rate limiting for all data transmitted by the device to any mesh
point in the mesh. This feature is disabled by default.
Rate
Define an transmit rate limit from 50 - 1,000,000 kbps. This limit constitutes a threshold
for the maximum the number of packets transmitted or received over the mesh point (from
all access categories). Traffic that exceeds the defined rate is dropped and a log message
is generated. The default setting is 5000 kbps.
Wireless Configuration 6 - 95
Maximum Burst Size
Set a maximum burst size from 2 - 1024 kbytes. The smaller the burst, the less likely the
receive packet transmission will result in congestion for the mesh point’s wireless client
destinations. By trending the typical number of ARP, broadcast, multicast and unknown
unicast packets over a period of time, the average rate for each access category can be
obtained. Once a baseline is obtained, administrators should then add a minimum of a
10% margin to allow for traffic bursts at the site. The default burst size is 320 kbytes.
9. Set the following To Air Downstream Random Early Detection Threshold settings for each access category. An early
random drop is done when the amount of tokens for a traffic stream falls below the set threshold.
Background Traffic
Set a percentage value for background traffic in the receive direction. This is a percentage
of the maximum burst size for low priority traffic. Background traffic exceeding the defined
threshold is dropped and a log message is generated. Background traffic consumes the
least bandwidth of any access category, so this value can be set to a lower value once a
general receive rate is known by the network administrator (using a time trend analysis).
The default threshold is 50%.
Best Effort Traffic
Set a percentage value for best effort traffic in the receive direction. This is a percentage
of the maximum burst size for normal traffic. Best effort traffic exceeding the defined
threshold is dropped and a log message is generated. Best effort traffic consumes little
bandwidth, so this value can be set to a lower value once a general receive rate is known
by the network administrator (using a time trend analysis). The default threshold is 50%.
Video Traffic
Set a percentage value for video traffic in the receive direction. This is a percentage of the
maximum burst size for video traffic. Video traffic exceeding the defined threshold is
dropped and a log message is generated. Video traffic consumes significant bandwidth,
so this value can be set to a higher value once a general receive rate is known by the
network administrator (using a time trend analysis). The default threshold is 25%.
Voice Traffic
Set a percentage value for voice traffic in the receive direction. This is a percentage of the
maximum burst size for voice traffic. Voice traffic exceeding the defined threshold is
dropped and a log message is generated. Voice applications consume significant
bandwidth, so this value can be set to a higher value once a general transmit rate is known
by the network administrator (using a time trend analysis). The default threshold is 0%.
0% means no early random drops will occur.
10. Configure the following parameters in respect to the intended From Air Upstream Rate Limit for the Neighbor Settings
field.
Neighbor Rx Rate Limit
Select this radio button to enable rate limiting for data transmitted from the client to its
associated access point radio and connected wireless controller. Enabling this option does
not invoke client rate limiting for data traffic in the receive direction. This feature is
disabled by default.
Rate
Define an transmit rate limit from 50 - 1,000,000 kbps. This limit constitutes a threshold
for the maximum the number of packets transmitted or received (from all access
categories). Traffic that exceeds the defined rate is dropped by the client and a log
message is generated. The default rate is 1,000 kbps.
Maximum Burst Size
Set a maximum burst size from 2 - 1024 kbytes. The smaller the burst, the less likely the
transmit packet transmission will result in congestion for the wireless client. The default
burst size is 64 kbytes.
6 - 96 WiNG 5.5.3 Access Point System Reference Guide
11. Set the following Neighbor Receive Random Early Detection Threshold settings for each access category:
Background Traffic
Set a percentage value for background traffic in the transmit direction. This is a
percentage of the maximum burst size for low priority traffic. Background traffic exceeding
the defined threshold is dropped by the client and a log message is generated. The default
threshold is 50%.
Best Effort Traffic
Set a percentage value for best effort traffic in the transmit direction. This is a percentage
of the maximum burst size for normal traffic. Best effort traffic exceeding the defined
threshold is dropped by the client and a log message is generated. The default threshold
is 50%.
Video Traffic
Set a percentage value for video traffic in the transmit direction. This is a percentage of
the maximum burst size for video traffic. Video traffic exceeding the defined threshold is
dropped by the client and a log message is generated. The default threshold is 25%.
Voice Traffic
Set a percentage value for voice traffic in the receive direction. This is a percentage of the
maximum burst size for voice traffic. Voice traffic exceeding the defined threshold is
dropped by the client and a log message is generated. The default threshold is 0%. 0%
implies no early random drops will occur.
12. Configure the following parameters in respect to the intended Neighbor To Air Downstream Rate Limit, or traffic from
a controller to associated access point radios and the wireless client:
Neighbor Tx Rate Limit
Select this radio button to enable rate limiting for data transmitted from connected
wireless clients. Enabling this option does not invoke rate limiting for data traffic in the
transmit direction. This feature is disabled by default.
Rate
Define a receive rate limit from 50 - 1,000,000 kbps. This limit constitutes a threshold for
the maximum the number of packets transmitted or received by the client. Traffic that
exceeds the defined rate is dropped and a log message is generated. The default rate is
1,000 kbytes.
Maximum Burst Size
Set a maximum burst size from 2 - 64 kbytes. The smaller the burst, the less likely the
receive packet transmission will result in congestion for the wireless client. The default
burst size is 64 kbytes.
13. Set the following Neighbor To Air Downstream Random Early Detection Threshold settings for each access
category:
Background Traffic
Set a percentage value for background traffic in the receive direction. This is a percentage
of the maximum burst size for low priority traffic. Background traffic exceeding the defined
threshold is dropped by the client and a log message is generated. The default is 50%.
Best Effort Traffic
Set a percentage value for best effort traffic in the receive direction. This is a percentage
of the maximum burst size for normal traffic. Best effort traffic exceeding the defined
threshold is dropped by the client and a log message is generated. The default is 50%.
Video Traffic
Set a percentage value for video traffic in the receive direction. This is a percentage of the
maximum burst size for video traffic. Video traffic exceeding the defined threshold is
dropped by the client and a log message is generated. The default is 25%.
Wireless Configuration 6 - 97
Voice Traffic
Set a percentage value for voice traffic in the receive direction. This is a percentage of the
maximum burst size for voice traffic. Voice traffic exceeding the defined threshold is
dropped by the client and a log message is generated. The default threshold is 0%.0%
means no early random drops will occur.
14. Select OK when completed to update this mesh QoS rate limit settings. Select Reset to revert the screen back to its last
saved configuration.
15. Select the Multimedia Optimizations tab.
Figure 6-45 Mesh QoS Policy - Multimedia Optimizations screen
16. Set the following Accelerated Multicast settings:
Disable Multicast
Streaming
Select this option to disable Multicast Streaming on the mesh point.
Automatically Detect
Multicast Streams
Select this option to have bridged multicast packets converted to unicast to provide better
overall airtime utilization and performance. The administrator can either have the system
automatically detect multicast streams and convert all detected multicast streams to
unicast, or specify which multicast streams are to be converted to unicast. When the
stream is converted and being queued up for transmission, there are a number of
classification mechanisms that can be applied to the stream and the administrator can
select what type of classification they would want.
Manually Configure
Multicast Addresses
Select this option and specify a list of multicast addresses and classifications. Packets are
accelerated when the destination addresses matches.
17. Select OK when completed to update the Mesh Multimedia Optimizations settings. Select Reset to revert to the last saved
configuration.
6 - 98 WiNG 5.5.3 Access Point System Reference Guide
6.8 Passpoint Policy
Wireless Configuration
A Passpoint Policy provides a mechanism by which devices can select the correct network by querying for information from the
available networks and then deciding which network to associate with. A Passpoint policy is associated to a WLAN to enable
the WLAN to provide hotspot services.
A Passpoint policy contains configuration that enables a client to query a network for information such as WAN metric, domain
names and other relevant information. Only relevant information is presented to the client which enables it to decide with
network to join.
To define a Passpoint Policy:
1. Select Configuration.
2. Select Wireless.
3. Select Passpoint Policy to display existing Passpoint policies.
Figure 6-46 Wireless Passpoint Policy screen
4. Refer to the following configuration data for existing Passpoint policies:
Name
Displays the name of the configured Passpoint policy.
Access Network
Type
Displays the Access Network Type for this Passpoint policy. Displays the type of hotspot which is
advertised to all clients.
Operator Name
Displays the name of the operator running the hotspot.
Venue Name
Displays information about the venue hosting the hotspot.
Wireless Configuration 6 - 99
5. Select the Add button to define a new Passpoint policy, or select an existing Passpoint policy and select Edit to modify its
existing configuration. Existing Passpoint policies can be selected and deleted as needed.
Figure 6-47 Passpoint Policy - Add new policy
6. Configure the following parameters in respect to the Basic Configuration fields:
Access Network Type
Select the network type from the drop-down. This is the type of network that is advertised to
requesting clients.
Operator Name
Enter a friendly name for the operator running the hotspot service. Enter a string not longer than
64 characters.
Venue Name
Enter a friendly name for the venue in which this hotspot service is running. Enter a string not
longer than 252 characters.
Venue Name Lang
Use this table to provide encoding information to display the Venue Name in other languages.
Use this table to provide the language Code and the hexadecimal representation of the venue
name in the Name field. Multiple values can be entered in this table.
7. Configure the following parameters with respect to the Operator Network Parameters fields:
Operator Name Lang
Use this table to provide encoding information to display the Operator Name in other
languages. Use this table to provide the language Code and the hexadecimal representation of
the operator name in the Name field. Multiple values can be entered in this table.
PLMNID
Use the PLMNID table to provide the Mobile Country Code (MCC) and the Mobile Network
Code (MNC) for the operator along with a brief description of this information.
8. Select OK when completed to update the Passpoint policy settings. Select Reset to revert to the last saved configuration.
6 - 100 WiNG 5.5.3 Access Point System Reference Guide
CHAPTER 7
NETWORK CONFIGURATION
The access point allows packet routing customizations and additional route resources.
For more information on the network configuration options available to the access point, refer to the following:
• Policy Based Routing (PBR)
• L2TP V3 Configuration
• AAA Policy
• AAA TACACS Policy
• Alias
For configuration caveats specific to Configuration > Network path, refer to
Network Deployment Considerations on page 7-42.
7-2
WiNG 5.5.3 Access Point System Reference Guide
7.1 Policy Based Routing (PBR)
Network Configuration
Define a policy based routing (PBR) configuration to direct packets to selective paths. PBR can optionally mark traffic for
preferential services (QoS). PBR minimally provides the following:
• A means to use source address, protocol, application and traffic class as traffic routing criteria
• The ability to load balance multiple WAN uplinks
• A means to selectively mark traffic for QoS optimization
Since PBR is applied to incoming routed packets, a route-map is created containing a set of filters and associated actions.
Based on the actions defined in the route-map, packets are forwarded to the next relevant hop. Route-maps are configurable
under a global policy called routing-policy, and applied to profiles and devices.
Route-maps contain a set of filters which select traffic (match clauses) and associated actions (set clauses) for routing. A routemap consists of multiple entries, each carrying a precedence value. An incoming packet is matched against the route-map with
the highest precedence (lowest numerical value). If it matches, the routing decision is based on this route-map. If the packet
does not match the route-map, the route-map entry with next highest precedence is matched. If the incoming packet does not
match any of the route-map entries, it’s subjected to typical destination based routing. Each route-map entry can optionally
enable/disable logging.
The following criteria can optionally be used as traffic selection segregation criteria:
• IP Access List - A typical IP ACL can be used for traffic permissions. The mark and log actions in ACL rules however are
neglected. Route-map entries have separate logging. Only one ACL can be configured per route map entry.
• IP DSCP - Packet filtering can be performed by traffic class, as determined from the IP DSCP field. One DSCP value is
configurable per route map entry. If IP ACLs on a WLAN, ports or SVI mark the packet, the new/marked DSCP value is used
for matching.
• Incoming WLAN - Packets can be filtered by the incoming WLAN. There are two ways to match the WLAN:
• If the device doing policy based routing has an onboard radio and a packet is received on a local WLAN, then this WLAN
is used for selection.
• If the device doing policy based routing does not have an onboard radio and a packet is received from an extended VLAN,
then the device which received the packet passes the WLAN information in the MINT packet for the PBR router to use
as match criteria.
• Client role - The client role can be used as match criteria, similar to a WLAN. Each device has to agree on a unique identifier
for role definition and pass the same MINT tunneled packets.
• Incoming SVI - A source IP address qualifier in an ACL typically satisfies filter requirements. But if the host originating the
packet is multiple hops away, the incoming SVI can be used as match criteria. In this context the SVI refers to the device
interface performing policy based routing, and not the originating connected device.
Each route map entry has a set of match and set (action) clauses. ACL rules configured under route map entries merge to create
a single ACL. Route map precedence values determine the prioritization of the rules in this merged ACL. An IP DSCP value is
also added to the ACL rules.
Set (or action) clauses determine the routing function when a packet satisfies match criteria. If no set clauses are defined, the
default is to fallback to destination based routing for packets satisfying the match criteria. If no set clause is configured and
fallback to destination based routing is disabled, then the packet is dropped. The following can be defined within set clauses:
• Next hop - The IP address of the next hop or the outgoing interface through which the packet should be routed. Up to two
next hops can be specified. The outgoing interface should be a PPP, a tunnel interface or a SVI which has DHCP client
configured. The first reachable hop should be used, but if all the next hops aren’t reachable, typical destination based route
lookup is performed.
Network Configuration
7-3
• Default next hop - If a packet subjected to PBR does not have an explicit route to the destination, the configured default
next hop is used. This can be either the IP address of the next hop or the outgoing interface. Only one default next hop can
be defined. The difference between the next hop and the default next-hop is in case of former, PBR occurs first, then
destination based routing. In case of the latter, the order is reversed. With both cases:
.a If a defined next hop is reachable, it’s used. If fallback is configured refer to (b).
.b Do normal destination based route lookup. If a next hop is found its used, if not refer to (c)
.c If default next hop is configured and reachable, it’s used. If not, drop the packet.
• Fallback - Fallback to destination based routing if none of the configured next hops are reachable (or not configured). This
is enabled by default.
• Mark IP DSCP - Set IP DSCP bits for QoS using an ACL. The mark action of the route maps takes precedence over the mark
action of an ACL.
NOTE: A packet should optimally satisfy all the match criteria, if no match clause is
defined in a route-map, it would match everything. Packets not conforming to any of the
match clauses are subjected to normal destination based routing.
To define a PBR configuration:
1. Select Configuration tab from the web UI.
2. Select Network.
3. Select Policy Based Routing.
The Policy Based Routing screen displays by default.
Figure 7-1 Policy Based Routing screen
4. Either select Add to create a new PBR configuration, Edit to modify the attributes of an existing PBR configuration or
Delete to remove a selected PBR configuration.
7-4
WiNG 5.5.3 Access Point System Reference Guide
5. If creating a new PBR policy assign it a Policy Name up to 32 characters to distinguish this route map configuration from
others with similar attributes. Select Continue to proceed to the Policy Name screen where route map configurations can
be added, modified or removed. Select Exit to exit without creating a PBR policy.
Figure 7-2 Policy Based Routing screen - Route Maps tab
6. Refer to the following to determine whether a new route-map configuration requires creation or an existing route-map
requires modification or removal:
Precedence
Lists the numeric precedence (priority) assigned to each listed PBR configuration. A routemap consists of multiple entries, each carrying a precedence value. An incoming packet is
matched against the route-map with the highest precedence (lowest numerical value).
DSCP
Displays each policy’s DSCP value used as matching criteria for the route map. DSCP is
the Differentiated Services Code Point field in an IP header and is for packet classification.
Packets are filtered based on the traffic class defined in the IP DSCP field. One DSCP value
can be configured per route map entry.
Role Policy
Lists each policy’s role policy used as matching criteria.
User Role
Lists the user role defined in the Role Policy.
Access Control List
Displays each policy’s IP ACL used as an access/deny filter criteria for the route map.
WLAN
Displays each policy’s WLAN used as an access/deny filter for the route map.
Incoming Interface
Display the name of the access point WWAN or VLAN interface on which the packet is
received for the listed PBR policy.
7. Select Add or Edit to create or modify a route-map configuration.
Network Configuration
7-5
Figure 7-3 Policy Based Routing screen - Add a Route Map
8. Use the spinner control to set a numeric precedence (priority) for this route-map. An incoming packet is matched against
the route-map with the highest precedence (lowest numerical value).
9. Refer to the Match Clauses field to define the following matching criteria for the route-map configuration:
DSCP
Select this option to enable a spinner control to define the DSCP value used as matching
criteria for the route map.
DSCP is the Differentiated Services Code Point field in an IP header and is for packet
classification. Packets are filtered based on the traffic class defined in the IP DSCP field.
One DSCP value can be configured per route map entry.
Role Policy
Use the drop-down to select a Role Policy to use with this route-map.
Click the Create icon to create a new Role Policy. To view and modify an existing policy,
click the Edit icon.
User Role
Use the drop-down menu to select a role defined in the selected Role Policy. This user role
is used while deciding the routing.
Access Control List
Use the drop-down menu to select an IP based ACL used as matching criteria for this
route-map.
Click the Create icon to create a new ACL. To view and modify an existing ACL, click the
Edit icon.
WLAN
Use the drop-down menu to select the access point WLAN used as matching criteria for
this route-map.
Click the Create icon to create a new WLAN. To view and modify an existing WLAN, click
the Edit icon.
7-6
WiNG 5.5.3 Access Point System Reference Guide
Incoming Interface
Select this option to enable radio buttons used to define the interfaces required to receive
route-map packets. Use the drop-down menu to define either the access point’s wwan1
or pppoe1 interface. Neither is selected by default. Or, select the VLAN ID option to define
the access point VLAN to receive route-map-packets.
10. Set the following Action Clauses to determine the routing function performed when a packet satisfies match criteria.
Optionally fallback to destination based routing if no hop resource is available.
Next Hop (Primary)
Define a first hop priority request. Set either the IP address of the virtual resource or select
the Interface option and define either a wwan1, pppoe1 or a VLAN interface. In the
simplest terms, if this primary hop resource is available, its used with no additional
considerations.
Next Hop (secondary)
If the primary hop request were unavailable, a second resource can be defined. Set either
the IP address of the virtual resource or select the Interface option and define either a
wwan1, pppoe1 or a VLAN interface.
Default Next Hop
If a packet subjected to PBR does not have an explicit route to the destination, the
configured default next hop is used. This value is set as either the IP address of the next
hop or the outgoing interface. Only one default next hop can be defined. The difference
between the next hop and the default next-hop is in case of former, PBR occurs first, then
destination based routing. In case of the latter, the order is reverse. Set either the next
hop IP address or define either a wwan1, pppoe1 or a VLAN interface.
Use Destination Routing
It may be a good idea to select this option to default back to destination based routing if
none of the defined hop resources are reachable. Packets are dropped if a next hop
resource is unavailable and fallback to destination routing is disabled. This option is
enabled by default.
Mark
Select this option and use the spinner control to set IP DSCP bits for QoS using an ACL.
The mark action of the route maps takes precedence over the mark action of an ACL.
11. Select OK to save the updates to the route-map configuration. Select Reset to revert to the last saved configuration.
12. Select the General tab from within the Policy Based Routing screen.
Network Configuration
7-7
Figure 7-4 Policy Based Routing screen - General tab
13. Set the following General PBR configuration settings:
Logging
Select this option to log events generated by route-map configuration rule enforcement.
This setting is disabled by default.
Local PBR
Select this option to implement policy based routing for this access point’s packet traffic.
This setting is enabled by default, so the match and action clauses defined within the
Route Maps tab are implemented until disabled using this setting.
Use CRM
Select the Use CRM (Critical Resource Management) option to monitor access point link
status. Selecting this option determines the disposition of the route-map next hop via
monitored critical resources. Link monitoring is used to determine a potential failover to
the secondary next hop. This setting is enabled by default.
14. Select OK to save the updates to the route-map general configuration. Select Reset to revert to the last saved
configuration.
7-8
WiNG 5.5.3 Access Point System Reference Guide
7.2 L2TP V3 Configuration
Network Configuration
L2TP V3 is an IETF standard used for transporting different types of layer 2 frames in an IP network. L2TP V3 defines control
and encapsulation protocols for tunneling layer 2 frames between two IP nodes.
Use L2TP V3 to create tunnels for transporting layer 2 frames. L2TP V3 enables WING supported controllers and access points
to create tunnels for transporting Ethernet frames to and from bridge VLANs and physical ports. L2TP V3 tunnels can be defined
between WING devices and other vendor devices supporting the L2TP V3 protocol.
Multiple pseudowires can be created within an L2TP V3 tunnel. WING supported access points support an Ethernet VLAN
pseudowire type exclusively.
NOTE: A pseudowire is an emulation of a layer 2 point-to-point connection over a
packet-switching network (PSN). A pseudowire was developed out of the necessity to
encapsulate and tunnel layer 2 protocols across a layer 3 network.
Ethernet VLAN pseudowires transport Ethernet frames to and from a specified VLAN. One or more L2TP V3 tunnels can be
defined between tunnel end points. Each tunnel can have one or more L2TP V3 sessions. Each tunnel session corresponds to
one pseudowire. An L2TP V3 control connection (a L2TP V3 tunnel) needs to be established between the tunneling entities
before creating a session.
For optimal pseudowire operation, both the L2TP V3 session originator and responder need to know the pseudowire type and
identifier. These two parameters are communicated during L2TP V3 session establishment. An L2TP V3 session created within
an L2TP V3 connection also specifies multiplexing parameters for identifying a pseudowire type and ID.
The working status of a pseudowire is reflected by the state of the L2TP V3 session. If a L2TP V3 session is down, the
pseudowire associated with it must be shut down. The L2TP V3 control connection keep-alive mechanism can serve as a
monitoring mechanism for the pseudowires associated with a control connection.
NOTE: If connecting an Ethernet port to another Ethernet port, the pseudowire type
must be Ethernet port, if connecting an Ethernet VLAN to another Ethernet VLAN, the
pseudowire type must be Ethernet VLAN.
To define an L2TP V3 tunnel configuration:
1. Select Configuration > Network > L2TP V3.
Network Configuration
7-9
Figure 7-5 L2TP V3 Policy screen
The L2TP V3 screen lists the policy configurations defined thus far.
2. Refer to the following to discern whether a new L2TP V3 policy requires creation or modification:
Name
Lists the 31 character maximum name assigned to each listed L2TP V3 policy upon
creation.
Cookie size
Displays the size of each policy’s cookie field within each L2TP V3 data packet. L2TP V3
data packets contain a session cookie which identifies the session (pseudowire)
corresponding to it. If using the CLI, cookie size can't be configured per session, and are
the same size for all sessions with in a tunnel.
Hello Interval
Displays each policy’s interval between L2TP V3 hello keep alive messages exchanged
within the L2TP V3 control connection.
Reconnect Attempts
Lists each policy’s maximum number of reconnection attempts to reestablish a tunnel
between peers.
Reconnect Interval
Displays the duration set for each listed policy between two successive reconnection
attempts.
Retry Count
Lists the number of retransmission attempts set for each listed policy before a target
tunnel peer is defined as not reachable.
Retry Time Out
Lists the interval the interval (in seconds) set for each listed policy before the
retransmission of a L2TP V3 signaling message.
Rx Window Size
Displays the number of packets that can be received without sending an
acknowledgement.
Tx Window Size
Displays the number of packets that can be transmitted without receiving an
acknowledgement.
Failover Delay
Displays the time to wait before tunnel re-establishment.
7 - 10 WiNG 5.5.3 Access Point System Reference Guide
Force L2 Path Recovery
Indicates if L2 Path Recovery is enabled to learn servers, gateways and other network
devices behind a L2TPV3 tunnel.
3. Select Add to create a new L2TP V3 policy, Edit to modify the attributes of a selected policy or Delete to remove obsolete
policies from the list of those available.
Figure 7-6 L2TP V3 Policy Creation screen
4. If creating a new L2TP V3 policy, assign it a Name up to 31 characters in length. Remember, a single L2TP V3 policy can be
used by numerous L2TP V3 tunnels.
5. Define the following Policy Details to add a device to a list of devices sanctioned for network operation:
Cookie size
L2TP V3 data packets contain a session cookie which identifies the session (pseudowire)
corresponding to it. Use the spinner control to set the size of the cookie field present within
each L2TP V3 data packet. Options include 0, 4 and 8. The default setting is 0. If using the CLI,
cookie size cannot be configured per session, and are the same size for all sessions with in a
tunnel.
Hello Interval
Define an interval in either Seconds (1 - 3,600), Minutes (1 -60) or Hours (1) between L2TP V3
hello keep alive messages exchanged within the L2TP V3 control connection. The default
setting is 1 minute.
Network Configuration 7 - 11
Reconnect Attempts
Use the spinner control to set a value (from 0 - 250) representing the maximum number of
reconnection attempts initiated to reestablish the tunnel. The default interval is 0.
Reconnect Interval
Define an interval in either Seconds (1 - 3,600), Minutes (1 -60) or Hours (1) between two
successive reconnection attempts. The default setting is 2 minutes.
Retry Count
Use the spinner control to define how many retransmission attempts are made before
determining a target tunnel peer is not reachable. The available range is from 1 - 10, with a
default value of 5.
Retry Time Out
Use the spinner control to define the interval (in seconds) before initiating a retransmission
of a L2TP V3 signaling message. The available range is from 1 - 250, with a default value of 5.
Rx Window Size
Specify the number of packets that can be received without sending an acknowledgement.
The available range is from 1 - 15, with a default setting of 10.
Tx Window Size
Specify the number of packets that can be transmitted without receiving an
acknowledgement. The available range is from 1 - 15, with a default setting of 10.
Failover Delay
Specify the wait time (in seconds) before re-establishing a failed tunnel.The available
duration is 5 - 60 seconds or 1 minute with a default setting of 5 seconds.
Force L2 Path
Recovery
Select to enable forcing the discovery of servers, gateways and other networks behind a
L2TPV3 tunnel when a tunnel is being established or when a failed tunnel is being
reestablished.
6. Select OK to save the updates to the L2TP V3 Policy Details. Select Reset to revert to the last saved configuration.
7 - 12 WiNG 5.5.3 Access Point System Reference Guide
7.3 AAA Policy
Network Configuration
Authentication, Authorization, and Accounting (AAA) is the mechanism network administrators use to define access control
within the access point managed network.
The access point can optionally use an external RADIUS and LDAP Servers (AAA Servers) to provide user database information
and user authentication data. Each WLAN managed by the access point can maintain its own unique AAA configuration.
AP6522, AP6522M, AP6532, AP6562, AP71XX, AP75XX, AP81XX and AP82XX model access points have an onboard RADIUS
server resource, while AP6511 and AP6521 models do not.
AAA provides a modular way of performing following services:
• Authentication — Authentication provides a means for identifying users, including login and password dialog, challenge
and response, messaging support and (depending on the security protocol), encryption. Authentication is the technique by
which a user is identified before allowed access to the access point managed network. Configure AAA authentication by
defining a list of authentication methods, and then applying the list to various access point interfaces. The list defines the
authentication schemes performed and their sequence. The list must be applied to an interface before the defined
authentication technique is conducted.
• Authorization — Authorization occurs immediately after authentication. Authorization is a method for remote access
control, including authorization for services and individual user accounts and profiles. Authorization functions through the
assembly of attribute sets describing what the user is authorized to perform. These attributes are compared to information
contained in a database for a given user and the result is returned to AAA to determine the user's actual capabilities and
restrictions. The database could be located locally on the access point or be hosted remotely on a RADIUS server. Remote
RADIUS servers authorize users by associating attribute-value (AV) pairs with the appropriate user. Each authorization
method must be defined through AAA. When AAA authorization is enabled it’s applied equally to all interfaces on the
access point.
• Accounting — Accounting is the method for collecting and sending security server information for billing, auditing, and
reporting user data; such as start and stop times, executed commands (such as PPP), number of packets, and number of
bytes. Accounting enables wireless network administrators to track the services users are accessing and the network
resources they are consuming. When accounting is enabled, the network access server reports user activity to a RADIUS
security server in the form of accounting records. Each accounting record is comprised of AV pairs and is stored on an access
control server. The data can be analyzed for network management, client billing, and/or auditing. Accounting methods must
be defined through AAA. When AAA accounting is activated for the access point, it’s applied equally to all interfaces on
the access point’s access servers.
To define unique WLAN AAA configurations:
1. Select the Configuration tab from the Web UI.
2. Select Network.
3. Select AAA Policy to display a high level display of existing AAA policies.
The Authentication, Authorization, and Accounting (AAA) screen lists existing AAA policies. Any of these policies can
be selected and applied to the access point.
Network Configuration 7 - 13
Figure 7-7 Authentication, Authorization, and Accounting (AAA) screen
4. Refer to the following information listed for each existing AAA policy:
AAA Policy
Displays the name assigned to the AAA policy when it was initially created. The name
cannot be edited within a listed profile.
Accounting Packet Type
Displays the accounting type set for the AAA policy. Options include:
• Start Only - Sends a start accounting notice to initiate user accounting.
• Start/Stop - Sends a start accounting notice at the beginning of a process and a stop
notice at the end of a process. The start accounting record is sent in the background.
The requested process begins regardless of whether the start accounting notice is
received by the accounting server.
Request Interval
Lists the interval at which an access point sends a RADIUS accounting request to the
RADIUS server.
NAC Policy
Lists the Network Access Control (NAC) filter used to either include or exclude clients from
entering the access point managed network.
Server Pooling Mode
The server pooling mode controls how requests are transmitted across RADIUS servers.
Selecting Failover results in working down the list of servers, if a server is unresponsive
and unavailable. The Load Balanced option uses all available servers transmitting
requests in round robin.
5. To configure a new AAA policy, select the Add button.
7 - 14 WiNG 5.5.3 Access Point System Reference Guide
Figure 7-8 AAA Policy - RADIUS Authentication tab
6. Refer to the following configured RADIUS Authentication details:
Server Id
Displays the numerical server index (1-6) for the accounting server when added to the list
available to the access point.
Host
Displays the IP address or hostname of the RADIUS authentication server.
Port
Displays the port on which the RADIUS server listens to traffic within the access point
managed network. The port range is 1 - 65,535. The default port is 1812.
Server Type
Displays the type of AAA server in use as either Host, onboard-self or onboard-controller.
Request Proxy Mode
Displays whether a request is transmitted directly through the server or proxied through
the Virtual Controller AP or RF Domain manager.
Request Attempts
Displays the number of attempts a client can retransmit a missed frame to the RADIUS
server before it times out of the authentication session. The available range is from 1 - 10.
The default is 3.
Request Timeout
Displays the time from 1 - 60 seconds for the access point’s re-transmission of request
packets. The default is 3 seconds. If this time is exceeded, the authentication session is
terminated.
DSCP
Displays the DSCP value as a 6-bit parameter in the header of every IP packet used for
packet classification. The valid range is from 0 - 63, with a default value of 46.
Network Configuration 7 - 15
NAI Routing Enable
Displays NAI routing status. AAA servers identify clients using the NAI. The NAI is a
character string in the format of an E-mail address as either user or user@ but it need not
be a valid E-mail address or a fully qualified domain name. NAI can be used either in a
specific or generic form. The specific form, which must contain the user portion and may
contain the @ portion, identifies a single user. Each user still needs a unique security
association, but these associations can be stored on a AAA server. The original purpose
of NAI was to support roaming between dialup ISPs. Using NAI, each ISP need not have
all the accounts for all of its roaming partners in a single RADIUS database. RADIUS
servers can proxy requests to remote servers for each user credential.
NAC Enable
A green check mark defines NAC as enabled, while a red X defines NAC disabled with this
AAA policy.
7. Select a server ID from the table and select Edit, or select Add to create a new policy.
Figure 7-9 AAA Policy - RADIUS Authentication tab - Authentication Server screen
7 - 16 WiNG 5.5.3 Access Point System Reference Guide
8. Define the following settings to add or modify AAA RADIUS authentication server configuration:
Server Id
Define the numerical server index (1-6) for the authentication server to differentiate it
from others available to the access point’s AAA policy.
Host
Specify the IP address or hostname of the RADIUS authentication server.
Port
Define or edit the port on which the RADIUS server listens to traffic within then access
point managed network. The port range is 1 to 65,535. The default port is 1812.
Server Type
Select the type of AAA server as either Host, onboard-self or onboard-controller. AP6511
and AP6521 models do not have an onboard authentication resource and must use an
external server or Virtual Controller AP resource.
Secret
Specify the secret used for authentication on the selected RADIUS server. By default the
secret will be displayed as asterisks.
Request Proxy Mode
Select the method of proxy that browsers communicate with the RADIUS authentication
server. The mode could either be None, Through Wireless Controller or Through RF
Domain Manager.
Proxy Mint Host
Specify the hostname (if the device is a Level-1 MiNT neighbor) or the Mint-ID of the Mint
device to proxy hosts through.
Request Attempts
Specify the number of attempts a client can retransmit a missed frame to the RADIUS
server before it times out of the authentication session. The available range is from 1 - 10.
The default is 3.
Request Timeout
Specify the time from 1 - 60 seconds for the access point’s re-transmission of request
packets. If this time is exceeded, the authentication session is terminated. The default is
3 seconds.
Retry Timeout Factor
Specify the time from 50 - 200 seconds between retry timeouts for the access points’s retransmission of request packets. The default is 100.
DSCP
Specify the DSCP value as a 6-bit parameter in the header of every IP packet used for
packet classification. The valid range is from 0 - 63, with a default value of 46.
9. Set the following Network Address Identifier (NAI) Routing settings:
NAI Routing Enable
Select this check box to enable NAI routing. AAA servers identify clients using the NAI.
The NAI is a character string in the format of an E-mail address as either user or user@
but it need not be a valid E-mail address or a fully qualified domain name. NAI can be used
either in a specific or generic form. The specific form, which must contain the user portion
and may contain the @ portion, identifies a single user. Each user still needs a unique
security association, but these associations can be stored on a AAA server. The original
purpose of NAI was to support roaming between dialup ISPs. Using NAI, each ISP need
not have all the accounts for all of its roaming partners in a single RADIUS database.
RADIUS servers can proxy requests to remote servers for each user credential.
Realm
Enter the realm name in the field. The name cannot exceed 64 characters. When the
access point RADIUS server receives a request for a user name the server references a
table of user names. If the user name is known, the server proxies the request to the
RADIUS server.
Realm Type
Specify the type of realm that is being used, either Prefix or Suffix.
Network Configuration 7 - 17
Strip Realm
Select this option to remove information from the packet when NAI routing is enabled.
10. Select the RADIUS Accounting tab.
Figure 7-10 AAA Policy - RADIUS Accounting tab
11. Refer to the following configured RADIUS Accounting profile details:
Server ID
Displays the numerical server index (1-6) for the accounting server when added to the list
available to the access point.
Host
Displays the IP address or hostname of the RADIUS authentication server.
Port
Displays the port on which the RADIUS server listens to traffic within the access point
managed network. The port range is 1 to 65,535. The default port is 1813.
Server Type
Displays the type of AAA server in use either Host, onboard-self or onboard-controller.
Request Attempts
Displays the number of attempts a client can retransmit a missed frame to the RADIUS
server before it times out of the authentication session. The available range is from 1 - 10.
The default is 3.
Request Timeout
Displays the time from 1 - 60 seconds for the access point’s re-transmission of request
packets. The default is 5 seconds. If this time is exceeded, the authentication session is
terminated.
DSCP
Displays the DSCP value as a 6-bit parameter in the header of every IP packet used for
packet classification. The valid range is from 0 - 63, with a default value of 34.
Request Proxy Mode
Lists the method of proxy that browsers communicate with the RADIUS authentication
server. The mode could either be None, Through Wireless Controller or Through RF
Domain Manager.
7 - 18 WiNG 5.5.3 Access Point System Reference Guide
NAI Routing Enable
Displays the NAI routing status. AAA servers identify clients using the NAI. The NAI is a
character string in the format of an E-mail address as either user or user@ but it need not
be a valid E-mail address or a fully qualified domain name. NAI can be used either in a
specific or generic form. The specific form, which must contain the user portion and may
contain the @ portion, identifies a single user. Each user still needs a unique security
association, but these associations can be stored on a AAA server. The original purpose
of NAI was to support roaming between dialup ISPs. Using NAI, each ISP need not have
all the accounts for all of its roaming partners in a single RADIUS database. RADIUS
servers can proxy requests to remote servers for each user credential.
12. To edit an existing accounting profile, select the profile then select the Edit button. To add a new policy, select the Add
button.
Figure 7-11 AAA Policy - RADIUS Accounting tab - Accounting Server screen
13. Define the following settings to add or modify AAA RADIUS accounting server configuration:
Server Id
Displays the numerical server index (1-6) for the accounting server when added to the list
available to the access point.
Network Configuration 7 - 19
Host
Specify the IP address or hostname of the RADIUS authentication server.
Port
Define or edit the port on which the RADIUS server listens to traffic within the access
point managed network. The port range is 1 - 65,535. The default port is 1813.
Server Type
Select the type of AAA server as either Host, onboard-self or onboard-controller.
Secret
Specify the secret (password) used for authentication on the selected RADIUS server. By
default the secret is displayed as asterisks.
Request Proxy Mode
Select the method of proxy that browsers communicate with the RADIUS authentication
server. The mode could either be None, Through Wireless Controller or Through RF
Domain Manager.
Proxy Mint Host
Specify a 64 character maximum hostname or the Mint ID of the Mint device used for
proxying requests.
Request Attempts
Displays the number of attempts a client can retransmit a missed frame to the RADIUS
server before it times out of the authentication session. The available range is from 1 - 10.
The default is 3.
Request Timeout
Specify the time for the access point’s re-transmission of request packets. The default is
5 seconds. If this time is exceeded, the authentication session is terminated.
Retry Timeout Factor
Specify the interval, in seconds, between two successive re-transmission attempts of
request packets. Specify a value from 50 - 200 seconds. The default is 100 seconds.
DSCP
Displays the DSCP value as a 6-bit parameter in the header of every IP packet used for
packet classification. The valid range is from 0 - 63 with a default value of 34.
NAI Routing Enable
Displays NAI routing status. AAA servers identify clients using the NAI. The NAI is a
character string in the format of an E-mail address as either user or user@ but it need not
be a valid E-mail address or a fully qualified domain name. NAI can be used either in a
specific or generic form. The specific form, which must contain the user portion and may
contain the @ portion, identifies a single user. Each user still needs a unique security
association, but these associations can be stored on a AAA server. The original purpose
of NAI was to support roaming between dialup ISPs. Using NAI, each ISP need not have
all the accounts for all of its roaming partners in a single RADIUS database. RADIUS
servers can proxy requests to remote servers for each.
Realm
Enter the realm name. The name cannot exceed 64 characters. When the access point’s
RADIUS server receives a request for a user name, the server references a table of user
names. If the user name is known, the server proxies the request to the RADIUS server.
Realm Type
Specify the realm as either Prefix or Suffix.
Strip Realm
Select this option to remove information from the packet when NAI routing is enabled.
14. Select the Settings tab.
7 - 20 WiNG 5.5.3 Access Point System Reference Guide
Figure 7-12 AAA-Policy - Settings screen
15. Set the fo">