System Configuration The access point SNMP agent functions as a command responder and is a multilingual agent responding to SNMPv1, v2c and v3 managers (command generators). The factory default configuration maintains SNMPv1/2c support of the community names, hence providing backward compatibility. SNMP v1/v2c community definitions and SNMP v3 user definitions work independently, and both use the Access Control List (ACL) of the SNMP Access Control sub-screen.
4-20 AP-51xx Access Point Product Reference Guide considering adding a community definition using a site-appropriate name and access level. Set up a read/write definition (at a minimum) to facilitate full access by the access point administrator. 2. Configure the SNMP v1/v2 Configuration field (if SNMP v1/v2 is used) to add or delete community definitions, name the community, specify the OID and define community access. Add Click Add to create a new SNMP v1/v2c community definition.
System Configuration Security Level Use the Security Level area to specify a security level of noAuth (no authorization), AuthNoPriv (authorization without privacy), or AuthPriv (authorization with privacy). The NoAuth setting specifies no login authorization or encryption for the user. The AuthNoPriv setting requires login authorization, but no encryption. The AuthPriv setting requires login authorization and uses the Data Encryption Standard (DES) protocol.
-22 AP-51xx Access Point Product Reference Guide SNMP Access Control Click the SNMP Access Control button to display the SNMP Access Control screen for specifying which users can read SNMP-generated information and potentially modify related settings from an SNMP-capable client. The SNMP Access Control screen's Access Control List (ACL) uses Internet Protocol (IP) addresses to restrict access to the AP’s SNMP interface.
System Configuration Use the SNMP Access Control screen's Access Control List (ACL) to limit, by Internet Protocol (IP) address, who can access the access point SNMP interface. NOTE The ACL applies to both SNMP v3 user definitions and SNMP v1/v2c community definitions on the access point SNMP Access screen. To configure SNMP user access control for the access point: 1. Select System Configuration - > SNMP Access from the access point menu tree.
4-24 AP-51xx Access Point Product Reference Guide Access Control List Enter Start IP and End IP addresses (numerical addresses only, no DNS names supported) to specify a range of user that can access the access point SNMP interface. An SNMP-capable client can be set up whereby only the administrator (for example) can use a read/ write community definition. Use just the Starting IP Address column to specify a single SNMP user.
System Configuration 1. Select System Configuration - > SNMP Access - > SNMP Trap Configuration from the access point menu tree. 2. Configure the SNMP v1/v2c Trap Configuration field (if SNMP v1/v2c Traps are used) to modify the following: Add Click Add to create a new SNMP v1/v2c Trap Configuration entry. Delete Click Delete to remove a selected SNMP v1/v2c Trap Configuration entry.
4-26 AP-51xx Access Point Product Reference Guide Add Click Add to create a new SNMP v3 Trap Configuration entry. Delete Select Delete to remove an entry for an SNMP v3 user. Destination IP Specify a numerical (non DNS name) destination IP address for receiving the traps sent by the access point SNMP agent. Port Specify a destination User Datagram Protocol (UDP) port for receiving traps. Username Enter a username specific to the SNMP-capable client receiving the traps.
System Configuration 4.4.3 Configuring Specific SNMP Traps Use the SNMP Traps screen to enable specific traps on the access point. Symbol recommends defining traps to capture unauthorized devices operating within the access point coverage area. Trap configuration depends on the network machine that receives the generated traps. SNMP v1/v2c and v3 trap configurations function independently. In a mixed SNMP environment, traps can be sent using configurations for both SNMP v1/v2c and v3.
4-28 AP-51xx Access Point Product Reference Guide MU denied association Generates a trap when an MU is denied association to a access point WLAN. Can be caused when the maximum number of MUs for a WLAN is exceeded or when an MU violates the access point’s Access Control List (ACL). MU denied authentication Generates a trap when an MU is denied authentication on one of the AP’s WLANs. Can be caused by the MU being set for the wrong authentication type for the WLAN or by an incorrect key or password. 3.
System Configuration System Cold Start Generates a trap when the access point re-initializes while transmitting, possibly altering the SNMP agent's configuration or protocol entity implementation. Configuration Changes Generates a trap whenever changes to the access point’s configuration file are saved. Rogue AP detection Generates a trap if a Rogue AP is detected by the access point. AP Radar detection Generates a trap if an AP is detected using a form of radar detection.
4-30 AP-51xx Access Point Product Reference Guide 2. Configure the RF Trap Thresholds field to define device threshold values for SNMP traps. NOTE Average Bit Speed,% of Non-Unicast, Average Signal, Average Retries,% Dropped and % Undecryptable are not access point statistics. Pkts/s Enter a maximum threshold for the total throughput in Pps (Packets per second). Throughput Set a maximum threshold for the total throughput in Mbps (Megabits per second).
System Configuration % Undecryptable Define a maximum threshold for the total percentage of packets undecryptable for each device. Undecryptable packets can be the result of corrupt packets, bad CRC checks or incomplete packets. Associated MUs Set a maximum threshold for the total number of MUs associated with each device. 3. Configure the Minimum Packets field to define a minimum packet throughput value for trap generation.
4-32 AP-51xx Access Point Product Reference Guide To manage clock synchronization on the access point: 1. Select System Configuration - > Date/Time from the access point menu tree. 2. From within the Current Time field, click the Refresh button to update the time since the screen was displayed by the user. The Current Time field displays the current time based on the access point system clock.
System Configuration Enable NTP on access Select the Enable NTP on access point checkbox to allow a connection between the access point and one or more specified point NTP servers. A preferred, first alternate and second alternate NTP server cannot be defined unless this checkbox is selected. Disable this option (uncheck the checkbox) if Kerberos is not in use and time synchronization is not necessary. Preferred Time Server Specify the numerical (non DNS name) IP address and port of the primary NTP server.
4-34 AP-51xx Access Point Product Reference Guide 4.6 Logging Configuration The access point provides the capability for periodically logging system events that prove useful in assessing the throughput and performance of the access point or troubleshooting problems on the access point managed Local Area Network (LAN). Use the Logging Configuration screen to set the desired logging level (standard syslog levels) and view or save the current access point system log.
System Configuration View Log Click View to save a log of events retained on the access point. The system displays a prompt requesting the administrator password before saving the log. After the password has been entered, click Get File to display a dialogue with buttons to Open or Save the log.txt file. Click Save and specify a location to save the log file. Use the WordPad application to view the saved log.txt file on a Microsoft Windows based computer.
4-36 AP-51xx Access Point Product Reference Guide 4. Click Undo Changes (if necessary) to undo any changes made. Undo Changes reverts the settings displayed on the Logging Configuration screen to the last saved configuration. 5. Click Logout to securely exit the access point Symbol Access Point applet. A prompt displays confirming the logout before the applet is closed. 4.
System Configuration CAUTION Symbol discourages importing a 1.0 baseline configuration file to a 1.1 version access point. Similarly, a 1.1 baseline configuration file should not be imported to a 1.0 version access point. Importing configuration files between different version access point’s results in broken configurations, since new features added to the 1.1 version access point cannot be supported in a 1.0 version access point. ! To create an importable/exportable access point configuration file: 1.
4-38 AP-51xx Access Point Product Reference Guide TFTP Select the TFTP radio button if using an FTP server to import or export the configuration. Username Specify a username to be used when logging in to the FTP server. A username is not required for TFTP server logins. Password Define a password allowing access to the FTP server for the import or export operation.
System Configuration Upload and Apply A Configuration File Click the Upload and Apply A Configuration File button to upload a configuration file to this access point using HTTP. Download Configuration File Click the Download Configuration File button to download this access point’s configuration file using HTTP. 4. Refer to the Status field to assess the completion of the import/export operation.
4-40 AP-51xx Access Point Product Reference Guide ! CAUTION If errors occur when importing the configuration file, a parsing message displays defining the line number where the error occurred. The configuration is still imported, except for the error. Consequently, it is possible to import an invalid configuration. The user is required to fix the problem and repeat the import operation until an error-free import takes place. NOTE Symbol recommends importing configuration files using the CLI.
System Configuration configuration file is selected for automatic update, the configuration is automatically updated since the access point is unable to compare the differences between configuration files. ! CAUTION If downgrading firmware from a 1.1 to a 1.0 version, the access point automatically reverts to 1.0 default settings, regardless of whether you are downloading the firmware manually or using the automatic download feature.
4-42 AP-51xx Access Point Product Reference Guide 3. Configure the DHCP Options field to enable automatic firmware and/or configuration file updates. DHCP options are used for out-of-the-box rapid deployment for Symbol wireless products. The following are the two DHCP options available on the access point: • Enable Automatic Firmware Update • Enable Automatic Configuration Update These options can be used to update newer firmware and configuration files on the access point.
System Configuration Enable Automatic Firmware Update Select this checkbox to allow an automatic firmware update each time firmware versions are found to be different between the access point and the LAN or WAN interface. This option is used in conjunction with other DHCP options configured on a DHCP server.
4-44 AP-51xx Access Point Product Reference Guide NOTE Click Apply to save the settings before performing the firmware update. The user is not able to navigate the access point user interface while the firmware update is in process. 9. Click the Perform Update button to initiate the update. Upon confirming the firmware update, the AP reboots and completes the update.
System Configuration 12. Click Apply to save the filename and filepath information entered into the Firmware Update screen. The Apply button does not execute the firmware, only saves the update settings entered. 13. Click Undo Changes (if necessary) to undo any changes made. Undo Changes reverts the settings displayed on Firmware Update screen to the last saved configuration. 14. Click Logout to securely exit the access point Symbol Access Point applet.
4-46 AP-51xx Access Point Product Reference Guide
Network Management Configuring network management includes configuring network aspects in numerous areas. See the following sections for more information on access point network management: • • • • Configuring the LAN Interface Configuring WAN Settings Enabling Wireless LANs (WLANs) Configuring Router Settings 5.1 Configuring the LAN Interface The access point has one physical LAN port supporting two unique LAN interfaces. The access point LAN port has its own MAC address.
5-2 AP-51xx Access Point Product Reference Guide Use the LAN Configuration screen to enable one (or both) of the access point’s LAN interfaces, assign them names, define which LAN is currently active on the access point Ethernet port and assign a timeout value to disable the LAN connection if no data traffic is detected within a defined interval. To configure the access point LAN interface: 1. Select Network Configuration -> LAN from the access point menu tree. 2.
Network Management Ethernet Port The Ethernet Port radio buttons allow you to select one of the two available LANs as the LAN actively transmitting over the access point’s LAN port. Both LANs can be active at any given time, but only one can transmit over the access point physical LAN connection, thus the selected LAN has priority. Enable 802.1q Trunking Select the Enable 802.1q Trunking checkbox to enable the LAN to conduct VLAN tagging.
5-4 AP-51xx Access Point Product Reference Guide 5. Click Logout to securely exit the access point Symbol Access Point applet. A prompt displays confirming the logout before the applet is closed. 5.1.1 Configuring VLAN Support A Virtual Local Area Network (VLAN) is a means to electronically separate data on the same access point from a single broadcast domain into separate broadcast domains.
Network Management to the access point. The access point then maps the target WLAN for the assigned VLAN and traffic passes normally, allowing for the completion of the DHCP request and further traffic. To create new VLANs or edit the properties of an existing VLAN: 1. Select Network Configuration -> LAN from the access point menu tree. 2. Ensure the Enable 802.1q Trunking button is selected from within the LAN Setting field. Trunk links are required to pass VLAN information between destinations.
5-6 AP-51xx Access Point Product Reference Guide To create a new VLAN, click the Create button, to edit the properties of an existing VLAN, click the Edit button. 4. Assign a unique VLAN ID (from 1 to 4095) to each VLAN added or modified. The VLAN ID associates a frame with a specific VLAN and provides the information the access point needs to process the frame across the network.
Network Management 8. Enter a Management VLAN Tag for LAN1 and LAN2. The Management VLAN uses a default tag value of 1. The Management VLAN is used to distinguish VLAN traffic flows for the LAN. The trunk port marks the frames with special tags as they pass between the access point and its destination, these tags help distinguish data traffic. Authentication servers (such as Radius and Kerberos) must be on the same Management VLAN.
5-8 AP-51xx Access Point Product Reference Guide frame arrives on the access point, it queries the VMPS for the VLAN assignment based on the source MAC address of the arriving frame. If statically mapping VLANs, leave the Dynamic checkbox specific to the target WLAN and its intended VLAN unselected. The administrator is then required to configure VLAN memberships manually. The Dynamic checkbox is enabled only when a WLAN is having EAP security configured. Otherwise, the checkbox is disabled. 12.
Network Management 2. Configure the DHCP Configuration field to define the DHCP settings used for the LAN. NOTE Symbol recommends the WAN and LAN ports should not both be configured as DHCP clients. This interface is a DHCP Client Select this button to enable DHCP to set access point network address information via this LAN1 or LAN2 connection. This is recommended if the access point resides within a large corporate network or the Internet Service Provider (ISP) uses DHCP.
5-10 AP-51xx Access Point Product Reference Guide This interface uses static IP Address Select the This interface uses static IP Address button, and manually enter static network address information in the areas provided. This interface is a DHCP Server The access point can be configured to function as a DHCP server over the LAN1 or LAN2 connection. Select the This interface is a DHCP Server button and manually enter static network address information in the areas provided.
Network Management WINS Server Enter the numerical (non DNS name) IP address of the WINS server. WINS is a Microsoft NetBIOS name server. Using a WINS server eliminates the broadcasts needed to resolve computer names to IP addresses by providing a cache or database of translations. Mesh STP Configuration Click the Mesh STP Configuration button to define bridge settings for this specific LAN. Each of the access point’s two LANs can have a separate mesh configuration.
5-12 AP-51xx Access Point Product Reference Guide 1. Select Network Configuration -> LAN -> LAN1 (or LAN2) from the access point menu tree. 2. Click the Advanced DHCP Server button from within the LAN1 or LAN2 screen. 3. Specify a lease period in seconds for available IP addresses using the DHCP Lease Time (Seconds) parameter. An IP address is reserved for re-connection for the length of time you specify. The default interval is 86400 seconds. 4.
Network Management 5.1.2.2 Setting the Type Filter Configuration Each access point LAN (either LAN1 or LAN2) can keep a list of frame types that it forwards or discards. The Type Filtering feature prevents specific (a potentially unneccesary) frames from being processed by the access point in order to improve throughput. These include certain broadcast frames from devices that consume bandwidth, but are unnecessary to access point operations.
5-14 AP-51xx Access Point Product Reference Guide Packet types supported for the type filtering function include 16-bit DIX Ethernet types as well as Symbol proprietary types. Select an Ethernet type from the drop down menu, or enter the Ethernet type’s hexadecimal value. Consult with your System Administrator if unsure of the implication of adding or omitting a type from the list for either LAN1 or LAN2. 4.
Network Management 2. Refer to the WAN IP Configuration field to enable the WAN interface, and set network address information for the WAN connection. NOTE Symbol recommends that the WAN and LAN ports should not both be configured as DHCP clients. Enable WAN Interface Select the Enable WAN Interface checkbox to enable a connection between the access point and a larger network or outside world through the WAN port. Disable this option to effectively isolate the access point’s WAN.
5-16 AP-51xx Access Point Product Reference Guide This interface is a DHCP Client This checkbox enables DHCP for the access point WAN connection. This is useful, if the larger corporate network or Internet Service Provider (ISP) uses DHCP. DHCP is a protocol that includes mechanisms for IP address allocation and delivery of host-specific configuration parameters from a DHCP server to a host. Some of these parameters are IP address, network mask, and gateway.
Network Management More IP Addresses Click the More IP Addresses button to specify additional static IP addresses for the access point. Additional IP addresses are required when users within the WAN need dedicated IP addresses, or when servers need to be accessed (addressed) by the outside world. The More IP Addresses screen allows the administrator to enter up to seven additional WAN IP addresses for the access point WAN. Only numeric, non-DNS names can be used.
5-18 AP-51xx Access Point Product Reference Guide Keep-Alive Select the Keep-Alive checkbox to maintain the access point WAN connection indefinitely (no timeout interval). Some ISPs terminate inactive connections. Enabling Keep-Alive keeps the access point WAN connection active, even when there is no traffic. If the ISP drops the connection after an idle period, the access point automatically re-establishes the connection to the ISP. Enabling Keep-Alive mode disables (grays out) the Idle Time field.
Network Management 6. Click Logout to securely exit the access point Symbol Access Point applet. A prompt displays confirming the logout before the applet is closed. 5.2.1 Configuring Network Address Translation (NAT) Settings Network Address Translation (NAT) converts an IP address in one network to a different IP address or set of IP addresses in another network.
5-20 AP-51xx Access Point Product Reference Guide 2. Configure the Address Mappings field to generate a WAN IP address, define the NAT type and set outbound/inbound NAT mappings. WAN IP Address The WAN IP addresses on the NAT screen are dynamically generated from address settings applied on the WAN screen. NAT Type Specify the NAT Type as 1 to 1 to map a WAN IP address to a single host (local) IP address.
Network Management 5. Click Logout to securely exit the access point Symbol Access Point applet. A prompt displays confirming the logout before the applet is closed. 5.2.1.1 Configuring Port Forwarding Use the Port Forwarding screen to configure port forwarding parameters for inbound traffic from the associated WAN IP address. To configure port forwarding for the access point: 1. Select Network Configuration -> WAN -> NAT from the access point menu tree. 2.
5-22 AP-51xx Access Point Product Reference Guide Transport Use the Transport pull-down menu to specify the transport protocol used in this service. The choices are ALL, TCP, UDP, ICMP, AH, ESP, and GRE. Start Port and End Port Enter the port or ports used by the port forwarding service. To specify a single port, enter the port number in the Start Port area. To specify a range of ports, use both the Start Port and End Port options to enter the port numbers.
Network Management To configure WLANs on the access point: 1. Select Network Configuration -> Wireless from the access point menu tree. If a WLAN is defined, that WLAN displays within the Wireless Configuration screen. When the access point is first booted, WLAN1 exists as a default WLAN available immediately for connection. 2. Refer to the information within the Wireless Configuration screen to view the name, ESSID, access point radio designation, VLAN ID and security policy of existing WLANs.
5-24 AP-51xx Access Point Product Reference Guide VLAN The VLAN field displays the specific VLAN the target WLAN is mapped to. For information on VLAN configuration for the WLAN, see Configuring VLAN Support on page 5-4. Security Policy The Security Policy field displays the security profile configured for the target WLAN. For information on configuring security for a WLAN, see Enabling Authentication and Encryption Schemes on page 6-5.
Network Management Use the New WLAN and Edit WLAN screens as required to create/modify a WLAN. To create a new WLAN or edit the properties of an existing WLAN: 1. Select Network Configuration -> Wireless from the access point menu tree. The Wireless Configuration screen displays. 2. Click the Create button to configure a new WLAN, or highlight a WLAN and click the Edit button to modify an existing WLAN. Either the New WLAN or Edit WLAN screen displays. 3.
5-26 AP-51xx Access Point Product Reference Guide ESSID Enter the Extended Services Set Identification (ESSID) associated with the WLAN. The WLAN name is auto-generated using the ESSID until changed by the user. The maximum number of characters that can be used for the ESSID is 32. Name Define or revise the name for the WLAN. The name should be logical representation of WLAN coverage area (engineering, marketing etc.). The maximum number of characters that can be used for the name is 31.
Network Management Enable Hotspot ! Select the Enable Hotspot checkbox to allow this WLAN (whether it be a new or existing WLAN) to be configured for hotspot support. Clicking the Configure Hotspot button launches a screen wherein the parameters of the hotspot can be defined. For information on configuring a target WLAN for hotspot support, see Configuring WLAN Hotspot Support on page 5-39.
5-28 AP-51xx Access Point Product Reference Guide Kerberos Password Enter a Kerberos password if Kerberos has been selected as the security scheme from within the Security Policies field. The field is grayed out if Kerberos has not been selected for the WLAN. For information on configuring Kerberos, see Configuring Kerberos Authentication on page 6-9. 5.
Network Management 6. Click Apply to save any changes to the WLAN screen. Navigating away from the screen without clicking Apply results in all changes to the screens being lost. 7. Click Cancel to securely exit the New WLAN or Edit WLAN screen and return to the Wireless Configuration screen. 5.3.1.
5-30 AP-51xx Access Point Product Reference Guide 2. Click Logout to exit the Security Configuration screen. 5.3.1.2 Configuring a WLAN Access Control List (ACL) An Access Control Lists (ACL) affords a system administrator the ability to grant or restrict MU access by specifying a MU MAC address or range of MAC addresses to either include or exclude from access point connectivity.
Network Management NOTE When the access point is first launched, a single ACL policy (default) is available and mapped to WLAN 1. It is anticipated numerous additional ACL policies will be created as the list of WLANs grows. 2. Click the Create button to configure a new ACL policy, or select a policy and click the Edit button to modify an existing ACL policy. The access point supports a maximum of 16 MU ACL policies.
5-32 AP-51xx Access Point Product Reference Guide Either the New MU ACL Policy or Edit MU ACL Policy screens display. 3. Assign a name to the new or edited ACL policy that represents an inclusion or exclusion policy specific to a particular type of MU traffic you may want to use with a single or group of WLANs. More than one WLAN can use the same ACL policy. 4. Configure the parameters within the Mobile Unit Access Control List field to allow or deny MU access to the access point.
Network Management 5. Click Apply to save any changes to the New MU ACL Policy or Edit MU ACL Policy screen and return to the Mobile Unit Access Control List Configuration screen. Navigating away from the screen without clicking Apply results in all changes to the screens being lost. 6. Click Cancel to securely exit the New MU ACL Policy or Edit MU ACL Policy screen and return to the Mobile Unit Access Control List Configuration screen. 7.
5-34 AP-51xx Access Point Product Reference Guide 2. Click the Create button to configure a new QoS policy, or select a policy and click the Edit button to modify an existing QoS policy. The access point supports a maximum of 16 QoS policies.
Network Management 3. Assign a name to the new or edited QoS policy that makes sense to the access point traffic receiving priority. More than one WLAN can use the same QoS policy. 4. Select the Support Voice prioritization checkbox to allow legacy voice prioritization. Certain products may not receive priority over other voice or data traffic.
5-36 AP-51xx Access Point Product Reference Guide 5. Use the two Multicast Address fields to specify one or two MAC addresses to be used for multicast applications. Some VoIP devices make use of multicast addresses. Using this mechanism ensures that the multicast packets for these devices are not delayed by the packet queue. 6. Use the drop-down menu to select the radio traffic best representing the network requirements of this WLAN.
Network Management Best Effort Best Effort traffic includes traffic from legacy devices or applications lacking QoS capabilities. Best Effort traffic is negatively impacted by data transfers with long delays as well as multimedia traffic. Video Video traffic includes music streaming and application traffic requiring priority over all other types of network traffic. Voice Voice traffic includes VoIP traffic and typically receives priority over Background and Best Effort traffic. 8.
5-38 AP-51xx Access Point Product Reference Guide 9. Click Apply to save any changes to the New QoS Policy or Edit QoS Policy screen to return to the Quality of Service Configuration screen. Navigating away from the screen without clicking Apply results in all changes to the screens being lost. 10. Click Cancel to securely exit the New QoS Policy or Edit QoS Policy screen to return to the Quality of Service Configuration screen. 11.
Network Management 5.3.1.4 Configuring WLAN Hotspot Support The access point enables hotspot operators to provide user authentication and accounting without a special client application. The access point uses a traditional Internet browser as a secure authentication device. Rather than rely on built-in 802.11security features to control access point association privileges, configure a WLAN with no WEP (an open network).
5-40 AP-51xx Access Point Product Reference Guide 3. Refer to the HTTP Redirection field to specify how the Login, Welcome, and Fail pages are maintained for this specific WLAN. The pages can be hosted locally or remotely. . Use Default Files Select the Use Default Files checkbox if the login, welcome and fail pages reside on the access point. Use External URL Select the Use External URL checkbox to define a set of external URLs for hotspot users to access the login, welcome and fail pages.
Network Management Welcome Page URL Define the complete URL for the location of the Welcome page. The Welcome page asserts the hotspot user has logged in successfully and can access the Internet. Fail Page URL Define the complete URL for the location of the Fail page. The Fail screen asserts the hotspot authentication attempt failed, you are not allowed to access the Internet and you need to provide correct login information to access the Internet. 5.
5-42 AP-51xx Access Point Product Reference Guide Select mode Use the Select mode drop-down menu to define whether an Internal or External server is to be used for the primary server. Pri Server IP Define the IP address of the primary Radius server. This is the address of your first choice for Radius server. Pri Port Enter the TCP/IP port number for the server acting as the primary Radius server. The default port is 1812.
Network Management When a client requests a URL from a Web server, the login handler returns an HTTP redirection status code (for example, 301 Moved Permanently), which indicates to the browser it should look for the page at another URL. This other URL can be a local or remote login page (based on the hotspot configuration). The login page URL is specified in the location’s HTTP header.
5-44 AP-51xx Access Point Product Reference Guide 5.3.2 Setting the WLAN’s Radio Configuration Each access point WLAN can have a separate 802.11a or 802.11b/g radio configured and mapped to that WLAN. The first step is to enable the radio. One of two possible radio configuration pages are available on the access point depending on which model SKU is purchased. If the access point is a single-radio model, the Radio Configuration screen enables you to configure the single radio for either 802.11a or 802.
Network Management 2. Enable the radio(s) using the Enable checkbox(es). Refer to RF Band of Operation parameter to ensure you are enabling the correct 802.11a or 802.11b/g radio. After the settings are applied within this Radio Configuration screen, the Radio Status and MUs connected values update. If this is an existing radio within a mesh network, these values update in real-time.
5-46 AP-51xx Access Point Product Reference Guide The maximum number of client bridge connections per radio is 12, with 24 representing the maximum for dual-radio models. ! CAUTION An access point is Base Bridge mode logs out whenever a Client Bridge associates to the Base Bridge over the LAN connection. This problem is not experienced over the access point’s WAN connection. If this situation is experienced, log-in to the access point again.
Network Management within the BBs Connected field. If this is an existing radio within a mesh network, these values update in real-time. 6. Click the Advanced button to define a prioritized list of access points to define Mesh Connection links. For a detailed overview on mesh networking and how to configure the radio for mesh networking support, see Configuring Mesh Networking on page 9-1. 7. Click Apply to save any changes to the Radio Configuration screen.
5-48 AP-51xx Access Point Product Reference Guide On a single-radio model, Radio1 could either be an 802.11a or 802.11b/g radio depending on which radio has been enabled. 2. Configure the Properties field to assign a name and placement designation for the radio. Placement Use the Placement drop-down menu to specify whether the radio is located outdoors or indoors. Default placement depends on the country of operation selected for the access point.
Network Management ERP Protection Extended Rate PHY (ERP) allows 802.11g MUs to interoperate with 802.11b only MUs. ERP Protection is managed automatically by the access point and informs users when 802.11b MUs are present within the access point’s coverage area. The presence of 802.11b MUs within the 802.11g coverage area negatively impacts network performance, so this feature should looked to as an indicator of why network performance has been degraded. 3.
5-50 AP-51xx Access Point Product Reference Guide 802.11 b/g mode Specify b only, g only or b and g to define whether the 802.11b/ g radio transmits in the 2.4 Ghz band exclusively for 802.11b (legacy) clients or transmits in the 2.4 Ghz band for 802.11g clients. Selecting b and g enables the access point to transmit to both b and g clients if legacy clients (802.11b) partially comprise the network. Select accordingly based on the MU requirements of the network.
Network Management 4. Refer to the Beacon Settings field to set the radio beacon and DTIM intervals. Beacon Interval The beacon interval controls the performance of power save stations. A small interval may make power save stations more responsive, but it will also cause them to consume more battery power. A large interval makes power save stations less responsive, but could increase power savings. The default is 100. Avoid changing this parameter as it can adversely affect performance.
5-52 AP-51xx Access Point Product Reference Guide 5. Configure the Performance field to set the preamble, thresholds values, data rates and QoS values for the radio. Support Short Preamble The preamble is approximately 8 bytes of packet header generated by the access point and attached to the packet prior to transmission from the 802.11b radio. The preamble length for 802.11b transmissions is data rate dependant. The short preamble is 50% shorter than the long preamble.
Network Management 6. Select the Advanced Settings tab to strategically map BSSIDs to WLANs in order to define them as primary WLANs.
5-54 AP-51xx Access Point Product Reference Guide Defining Primary WLANs allows an administrator to dedicate BSSIDs (4 BSSIDs are available for mapping) to WLANs. From that initial BSSID assignment, Primary WLANs can be defined from within the WLANs assigned to BSSID groups 1 through 4. Each BSSID beacons only on the primary WLAN. The user should assign each WLAN to its own BSSID.
Network Management 9. Click Undo Changes (if necessary) to undo any changes made to the screen and its subscreens. Undo Changes reverts the settings to the last saved configuration. 10. Click Logout to securely exit the access point Symbol Access Point applet. A prompt displays confirming the logout before the applet is closed. 5.3.3 Configuring Bandwidth Management Settings The access point can be configured to grant individual WLAN’s network bandwidth priority levels.
5-56 AP-51xx Access Point Product Reference Guide Weighted RoundRobin If selected, a weighting (prioritization) scheme (configured within the QoS Configuration screen) is used to define which WLANs receive access point resources first. 3. Configure the Bandwidth Share for Each WLAN field to set a raw weight (for WLANs using the Weighted Round-Robin option) for each WLAN. The weight% changes as the weight is entered.
Network Management NOTE Though the Rogue AP and Firewall features appear after the Bandwidth Management features within the access point menu tree, they are described in Chapter 6, Configuring Access Point Security on page 6-1, as both items are data protection functions. More specifically, see, Configuring Firewall Settings on page 6-25 and Configuring Rogue AP Detection on page 6-52. 5.
5-58 AP-51xx Access Point Product Reference Guide mask (or network mask) and gateway settings are those belonging to each subnet. Displayed interfaces are those associated with destination IP addresses. To change any of the network address information within the WAN screen, see Configuring WAN Settings on page 5-14. 3. From the Use Default Gateway drop-down menu, select the WAN or either of the two LANs (if enabled) to server as the default gateway to forward data packets from one network to another. 4.
Network Management RIP v1 RIP version 1 is a mature, stable, and widely supported protocol. It is well suited for use in stub networks and in small autonomous systems that do not have enough redundant paths to warrant the overhead of a more sophisticated protocol. RIP v2 (v1 compat) RIP version 2 (compatible with version 1) is an extension of RIP v1’s capabilities, but it is still compatible with RIP version 1.
5-60 AP-51xx Access Point Product Reference Guide 3. If RIP v2 or RIP v2 (v1 compat) is the selected RIP type, the RIP v2 Authentication field becomes active. Select the type of authentication to use from the Authentication Type drop-down menu. Available options include: None This option disables the RIP authentication. Simple This option enable RIP version 2’s simple authentication mechanism. This setting activates the Password (Simple Authentication) field.
Network Management 4. If the Simple authentication method is selected, specify a password of up to 15 alphanumeric characters in the Password (Simple Authentication) area. 5. If the MD5 authentication method is selected, fill in the Key #1 field (Key #2 is optional). Enter any numeric value between 0 and 256 into the MD5 ID area. Enter a string consisting of up to 16 alphanumeric characters in the MD5 Auth Key area. 6. Click the OK button to return to the Router screen.
5-62 AP-51xx Access Point Product Reference Guide
Configuring Access Point Security Security measures for the access point and its WLANs are critical. Use the available access point security options to protect the access point LAN from wireless vulnerabilities, and safeguard the transmission of RF packets between the access point and its associated MUs. WLAN security can be configured on an ESS by ESS basis on the access point. Sixteen separate ESSIDs (WLANs) can be supported on an access point, and must be managed (if necessary) between the 802.
6-2 AP-51xx Access Point Product Reference Guide NOTE Security for the access point can be configured in various locations throughout the access point menu structure. This chapter outlines the security options available to the access point, and the menu locations and steps required to configure specific security measures. 6.
Configuring Access Point Security 6.2 Setting Passwords Before setting the access point security parameters, verify an administrative password for the access point has been created to restrict access to the device before advanced device security is configured. To password protect and restrict access point device access: 1. Connect a wired computer to the access point LAN port using a standard CAT-5 cable. 2.
6-4 AP-51xx Access Point Product Reference Guide If the default login is successful, the Change Admin Password window displays. Change the default login and password to significantly decrease the likelihood of hacking. ! CAUTION Restoring the access point’s configuration back to default settings changes the administrative password back to “symbol.” If restoring the configuration back to default settings, be sure you change the administrative password accordingly. 5.
Configuring Access Point Security A serial connection has now been established and the user should be able to view the serial connection window. 5. Reset the access point. An access point can be reset by removing and re-inserting the LAN cable or removing and re-inserting the power cable. As the access point is re-booting, a “Press esc key to run boot firmware” message displays. 6. Quickly press .
6-6 AP-51xx Access Point Product Reference Guide Each WLAN (16 WLANs available in total to an access point regardless of the model) can have a separate security policy. However, more than one WLAN can use the same security policy. Therefore, to avoid confusion, do not name security policies the same name as WLANs. Once security policies have been created, they are selectable within the Security field of each WLAN screen.
Configuring Access Point Security NOTE An existing security policy can be edited from the Security Configuration screen by selecting an existing policy and clicking the Edit button. Use the Edit Security Policy screen to edit the policy. For more information on editing an existing security policy, refer to security configuration sections described in steps 4 and 5. 3. Use the Name field to define a logical security policy name.
6-8 AP-51xx Access Point Product Reference Guide WEP 128 (104-bit key) Select the WEP 128 (104 bit key) button to display the WEP 128 Settings field within the New Security Policy screen. For specific information on configuring WEP 128, see Configuring WEP Encryption on page 6-16. KeyGuard Select the KeyGuard button to display the KeyGuard Settings field within the New Security Policy screen. For specific information on configuring KeyGuard, see Configuring KeyGuard Encryption on page 6-18.
Configuring Access Point Security 7. Click Cancel to return to the target WLAN screen without keeping any of the changes made within the New Security Policy screen. 6.4 Configuring Kerberos Authentication Kerberos (designed and developed by MIT) provides strong authentication for client/server applications using secret-key cryptography. Using Kerberos, a client must prove its identity to a server (and vice versa) across an insecure network connection.
6-10 AP-51xx Access Point Product Reference Guide 3. Select the Kerberos radio button. The Kerberos Configuration field displays within the New Security Policy screen. 4. Ensure the Name of the security policy entered suits the intended configuration or function of the policy. 5. Set the Kerberos Configuration field as required to define the parameters of the Kerberos authentication server and access point. Realm Name Specify a realm name that is case-sensitive, for example, SYMBOL.COM.
