ORiNOCO AP-700 User Guide
AP-700 User Guide IMPORTANT! Before installing and using this product, see the Safety and Regulatory Compliance Guide located on the product CD. Copyright © 2007 Proxim Wireless Corporation. All rights reserved. Covered by one or more of the following U.S. patents: 5,231,634; 5,875,179; 6,006,090; 5,809,060; 6,075,812; 5,077,753. This User Guide and the software described in it are copyrighted with all rights reserved.
AP-700 User Guide Contents 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Introduction to Wireless Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Guidelines for Roaming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
AP-700 User Guide SNTP (Simple Network Time Protocol) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Operational Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
AP-700 User Guide 5 Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 ICMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 IP/ARP Table . . . . .
AP-700 User Guide Setting IP Address using Serial Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Related Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 RADIUS Authentication Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 TFTP Server. . . . . . . .
AP-700 User Guide Reboot Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 B ASCII Character Chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 C Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 Software Features . . . . . . . . . . . . .
AP-700 User Guide Introduction 1 This chapter contains information on the following: • Introduction to Wireless Networking • Guidelines for Roaming • Management and Monitoring Capabilities Introduction to Wireless Networking An Access Point extends the capability of an existing Ethernet network to devices on a wireless network. Wireless devices can connect to a single Access Point, or they can move between multiple Access Points located within the same vicinity.
Introduction Management and Monitoring Capabilities AP-700 User Guide • All workstations with an 802.11 client adapter installed must use either a Network Name of “any” or the same Network Name as the Access Points that they will roam between. If an AP has Closed System enabled, a client must have the same Network Name as the Access Point to communicate (see Reboot the AP.). • All Access Points and clients must have matching security settings to communicate.
Introduction Management and Monitoring Capabilities AP-700 User Guide SNMP Management In addition to the HTTP and the CLI interfaces, you can also manage and configure an AP using the Simple Network Management Protocol (SNMP). Note that this requires an SNMP manager program, like HP Openview or Castlerock’s SNMPc.
Introduction Management and Monitoring Capabilities AP-700 User Guide The SSH server (AP) has host keys - a pair of asymmetric keys - a private key that resides on the AP and a public key that is distributed to clients that need to connect to the AP. As the client has knowledge of the server host keys, the client can verify that it is communicating with the correct SSH server. NOTE: The remainder of this guide describes how to configure an AP using the HTTP Web interface or the CLI interface.
AP-700 User Guide Installation and Initialization 2 In this chapter: • AP-700 Hardware Description – Overview – LED Indicators – Power-over-Ethernet (PoE) – Antennas • Prerequisites • System Requirements • Product Package • Hardware Installation • – Attach Cables – Install the Security Cover (Optional) – Mount the AP-700 – Power On the Unit – Install External Antennas (Professional Installation Required) Initialization – Using ScanTool – Logging In – Using the Setup Wizar
Installation and Initialization AP-700 Hardware Description AP-700 User Guide AP-700 Hardware Description Overview The AP-700 is a tri-mode AP that supports 802.11b, 802.11g, or 802.11a clients. The unit contains one embedded 802.11a/b/g radio that supports the following operational modes: • 802.11a only mode • 802.11b only mode • 802.11g only mode • 802.11b/g mode • 802.11g-wifi NOTE: In countries in which 802.11a (5 GHz) is not available for use, the AP-700 provides dual-band (802.11b and 802.
Installation and Initialization AP-700 Hardware Description Ethernet Wireless AP-700 User Guide Power Figure 2-2 LED Indicators on the Top Panel Power-over-Ethernet (PoE) The AP-700 is equipped with an 802.3af-compliant Power-over-Ethernet (PoE) module. PoE delivers both data and power to the access point over a single Ethernet cable. If you choose to use PoE, there is no difference in operation; the only difference is in the power source.
Installation and Initialization AP-700 Hardware Description AP-700 User Guide External Antennas The AP-700 also has two antenna connectors for use with external antennas. NOTE: AP-700 units using external antennas must be installed by a suitably trained professional installation technician or by a qualified installation service.
Installation and Initialization Prerequisites AP-700 User Guide Prerequisites Before installing your unit, you need to gather certain network information. The following table identifies the information you need. Network Name (SSID of the wireless cards) You must assign the Access Point a Network Name before wireless users can communicate with it. The clients also need the same Network Name. This is not the same as the System Name, which applies only to the Access Point.
Installation and Initialization Product Package AP-700 User Guide Product Package Each AP-700 shipment includes the items in the following table. Verify that you have received all parts of the shipment. NOTE: Unless noted in this table, cables are not supplied with the unit.
Installation and Initialization Hardware Installation AP-700 User Guide Hardware Installation NOTE: AP-700 units using external antennas must be installed by a suitably trained professional installation technician or by a qualified installation service. NOTE: Before installing and using this product, see the Safety and Regulatory Compliance Guide. NOTE: Avant d’installer et d’utiliser ce produit, consultez le manuel Safety and Regulatory Compliance Guide.
Installation and Initialization Hardware Installation • AP-700 User Guide Use a cross-over Ethernet cable or adapter if you intend to connect the unit to a single computer. Figure 2-4 Cabling without PoE 3. Optionally, connect an RS-232 cable (not shown) to the RS-232 console port (the right port, labeled “RS-232”). NOTE: You cannot install the security cover to the AP-700 if an RS-232 cable is connected. 4. Continue with Install the Security Cover (Optional). Cabling with Power Over Ethernet (PoE) 1.
Installation and Initialization Hardware Installation AP-700 User Guide Install the Security Cover (Optional) You can optionally install a security cover to deter unauthorized access to the unit. The security cover is a plastic enclosure that prevents access to the cabling and the Reset and Reload buttons. 1.
Installation and Initialization Hardware Installation AP-700 User Guide 5. Carefully slide the unit to the right until the tabs snap securely onto the narrow holes of the unit. If the unit is mounted correctly, no portion of the mounting plate should protrude from any of the sides of the unit. Figure 2-7 Mounting the AP to a Wall Ceiling Mounting Follow these steps to mount the unit to a ceiling: 1. If the unit’s power supply is plugged in, unplug it. 2.
Installation and Initialization Hardware Installation AP-700 User Guide The LED indicators exhibit the following behavior: Indication Solid Green Ethernet Solid Red Ethernet interface is connected at 100 Mbps with no traffic. Ethernet interface is connected at 100 Mbps with traffic. Ethernet interface is connected at 10 Mbps with no traffic. The Ethernet interface is connected at 10 Mbps with traffic. n/a Blinking Red n/a Blinking Green Solid Amber Blinking Amber Wireless Interface Power (802.
Installation and Initialization Hardware Installation AP-700 User Guide Figure 2-8 Opening the Antenna Compartment 2. There are two antenna connectors in the AP-700, labeled 1 and 2 Connect the antenna cable to connector 1 (the connector closer to the LED panel in the compartment). Figure 2-9 Antenna Connectors 3. If installing a second external antenna (not recommended), connect the antenna cable to connector 2. 4. Close the external antenna access compartment. 5.
Installation and Initialization Hardware Installation AP-700 User Guide EIRP Limit = EIRP limits specified below FL = Feeder loss including loss of connectors G = Antenna Gain Band 2.4 - 2.4835 GHz (Point-to-Multipoint 2.4 - 2.4835 GHz (Point-to-Point) EIRP Limit (dBm) USA and Canada 36 20 When G < 6: 36 20 When G >/= 6, use the following equation: EU –6 36 - G -------------3 5.15 - 5.25 GHz 5.25 - 5.35 GHz 5.47 - 5.725 GHz 5.725 - 5.850 GHz (Point-to-Multipoint) 5.725 - 5.
Installation and Initialization Initialization AP-700 User Guide Initialization The following sections detail how to initialize the AP using ScanTool, log in to the HTTP interface, perform an initial configuration of the AP using the Setup Wizard, and download the required AP software. • Using ScanTool • Logging In • Using the Setup Wizard • Installing the Software Using ScanTool ScanTool is a software utility that is included on the installation CD-ROM.
Installation and Initialization Initialization AP-700 User Guide NOTE: If your Access Point does not appear in the Scan List, click the Rescan button to update the display. If the unit still does not appear in the list, see Troubleshooting for suggestions. Note that after rebooting an Access Point, it may take up to five minutes for the unit to appear in the Scan List. 4. Do one of the following: • If the AP has been assigned an IP address by a DHCP server on the network: a.
Installation and Initialization Initialization AP-700 User Guide k. Click the Change button to return to the Change screen. l. Click the Web Configuration button at the bottom of the Change screen. m. Proceed to the Logging In section for information on how to access the HTTP interface using this IP address. Logging In Once the AP has a valid IP Address and an Ethernet connection, you may use your web browser to monitor and configure the AP.
Installation and Initialization Initialization AP-700 User Guide Figure 2-13 System Status Screen The buttons on the left of the screen provide access to the monitoring and configuration options for the AP. See Advanced Configuration to begin configuring the AP manually. You can also exit the Web interface or reboot the AP using these buttons. The Command Line Interface (CLI) also provides a method for monitoring and configuring the AP using Telnet or a serial connection.
Installation and Initialization Initialization AP-700 User Guide • Save & Next Button: Each Setup Wizard screen has a Save & Next button. Click this button to submit any changes you made to the unit’s parameters and continue to the next page. The instructions below describe how to navigate the Setup Wizard using the Save & Next buttons. • Navigation Panel: The Setup Wizard provides a navigation panel on the left-hand side of the screen.
Installation and Initialization Initialization AP-700 User Guide — Primary Network Name (SSID): Enter a Network Name (between 1 and 32 characters long) for the wireless network. You must configure each wireless client to use this name as well. Note that the unit supports up to 16 SSIDs/VLANs. Please see the Advanced Configuration chapter for information on the detailed rules on configuring multiple SSIDs, VLANs, and security profiles.
Installation and Initialization Initialization AP-700 User Guide 4. In the Search Knowledgebase field, enter 1686. 5. Click Search. 6. Click on the appropriate link to access the download page. 7. Use the instructions in the following sections to install the new software. Install Software with HTTP Interface Use the Update AP via HTTP tab to update the AP with the latest software image. 1. Click Commands > Update AP > via HTTP. Figure 2-15 Update AP via HTTP Command Screen 2.
Installation and Initialization Initialization • Enter 0 in the Time to Reboot field. • Click OK. AP-700 User Guide Install Software with TFTP Server A Trivial File Transfer Protocol (TFTP) server allows you to transfer files across a network. You can upload files from the AP for backup or copying, and you can download the files for configuration and AP Image upgrades. The Solarwinds TFTP server software is located on the AP Installation CD-ROM.
Installation and Initialization Initialization AP-700 User Guide 6. When the download is complete, type reboot 0 and press Enter.
AP-700 User Guide System Status 3 The first screen displayed after Logging In is the System Status screen. You can always return to this screen by clicking the Status button. Figure 3-1 System Status Screen The System Status screen provides the following information: • System Status: This area provides system-level information, including the unit’s IP address and contact information. See System for information on these settings. • System Alarms: System traps (if any) appear in this area.
AP-700 User Guide Advanced Configuration 4 This chapter contains information on configuring settings in the following categories: • System: Configure specific system information such as system name and contact information. • Network: Configure IP, DNS client, DHCP server, DHCP Relay Agent, DHCP Relay Servers, Link Integrity, and SNTP settings. • Interfaces: Configure the Access Point’s interfaces: Wireless and Ethernet. Configure the Channel Blacklist Table and a Wireless Distribution System (WDS).
Advanced Configuration AP-700 User Guide Figure 4-1 Configure Main Screen 2. Click the tab that corresponds to the parameter you want to configure. For example, click Network to configure the Access Point’s TCP/IP settings. Each Configure tab is described in the remainder of this chapter.
Advanced Configuration System AP-700 User Guide System You can configure and view the following parameters within the System Configuration screen: • Name: The name assigned to the AP. See the Dynamic DNS Support and Access Point System Naming Convention sections for rules on naming the AP. • Country: The country in which the AP will be used. Note that some countries have two selectable options (one for indoor use and one for outdoor use).
Advanced Configuration System AP-700 User Guide Figure 4-2 System Tab Dynamic DNS Support DNS is a distributed database mapping the user readable names and IP addresses (and more) of every registered system on the Internet. Dynamic DNS is a lightweight mechanism which allows for modification of the DNS data of host systems whose IP addresses change dynamically. Dynamic DNS is usually used in conjunction with DHCP for mapping meaningful names to host systems whose IP addresses change dynamically.
Advanced Configuration Network AP-700 User Guide Network The Network tab contains the following sub-tabs: • IP Configuration • DHCP Server • DHCP Relay Agent • Link Integrity • SNTP (Simple Network Time Protocol) IP Configuration This tab is used to configure the internet (TCP/IP) settings for the access point. These settings can be either entered manually (static IP address, subnet mask, and gateway IP address) or obtained automatically (dynamic).
Advanced Configuration Network AP-700 User Guide Basic IP Parameters • IP Address Assignment Type: Set this parameter to Dynamic to configure the Access Point as a Dynamic Host Configuration Protocol (DHCP) client; the Access Point will obtain IP settings from a network DHCP server automatically during boot-up. If you do not have a DHCP server or if you want to manually configure the Access Point’s IP settings, set this parameter to Static. • IP Address: The Access Point’s IP address.
Advanced Configuration Network AP-700 User Guide Figure 4-4 DHCP Server Configuration Screen You can configure and view the following parameters within the DHCP Server Configuration screen: NOTE: You must reboot the AP before changes to any of these DHCP server parameters take effect. • Enable DHCP Server: Place a check mark in the box provided to enable DHCP Server functionality. NOTE: You cannot enable the DHCP Server functionality unless there is at least one IP Pool Table Entry configured.
Advanced Configuration Network AP-700 User Guide NOTE: The Default Lease Time cannot be larger than the Maximum Lease Time. If you set the Maximum Lease Time, you should also set the Default Lease Time to ensure that the Default Lease Time is less than the Maximum. – Comment (optional) – Status: IP Pools are enabled upon entry in the table. You can also disable or delete entries by changing this field’s value.
Advanced Configuration Network AP-700 User Guide DHCP Server IP Address Table The AP supports the configuration of a maximum of 10 server settings in the DHCP Relay Agents server table. At least one server must be configured to enable DHCP Relay. To add entries to the table of DHCP Relay Agents, click Add in the DHCP Server IP Address Table; to edit existing entries, click Edit. The following window is displayed.
Advanced Configuration Network AP-700 User Guide Figure 4-7 Link Integrity Configuration Screen SNTP (Simple Network Time Protocol) SNTP allows a network entity to communicate with time servers in the network/internet to retrieve and synchronize time of day information. When this feature is enabled, the AP will attempt to retrieve the time of day information from the configured time servers (primary or secondary), and, if successful, will update the relevant time objects in the AP.
Advanced Configuration Network AP-700 User Guide Figure 4-8 SNTP Configuration Screen You can configure and view the following parameters within the SNTP screen: • SNTP Status: Select Enable or Disable from the drop-down menu. The selected status will determine which of the parameters on the SNTP screen are configurable. NOTE: When SNTP is enabled, it will take some time for the AP to retrieve the time of day from the configured time servers and update the relevant date and time parameters.
Advanced Configuration Network – Year: Enter the current year. – Month: Enter the month in digits (1-12). – Day: Enter the day in digits (1-31). – Hour: Enter the hour in digits (0-23). – Minutes: Enter the minutes in digits (0-59). – Seconds: Enter the seconds in digits (0-59).
Advanced Configuration Interfaces AP-700 User Guide Interfaces From the Interfaces tab, you configure the Access Point’s operational mode settings, power control settings, wireless interface settings and Ethernet settings. You may also configure a Wireless Distribution System for AP-to-AP communications. The Interfaces tab contains the following sub-tabs: • Operational Mode • Wireless A (802.
Advanced Configuration Interfaces AP-700 User Guide • 802.11b/g mode: This is the default mode. Use this mode if you want to support a mix of 802.11b and 802.11g devices. • 802.11g-wifi mode: The 802.11g-wifi mode has been defined for Wi-Fi testing purposes. It is not recommended for use in your wireless network environment. NOTE: In countries in which 802.11a (5 GHz) is not available for use, the AP-700 provides dual-band (802.11b and 802.11g) support only. 802.
Advanced Configuration Interfaces AP-700 User Guide spectrum. When a client enters a regulatory domain, it passively scans to learn at least one valid channel, i.e., a channel upon which it detects IEEE Standard 802.11 frames. The beacon frame contains information on the country code, the maximum allowable transmit power, and the channels to be used for the regulatory domain. The same information is transmitted in probe response frames in response to a client’s probe requests.
Advanced Configuration Interfaces AP-700 User Guide Configuring TX Power Control 1. Click Configure > Interfaces > Operational Mode. 2. Select Enable Transmit Power Control. 3. Enter the desired backoff from the maximum Transmit Power level (between 0 and 35 dBm) in the Wireless-A: Transmit Power Level Back-Off field. 4. Click OK.
Advanced Configuration Interfaces AP-700 User Guide Wireless A (802.
Advanced Configuration Interfaces AP-700 User Guide You can view and configure the following parameters for the Wireless interface: NOTE: You must reboot the Access Point before any changes to these parameters take effect. • Physical Interface Type: Depending on the Operational Mode, this field reports: – For 802.11a mode: “802.11a (OFDM 5 GHz).” NOTE: In countries in which 802.11a (5 GHz) is not available for use, the AP-700 provides dual-band (802.11b and 802.11g) support only. 802.
Advanced Configuration Interfaces AP-700 User Guide NOTE: Turbo mode is supported in only in 802.11a mode in the FCC regulatory domain when DFS is not required. If turbo mode is enabled, then this is displayed in the web UI and the transmit speeds and channels pull-down menus are updated with the valid values. • DTIM Period: The Deferred Traffic Indicator Map (DTIM) Period determines when to transmit broadcast and multicast packets to all clients.
Advanced Configuration Interfaces • 161: 5.805 GHz • 165: 5.825 GHz AP-700 User Guide If you are using the unit in a country and band that require DFS, keep in mind the following: • DFS is not a configurable parameter; it is always enabled and cannot be disabled. • You cannot manually select the device’s operating channel; you must let the unit select the channel.
Advanced Configuration Interfaces AP-700 User Guide When RTS/CTS occurs, the sending radio first transmits a Request to Send (RTS) packet to confirm that the medium is clear. When the receiving radio successfully receives the RTS packet, it transmits back a Clear to Send (CTS) packet to the sending radio. When the sending radio receives the CTS packet, it sends the data packet to the receiving radio.
Advanced Configuration Interfaces AP-700 User Guide channel is blacklisted automatically if it is found to be busy or occupied by radar during a scan at start-up. When a channel has been automatically blacklisted, it will remain blacklisted for 30 minutes. Additionally, an administrator can blacklist channels manually to prevent them from being used when ACS is enabled. To blacklist a channel manually: 1. Click on Configure > Interfaces > Wireless A. 2. Scroll down to the Channel Blacklist heading.
Advanced Configuration Interfaces AP-700 User Guide Wireless Distribution System (WDS) A Wireless Distribution System (WDS) creates a link between two 802.11a, 802.11b, or 802.11b/g APs over their radio interfaces. This link relays traffic from one AP that does not have Ethernet connectivity to a second AP that has Ethernet connectivity. WDS allows you to configure up to six (6) ports. In the WDS example below, AP 1 and AP 2 communicate over a WDS link (represented by the blue line).
Advanced Configuration Interfaces • AP-700 User Guide When WDS is enabled, Spanning Tree protocol is automatically enabled. It may be manually disabled. If Spanning Tree protocol is enabled by WDS and WDS is subsequently disabled, Spanning tree will remain enabled until it is manually disabled. See Spanning Tree. WDS Setup Procedure NOTE: You must disable Auto Channel Select to create a WDS. Each Access Point that is a member of the WDS must have the same channel setting to communicate with each other.
Advanced Configuration Interfaces AP-700 User Guide Figure 4-15 Adding WDS Links 6. Select which encryption method to use (if any) from the WDS Security Mode drop-down menu. 7. If you selected a WDS Security Mode, do one of the following: • If you selected WEP: Enter an encryption key. • If you selected AES: Enter a shared secret. 8. Enter the MAC Address that you wrote down in Step 2 in one of the Partner MAC Address field of the Wireless Distribution Setup window. 9.
Advanced Configuration Interfaces AP-700 User Guide Figure 4-16 Ethernet Sub-tab For best results, Proxim recommends that you configure the Ethernet setting to match the speed and transmission mode of the device the Access Point is connected to (such as a hub or switch). If in doubt, leave this setting at its default, auto-speed-auto-duplex.
Advanced Configuration Management AP-700 User Guide Management The Management tab contains the following sub-tabs: • Passwords • IP Access Table • Services • Automatic Configuration (AutoConfig) • Hardware Configuration Reset (CHRD) Passwords Passwords are stored in flash memory and secured using encryption. You can configure the following passwords: • SNMP Read Community Password: The password for read access to the AP using SNMP.
Advanced Configuration Management AP-700 User Guide IP Access Table The Management IP Access table limits in-band management access to the IP addresses or range of IP addresses specified in the table. This feature applies to all management services (SNMP, HTTP, and CLI) except for CLI management over the serial port. To configure this table, click Add and set the following parameters: • IP Address: Enter the IP Address for the management station.
Advanced Configuration Management • AP-700 User Guide Secure Management Status: Enables the further configuration of HTTPS Access, SNMPv3, and Secure Shell (SSH). After enabling Secure Management, you can choose to configure HTTPS (SSL) and Secure Shell access on the Services tab, and to configure SNMPv3 passwords on the Passwords tab. SNMP Settings • SNMP Interface Bitmask: Configure the interface or interfaces (Ethernet, Wireless, All Interfaces) from which you will manage the AP via SNMP.
Advanced Configuration Management AP-700 User Guide Figure 4-17 Management Services Configuration Screen 64
Advanced Configuration Management AP-700 User Guide Telnet Configuration Settings • Telnet Interface Bitmask: Select the interface (Ethernet, Wireless, All Interfaces) from which you can manage the AP via telnet. This parameter can also be used to Disable telnet management. • Telnet Port Number: The default port number for Telnet applications is 23.
Advanced Configuration Management AP-700 User Guide NOTE: When Secure Management is enabled on the AP, SSH will be enabled by default and cannot be disabled. Host keys must either be generated externally and uploaded to the AP (see Uploading Externally Generated Host Keys), generated manually, or auto-generated at the time of SSH initialization if SSH is enabled and no host keys are present. There is no key present in an AP that is in a factory default state.
Advanced Configuration Management AP-700 User Guide Serial Configuration Settings The serial port interface on the AP is enabled at all times. See Setting IP Address using Serial Port for information on how to access the CLI interface via the serial port. You can configure and view the following parameters: • Serial Baud Rate: Select the serial port speed (bits per second). Choose between 2400, 4800, 9600, 19200, 38400, or 57600; the default Baud Rate is 9600.
Advanced Configuration Management AP-700 User Guide • RADIUS Profile for Management Access Control: Specifies the RADIUS Profile to be used for RADIUS Based Management Access. • Local User Status: Enables or disables the local user when RADIUS Based Management is enabled. The default local user ID is root. • Local User Password and Confirm Password: The default local user password is public.
Advanced Configuration Management AP-700 User Guide Figure 4-19 Automatic Configuration Screen Set up Automatic Configuration for Dynamic IP Perform the following procedure to enable and set up Automatic Configuration when you have a dynamic IP address for the TFTP server via DHCP. The Configuration filename and the TFTP server IP address are contained in the DHCP response when the AP gets its IP address dynamically from the DHCP server.
Advanced Configuration Management AP-700 User Guide Figure 4-20 DHCP Options: Setting the Boot Server Host Name 4. Add the Boot Server Hostname and Boot Filename parameters to the Available Options list. 5. Set the value of the Boot Server Hostname Parameter to the hostname or IP Address of the TFTP server. For example: 11.0.0.7. Figure 4-21 DHCP Options: Setting the Bootfile Name 6. Set the value of the Bootfile Name parameter to the Configuration filename. For example: AP-Config. 7.
Advanced Configuration Management AP-700 User Guide access to the AP is not protected, an unauthorized person could reset the AP to factory defaults and thus gain control of the AP. The user can disable the hardware configuration reset functionality to prevent unauthorized access.
Advanced Configuration Management AP-700 User Guide 2. Check (enable) or uncheck (disable) the Enable Hardware Configuration Reset checkbox. 3. Change the default Configuration Reset Password in the “Configuration Reset Password” and “Confirm” fields. 4. Click OK. 5. Reboot the AP. NOTE: It is important to safely store the configuration reset password.
Advanced Configuration Filtering AP-700 User Guide Filtering The Access Point’s Packet Filtering features help control the amount of traffic exchanged between the wired and wireless networks. There are four sub-tabs under the Filtering heading: • Ethernet Protocol • Static MAC • Advanced • TCP/UDP Port Ethernet Protocol The Ethernet Protocol Filter blocks or forwards packets based on the Ethernet protocols they support. Follow these steps to configure the Ethernet Protocol Filter: 1.
Advanced Configuration Filtering • AP-700 User Guide To add an entry, click Add, and then specify the Protocol Number and a Protocol Name. – Protocol Number: Enter the protocol number. See http://www.iana.org/assignments/ethernet-numbers for a list of protocol numbers. – Protocol Name: Enter related information, typically the protocol name.
Advanced Configuration Filtering AP-700 User Guide Figure 4-26 Static MAC Filter Configuration Each static MAC entry contains the following fields: • Wired MAC Address • Wired Mask • Wireless MAC Address • Wireless Mask • Comment: This field is optional. Each MAC Address or Mask is comprised of 12 hexadecimal digits (0-9, A-F) that correspond to a 48-bit identifier. (Each hexadecimal digit represents 4 bits (0 or 1).
Advanced Configuration Filtering AP-700 User Guide A maximum of 200 entries can be created in the Static MAC filter table. To create an entry, click Add and enter the appropriate MAC addresses and Masks to setup a filter. The entry is enabled automatically when saved. Figure 4-27 Static MAC Filter Table - Add Entries To edit an entry, click Edit. To disable or remove an entry, click Edit and change the Status field from Enable to Disable or Delete.
Advanced Configuration Filtering AP-700 User Guide Prevent All Wireless Devices from Communicating with a Single Wired Device Configure the following settings to prevent all three Wireless Clients from communicating with Wired Server 1: • Wired MAC Address: 00:40:F4:1C:DB:6A • Wired Mask: FF:FF:FF:FF:FF:FF • Wireless MAC Address: 00:00:00:00:00:00 • Wireless Mask: 00:00:00:00:00:00 Result: The Access Point blocks all traffic between Wired Server 1 and all wireless clients.
Advanced Configuration Filtering AP-700 User Guide Figure 4-28 Advanced Filter Configuration The following protocols are listed in the Advanced Filter Table: • Deny IPX RIP • Deny IPX SAP • Deny IPX LSP • Deny IP Broadcasts • Deny IP Multicasts The AP can filter these protocols in the wireless-to-Ethernet direction, the Ethernet-to-wireless direction, or in both directions. Click Edit and use the Status field to Enable or Disable the filter.
Advanced Configuration Filtering AP-700 User Guide Figure 4-29 Static MAC Filter Table - Edit Entries TCP/UDP Port Port-based filtering enables you to control wireless user access to network services by selectively blocking TCP/UDP protocols through the AP.
Advanced Configuration Filtering AP-700 User Guide Figure 4-30 TCP/UDP Port Filter Configuration 2. Click Add under the TCP/UDP Port Filter Table heading. 3. In the TCP/UDP Port Filter Table, enter the Protocol Names to filter. 4. Set the destination Port Number (a value between 1 and 65535) to filter. See the IANA Web site at http://www.iana.org/assignments/port-numbers for a list of assigned port numbers and their descriptions. 5. Set the Port Type for the protocol: TCP, UDP, or both (TCP/UDP). 6.
Advanced Configuration Filtering AP-700 User Guide Figure 4-31 TCP/UDP Port Filter Table - Add Entries Editing TCP/UDP Port Filters 1. Click Edit under the TCP/UDP Port Filter Table heading. 2. Make any changes to the Protocol Name or Port Number for a specific entry, if necessary. 3. In the row that defines the port, set the Status to Enable, Disable, or Delete, as appropriate. 4. Select OK.
Advanced Configuration Alarms AP-700 User Guide Alarms The Alarms tab has the following sub-tabs: • Groups • Alarm Host Table • Syslog • Rogue Scan Groups Alarm groups can be enabled or disabled via the Web interface. Place a check mark in the box provided to enable a specific group. Remove the check mark from the box to disable the alarms. Alarm severity levels are as follows: • Critical alarms will often result in severe disruption in network activity or an automatic reboot of the AP.
Advanced Configuration Alarms AP-700 User Guide Trap Name oriTrapAuthenticationFailure Description Client authentication failure has occurred. Authentication failures can range from: • MAC Access Control table • RADIUS MAC authentication • 802.
Advanced Configuration Alarms Trap Name AP-700 User Guide Description Severity Level oriTrapDHCPFailed Response to the DHCP client request not received; device not dynamically assigned an IP address Major oriTrapDNSClientLookupFailure DNS client attempts to resolve a specified hostname (DNS lookup) and a failure occurs because either the DNS server is unreachable or there is an error for the hostname lookup. Trap specifies the hostname that was being resolved.
Advanced Configuration Alarms AP-700 User Guide Trap Name Description Severity Level oriTrapInvalidImage Invalid image loaded onto device Major oriTrapImageTooLarge Image loaded on the device exceeds the size limitation of flash Major oriTrapIncompatibleImage Incompatible image loaded onto device Major oriTrapInvalidImageDigitalSignature Image with invalid digital signature is loaded onto device Major SNTP Trap Group Trap Name Description Severity Level oriTrapSNTPFailure SNTP time retr
Advanced Configuration Alarms AP-700 User Guide Syslog The Syslog messaging system enables the AP to transmit event messages to a central server for monitoring and troubleshooting. The access point logs “Session Start (Log-in)” and “Session Stop (Log-out)” events for each wireless client as an alternative to RADIUS accounting. See RFC 3164 at http://www.rfc-editor.org for more information on the Syslog standard.
Advanced Configuration Alarms AP-700 User Guide • Syslog Lowest Priority Logged: The AP will send event messages to the Syslog server that correspond to the selected priority number and any priority numbers below it. For example, if set to 6, the AP will transmit event messages labeled priority 1 to 6 to the Syslog server. This parameter supports a range between 1 and 7; 6 is the default.
Advanced Configuration Alarms AP-700 User Guide Syslog Message Name Client Login Authentication Status Priority 6 Severity Informational Description Client logs in/authenticates. Message includes: • Client MAC Address • Authentication Type = None, ACL, RADIUS MAC, 802.
Advanced Configuration Alarms AP-700 User Guide Syslog Message Name Priority Severity Description CLI Configuration File Execution Errors 4 Minor There is an error in execution of the CLI configuration file. The message specifies the filename, line number, and error reason.
Advanced Configuration Alarms AP-700 User Guide and port does not have a valid Access Point as per the administrator’s database. Thus it labels Client 2’s AP as a Rogue AP and proceeds to prevent the Rogue AP attack by blocking this switch’s port. APs can be detected either by active scanning using 802.11 probe request frames or passively by detecting periodic beacons, or both. Wireless clients are detected by monitoring 802.
Advanced Configuration Alarms AP-700 User Guide Rogue Scan Perform this procedure to enable Rogue Scan and define the Scan Interval and Scan Interface. See Figure 4-35. The Rogue Scan screen also displays the number of new access points and clients detected in the last scan on each wireless interface. 1. Enable the Security Alarm Group. Select the Security Alarm Group link from the Rogue Scan screen. Configure a Trap Host to receive the list of access points (and clients) detected during the scan. 2.
Advanced Configuration Alarms AP-700 User Guide Figure 4-35 Rogue Scan Screen 92
Advanced Configuration Bridge AP-700 User Guide Bridge The AP is a bridge between your wired and wireless networking devices. As a bridge, the functions performed by the AP include: • MAC address learning • Forward and filtering decision making • Spanning Tree protocol used for loop avoidance Once the AP is connected to your network, it learns which devices are connected to it and records their MAC addresses in the Learn Table. The table can hold up to 10,000 entries.
Advanced Configuration Bridge AP-700 User Guide Figure 4-36 Spanning Tree Sub-Tab Storm Threshold Storm Threshold is an advanced Bridge setup option that you can use to protect the network against data overload by: • Specifying a maximum number of frames per second as received from a single network device (identified by its MAC address). • Specifying an absolute maximum number of messages per interface.
Advanced Configuration Bridge • AP-700 User Guide Wireless Threshold: Enter the maximum allowed number of packets per second. Intra BSS The wireless clients (or subscribers) that associate with a certain AP form the Basic Service Set (BSS) of a network infrastructure. By default, wireless subscribers in the same BSS can communicate with each other.
Advanced Configuration QoS AP-700 User Guide QoS Wi-Fi Multimedia (WMM)/Quality of Service (QoS) Introduction The AP supports Wi-Fi Multimedia (WMM), which is a solution for QoS functionality based on the IEEE 802.11e specification. WMM defines enhancements to the MAC for wireless LAN applications with Quality of Service requirements, which include transport of voice traffic over IEEE 802.11 wireless LANs.
Advanced Configuration QoS AP-700 User Guide 4. To add a QoS Policy, click the Add button in the “QoS Policies Table” box. The Add Entries box appears. Figure 4-38 Add QoS Policy 5. Enter the Policy Name. 6.
Advanced Configuration QoS AP-700 User Guide Priority Mapping Use this page to configure QoS 802.1p to 802.1d priority mappings (for layer 2 policies) and IP DSCP to 802.1d priority mappings (for layer 3 policies). The first entry in each table contains the recommended priority mappings. Custom entries can be added to each table with different priority mappings. 1. Click Configure > QoS > Priority Mapping. Figure 4-39 Priority Mapping 2. Click Add in the 802.1p and 802.1d priority mapping table.
Advanced Configuration QoS AP-700 User Guide Figure 4-40 Add Priority Mapping Entry 3. Select the 802.1p Priority (from 0-7) for 802.1d Priorities 0-7. 4. Click OK. 5. Click Add in the IP Precedence/DSCP ranges and 802.1d Priority table. 6. Select the IP DSCP Range for each 802.1d Priority. 7. Click OK. NOTE: Changes to Priority Mapping require a reboot of the AP to take effect.
Advanced Configuration QoS AP-700 User Guide Perform the following procedure to configure the Station and AP EDCA tables. 1. Click Configure > QoS > EDCA. Figure 4-41 EDCA Tables 2. Click Edit and configure the following parameters in each table: NOTE: Changes to EDCA parameters require a reboot of the AP to take effect. • Index: read-only.
Advanced Configuration QoS AP-700 User Guide • AIFSN: Arbitration IFS per access category. Configurable range is 2 to 15. • Tx OP Limit: The Transmission Opportunity Limit. The Tx OP is an interval of time during which a particular QoS enhanced client has the right to initiate a frame exchange sequence onto the wireless medium. The Tx OP Limit defines the upper limit placed on the value of Tx OP a wireless entity can obtain for a particular access category. Configurable range is 0 to 65535.
Advanced Configuration Radius Profiles AP-700 User Guide Radius Profiles Configuring Radius Profiles on the AP allows the administrator to define a profile for RADIUS Servers used by the system or by a VLAN. The network administrator can define RADIUS Servers per Authentication Mode and per VLAN. The AP communicates with the RADIUS server defined in a profile to provide the following features: • MAC Access Control Via RADIUS Authentication • 802.
Advanced Configuration Radius Profiles AP-700 User Guide This figure shows a network with separate authentication servers for each authentication type and for each VLAN. The clients in VLAN 1 are authenticated using the authentication servers configured for VLAN 1. The type of authentication server used depends on whether the authentication is done for an 802.1x client or a non-802.1x client.
Advanced Configuration Radius Profiles AP-700 User Guide NOTE: This page configures only the Primary RADIUS Server associated with the profile. After configuring these parameters, save them by clicking OK. Then, to configure the Secondary RADIUS Server, edit the profile from the main page. Figure 4-44 Add RADIUS Server Profile • Server Profile Name: the profile name. This is the name used to associated a VLAN to the profile. See Configuring Security Profiles.
Advanced Configuration Radius Profiles AP-700 User Guide – Colon delimited/MAC: MAC addresses are formatted with a colon between each pair of digits (xx:yy:zz:aa:bb:cc) and the password sent to the RADIUS server is the MAC address of the client. – Single dash delimited/MAC: MAC addresses are formatted with a dash between the sixth and seventh digits (xxyyzz-aabbcc) and the password sent to the RADIUS server is the MAC address of the client.
Advanced Configuration Radius Profiles AP-700 User Guide RADIUS Accounting Using an external RADIUS server, the AP can track and record the length of client sessions on the access point by sending RADIUS accounting messages per RFC2866. When a wireless client is successfully authenticated, RADIUS accounting is initiated by sending an “Accounting Start” request to the RADIUS server. When the wireless client session ends, an “Accounting Stop” request is sent to the RADIUS server.
Advanced Configuration Radius Profiles AP-700 User Guide – Obtained during the Authentication process and used for determining the time interval for sending Accounting Update messages. – This attribute value takes precedence over the value of the Accounting Update Interval. Accounting Attributes • Acct-Delay-Time – • Acct-Session-Id – • Number of packets sent by subscriber. Acct-Terminate Cause – • Number of packets received by subscriber.
Advanced Configuration SSID/VLAN/Security AP-700 User Guide SSID/VLAN/Security The AP provides several security features to protect your network from unauthorized access. This section gives an overview of VLANs and then discusses the SSID/VLAN/Security configuration options in the AP: • VLAN Overview • Management VLAN • Security Profile • MAC Access • Wireless The AP also provides Broadcast Unique Beacon/Closed System and Rogue Scan to protect your network from unauthorized access.
Advanced Configuration SSID/VLAN/Security AP-700 User Guide Figure 4-45 Components of a Typical VLAN VLAN Workgroups and Traffic Management Access Points that are not VLAN-capable typically transmit broadcast and multicast traffic to all wireless Network Interface Cards (NICs). This process wastes wireless bandwidth and degrades throughput performance. In comparison, a VLAN-capable AP is designed to efficiently manage delivery of broadcast, multicast, and unicast traffic to wireless clients.
Advanced Configuration SSID/VLAN/Security AP-700 User Guide 1. VLAN disabled: Your network does not use VLANs, and you cannot configure the AP to use multiple SSIDs. 2. VLAN enabled, each VLAN workgroup uses a different VLAN ID Tag. 3. VLAN enabled, a mixture of Tagged and Untagged workgroups exist. 4. VLAN enabled, all VLANs untagged: VLAN is enabled in order to use SSID. (Note that typical use of SSIDs assumes actual use of VLANs.) NOTE: VLAN must be enabled to configure security per SSID.
Advanced Configuration SSID/VLAN/Security AP-700 User Guide CAUTION: Once a VLAN Management ID is configured and is equivalent to one of the VLAN User IDs on the AP, all members of that User VLAN will have management access to the AP. Be careful to restrict VLAN membership to those with legitimate access to the AP. NOTE: When VLAN is enabled, ensure that all devices in the network share the same VLAN ID. 1. Click Configure > SSID/VLAN/Security > Mgmt VLAN. 2.
Advanced Configuration SSID/VLAN/Security AP-700 User Guide • EAP-Message Digest 5 (MD5): Username/Password-based authentication; does not support automatic key distribution • EAP-Transport Layer Security (TLS): Certificate-based authentication (a certificate is required on the server and each client); supports automatic key distribution • EAP-Tunneled Transport Layer Security (TTLS): Certificate-based authentication (a certificate is required on the server; a client’s username/password is tunneled t
Advanced Configuration SSID/VLAN/Security AP-700 User Guide Wi-Fi Protected Access (WPA/802.11i [WPA2]) Wi-Fi Protected Access (WPA) is a security standard designed by the Wi-Fi Alliance in conjunction with the Institute of Electrical and Electronics Engineers (IEEE). The AP supports 802.11i (WPA2), based on the IEEE 802.11i security standard. WPA is a replacement for Wired Equivalent Privacy (WEP), the encryption technique specified by the original 802.11 standard.
Advanced Configuration SSID/VLAN/Security AP-700 User Guide If you have both 802.1x and MAC Access Control authentication enabled, the 802.1x authentication takes precedence because it is higher in the authentication protocol hierarchy. This is required in order to propagate the WEP/TKIP/AES keys to the clients in such cases. If you disable 802.1x on the AP, you will see the effects of MAC authentication. In addition, setting MAC Access Control status to Strict will cause both MAC ACL settings and 802.
Advanced Configuration SSID/VLAN/Security AP-700 User Guide Figure 4-48 Security Profile Configuration 2. Click Add in the Security Profile Table to create a new entry. To modify an existing profile, select the profile and click Edit. To delete an existing profile, select the profile and click Delete. You cannot delete a Security Profile used in an SSID. Also, the first Security Profile cannot be deleted. 3.
