Page 1 RoamAbout ™ Wireless Networking Access Point 3000 Configuration Guide P/N 9033900-04...
Page 3 Elektrischer Gefahrenhinweis: Installationen sollten nur durch ausgebildetes und qualifiziertes Personal vorgenommen werden. Notice Enterasys Networks reserves the right to make changes in specifications and other information contained in this document and its web site without prior notice. The reader should in all cases consult Enterasys Networks to determine whether any such changes have been made. The hardware, firmware, or software described in this document is subject to change without notice. IN NO EVENT SHALL ENTERASYS NETWORKS BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS DOCUMENT, WEB SITE, OR THE INFORMATION CONTAINED IN THEM, EVEN IF ENTERASYS NETWORKS HAS BEEN ADVISED OF, KNEW OF, OR SHOULD HAVE KNOWN OF, THE POSSIBILITY OF SUCH DAMAGES. Enterasys Networks, Inc. 50 Minuteman Road Andover, MA 01810 © 2005 Enterasys Networks, Inc. All rights reserved. Part Number: 9033900‐04 April 2005 ROAMABOUT ENTERASYS, ENTERASYS NETWORKS, , and any logos associated therewith, are trademarks or registered trademarks of Enterasys Networks, Inc., in the United States and other countries. All other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies. Documentation URL: http://www.enterasys.com/support/manuals Documentacion URL: http://www.enterasys.com/support/manuals...
Page 4 Enterasys Networks, Inc. Firmware License Agreement BEFORE OPENING OR UTILIZING THE ENCLOSED PRODUCT, CAREFULLY READ THIS LICENSE AGREEMENT. This document is an agreement (“Agreement”) between the end user (“You”) and Enterasys Networks, Inc. on behalf of itself and its Affiliates (as hereinafter defined) (“Enterasys”) that sets forth Your rights and obligations with respect to the Enterasys software program/firmware installed on the Enterasys product (including any accompanying documentation, hardware or media) (“Program”) in the package and prevails over any additional, conflicting or inconsistent terms and conditions appearing on any purchase order or other document submitted by You. “Affiliate” means any person, partnership, corporation, limited liability company, or other form of enterprise that directly or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with the party specified. This Agreement constitutes the entire understanding between the parties, and supersedes all prior discussions, representations, understandings or agreements, whether oral or in writing, between the parties with respect to the subject matter of this Agreement. The Program may be contained in firmware, chips or other media. BY INSTALLING OR OTHERWISE USING THE PROGRAM, YOU REPRESENT THAT YOU ARE AUTHORIZED TO ACCEPT THESE TERMS ON BEHALF OF THE END USER (IF THE END USER IS AN ENTITY ON WHOSE BEHALF YOU ARE AUTHORIZED TO ACT, “YOU” AND “YOUR” SHALL BE DEEMED TO REFER TO SUCH ENTITY) AND THAT YOU AGREE THAT YOU ARE BOUND BY THE TERMS OF THIS AGREEMENT, WHICH INCLUDES, AMONG OTHER PROVISIONS, THE LICENSE, THE DISCLAIMER OF WARRANTY AND THE LIMITATION OF LIABILITY. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT OR ARE NOT AUTHORIZED TO ENTER INTO THIS AGREEMENT, ENTERASYS IS UNWILLING TO LICENSE THE PROGRAM TO YOU AND YOU AGREE TO RETURN THE UNOPENED PRODUCT TO ENTERASYS OR YOUR DEALER, IF ANY, WITHIN TEN (10) DAYS FOLLOWING THE DATE OF RECEIPT FOR A FULL REFUND. IF YOU HAVE ANY QUESTIONS ABOUT THIS AGREEMENT, CONTACT ENTERASYS NETWORKS, LEGAL DEPARTMENT AT (978) 684‐1000. You and Enterasys agree as follows: LICENSE. You have the non‐exclusive and non‐transferable right to use only the one (1) copy of the Program provided in this package subject to the terms and conditions of this Agreement. RESTRICTIONS. Except as otherwise authorized in writing by Enterasys, You may not, nor may You permit any third party to: (i) Reverse engineer, decompile, disassemble or modify the Program, in whole or in part, including for reasons of error correction or interoperability, except to the extent expressly permitted by applicable law and to the extent the parties shall not be permitted by that applicable law, such rights are expressly excluded. Information necessary to achieve ...
Page 5 EXPORT RESTRICTIONS. You understand that Enterasys and its Affiliates are subject to regulation by agencies of the U.S. Government, including the U.S. Department of Commerce, which prohibit export or diversion of certain technical products to certain countries, unless a license to export the Program is obtained from the U.S. Government or an exception from obtaining such license may be relied upon by the exporting party. If the Program is exported from the United States pursuant to the License Exception CIV under the U.S. Export Administration Regulations, You agree that You are a civil end user of the Program and agree that You will use the Program for civil end uses only and not for military purposes. If the Program is exported from the United States pursuant to the License Exception TSR under the U.S. Export Administration Regulations, in addition to the restriction on transfer set forth in Sections 1 or 2 of this Agreement, You agree not to (i) reexport or release the Program, the source code for the Program or technology to a national of a country in Country Groups D:1 or E:2 (Albania, Armenia, Azerbaijan, Belarus, Bulgaria, Cambodia, Cuba, Estonia, Georgia, Iraq, Kazakhstan, Kyrgyzstan, Laos, Latvia, Libya, Lithuania, Moldova, North Korea, the People’s Republic of China, Romania, Russia, Rwanda, Tajikistan, Turkmenistan, Ukraine, Uzbekistan, Vietnam, or such other countries as may be designated by the United States Government), (ii) export to Country Groups D:1 or E:2 (as defined herein) the direct product of the Program or the technology, if such foreign produced direct product is subject to national security controls as identified on the U.S. Commerce Control List, or (iii) if the direct product of the technology is a complete plant or any major component of a plant, export to Country Groups D:1 or E:2 the direct product of the plant or a major component thereof, if such foreign produced direct product is subject to national security controls as identified on the U.S. Commerce Control List or is subject to State Department controls under the U.S. Munitions List. UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The enclosed Program (i) was developed solely at private expense; (ii) contains “restricted computer software” submitted with restricted rights in accordance with section 52.227‐19 (a) through (d) of the Commercial Computer Software‐Restricted Rights Clause and its successors, and (iii) in all respects is proprietary data belonging to Enterasys and/or its suppliers. For Department of Defense units, the Program is considered commercial computer software in accordance with DFARS section 227.7202‐3 and its successors, and use, duplication, or disclosure by the Government is subject to restrictions set forth herein. DISCLAIMER OF WARRANTY. EXCEPT FOR THOSE WARRANTIES EXPRESSLY PROVIDED TO YOU IN WRITING BY ENTERASYS, ENTERASYS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON‐ INFRINGEMENT WITH RESPECT TO THE PROGRAM. IF IMPLIED WARRANTIES MAY NOT BE DISCLAIMED BY APPLICABLE LAW, THEN ANY IMPLIED WARRANTIES ARE LIMITED IN DURATION TO THIRTY (30) DAYS AFTER DELIVERY OF THE PROGRAM TO YOU. LIMITATION OF LIABILITY. IN NO EVENT SHALL ENTERASYS OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS, PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR RELIANCE DAMAGES, OR OTHER LOSS) ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM, EVEN IF ENTERASYS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS FOREGOING LIMITATION SHALL APPLY REGARDLESS OF THE CAUSE OF ACTION UNDER WHICH DAMAGES ARE SOUGHT.
Page 6 10. ENFORCEMENT. You acknowledge and agree that any breach of Sections 2, 4, or 9 of this Agreement by You may cause Enterasys irreparable damage for which recovery of money damages would be inadequate, and that Enterasys may be entitled to seek timely injunctive relief to protect Enterasys’ rights under this Agreement in addition to any and all remedies available at law. 11. ASSIGNMENT. You may not assign, transfer or sublicense this Agreement or any of Your rights or obligations under this Agreement, except that You may assign this Agreement to any person or entity which acquires substantially all of Your stock or assets. Enterasys may assign this Agreement in its sole discretion. This Agreement shall be binding upon and inure to the benefit of the parties, their legal representatives, permitted transferees, successors and assigns as permitted by this Agreement. Any attempted assignment, transfer or sublicense in violation of the terms of this Agreement shall be void and a breach of this Agreement. 12. WAIVER. A waiver by Enterasys of a breach of any of the terms and conditions of this Agreement must be in writing and will not be construed as a waiver of any subsequent breach of such term or condition. Enterasys’ failure to enforce a term upon Your breach of such term shall not be construed as a waiver of Your breach or prevent enforcement on any other occasion. 13. SEVERABILITY. In the event any provision of this Agreement is found to be invalid, illegal or unenforceable, the validity, legality and enforceability of any of the remaining provisions shall not in any way be affected or impaired thereby, and that provision shall be reformed, construed and enforced to the maximum extent permissible. Any such invalidity, illegality or unenforceability in any jurisdiction shall not invalidate or render illegal or unenforceable such provision in any other jurisdiction. 14. TERMINATION. Enterasys may terminate this Agreement immediately upon Your breach of any of the terms and conditions of this Agreement. Upon any such termination, You shall immediately cease all use of the Program and shall return to Enterasys the Program and all copies of the Program.
Page 7: Table Of Contents
Contents Preface Purpose of This Manual ........................... xiii Intended Audience ............................xiii Associated Documents ............................ xiii Document Conventions ........................... xiii Getting Help ..............................xiv Chapter 1: Introduction Overview ................................. 1-1 Features and Benefits ............................ 1-2 Applications ..............................1-2 Chapter 2: Network Configuration Overview .................................
Page 8 Using the CLI ............................4-19 CLI Commands for VLAN Support ....................4-19 CLI Commands for Filtering......................4-21 QoS ................................4-22 Using Web Management ........................4-22 Using the CLI ............................4-24 CDP Settings ..............................4-26 Using Web Management ........................4-26 Using the CLI ............................4-27 Rogue AP Detection .............................
Page 9 Using the CLI to View Neighbor AP Detection Status ................4-88 Using Web Management to View Event Logs ..................4-90 Using the CLI to View Event Logs ......................4-91 Appendix A: Using the Command Line Interface Accessing the CLI ............................A-1 Console Connection ..........................
Page 10 sntp-server ip ........................... A-39 sntp-server enable........................... A-40 sntp-server date-time........................A-41 sntp-server daylight-saving......................A-42 sntp-server timezone ........................A-43 show sntp ............................A-43 show system............................ A-44 show version............................ A-45 PPPoE Commands ..........................A-45 ip pppoe............................A-46 pppoe ip allocation mode......................... A-47 pppoe ipcp dns ..........................A-48 pppoe lcp echo-interval ........................
Page 11 radius-server secondary ........................A-86 show radius ............................. A-87 802.1x Port Authentication Commands ....................A-88 802.1x.............................. A-89 802.1x broadcast-key-refresh-rate ....................A-91 802.1x session-key-refresh-rate ...................... A-92 802.1x session-timeout........................A-93 802.1x supplicant..........................A-94 mac-access permission ........................A-95 mac-access entry ..........................A-96 mac-authentication server ....................... A-97 mac-authentication session-timeout ....................
Page 12 multicast-cipher ..........................A-143 unicast-cipher ..........................A-144 wpa-clients............................. A-145 wpa-mode............................A-147 wpa-preshared-key........................A-148 vap..............................A-149 shutdown ............................A-150 show interface wireless ......................... A-151 show station........................... A-152 IAPP Commands ..........................A-153 iapp..............................A-153 QoS Commands ..........................A-154 qos mode............................A-155 qos mac-addr..........................A-156 qos ether-type..........................
Page 13 Figures Ad Hoc Wireless LAN ......................... 2-2 Infrastructure Wireless LAN........................ 2-3 Infrastructure Wireless LAN for Roaming ................... 2-4 Tables Advanced Configuration ........................4-2 QoS Mode and Classifications ......................4-23 SNMP Notifications ......................... 4-33 Logging Level Descriptions ......................4-43 VLAN ID RADIUS Attributes ......................4-50 Security Mechanisms ........................
Page 15: Preface
Preface Purpose of This Manual This manual provides the configuration instructions for the RoamAbout Access Point 3000 using Web management and the Command Line Interface (CLI). Intended Audience This manual is intended for the wireless network manager who will configure the RoamAbout Access Point 3000. You should have a basic knowledge of Local Area Networks (LANs) and networking functions. Associated Documents You can download the documentation from the Enterasys Networks Web site. Documentation URL: http://www.enterasys.com/support/manuals Documentacion URL: http://www.enterasys.com/support/manuals Dokumentation: http://www.enterasys.com/support/manuals Document Conventions The following icons are used in this document: Caution: Contains information essential to avoid damage to the equipment. Precaución: Contiene información esencial para prevenir dañar el equipo. Achtung: Verweißt auf wichtige Informationen zum Schutz gegen Beschädigungen.
Page 16: Getting Help
World Wide Web: www.enterasys.com/support Phone: (603) 332-9400 1-800-872-8440 (toll-free in the U.S. and Canada) For the Enterasys Networks Support toll-free number in your country: www.enterasys.com/support/gtac-all.html Email: support@enterasys.com To expedite your message, please type [wireless] in the subject line. To send comments or suggestions concerning this document to the Technical Writing Department: techwriting@enterasys.com...
Page 17: Chapter 1: Introduction
Introduction Overview The Enterasys Networks Wireless Access Point 3000 is an IEEE 802.11a/b/g (RBT3K‐AG and RBT3K‐AG‐G), or an IEEE 802.11b/g only (RBT3K‐1G), access point that provides transparent, wireless high‐speed data communications between the wired LAN and fixed, portable or mobile devices equipped with an 802.11a, 802.11b or 802.11g wireless adapter. This solution offers fast, reliable wireless connectivity with considerable cost savings over wired LANs (which include long‐term maintenance overhead for cabling). Using 802.11a, 802.11b, and 802.11g technology, this access point can easily replace a 10 Mbps Ethernet connection or seamless integration into a 10/100 Mbps Ethernet LAN. In addition, the access point offers full network management capabilities through an easy to configure Web interface, and a command line interface for initial configuration and troubleshooting. The IEEE 802.11a/g standard uses a radio modulation technique known as Orthogonal Frequency Division Multiplexing (OFDM), and a shared collision domain (CSMA/CA). It operates at the 5 GHz Unlicensed National Information Infrastructure (UNII) band for connections to 802.11a clients, and at 2.4 GHz for connections to 802.11g clients. IEEE 802.11g includes backward compatibility with the IEEE 802.11b standard. IEEE 802.11b also operates at 2.4 GHz, but uses Direct Sequence Spread Spectrum (DSSS) modulation technology to achieve a communication rate of up to 11 Mbps. The access point also supports a 54 Mbps half‐duplex connection to Ethernet networks for each active channel (up to 108 Mbps in turbo mode on the 802.11a interface). RoamAbout Access Point 3000 Configuration Guide 1-1...
Page 18: Features And Benefits
Features and Benefits Features and Benefits The features and benefits of the Access Point 3000 include the following: • Local network connection via 10/100 Mbps Ethernet ports or 54 Mbps wireless interface (supporting up to 250 mobile users per radio) • IEEE 802.11a, 802.11b, and 802.11g compliant • Rogue AP Detection provides the ability to scan the airwaves and collect information about access points in the area. This feature detects neighboring access points and access points not authorized to participate in the network • Advanced security through 64‐bit (40‐bit), 128‐bit, 152‐bit Wired Equivalent Protection (WEP) encryption, IEEE 802.1x port authentication, Wi‐Fi Protected Access (WPA), AES (802.11i ready), SSID broadcast disable, remote authentication via RADIUS server, and MAC address filtering features to protect your sensitive data and authenticate only authorized users to your network • Provides seamless roaming within the IEEE 802.11a, 802.11b, and 802.11g WLAN environment • Automatically selects the available channel at power‐up • Allows you to configure up to seven Virtual Access Points (VAPs) on each radio interface each with its own set of authenticaion and security parameters • Supports Cabletron Discovery Protocol (CDP) • Supports Spectralink Voice Priority (SVP) Applications The Wireless products offer a high speed, reliable, cost‐effective solution for 10/100 Mbps wireless Ethernet client access to the network in applications such as: • Remote access to corporate network information • E‐mail, file transfer, and terminal emulation •...
Page 19: Chapter 2: Network Configuration
Network Configuration Overview The wireless solution supports a stand‐alone wireless network configuration as well as an integrated configuration with 10/100 Mbps Ethernet LANs. Wireless network cards, adapters, and access points can be configured as: • Ad hoc for departmental, SOHO, or enterprise LANs • Infrastructure for wireless LANs • Infrastructure wireless LAN for roaming wireless PCs The 802.11b and 802.11g frequency band which operates at 2.4 GHz can easily encounter interference from other 2.4 GHz devices, such as other 802.11b or g wireless devices, cordless phones and microwave ovens. If you experience poor wireless LAN performance, try the following measures: • Limit any possible sources of radio interference within the service area • Increase the distance between neighboring access points to reduce interference • Decrease the signal strength of neighboring access points • Increase the channel separation of neighboring access points (e.g., up to 5 channels of separation for 802.11b, up to 4 channels for 802.11a, or 5 channels for 802.11g) RoamAbout Access Point 3000 Configuration Guide 2-1...
Page 20: Network Topologies
Network Topologies Network Topologies Ad Hoc Wireless LAN (no Access Point or Bridge) An ad hoc wireless LAN consists of a group of computers, each equipped with a wireless adapter, connected via radio signals as an independent wireless LAN. Computers in a specific ad hoc wireless LAN must therefore be configured to the same radio channel. Figure 2‐1 shows an example of this configuration. Figure 2-1 Ad Hoc Wireless LAN Ad Hoc Wireless LAN Notebook with Wireless USB Adapter Notebook with Wireless PC Card Notebook with Wireless PCI Adapter 2-2 Network Configuration...
Page 21: Infrastructure Wireless Lan
Network Topologies Infrastructure Wireless LAN The access point also provides access to a wired LAN for wireless workstations. An integrated wired/wireless LAN is called an infrastructure configuration. A Basic Service Set (BSS) consists of a group of wireless PC users, and an access point that is directly connected to the wired LAN. Each wireless PC in this BSS can talk to any computer in its wireless group via a radio link, or access other computers or network resources in the wired LAN infrastructure via the access point. The infrastructure configuration not only extends the accessibility of wireless PCs to the wired LAN, but also increases the effective wireless transmission range for wireless PCs by passing their signal through one or more access points. A wireless infrastructure can be used for access to a central database, or for connection between mobile workers, as shown in Figure 2‐2. Figure 2-2 Infrastructure Wireless LAN Wired LAN Extension to Wireless Adapters File Server Desktop PC Switch Notebook with Wireless PC Card Adapter DC 5V/3 CON SOL LOC K Access Point...
Page 22: Infrastructure Wireless Lan For Roaming Wireless Pcs
Network Topologies Infrastructure Wireless LAN for Roaming Wireless PCs The Basic Service Set (BSS) defines the communications domain for each access point and its associated wireless clients. The BSS ID is a 48‐bit binary number based on the access point’s wireless MAC address, and is set automatically and transparently as clients associate with the access point. The BSS ID is used in frames sent between the access point and its clients to identify traffic in the service area. The BSS ID is only set by the access point, never by its clients. The clients only need to set the Service Set Identifier (SSID) that identifies the service set provided by one or more access points. The SSID can be manually configured by the clients, can be detected in an access point’s beacon, or can be obtained by querying for the identity of the nearest access point. For clients that do not need to roam, set the SSID for the wireless card to that used by the access point to which you want to connect. A wireless infrastructure can also support roaming for mobile workers. More than one access point can be configured to create an Extended Service Set (ESS), as shown in Figure 2‐3. By placing the access points so that a continuous coverage area is created, wireless users within this ESS can roam freely. All wireless network card adapters and Access Point 3000s, within a specific ESS, must be configured with the same SSID. Figure 2-3 Infrastructure Wireless LAN for Roaming File Server Desktop PC Switch Notebook with Wireless PC Card Adapter DC 5V/3 CON SOL...
Page 23: Chapter 3: Initial Configuration
Initial Configuration Overview You can manage the RoamAbout Access Point 3000 with: • Command Line Interface (CLI) that you access through a direct connection to the console port For a description of how to use the CLI, refer to Appendix A: Using the Command Line Interface. To view a list of all the CLI commands, refer to “Command Groups” on page A‐9. • Web interface that you access through Internet Explorer or another Web browser Note: You must click on the Apply button at the bottom of each Web interface page for the configuration changes on that page to take effect. • An SNMP manager, such as Enterasys Networks NetSight management applications. Refer to the RoamAbout Access Point 3000 Hardware Installation Guide for information on the ...
Page 24: Using The Cli
Username: admin Password:******** RoamAbout 3000# Set the Country Code. This restricts operation of the access point to the radio channels permitted for wireless networks in the specified country. Type country ? to display the list of countries. RoamAbout 3000#country ? WORD Country code: AL-ALBANIA, DZ-ALGERIA, AR-ARGENTINA, AM-ARMENIA, AU- AUSTRALIA, AT-AUSTRIA, AZ-AZERBAIJAN, BH-BAHRAIN, BY-BELARUS, BE-BELGIUM, BZ-BELIZE, BO-BOLVIA, BR-BRAZIL, BN-BRUNEI_DARUSSALAM, BG-BULGARIA, CA- CANADA, CL-CHILE, CN-CHINA, CO-COLOMBIA, CR-COSTA_RICA, HR-CROATIA, CY- CYPRUS, CZ-CZECH_REPUBLIC, DK-DENMARK, DO-DOMINICAN_REPUBLIC, EC-ECUADOR,...
Page 25 Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)# d. Set the IP Address. Type ip address ip‐address netmask gateway, where ip‐address is the access point’s IP address, netmask is the network mask for the network, and gateway is the default gateway router. Check with your system administrator to obtain an IP address that is compatible with your network. RoamAbout 3000(if-ethernet)#ip address ip-address netmask gateway RoamAbout 3000(if-ethernet)#end RoamAbout 3000(config)# After configuring the access point’s IP parameters, you can access the management interface from anywhere within the attached network. The command line interface can also be accessed using Telnet from any computer attached to the network. Change the default username and password: type username and specify a unique user name; type password and specify a unique password.
Page 26: Using Web Management
VLAN packets from the access point. The switch port must also be configured to accept the access point’s management VLAN ID and native VLAN IDs. Otherwise, connectivity to the access point will be lost when you enable the VLAN feature. RoamAbout 3000(config)#management-vlanid 10 RoamAbout 3000(config)#management-vlan enable Reboot system now? <y/n>:y...
Page 27 Initial Configuration Steps The Country Code page appears. To set the Country: Click the arrow in the Country pulldown menu to select the appropriate country, then click Apply at the bottom of the page. The access point prompts you to reset. b. Click OK. The Identification page appears. RoamAbout Access Point 3000 Configuration Guide 3-5...
Page 28 Initial Configuration Steps Click Administration from the menu on the left‐hand side of the page. The Administration page appears. 3-6 Initial Configuration...
Page 29 Initial Configuration Steps d. Click Reset, at the bottom of the page. The access point prompts you to confirm that you want to reboot the system. Click OK. The access point reboots and the Login window appears. Enter the username admin and the password password and click LOGIN. RoamAbout Access Point 3000 Configuration Guide 3-7...
Page 30 Initial Configuration Steps To set a static IP address: Click TCP/IP Settings from the menu on the left of the page. The TCP/IP Settings page appears. b. Click the DHCP Client: Disable radio button. An IP Address section appears on the page. 3-8 Initial Configuration...
Page 31 Initial Configuration Steps Specify IP address, Subnet Mask, Default Gateway, and Primary and Secondary DNS. d. Click Apply at the bottom of the page. Type the IP address that you specified for the access point in your browser’s address field. For example, enter http://10.2.101.22/. The Login window appears. Enter the username admin and the password password and click LOGIN. g. Click Administration from the menu on the left of the page. The Administration page appears. h. Click Reset, at the bottom of the page. The access point prompts you to confirm that you want to reboot the system. Click OK. The access point reboots and the Login window appears. Enter the username admin and the password password and click LOGIN . RoamAbout Access Point 3000 Configuration Guide 3-9...
Page 32 Initial Configuration Steps Set username and password. Click Administration from the menu on the left of the page. The Administration page appears. b. Specify a new username in the Username field. Specify a new password in the Password field. d. Specify the new password again in the Confirm Password field. Click Apply at the bottom of the page. The access point displays a Settings Saved message. Click OK. The Administration page appears. Set management VLAN: Click Filter Control from the menu on the left of the page. The Filter Control page appears. 3-10 Initial Configuration...
Page 33 Initial Configuration Steps b. Click the Management VLAN ID: field and enter the VLAN ID from which you will manage the AP. Click the Management VLAN: Enable radio button. d. Click Apply at the bottom of the page. The access point displays a dialog box indicating that the VLAN status has changed and will take effect after the next reboot. The dialog box prompts you to choose whether to reboot now or later. Click OK to reboot now. The access point reboots and the Login window appears. Enter the username and the password that you specified for this access point and click LOGIN. Go to Chapter 4 for advanced configuration. RoamAbout Access Point 3000 Configuration Guide 3-11...
Page 34 Initial Configuration Steps 3-12 Initial Configuration...
Page 35: Chapter 4: Advanced Configuration
Advanced Configuration Overview This chapter presents advanced configuration information organized according to the structure of the Web interface for easy reference. Enterasys Networks recommends that you configure a user name and password to control management access to this device as the first advanced configuration step (refer to Administration on page 4‐37). Table 4‐1 lists the configuration options and brief descriptions. Using the Web Interface You must click on the Apply button at the bottom of each Web interface page for the configuration changes on that page to take effect. Using the Command Line Interface (CLI) For a description of how to use the CLI, refer to Appendix A: Using the Command Line Interface. To view a list of all the CLI commands, refer to Command Groups on page A‐9. RoamAbout Access Point 3000 Configuration Guide 4-1...
Page 36: Advanced Configuration
Overview Table 4-1 Advanced Configuration Menu Description Page Identification Specifies the system name, location and contact. TCP / IP Settings Enables DHCP, or allows you to configures the IP address, subnet mask, gateway, and domain name servers. RADIUS Configures the RADIUS server for wireless client authentication. PPPoE Setup Configures the access point to support Point-to-Point Protocol over 4-12...
Page 37: Identification
Identification Identification Using Web Management The system information parameters for the Access Point 3000 can be left at their default settings. However, modifying these parameters can help you to more easily distinguish different devices in your network. • System Name is an alias used for the access point, enabling the device to be uniquely identified on the network. Default: RoamAbout AP; maximum length: 32 characters • System Location is a text string that describes the system location. Maximum length: 253 characters • System Contact is a text string that describes the system contact. Maximum length: 253 characters RoamAbout Access Point 3000 Configuration Guide 4-3...
Page 38: Using The Cli
Identification Using the CLI From the config mode, use the system name command to specify a new system name. Then return to the Exec mode, and use the show system command to display the changes to the system identification settings. RoamAbout 3000#configure RoamAbout 3000(config)#system name R&D RoamAbout 3000(config)#exit RoamAbout 3000#show system System Information ==================================================================== Serial Number : 034830992141 System Up time : 0 days, 5 hours, 8 minutes, 42 seconds System Name : RoamAbout AP...
Page 39: Tcp / Ip Settings
TCP / IP Settings TCP / IP Settings Configuring the Access Point 3000 with an IP address expands your ability to manage the access point. A number of access point features depend on IP addressing to operate. Note: You can use the Web browser interface to access the access point if the access point already has an IP address that is reachable through your network. By default, the Access Point 3000 will be automatically configured with IP settings from a Dynamic Host Configuration Protocol (DHCP) server. However, if you are not using a DHCP server to configure IP addressing, use the CLI to manually configure the initial IP values (refer to ...
Page 40: Using Web Management
TCP / IP Settings Using Web Management Select TCP/IP Settings from the menu. • DHCP allows you to enable or disable the option to obtain the IP settings for the access point from a DHCP (Dynamic Host Configuration Protocol) server. The IP address, subnet mask, default gateway, and Domain Name Server (DNS) address are dynamically assigned to the access point by the network DHCP server. Default: Enable Note: Enterasys Networks recommends that you reset the access point after changing the DHCP client status. • IP Address – IP Address is the IP address of the access point. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods. – Subnet Mask is the mask that identifies the host address bits used for routing to specific subnets. – Default Gateway is the IP address of the router for the access point, which is used if the requested destination address is not on the local subnet.
Page 41 TCP / IP Settings • Web Servers – HTTP Server allows the access point to be monitored or configured from a browser. – HTTP Port specifies the port to be used by the Web browser interface. – HTTPS Server allows you to enable or disable the secure HTTP server on the access point. – HTTPS Port specifies the UDP port number used for HTTPS/SSL connection to the access pointʹs Web interface. • Telnet & SSH Settings Telnet allows you to manage the access point from anywhere in the network. Telnet is not secure from hostile attacks. Therefore, it is recommended to use the Secure Shell (SSH). The SSH protocol uses generated public keys to encrypt all data transfers passing between the access point and SSH‐enabled management station clients and ensures that data traveling over the network arrives unaltered. – Telnet Server disables or enables the Telnet server. Default: Enabled. – SSH Server disables or enables the SSH server. Default: Enabled. – SSH Port Number sets the UDP port for the SSH server. Range: 1‐22, 24‐79, 81‐442, 444‐ 2312, 2314‐65535; Default: 22 Notes: SSH Port Number range may vary from range specified here; range varies based on default ports defined on access point and port usage by other applications.
Page 42: Using The Cli
Password:******** RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#ip address 192.168.1.2 255.255.255.0 192.168.1.253 RoamAbout 3000(if-ethernet)#dns primary-server 192.168.1.55 RoamAbout 3000(if-ethernet)#dns secondary-server 10.1.0.55 RoamAbout 3000(if-ethernet)#end RoamAbout 3000(config)#end...
Page 43: Radius
RADIUS RADIUS Remote Authentication Dial‐in User Service (RADIUS) is an authentication protocol that uses software running on a central server to control access to RADIUS‐aware devices on the network. An authentication server contains a database of user credentials for each user that requires access to the network. A primary RADIUS server must be specified for the Access Point 3000 to implement IEEE 802.1x network access control and Wi‐Fi Protected Access (WPA) wireless security. A secondary RADIUS server may also be specified as a backup should the primary server fail or become inaccessible If you are using MAC authentication, you must provide the following information to the RADIUS Server Network Administrator: • MAC Address of your wireless client. This becomes the username, which is case‐sensitive (lower‐case), and in the format: 00‐01‐f4‐ab‐cd‐ef. • Configure the RADIUS server to authenticate using the default password of “NOPASSWORD” for all the MAC address based user names. Notes: This guide assumes that you already configured RADIUS server(s) to support the access point. Configuration of RADIUS server software is beyond the scope of this guide, refer to the documentation provided with the RADIUS server software.
Page 44: Using Web Management
RADIUS Using Web Management Select RADIUS from the menu. Configure the following settings to use RADIUS authentication on the access point: • IP Address/Server Name specifies the IP address or host name of the RADIUS server. The IP address must be an IP Version 4 address. • Port Number is the UDP port number used by the RADIUS server for authentication. This value must match the configuration of your primary RADIUS authentication server. Range: 1024‐65535; Default: 1812 • Key is the shared text string used to encrypt messages between the access point and the RADIUS server. Be sure that the same text string is specified on the RADIUS server. Do not use blank spaces in the string. Maximum length: 255 characters • Timeout (seconds) is the number of seconds the access point waits for a reply from the RADIUS server before re‐sending a request. Range: 1‐60 seconds; Default: 5 • Retransmit attempts is the number of times the access point tries to re‐send a request to the RADIUS server before authentication fails. Range: 1‐30; Default: 3 Note: For the Timeout and Retransmit attempts fields, accept the default values unless you experience problems connecting to the RADIUS server over the network. •...
Page 45: Using The Cli
From the global configuration mode, use the radius‐server address command to specify the address of the primary RADIUS server, or the radius‐server secondary address command to specify the address of the secondary RADIUS server. (The following example configures settings for the primary RADIUS server.) Use the radius‐server or radius server secondary and key, port, port‐accounting, retransmit, timeout, and timeout‐iterim commands to configure the other RADIUS server parameters. Use the show radius command from the Exec mode to display the current settings for the primary and secondary RADIUS servers. RoamAbout 3000#configure RoamAbout 3000(config)#radius-server address 192.168.1.25 RoamAbout 3000(config)#radius-server port 181 RoamAbout 3000(config)#radius-server key green RoamAbout 3000(config)#radius-server timeout 10 RoamAbout 3000(config)#radius-server retransmit 5 RoamAbout 3000(config)#radius-server port-accounting 1813 RoamAbout 3000(config)#radius-server port-accounting enable RoamAbout 3000(config)#exit RoamAbout 3000#show radius...
Page 46: Pppoe
PPPoE PPPoE Since many Internet Service Providers (ISP) use Point‐to‐Point Protocol over Ethernet (PPPoE) to establish communications with end users, the access point includes a built‐in client for this protocol. You can configure the access point to support PPPoE as an authentication method to establish communications with end users. Using Web Management Select PPPoE Settings from the menu. • PPPoE: enables the access point to support PPPoE as an authentication method to establish communications with end users through an ISP. Default: Disable • Username: The username assigned by your service provider for the PPPoE tunnel. The range is 1 to 63 alphanumeric characters. • Password: The password assigned by your service provider for the PPPoE tunnel. The range is 1 to 63 alphanumeric characters. • Service Name: The service name assigned by your service provider for the PPPoE. The service name may be required by some service providers. The range is 1 to 63 alphanumeric characters. • IP Allocation Mode: Specifies how IP addresses for the PPPoE tunnel are configured on the RJ‐ 45 interface. The allocation mode depends on the type of service you have purchased from the ISP. If Automatically allocated is selected, DHCP is used to allocate the IP addresses for the PPPoE connection. If static addresses have been assigned to you by the ISP, you must manually enter the assigned addresses. The default setting is Automatically allocated. 4-12 Advanced Configuration...
Page 47: Using The Cli
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#ip pppoe RoamAbout 3000(if-ethernet)#pppoe ip allocation mode static RoamAbout 3000(if-ethernet)#pppoe ipcp dns RoamAbout 3000(if-ethernet)#pppoe lcp echo-interval 30 RoamAbout 3000(if-ethernet)#pppoe local ip 10.7.1.200...
Page 48: Authentication
Authentication Authentication 802.1x Supplicant allows you to enable the access point as an 802.1x authentication supplicant with the network. Using Web Management Select Authentication from the menu. • 802.1x Supplicant allows you to enable or disable the access point as an 802.1x authentication supplicant to authenticate with the network. If enabled, you must specify: • Username specifies the username that the access point uses to authenticate to the network. Range: 1 to 32 characters • Password specifies the password that the access point uses to authenticate to the network. Range: 1 to 32 characters 4-14 Advanced Configuration...
Page 49: Using The Cli
Authentication Using the CLI Use the 802.1x supplicant user command from the global configuration mode to specify the username and password that the access points uses for authentication with the network. Use the 802.1x supplicant command to enable the access point as an 802.1x supplicant. To display the current settings, use the show authentication command from the Exec mode. Use the no 8021.x supplication command from the global configuration mode to disable. RoamAbout Access Point 3000 Configuration Guide 4-15...
Page 50 Authentication RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#802.1x supplicant user User Name<1-32> : RBT3K-AND Password<1-32> :password Confirm password<1-32> :password RoamAbout 3000(config)#802.1x supplicant RoamAbout 3000(config)# RoamAbout 3000(config)#exit RoamAbout 3000#show authentication 802.11a Authentication Server Information VAP AuthMode SessionTimeout Password...
Page 51: Filter Control
Filter Control Filter Control The access point can employ VLAN ID and network traffic frame filtering to control access to network resources and increase security. Using Web Management Select Filter Control from the menu. RoamAbout Access Point 3000 Configuration Guide 4-17...
Page 52 Filter Control • Management VLAN ID specifies the management VLAN ID for the access point. The management VLAN is for managing the access point. For example, the access point allows traffic that is tagged with the specified VLAN to manage the access point via remote management, SSH, SNMP, Telnet, etc. • Management VLAN allows you to enable or disable management VLAN tagging support on the Access Point 3000. Default: Disable • Ethernet Untagged VLAN ID specifies the VLAN ID to which the AP maps untagged packets entering through the APʹs Ethernet port. Range: 1 to 4094 • IAPP (Inter Access Point Protocol) enables the protocol signaling required for wireless clients to roam between different 802.11f‐compliant access points. Select Disable to disable 802.11f signaling. Default: Enable. • IBSS Relay Control, in conjunction with radio interface and Virtual AP (VAP) IBSS settings, controls whether clients associated with an interface or VAP can establish wireless communications with clients associated with other interfaces or VAPs. Default: All VAP mode – In All VAP Mode, clients associated with any IBSS enabled radio interfaces or VAPs can establish wireless communications with each other. – In Per VAP Mode, clients associated with a specific IBSS enabled radio interface or VAP can establish wireless communications with other clients associated with the same interface or VAP. For example, clients associated with VAP1 can establish wireless communications with each other but not with clients associated with an IBSS enabled VAP2. • Wireless AP Management controls management access to the Access Point 3000 from wireless clients. Management interfaces include the Web, Telnet, or SNMP. Default: Allow – Allow permits management access from wireless clients. The default setting. – Disallow blocks management access from wireless clients. • Ethernet Type Filter controls checks on the Ethernet type of all incoming and outgoing Ethernet packets against the protocol filtering table. Default: Disable – Disable: The access point does not filter Ethernet protocol types.
Page 53: Using The Cli
CLI Commands for VLAN Support From the global configuration mode, use the management‐vlanid command to set the default Management VLAN ID for the Ethernet interface, then enable management VLAN tagging using the management‐vlan enable command (use no management‐vlan to disable). When you change the access point’s management VLAN setting, you must reboot the access point to implement the change. To view the current management VLAN settings, use the show system command. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#management-vlanid 3 RoamAbout 3000(config)#management-vlan enable Reboot system now? <y/n>: y Username: admin Password:******** RoamAbout 3000#show system System Information ====================================================================...
Page 54 Filter Control From the interface ethernet mode, use the untagged‐vlanid to specify a VLAN ID for the AP to use for untagged packets entering through the APʹs Ethernet port. Use the show interface command from the exec mode to view untagged‐vlanid status. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#untagged-vlanid 10 RoamAbout 3000(if-ethernet)#exit RoamAbout 3000#show interface Ethernet Interface Information ======================================== IP Address : 10.2.43.203...
Page 55: Cli Commands For Filtering
RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#filter wireless-ap-manage RoamAbout 3000(config)#filter ethernet-type enable RoamAbout 3000(config)#filter ethernet-type protocol CDP RoamAbout 3000(config)#exit RoamAbout 3000#show filters Protocol Filter Information =========================================================== IBSS Relay Control :All VAP Mode 802.11a VAP0 :ENABLED...
Page 56: Qos
When you configure QoS (Quality of Service) on the access point, you can select specific network traffic, prioritize it, and use congestion‐management and congestion‐avoidance techniques to provide preferential treatment. Implementing QoS in your wireless LAN makes network performance more predictable and bandwidth utilization more effective. The access point uses a weighted‐fair queuing scheme. Precedence is granted to the highest priority based on a weighted queuing scheme of all priorities, granting all priorities the ability to transmit/receive data. Eight priority classes are defined. Network managers determine actual mappings. The highest priority is seven and the lowest priority is 0. For example, if you select 5 as the priority, 5 receives higher priority than those set with 0, 1, 2, 3, or 4 and lower priority than those set with 6 and 7 as their priority. Using Web Management Select QoS from the menu. The QoS Settings and Status page appears. The QoS mode selections are displayed in the following screen. 4-22 Advanced Configuration...
Page 57: Qos Mode And Classifications
• QoS Mode drop‐down menu selections: – Source Address allows you to specify priorities based on source MAC address. Specify source MAC addresses and associated priority levels in the MAC Address table. – Destination Address allows you to specify priorities based on destination MAC address. Specify destination MAC addresses and associated priority levels in the MAC Address table. – Ethernet Type allows you to specify priorities based on Ethernet types. Specify Ethernet types and associated priority levels in the Ethernet Type table. If you are using the CLI, the Ethernet type must be specified in the format HEX 0000‐FFFF (see the ISO Designator table listed in the Filter Control Web page). – 802.1p is a specification that provides Layer 2 switches the ability to prioritize traffic (and perform dynamic multicast filtering). The prioritization specification works at the media access control (MAC) framing layer of the OSI model. To be compliant with 802.1p, Layer 2 switches must be capable of grouping incoming LAN packets into separate traffic classes. Other than selecting 802.1p, and then clicking on Apply, there is no other user intervention on the access point. Priorities are set on the switch. • SVP Status enables or disables the AP QoS to utilize Speculation Voice Priority (SVP) to give voice packets priority over data packets on the AP. Default: Disable • QoS Classifications are set in conjunction with the selected QoS mode. See Table 4‐2 for a list of QoS classifications associated with QoS modes. Table 4-2 QoS Mode and Classifications Mode Classification Source Address MAC Address. Specify priorities for up to 10 source addresses identified by MAC address.
Page 58: Using The Cli
• If you select source (SA) or destination (DA) address, you must use the qos mac‐address command to configure at least one MAC address for the qos mode to take affect. To display the QoS settings, use the show qos command from the Exec mode. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#qos mode SA RoamAbout 3000(config)#qos mac-addr 00-01-f4-32-62-ac 6 RoamAbout 3000(config)#exit RoamAbout 3000# RoamAbout 3000#show qos QoS information ====================================================== QoS Mode : Source Address Address...
Page 59 To enable SVP, from the global configuration mode, use the svp command. To disable SVP, use the no version of the command. Use the show svp command from the Exec mode to view the SVP status. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#svp RoamAbout 3000(config)# RoamAbout 3000(config)#no svp RoamAbout 3000(config)#exit RoamAbout 3000#show svp SVP: Disabled RoamAbout 3000# RoamAbout Access Point 3000 Configuration Guide 4-25...
Page 60: Cdp Settings
CDP Settings CDP Settings Cabletron Discovery Protocol (CDP) settings controls how the AP uses CDP to discover neighbors on the physical LAN to which it connects. Using Web Management Select CDP Settings from the menu. The CDP Settings page appears. Note: The Port Status overrides the Global Status. Make the same selections for both global and port status or make sure the port status settings match the behavior you want. •...
Page 61: Using The Cli
CDP Settings • Port Status: – Disable ‐ disables this AP from using CDP. – Enable ‐ enables this AP to use CDP and to send information about itself at the specified Transmit Frequency. – Auto ‐ enables this AP to use CDP and to send information about itself only when neighbors request information. Default: Auto Using the CLI From the global configuration mode, enable cdp with the cdp auto‐enable or cdp enable commands. Specify the hold time, transmit frequency and optionally an authentication code using the cdp hold‐time, cdp tx‐frequency and cdp authentication commands. To disable cdp, use the cdp disable command. Use the show cdp command from Exec mode to display cdp settings, or to view neighbor entries or cdp traffic statics. RoamAbout Access Point 3000 Configuration Guide 4-27...
Page 62 : 10.2.191.52 Neighbor MAC Address : 00-E0-63-BB-93-C2 Time Mark : 0 days, 0 hours, 0 minutes, 57 seconds Device Type : Dot1d Bridge Description : Enterasys Networks 6H303-48 Rev 05.05.01 03/14/03-- 11:10 ofc Port : 14 --------------------------------------------------------------------- Neighbor IP Address : 10.2.43.200...
Page 63: Rogue Ap Detection
Rogue AP Detection Rogue AP Detection This feature scans the airwaves and collects information about access points in the area. It lists access points found during the scan on the Neighbor AP Detection Status page after the scan is complete. If you enable the RADIUS authentication setting, this feature also identifies rogue APs. It performs a RADIUS server look up for the MAC address of each access point found. It reports access points whose MAC addresses it finds in the RADIUS server on the Neighbor AP Detection Status page. It reports access points whose MAC addresses it does not find as rogue APs in the syslog. The term "rogue AP" is used to describe an access point that is not authorized to participate on the network. It may not have the proper security settings in place. Rogue AP’s can potentially allow unauthorized users access to the network. In addition, a legitimate client may mistakenly associate to a rogue AP with invalid encryption settings and not to the AP that has been configured for it to use. This can cause a denial of service problem. RoamAbout Access Point 3000 Configuration Guide 4-29...
Page 64: Using Web Management
Rogue AP Detection Using Web Management Select Rogue AP Detection from the menu. The Rogue AP Detection selections are displayed in the following screen. • RADIUS Authentication enables the access point to discover rogue access points. Enabling RADIUS Authentication causes the access point to check the MAC address/Basic Service Set Identifier (BSSID) of each access point that it finds against a RADIUS server to determine whether the access point is allowed. With RADIUS authentication disabled, the access point can identify its neighboring access points only; it cannot identify whether the access points are allowed or are rogues. If you enable RADIUS authentication, you must configure a RADIUS server (on the RADIUS page) for this access point. • AP Scan Interval specifies the wait‐time between scans. Default: 720 minutes between scans. • AP Scan Duration specifies the amount of time to scan each frequency channel. Default: 350 milliseconds. • AP Scan Now button scans for the specified interface. • Scan All button scans for all 802.11a and 802.11b/g interfaces. 4-30 Advanced Configuration...
Page 65: Using The Cli
Rogue AP scan for all interfaces, use the scan command. Use the show rogue‐ap command from the Exec mode to view interface‐a and interface‐g settings and to view scan results for both interfaces. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#rogue-ap interface-a duration 500 RoamAbout 3000(config)#rogue-ap interface-a interduration 1000 RoamAbout 3000(config)#rogue-ap interface-a interval 750 RoamAbout 3000(config)#rogue-ap interface-a enable RoamAbout 3000(config)#rogue-ap radius enable RoamAbout 3000(config)#exit SNMP The access point includes an on‐board agent that supports SNMP versions 1, 2c, and 3. Access to ...
Page 66: Using Web Management
SNMP Using Web Management Select SNMP from the menu. 4-32 Advanced Configuration...
Page 67: Snmp Notifications
SNMP • SNMP allows you to enable or disable SNMP management access and also enables the access point to send SNMP traps (notifications). SNMP management is enabled by default. • Community Name (Read Only) defines the SNMP community access string that has read‐only access. Authorized management stations are only able to retrieve MIB objects. Default: public, maximum length: 23 characters, case sensitive • Community Name (Read/Write) defines the SNMP community access string that has read/write access. Authorized management stations are able to both retrieve and modify MIB objects. Default: private, maximum length: 23 characters, case sensitive • Trap Destination (1 to 4) enables or disables each of the four available trap destinations. If enabled, you must define the trap destination using the IP address and community name fields. • Trap Destination IP Address (1 to 4) specifies the recipient of SNMP notifications. Enter the IP address or the host name. Host Name: 1 to 20 characters • Trap Destination Community Name specifies the community string sent with the notification operation. Default: public, maximum length: 23 characters, case sensitive • Trap Configuration allows selection of specific SNMP notifications to send. Table 4‐3 lists the available notifications. Table 4-3 SNMP Notifications Notification Description sysSystemUp The access point is up and running sysSystemDown The access point is about to shutdown and reboot sysRadiusServerChanged...
Page 68 SNMP Table 4-3 SNMP Notifications (continued) localMacAddrAuthFail A client station failed authentication with the local MAC address database on the access point pppLogonFail The access point failed to log onto the PPPoE server using the configured user name and password iappStationRoamedFrom A client station roamed from another access point (identified by its IP address)
Page 69 SNMP • Group List is the list of groups for SNMP v3 users. The access point enables SNMP v3 users to be assigned to three pre‐defined groups. Other groups cannot be defined. The available groups are: – RO is a read‐only group using no authentication and no data encryption. Users in this group use no security, authentication or encryption, in SNMP messages they send to the agent. This is the same as SNMP v1 or SNMP v2c. – RWAuth is a read/write group using authentication, but no data encryption. Users in this group send SNMP messages that use an MD5 key/password for authentication, but not a DES key/password for encryption. – RWPriv is a read/write group using authentication and data encryption. Users in this group send SNMP messages that use an MD5 key/password for authentication and a DES key/password for encryption. Both the MD5 and DES key/passwords must be defined. – Security Level ‐ noAuthNoPriv uses no authentication or privacy ‐ authNoPriv requires authentication, but not privacy ‐ authPriv requires authentication and privacy – WriteView allows write access to set objects. – Action Add adds a new group; Edt allows you to edit an existing group; Del deletes the group. • SNMP Targets – Target ID is the name you enter to identify the SNMP target. Maximum: 32 characters. – IP Address is the IP address of the user. – UDP port is the UDP port of the server. – SNMP user is the name of the user. This name must match the name you entered in SNMP Users.
Page 70: Using The Cli
RoamAbout 3000(config)#snmp-server user User Name<1-32> vvvvvv:dave Group Name<1-32> :RWPriv md5 (Auth) Passphrase <8-32>:davepass1 des (Priv) Passphrase <8-32>:davepass2 RoamAbout 3000(config)#snmp-server targets mytraps 192.168.1.33 dave RoamAbout 3000(config)#snmp-server group Group Name<1-32> :RAPriv 1. NoAuthNoPriv 2. AuthNoPriv 3. AuthPriv Select the security level<1,2,3>:[1]: 3 Write right<none,write>: none...
Page 71: Administration
Administration Administration Changing the Password Management access to the Web and CLI interface on the Access Point 3000 is controlled through a single user name and password. You can also gain additional access security by disabling the com port after configuring the AP, and using control filters (refer to Filter Control on page 4‐17.) To protect access to the management interface, you should change the user name and password as soon as possible. If the user name and password are not configured, then anyone having access to the access point may be able to compromise access point and network security. Using Web Management Select Administration from the menu. RoamAbout Access Point 3000 Configuration Guide 4-37...
Page 72: Using The Cli
Confirm New Password requires you to re‐enter the password for verification. • Reset Username/Password Restore from default resets the username and/or the password back to the default settings. The default username is admin and the default password is password. Using the CLI Use the username and password commands from the CLI configuration mode. RoamAbout 3000(config)#username John RoamAbout 3000(config)#password **** RoamAbout 3000(config)#confirm password **** RoamAbout 3000(config)#exit RoamAbout 3000# Enabling Disabling Com Port Using Web Management Com Port Status radio buttons disable or enable the AP’s com port. Default: Enable Using the CLI Use the com‐port command from the Global Configuration mode. RoamAbout 3000(config)#com-port disable RoamAbout 3000(config)#com-port enable...
Page 73: Upgrading Firmware
Administration Upgrading Firmware You can upgrade the Access Point 3000 software from a local file on the management workstation, or from an FTP or TFTP server. New software may be provided periodically on the Wireless Web site (http://www.enterasys.com/products/wireless). After upgrading new software, you must reboot the Access Point 3000 to implement the new code. Until a reboot occurs, the Access Point 3000 will continue to run the software it was using before the upgrade started. Before upgrading new software, verify that the Access Point 3000 is connected to the network and has been configured with a compatible IP address and subnet mask. Bulk upgrades can be done using Enterasys Networks NetSight Inventory Manager. If you need to download from an FTP or TFTP server, perform the following additional tasks: • Obtain the IP address of the FTP or TFTP server where the access point software is stored. • Verify that the image is in the appropriate directory on the server. • If upgrading from an FTP server, be sure that you have an account configured on the server with a user name and password. • If VLANs are configured on the access point, determine the VLAN ID with which the FTP or TFTP server is associated, and then configure the management station, or the network port to which it is attached, with the same VLAN ID. If you are managing the access point from a wireless client, the VLAN ID for the wireless client must be configured on a RADIUS server. RoamAbout Access Point 3000 Configuration Guide 4-39...
Page 74: Using Web Management
Administration Using Web Management • Current version displays the version number of code. • Local downloads an operation code image file from the Web management station to the access point using HTTP. Specify the name of the code file in the New firmware file field, either: – Use the Browse button to locate the image file locally on the management station. – Enter the name of the code file on the server. The new firmware file name should not contain slashes (\ or /), the leading letter of the file name should not be a period (.), and the maximum length for file names is 32 characters for files on the access point. (Valid characters: A‐Z, a‐z, 0‐9, “.”, “‐”, “_”). – Click Start Upgrade to download file. • Remote downloads an operation code image file from a specified remote FTP or TFTP server. – Click the radio button beside FTP or TFTP server. – IP Address specifies the IP address or host name of FTP or TFTP server. – Username specifies the user ID for login on an FTP server. – Password specifies the password used for login on an FTP server. – Click Start Upgrade to download file. • Restore Factory Settings resets the configuration settings to the factory default settings (all configuration settings will be lost), and then you must reboot the system. Caution: If you restore factory defaults, all user configured information will be lost. You will have to re-enter the default user name (admin) to regain management access to this device.
Page 75: Using The Cli
Using the CLI To download software from a TFTP/FTP Server, use the copy command from the Exec mode. The copy command requires you to specify either the file type and then the server type, or the server type and then the file type. You must then specify the file name, and IP address of the TFTP server. When the download is complete, you can use the dir command to check that the new file is present in the access point file system. To run the new software, use the reset board command to reboot the access point. RoamAbout 3000# RoamAbout 3000#copy tftp file 1. Application image 2. Config file 3. Boot block image Select the type of download<1,2,3>: [1]:1 TFTP Source file name:ets-img_v2.1.2.bin TFTP Server IP:196.192.18.1 FTP Username:[admin]:...
Page 76: System Log
System Log System Log The Access Point 3000 can be configured to send event and error messages to a System Log Server. The system clock can also be synchronized with a time server, so that all the messages sent to the Syslog server are stamped with the correct time and date. The Access Point 3000 supports a logging process that can control error messages saved to memory or sent to a Syslog server. The logged messages serve as a valuable tool for isolating access point and network problems. Using Web Management Select System Log from the menu. • System Log Setup enables the logging of error messages. • Server (1, 2, 3, 4) enables the sending of log messages to a Syslog server host. – Server Name/IP is the IP address or name of a Syslog server. – Server UDP Port specifies the UDP port to use on that server. • Logging Console enables the logging of error messages to the console. • Logging Level sets the severity level for event logging. 4-42 Advanced Configuration...
Page 77: Logging Level Descriptions
System Log • Logging Facility‐Type specifies the syslog facility to use for messages, (16 to 23) local 0 to local 7. • LoggingClear button clears the event log. The system allows you to limit the messages that are logged by specifying a minimum severity level. Table 4‐4 lists the error message levels from the most severe (Alert) to least severe (Debug). The message levels that are logged include the specified minimum level up to the Alert level. Table 4-4 Logging Level Descriptions Error Level Description Emergency Immediate action needed Alerts Immediate action needed Critical Critical conditions (e.g., memory allocation, or free memory error - resource exhausted) Error Error conditions (e.g., invalid input, default used) Warning...
Page 78: Using The Cli
RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#logging on RoamAbout 3000(config)#logging level alert RoamAbout 3000(config)#logging console RoamAbout 3000(config)#logging host 1 10.1.0.3 1024 RoamAbout 3000(config)#logging facility-type 19 RoamAbout 3000(config)#exit RoamAbout 3000#show logging Logging Information ============================================...
Page 79: Configuring Sntp
System Log Configuring SNTP Simple Network Time Protocol (SNTP) allows the Access Point 3000 to set its internal clock based on periodic updates from a time server. Maintaining an accurate time on the access point enables the system log to record meaningful dates and times for event entries. The Access Point 3000 acts as an SNTP client, periodically sending time synchronization requests to specific time servers. You can configure up to two time server IP addresses. The access point will attempt to poll each server in the configured sequence. • SNTP Server configures the access point to operate as an SNTP client. When enabled, at least one time server IP address must be specified. When disabled, you manually set the date and time of the system clock. – Primary Server is the IP address of an SNTP time server that the access point attempts to poll for a time update. Default: 137.92.140.80 – Secondary Server is the IP address of a secondary SNTP time server. The access point first attempts to update the time from the primary server; if this fails it attempts an update from the secondary server. Default: 192.43.244.18 Note: If SNTP is disabled, you can manually set the date and time of the system clock. – Set Time (SNTP Server disabled) allows you to manually set the current date and time for the location of this access point.
Page 80: Using The Cli To Configure Sntp
RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#sntp-server ip 1 10.1.0.19 RoamAbout 3000(config)#sntp-server enable RoamAbout 3000(config)#sntp-server timezone +8 RoamAbout 3000(config)#sntp-server daylight-saving Enter Daylight saving from which month<1-12>: 3 and which day<1-31>: 31 Enter Daylight saving end to which month<1-12>: 10...
Page 81: Radio Interface
Radio Interface Radio Interface The IEEE 802.11a and 802.11b/g interfaces include configuration options for radio signal characteristics, Virtual APs (VAPs), and wireless security features. The configuration options for both radio interfaces are nearly identical, and are both covered in this section of the manual. The Radio Settings section includes options for the radio characteristics of the interface, and the network definition of the default radio interface and up to seven VAPs per radio interface. Radio Signal Characteristics The access point can operate in several different radio modes, IEEE 802.11a only, 802.11b only, 802.11g only, 802.11b/g only, or a mixed 802.11a/b/g mode. Also note that 802.11g is backward compatible with 802.11b. Note: The radio channel settings for the Access Point 3000 are limited by local regulations, which determine the number of channels that are available. The IEEE 802.11a interface operates within the 5 GHz band, at up to 54 Mbps in normal mode or ...
Page 82 Radio Interface Using Web Management Select Radio Settings under the type of interface (802.11a or 802.11b/g) that you want to configure. 4-48 Advanced Configuration...
Page 83 Radio Interface • Interface Status disables/enables use of this default radio interface. Default: Enable. Notes: Before enabling the radio card, you must set the country selection using the CLI. For more information, see the RoamAbout Access Point 3000 Hardware Installation and Configuration Guide. You must enable the default radio interface in order to configure VAPs on this radio interface. •...
Page 84: Vlan Id Radius Attributes
Radio Interface Table 4-5 VLAN ID RADIUS Attributes Number RADIUS Attribute Value Tunnel-Type VLAN (13) Tunnel-Medium-Type Tunnel-Private-Group-ID VLANID (1 to 4095 in hexadecimal) Note: The specific configuration of RADIUS server software is beyond the scope of this guide. Refer to the documentation provided with the RADIUS server software. •...
Page 85 Radio Interface • VLAN enables or disables VLAN tagging support on this default radio interface. If enabled, the access point will tag traffic passing from wireless clients to the wired network with the VLAN ID associated with each client on the RADIUS server. Up to 64 VLAN IDs can be mapped to specific wireless clients, allowing users to remain within the same VLAN as they move around a campus site. This feature can also be used to control access to network resources from wireless clients, thereby improving security. Default: Disable – Enable: When VLAN filtering is enabled, the access point must also have 802.1x authentication enabled and a RADIUS server configured. Wireless clients must also support 802.1x client software to be assigned to a specific VLAN. – Disable: When VLAN filtering is disabled, this default radio interface ignores the VLAN tags on any received frames. Note: If the radio interface has VLANs enabled, then VLANs are enabled on all VAPs associated with this radio interface. • Radio Channel specifies the channel number for the operating radio channel in the access point. – The 802.11a radio channel that the access point uses to communicate with wireless clients. When multiple access points are deployed in the same area, set the channel on ...
Page 86 Radio Interface • Multicast Data Rate sets the speed to support for multicast traffic. The faster the transmit speed, the shorter the coverage area at that speed. For example, an AP with an 802.11b 11 Mbit/s Radio Card can communicate with clients up to a distance of 375 feet in a semi‐open environment. However, only clients within the first 165 feet can communicate at 11 Mbit/s. Clients between 165 and 230 feet communicate at 5.5 Mbit/s. Clients between 230 and 300 feet communicate at 2 Mbit/s; and clients between 300 to 375 feet communicate at 1 Mbit/s. • Beacon Interval (20‐1000) sets the rate at which beacon signals are transmitted from the access point. The beacon signals allow wireless clients to maintain contact with the access point. They may also carry power‐management information. Default: 100 Ms • Data Beacon Rate (1‐255) sets the rate at which stations in sleep mode must wake up to receive broadcast/multicast transmissions. Known also as the Delivery Traffic Indication Map (DTIM) interval, it indicates how often the MAC layer forwards broadcast/multicast traffic, which is necessary to wake up stations that are using Power Save mode. The default value of 2 indicates that the access point will save all broadcast/multicast frames for the Basic Service Set (BSS) and forward them after every second beacon. Using smaller DTIM intervals delivers broadcast/multicast frames in a more timely manner, causing stations in Power Save mode to wake up more often and drain power faster. Using higher DTIM values reduces the power used by stations in Power Save mode, but delays the transmission of broadcast/multicast frames. Range: 1‐255 beacons; Default: 2 beacons • Fragment Length (256‐2346) specifies an alternative frame length for packets. When transmitting data via the wireless network, your wireless network automatically splits up the file or message in a number of different packets that are re‐assembled again by the communication partner. RoamAbout products use standard IEEE 802.11 compatible frame lengths, where different lengths apply for each Transmit Rate. Fragmentation will apply alternative (usually shorter) frame lengths to split and reassemble the wireless data frames. Default: 2346. • RTS Threshold (0‐2347) sets the Request to Send (RTS) threshold frame length between 0 and 2,327 bytes. You can configure the access point to initiate an RTS frame sequence always, never, or only on frames longer than a specified length. If the packet size is smaller than the preset RTS threshold size, the RTS/CTS mechanism will NOT be enabled. The access point sends request to send (RTS) frames to a particular receiving station to negotiate the sending of a data frame. After receiving an RTS, the station send a CTS (Clear to ...
Page 87 Radio Interface Virtual AP: • VAP (1‐7) enables or disables the selected virtual access point (VAP). • Description that you provide for this VAP. • Network Name (SSID) the name that you specify for the basic service set provided by this VAP. All clients that want to connect to the wired LAN through this VAP must set their SSIDs to this SSID. • Native VLAN ID is the VLAN ID for this VAP. The access point assigns this VLAN ID to all client traffic using this VAP unless you assign unique VLAN IDs to clients through the RADIUS server using RFC 3580 (Section 3.31) tunnel attributes.
Page 88: Using The Cli For The 802.11A Interface
Radio Interface Using the CLI for the 802.11a Interface From the global configuration mode, enter the interface wireless a command to access the 802.11a radio interface. Set the interface SSID using the ssid command and, if required, configure a name for the interface using the description command. Use the turbo command to enable this feature before setting the radio channel with the channel command. Set any other parameters as required. To view the current 802.11a radio settings, use the show interface wireless a command. 4-54 Advanced Configuration...
Page 89 RoamAbout 3000(if-wireless a)#speed 9 RoamAbout 3000(if-wireless a)#max-association 32 RoamAbout 3000(if-wireless a)#beacon-interval 150 RoamAbout 3000(if-wireless a)#dtim-period 5 RoamAbout 3000(if-wireless a)#fragmentation-length 512 RoamAbout 3000(if-wireless a)#rts-threshold 256 RoamAbout 3000(if-wireless a)#exit RoamAbout 3000#show interface wireless a Wireless Interface Information =========================================================== ----------------Identification----------------------------- Description : RD-AP#3 SSID : r&d...
Page 90: Using The Cli For 802.11B/G Interface
Radio Interface Using the CLI for 802.11b/g Interface From the global configuration mode, enter the interface wireless g command to access the 802.11g radio interface. Set the interface SSID using the ssid command and, if required, configure a name for the interface using the description command. You can also use the no ssid‐broadcast command to stop sending the SSID in beacon messages. Select a radio channel or set selection to Auto using the channel command. Set any other parameters as required. To view the current 802.11g radio settings, use the show interface wireless g command. 4-56 Advanced Configuration...
Page 91 RoamAbout 3000(if-wireless g)#speed 6 RoamAbout 3000(if-wireless g)#max-association 32 RoamAbout 3000(if-wireless g)#beacon-interval 150 RoamAbout 3000(if-wireless g)#dtim-period 5 RoamAbout 3000(if-wireless g)#fragmentation-length 512 RoamAbout 3000(if-wireless g)#rts-threshold 256 RoamAbout 3000(if-wireless g)#exit RoamAbout 3000#show interface wireless g Wireless Interface Information =========================================================== ----------------Identification----------------------------- Description : RD-AP#3 SSID : r&d...
Page 92: Using The Cli For The Vaps
Radio Interface Using the CLI for the VAPs From the global configuration mode, enter the interface wireless a command to access the 802.11a radio interface, or the interface wireless g command to access the 802.11g radio interface. Use the vap [1‐7] command to specify the VAP you want to configure and to enter VAP mode. Set the VAP SSID using the ssid command and, if required, configure a name for the VAP using the description command. Use the native‐vlanid command to specify the native VLANID for this VAP. Enable secure access for this VAP with the secure‐access command. Set any other parameters as required. Specify whether clients associated with this VAP can establish wireless communications with each other through the AP with the ibss‐relay command. Specify the maximum number of clients that can associate with the VAP using the max‐association command. To view VAP settings, use the show interface wireless <a|g> <vap#> command. 4-58 Advanced Configuration...
Page 93 RoamAbout 3000(if-wireless g: VAP[1])#native-vlanid 20 RoamAbout 3000(if-wireless g: VAP[1])#secure-access RoamAbout 3000(if-wireless g: VAP[1])#ibss-relay RoamAbout 3000(if-wireless g: VAP[1])#max-association 32 RoamAbout 3000(if-wireless g: VAP[1])#end RoamAbout 3000(if-wireless g:)#exit RoamAbout 3000#show interface wireless g 1 Wireless Interface Information =========================================================== ----------------Identification----------------------------- Description : RD-AP#3-1 SSID : r&d...
Page 94: Security
Security Security The Access Point 3000 is configured by default as an “open system,” which broadcasts a beacon signal including the configured SSID. Wireless clients can read the SSID from the beacon, and automatically reset their SSID to allow immediate connection to the nearest access point. To improve wireless network security, you have to implement two main functions: • Authentication: to verify that clients attempting to connect to the network are authorized users. • Traffic Encryption: to protect data passing between the access point and clients from interception and eavesdropping. The access point can implement one or a combination of the following security mechanisms: • Wired Equivalent Privacy (WEP) • AES (802.11i ready) • IEEE 802.1x • Wireless MAC address filtering • Wi‐Fi Protected Access (WPA) 4-60 Advanced Configuration...
Page 95: Security Mechanisms
Security The security mechanisms that you may employ depend upon the level of security required, the network and management resources available, and the software support provided on wireless clients. Table 4‐6 provides a summary of wireless security considerations. Table 4-6 Security Mechanisms Security Mechanism Client Support Implementation Considerations Built-in support on all 802.11a, Provides only basic security 802.11b, and 802.11g devices Requires manual key management WEP over Requires 802.1x client support Provides dynamic key rotation for improved WEP 802.1x in system or by add-in software security...
Page 96: Wired Equivalent Privacy (Wep)
Security Wired Equivalent Privacy (WEP) WEP provides a basic level of security, preventing unauthorized access to the network and encrypting data transmitted between wireless clients and the access point. WEP uses static shared keys (fixed‐length hexadecimal or alphanumeric strings) that are manually distributed to all clients that want to use the network. WEP is the security protocol initially specified in the IEEE 802.11 standard for wireless communications. For more robust wireless security, the Access Point 3000 provides Wi‐Fi Protected Access (WPA) and AES for improved data encryption and user authentication. Setting up shared keys enables the basic IEEE 802.11 Wired Equivalent Privacy (WEP) on the access point to prevent unauthorized access to the network. If you choose to use WEP shared keys instead of an open system, be sure to define at least one static WEP key for user authentication and data encryption. Also, be sure that the WEP shared keys are the same for each client in the wireless network. Using Web Management Click on Security in the menu under the type of interface (802.11a or 802.11b/g) that you want to configure. 4-62 Advanced Configuration...
Page 97 Security • Statics Key Settings specify up to four static WEP encryption keys that clients may use with either the default interface or a VAP associated with this radio – Key Type specifies the preferred method of entering WEP encryption keys on the access point and enter up to four keys: ‐ Hexadecimal: Enter keys as 10 hexadecimal digits (0 to 9 and A to F) for 64 bit keys, 26 hexadecimal digits for 128 bit keys, or 32 hexadecimal digits for 152 bit keys. ‐ Alphanumeric: Enter keys as 5 alphanumeric characters for 64 bit keys, 13 alphanumeric characters for 128 bit keys, or 16 alphanumeric characters for 152 bit keys. – Key Len specifies whether to use 64, 128 or 152 bit keys. – Key: Specify a key in the appropriate format for the type of key type and length that you selected. Hexadecimal: 64‐bit enter a 10 digit key; 128‐bit enter a 26 digit key; 152‐bit enter a 32 digit key. Alphanumeric: 64‐bit enter a 5 character key; 128‐bit enter a 13 character key; 152‐bit enter a 16 character key. – Transmit Key Select specifies the key number to use for encryption for the default interface and each of the VAPs. If the clients have all four keys configured to the same values, you can change the encryption key to any of the four settings without having to update the client keys. After completing the Static Key Settings, click default interface or any of the VAPs for which you want to specify security settings. The Security Settings page appears. RoamAbout Access Point 3000 Configuration Guide 4-63...
Page 98 Security • Authentication Type Setup sets the access point to communicate as an open system that accepts network access attempts from any client, or with clients using pre‐configured static shared keys. – Open System (the default setting): Select this option if you plan to use WPA or 802.1x as a security mechanism. If you don’t set up any other security mechanism on the access point, the network has no protection and is open to all users. – Shared Key sets the access point to use WEP shared keys. If this option is selected, you must configure at least one key on the access point and all clients. Note: To use 802.1x on wireless clients requires a network card driver and 802.1x client software that supports the EAP authentication type that you want to use. Windows XP provides native WPA support, other systems require additional software.
Page 99 Security • Data Encryption Setup enables or disables the access point to use WEP shared keys for data encryption. If this option is selected, you must configure at least one key on the access point and all clients. (Default: Disable) Note: You must enable WEP encryption in order to enable all types of encryption on the access point; however, you do not need to define WEP keys for WPA. • WPA Clients sets the specified radio interface or VAP to: – Required ‐ allow only WPA‐enabled clients to access the network; – Supported ‐ allow WPA‐enabled clients and clients only capable of supporting WEP to access the network; ...
Page 100 Security • WPA Pre‐shared Key Type specifies the WPA pre‐shared key type and the key for client authentication with this radio interface or VAP. If you use the WPA pre‐shared‐key, you must configure all wireless clients with the same key entered here to communicate with this interface or VAP. – Hexadecimal uses a key made up of a string of 64 hexadecimal numbers. – Alphanumeric uses a key in an easy‐to‐remember form of letters and numbers. The string must be from 8 to 63 characters and can include spaces. – WPA Pre‐Shared Key specifies the pre‐shared key in the appropriate format for the type of key you selected: a string of 64 hexadecimal numbers, or a string of 8 to 63 alphanumeric characters. 802.1x Authentication: Wireless clients can be authenticated for network access by checking their MAC address against the local database configured on the access point, or by using the IEEE 802.1x network access authentication protocol to look up their MAC addresses on a RADIUS server. The 802.1x protocol can also be configured to check other user credentials such as a user name and password. • 802.1x Setup. IEEE 802.1x is a standard framework for network access control that uses a central RADIUS server for user authentication. This control feature prevents unauthorized access to the network by requiring an 802.1x client application to submit user credentials for authentication. The 802.1x standard uses the Extensible Authentication Protocol (EAP) to pass user credentials (either digital certificates, user names and passwords, or other) from the client to the RADIUS server. Client authentication is then verified on the RADIUS server before the access point grants client access to the network. The 802.1x EAP packets are also used to pass dynamic unicast session keys and static broadcast keys to wireless clients. Session keys are unique to each client and are used to encrypt and correlate traffic passing between a specific client and the access point. You can also enable broadcast key rotation, so the access point provides a dynamic broadcast key and changes it at a specified interval. You can enable 802.1x as optionally supported or as required to enhance the security of the wireless network. – Disable indicates that the access point does not support 802.1x authentication for any wireless client. After successful wireless association with the access point, each client is allowed to access the network. –...
Page 101 Security When you enable 802.1x, you can also enable the broadcast and session key rotation intervals. – Broadcast Key Refresh Rate sets the interval at which the broadcast keys are refreshed for stations using 802.1x dynamic keying. (Range: 0‐1440 minutes; Default: 0 means disabled) – Session Key Refresh Rate specifies the interval at which the access point refreshes unicast session keys for associated clients. (Range: 0‐1440 minutes; Default: 0 means disabled) – 802.1x Session Timeout sets the time period after which a connected client must be re‐ authenticated. During the re‐authentication process of verifying the client’s credentials on the RADIUS server, the client remains connected to the network. Only if re‐authentication fails is network access blocked. Default: 60 minutes. • MAC Authentication configures how the access point uses MAC addresses to authorize wireless clients to access the network. This authentication method provides a basic level of authentication for wireless clients attempting to gain access to the network. A database of authorized MAC addresses can be stored locally on the Access Point 3000 or remotely on a central RADIUS server. (Default: Local MAC) – Local MAC indicates that the MAC address of the associating station is compared against the local database stored on the access point. Local MAC Authentication enables the local database to be set up. – RADIUS MAC specifies that the MAC address of the associating station is sent to a configured RADIUS server for authentication. To use a RADIUS authentication server for MAC address authentication, the access point must be configured to use a RADIUS server, see RADIUS (page 4‐9). – Disable specifies that the access point does not check an associating station’s MAC address. If you specify RADIUS MAC for this default interface or VAP, you must specify the following parameters: – MAC Authentication Password specifies the authentication password this radio interface or VAP sends to the RADIUS server to authenticate MAC addresses. – MAC Authentication Session Timeout specifies the amount of time after which you want a MAC authentication session to timeout between the AP and the RADIUS server. If you specify Local MAC for this default interface or VAP, you must specify Local MAC Authentication settings that configure the local MAC authentication database. The MAC database provides a mechanism to take certain actions based on a wireless client’s MAC ...
Page 102: Cli Commands For 802.1X Authentication
RoamAbout 3000(if-wireless a)#vap 1 RoamAbout 3000(if-wireless a: VAP[1])#802.1x supported RoamAbout 3000(if-wireless a: VAP[1])#802.1x broadcast-key- refresh-rate 5 RoamAbout 3000(if-wireless a: VAP[1])#802.1x session-key- refresh-rate 5 RoamAbout 3000(if-wireless a: VAP[1])#802.1x session-timeout 300 RoamAbout 3000(if-wireless a: VAP[1])#end RoamAbout 3000(if-wireless a)#end RoamAbout 3000# 4-68 Advanced Configuration...
Page 103 Security To display the current settings, use the show interface wireless <a|g> <vap#> command from the Exec mode. RoamAbout 3000#show interface wireless a 1 Wireless Interface Information =========================================================== ----------------Identification----------------------------- Description : RD-AP#3 SSID : r&d Turbo Mode : OFF Channel : 149 (AUTO) Status : Enable ----------------802.11 Parameters-------------------------- Transmit Power : FULL (20 dBm) Maximum Tx Data Rate...
Page 104: Cli Commands For Local Mac Authentication
RoamAbout 3000(if-wireless g)# RoamAbout 3000(if-wireless g)#mac-access entry 00-01-f4-88-b3-d6 denied This MAC address 00-01-f4-cc-99-1a filter permission status has been changed !! RoamAbout 3000(if-wireless g)# RoamAbout 3000(if-wireless g)# mac-access entry 00-01-f4-88-b3-d6 delete RoamAbout 3000(if-wireless g)#vap 4 RoamAbout 3000(if-wireless g: VAP[4])#mac-access entry 00-00-11-22-33-44 allowed...
Page 105 Security RoamAbout 3000#show authentication 802.11a Authentication Server Information VAP AuthMode SessionTimeout Password Default Local MAC ============================================================================ Default LOCAL 0 min 00000 ALLOWED LOCAL 0 min 11111 ALLOWED LOCAL 0 min 22222 ALLOWED LOCAL 2 min 24567 ALLOWED LOCAL 0 min...
Page 106: Cli Commands For Radius Mac Authentication
RoamAbout 3000(if-wireless a)#mac-authentication server remote RoamAbout 3000(if-wireless a)#mac-authentication session-timeout 300 RoamAbout 3000(if-wireless a)#mac-authentication password Uc*2Zq RoamAbout 3000(if-wireless a)#vap 6 RoamAbout 3000(if-wireless a: VAP[6])#mac-authentication server remote RoamAbout 3000(if-wireless a: VAP[6])#mac-authentication session-timeout 300 RoamAbout 3000(if-wireless a: VAP[6])#mac-authentication password Uc*3Zq RoamAbout 3000(if-wireless a: VAP[6])#exit RoamAbout 3000# To display the current settings, use the show authentication command from the Exec mode.
Page 107 Security RoamAbout 3000#show authentication 802.11a Authentication Server Information VAP AuthMode SessionTimeout Password Default Local MAC ============================================================================ Default REMOTE 300 min Uc*2Zq ALLOWED LOCAL 0 min 11111 ALLOWED LOCAL 0 min 22222 ALLOWED LOCAL 2 min 24567 ALLOWED LOCAL 0 min...
Page 108: Cli Commands For 802.1X Authentication
RoamAbout 3000(if-wireless g)#802.1x session-key-refresh-rate 5 RoamAbout 3000(if-wireless g)#802.1x session-timeout 300 RoamAbout 3000(if-wireless g)#vap 4 RoamAbout 3000(if-wireless g: VAP[4])#802.1x required RoamAbout 3000(if-wireless g: VAP[4])#802.1x broadcast-key-refresh-rate 5 RoamAbout 3000(if-wireless g: VAP[4])#802.1x session-key-refresh-rate 5 RoamAbout 3000(if-wireless g: VAP[4])#802.1x session-timeout 300 RoamAbout 3000(if-wireless g: VAP[4])#exit...
Page 109 Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless g)#authentication shared RoamAbout 3000(if-wireless g)#encryption RoamAbout 3000(if-wireless g)#multicast-cipher wep RoamAbout 3000(if-wireless g)#key 1 128 ascii 1b3d5f6h7j8L9 RoamAbout 3000(if-wireless g)#transmit-key 1 RoamAbout 3000(if-wireless g)#vap 2 RoamAbout 3000(if-wireless g: VAP[2])#authentication shared RoamAbout 3000(if-wireless g: VAP[2])#encryption...
Page 110: Using The Cli Commands For Wep Over 802.1X Security
Using the CLI Commands for WEP over 802.1x Security From the interface wireless or interface wireless: VAP configuration modes, use the authentication command to select open system authentication. Use the multicast‐cipher command to select WEP cipher type. Set 802.1x to required with 802.1x command. Disable MAC authentication with the no mac‐authentication command. To view the current 802.11g security settings, use the show interface wireless g command (not shown in example). RoamAbout 3000(config)#interface wireless g Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless g)#authentication open RoamAbout 3000(if-wireless g)#encryption 128 RoamAbout 3000(if-wireless g)#multicast-cipher wep RoamAbout 3000(if-wireless g)#802.1x required...
Page 111: Status Information
Status Information Status Information Status information is described in Table 4‐7. Table 4-7 Status Menu Description AP Status Displays configuration settings for the basic system and the wireless interface CDP Status Displays information about neighbors with which this AP exchanges Cabletron Discovery Protocol (CDP) packets and information about packets exchanged. Station Status Shows the wireless clients currently associated with the access point.
Page 112: Using Web Management To View Ap Status
Status Information Using Web Management to View AP Status Select AP Status from the menu. 4-78 Advanced Configuration...
Page 113 Status Information The AP System Configuration table displays the following basic system configuration settings: • System Up Time is the length of time the management agent had been up. • MAC Address is the physical layer address for the device. • System Name is the name assigned to this system. • System Contact is the administrator responsible for the system. • IP Address is the IP address of the management interface for this device. • IP default gateway is the IP address of the gateway router between this device and management stations that exist on other network segments. • HTTP Server displays enabled if management access via HTTP is enabled on the access point. • HTTP Server Port displays the UDP port number used for a secure HTTP connection to the access point’s Web interface. • HTTPS Server displays enabled if secure HTTP server is enabled on the access point. • HTTPS Server Port displays the TCP port used by the HTTPS interface. • Version displays the version number for the runtime code. The AP Wireless Configuration table displays the wireless interface settings listed below. • 802.1x displays if IEEE 802.1x access control for wireless clients is enabled. • SSID is the service set identifier for the wireless group. • Channel is the radio channel through which the access point communicates with wireless clients. • Encryption displays enabled or disabled. • Authentication Type displays if open system or shared key authentication is used. RoamAbout Access Point 3000 Configuration Guide 4-79...
Page 114: Using The Cli To Display Ap Status
Status Information Using the CLI to Display AP Status To view the current access point system settings, use the show system command from the Exec mode. To view the current radio interface settings, use the show interface wireless a or show interface wireless g command. RoamAbout 3000#show system ystem Information ==================================================================== Serial Number : 034830992141 System Up time : 0 days, 5 hours, 8 minutes, 42 seconds System Name : RoamAbout AP System Location...
Page 115: Using Web Management To View Cdp Status
Use the cdp enable or cdp auto‐enable commands from the general configuration mode to enable the AP to use CDP. Set CDP parameters using the cdp hold‐time, cdp tx‐frequency, and cdp authentication commands. To view the current CDP settings, use the show cdp command from the Exec mode. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#cdp auto-enable RoamAbout 3000(config)#cdp hold-time 300 RoamAbout 3000(config)#cdp authentication asdfg RoamAbout 3000(config)#cdp tx-frequency 120 RoamAbout 3000(config)#exit RoamAbout 3000#show cdp CDP Global Information ======================================== Global Status...
Page 116: Using Web Management To View Station Status
Status Information Using Web Management to View Station Status Select Station Status from the menu. The Station Status window displays the status of stations associated with the default radio interfaces and any VAPs configured for each radio interface. 4-82 Advanced Configuration...
Page 117 Status Information • Station Address is the MAC address of the wireless client. • Authenticated displays if the station has been authenticated. The two basic methods of authentication supported for 802.11 wireless networks are “open system” and “shared key.” Open‐system authentication accepts any client attempting to connect to the access point without verifying its identity. The shared‐key approach uses Wired Equivalent Privacy (WEP) to verify client identity by distributing a shared key to stations before attempting authentication. • Associated displays if the station has been successfully associated with the access point. Once authentication is completed, stations can associate with the current access point, or reassociate with a new access point. The association procedure allows the wireless system to track the location of each mobile client, and ensure that frames destined for each client are forwarded to the appropriate access point. • Forwarding Allowed displays if the station has passed 802.1x authentication, and is now allowed to forward traffic to the access point. • Key Type displays the current key type used for encryption. • Tx displays the number of packets/bytes that this station has transmitted. • Rx displays the number of packets/bytes that this station has received. RoamAbout Access Point 3000 Configuration Guide 4-83...
Page 118: Using The Cli To Display Station Status
Status Information Using the CLI to Display Station Status To view the status of clients currently associated with each of the default interfaces and any configured VAPs, use the show station command from the Exec mode. 4-84 Advanced Configuration...
Page 119 Status Information RoamAbout 3000#show station Station Table Information =================================================== 802.11a Channel : 42 if-wireless A [default] No 802.11a Stations. if-wireless A VAP [1] No 802.11a Stations. if-wireless A VAP [2] No 802.11a Stations. if-wireless A VAP [3] No 802.11a Stations.
Page 120: Using Web Management To View Neighbor Ap Detection Status
Status Information Using Web Management to View Neighbor AP Detection Status Select Neighbor AP Detection Status from the menu. Click the appropriate radio button to Sort by: BSSID, Channel, SSID, RSSI and then click Save as Default to display the 802.11 a or b/g Neighbor AP lists sorted by your selection. 4-86 Advanced Configuration...
Page 121 Status Information The Web interface displays a list of 802.11a and a list of 802.11b/g neighbors detected. Click the appropriate radio button to Sort by: BSSID, Channel, SSID, RSSI and then click Save as Default to display the 802.11a or 802.11b/g Neighbor AP lists sorted by your selection. The 802.11a or 802.11b/g Neighbor AP lists display the following information: • AP Address (BSSID) is the MAC address of the access point. • SSID identifies the name of the network associated with this access point. • Channel identifies the radio channel that the access point uses to communicate with wireless clients. • Mhz identifies the bandwidth the access point uses on that channel. • RSSI specifies a measure of the power of the signal received from the access point. • Encryption indicates whether clients associating to this access point use encryption • IBSS RoamAbout Access Point 3000 Configuration Guide 4-87...
Page 122: Using The Cli To View Neighbor Ap Detection Status
Status Information Using the CLI to View Neighbor AP Detection Status To view the neighbor AP detection results of a rogue AP scan, use the show rogue‐ap command from the Exec mode. 4-88 Advanced Configuration...
Page 123 Status Information RoamAbout 3000#show rogue-ap 802.11a Channel : Rogue AP Setting ======================================================= Rogue AP Detection : Enabled Rogue AP Authentication : Enabled Rogue AP Scan Interval : 720 minutes Rogue AP Scan Duration : 100 milliseconds Rogue AP Scan InterDuration: 1000 milliseconds 802.11a Channel : Rogue AP Status...
Page 124: Using Web Management To View Event Logs
Status Information Using Web Management to View Event Logs The Event Logs window shows the log messages generated by the access point and stored in memory. The Event Logs table displays the following information: • Log Time is the time the log message was generated. • Event Level is the logging level associated with this message. For a description of the various levels, refer to “Logging Level Descriptions” on page 4‐43. • Event Message is the content of the log message. • Error Messages. An example of a logged error message is: “Station Failed to authenticate (unsupported algorithm).” This message may be caused by any of the following conditions: – The Access point was set to “Open Authentication,” but a client sent an authentication request frame with a “Shared key.” – The Access point was set to “Shared Key Authentication,” but a client sent an authentication frame for “Open System.” – The WEP keys do not match: When the access point uses “Shared Key Authentication,” but the key used by client and access point are not the same, the frame will be decrypted incorrectly, using the wrong algorithm and sequence number. 4-90 Advanced Configuration...
Page 125: Using The Cli To View Event Logs
Status Information Using the CLI to View Event Logs To view status of clients currently associated with the access point, use the show events command from the Exec mode. RoamAbout 3000#show events Event Logs ====================================================== Jan 01 21:04:25 Information: 802.11b/g:WEP Encryption Mode set to 128-BIT Encryption Jan 01 21:04:15 Information: 802.11b/g:Authentication Mode set to SHARED KEY Jan 01 20:56:44 Information: 802.11a:Description updated to RD-AP#3...
Page 126 Status Information 4-92 Advanced Configuration...
Page 127: Appendix A: Using The Command Line Interface
Using the Command Line Interface Accessing the CLI When accessing the management interface for the Access Point 3000 over a direct connection to the console port, or via a Telnet connection, the access point can be managed by entering command keywords and parameters at the prompt. Refer to the RoamAbout Access Point 3000 Hardware Installation Guide for more information. Console Connection To access the access point through the console port, perform the following steps: At the console prompt, enter the user name and password. The default user name is “admin” and the default password is “password.” The CLI displays the “RoamAbout 3000#” prompt. Enter the necessary commands to complete your desired tasks. When finished, exit the session with the “exit” command. After connecting to the system through the console port, the login screen displays: Username: admin Password:******** RoamAbout 3000# RoamAbout Access Point 3000 Configuration Guide A-1...
Page 128: Telnet Connection
Reboot system now? <y/n>: y Username: admin Password:******** RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#ip address 10.1.0.1 255.255.255.0 10.1.0.254 RoamAbout 3000(if-ethernet)# After you configure the access point with an IP address, you can open a Telnet session by performing the following steps. From the remote host, enter the Telnet command and the IP address of the device you want to access. At the prompt, enter the user name and system password. The CLI will display the ...
Page 129: Entering Commands
Entering Commands Entering Commands This section describes how to enter the CLI commands. Keywords and Arguments A CLI command is a series of keywords and arguments. Keywords identify a command, and arguments specify configuration parameters. For example, in the command “show interfaces ethernet,” show and interfaces are keywords, and ethernet is an argument that specifies the interface type. You can enter commands as described below: • To enter a simple command, enter the command keyword. • To enter commands that require parameters, enter the required parameters after the command keyword. For example, to set a password for the administrator, enter: RoamAbout 3000(config)#username dave Minimum Abbreviation The CLI will accept a minimum number of characters that uniquely identify a command. For example, the command “configure” can be entered as con. If an entry is ambiguous, the system will prompt for further input. Command Completion If you terminate the input using the Tab key, the CLI displays the remaining characters of a partial keyword up to the point of ambiguity. For example, typing con followed by a tab displays the command up to “configure.” RoamAbout Access Point 3000 Configuration Guide A-3...
Page 130: Getting Help On Commands
Show sntp configuration station Show 802.11 station table Show SVP system Show system information version Show system version RoamAbout 3000# The command “show interface ?” will display the following information: RoamAbout 3000#show interface ? ethernet Show Ethernet interface wireless Show wireless interface <cr> RoamAbout 3000#show interface Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided. (Remember not to leave a space between the command and question mark.) For ...
Page 131: Negating The Effect Of Commands
Getting Help on Commands Negating the Effect of Commands For many configuration commands you can enter the prefix keyword “no” to cancel the effect of a command or reset the configuration to the default value. For example, the logging command will log system messages to a host server. To disable logging, specify the no logging command. This guide describes the negation effect for all applicable commands. Viewing Command History The CLI maintains a history of commands that have been entered. You can scroll back through the history of commands by pressing the up arrow key. Any command displayed in the history list can be executed again, or first modified and then executed. Using the show history command displays a longer list of recently executed commands. RoamAbout Access Point 3000 Configuration Guide A-5...
Page 132: Understanding Command Modes
Table A-1 Command Class Modes Class Mode Exec Privileged Configuration Global Interface-ethernet Interface-wireless Exec Commands When you open a new console session on the access point, the system enters Exec command mode. Only a limited number of the commands are available in this mode. You can access all other commands only from the configuration mode. To access Exec mode, open a new console session with the user name “admin” and the password “password”. The command prompt displays as “RoamAbout 3000#” for Exec mode. Username: admin Password: ******** RoamAbout 3000# Configuration Commands Configuration commands are used to modify access point settings. These commands modify the running configuration and are saved in memory. The configuration commands are organized into three different modes: • Global Configuration These commands modify the system level configuration, and include commands such as username and password. • Interface‐Ethernet Configuration These commands modify the Ethernet port configuration, and include command such as dns and ip. • Interface‐Wireless Configuration These commands modify the wireless port configuration, and include command such as ssid and authentication.
Page 133: Configuration Commands
You can use the end command to go back a level, or the exit command to go back to the Exec mode. RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)# RoamAbout 3000(if-ethernet)#end RoamAbout 3000(config)# RoamAbout 3000(config)#interface wireless a Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless a)# RoamAbout 3000(if-wireless a)#exit RoamAbout 3000# To enter the VAP sub‐mode, you must specify the “VAP” command while in either the “interface wireless a,” or “interface wireless g” configuration modes. RoamAbout 3000(config)#interface wireless a Enter Wireless configuration commands, one per line.
Page 134: Command Line Processing
Command Line Processing Command Line Processing Commands are not case sensitive. You can abbreviate commands and parameters as long as they contain enough letters to differentiate them from any other currently available commands or parameters. You can use the Tab key to complete partial commands, or enter a partial command followed by the “?” character to display a list of possible matches. Table A-2 lists the editing keystrokes you can use for command‐line processing. Table A-2 Command Line Processing Editing Keystrokes Keystroke Function Shifts cursor to start of command line. Ctrl-A Shifts cursor to the left one character. Ctrl-B Terminates a task and displays the command prompt. Ctrl-C Shifts cursor to end of command line.
Page 135: Command Groups
Command Groups Command Groups The AP 3000 commands fall into the functional command groups shown in Table A‐3. Table A-3 Command Groups Command Group Description Page General Basic commands for entering configuration mode, restarting A-10 the system, or quitting the CLI System Management Controls user name, password, system logs, browser management options, clock settings, and a variety of other A-16 system information PPPoE...
Page 136: General Commands
Shows the configuration settings for the console port Exec A-15 show line configure This command activates Global Configuration mode. You must enter this mode to modify most of the settings on the access point. You must also enter Global Configuration mode prior to enabling the context modes for Interface Configuration. See “Accessing the CLI” on page A‐1. Default Setting None Command Mode Exec Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)# Related Commands end page A‐11 exit page A‐11 A-10...
Page 137: End
Command Groups This command returns to the previous configuration mode. Default Setting None Command Mode Global Configuration, Interface Configuration Example This example shows how to return to the Configuration mode from the Interface Configuration mode: RoamAbout 3000(if-ethernet)#end RoamAbout 3000(config)# exit This command returns to the Exec mode or exits the session. Default Setting None Command Mode Example This example shows how to return to the Exec mode from the Interface Configuration mode, and then quit the CLI session: RoamAbout 3000(if-ethernet)#exit RoamAbout 3000#exit Username: RoamAbout Access Point 3000 Configuration Guide A-11...
Page 138: Ping
Syntax ping <host_name | ip_address> • host_name is the alias of the host. • ip_address is the IP address of the host. Default Setting None Command Mode Exec Command Usage • Use the ping command to see if another site on the network can be reached. • The following are some results of the ping command: ‐ Normal response ‐ The normal response occurs in one to ten seconds, depending on network traffic. ‐ Destination does not respond ‐ If the host does not respond, a “timeout” appears in ten seconds. ‐ Destination unreachable ‐ The gateway for this destination indicates that the destination is unreachable. ‐ Network or host unreachable ‐ The gateway found no corresponding entry in the route table. • Press the <Esc> key to stop the ping command. Example RoamAbout 3000#ping 10.1.0.19 192.168.1.19 is alive RoamAbout 3000# A-12...
Page 139: Reset
Command Groups reset This command resets the access point back to the factory default settings, and restarts the system. Syntax reset <board | configuration> • board reboots the system and retains your configuration settings • configuration resets the configuration settings to the factory defaults, and then reboots the system Default Setting None Command Mode Exec Command Usage When the system is restarted, it will always run the Power‐On Self‐Test. Example This example shows how to reset the system: RoamAbout 3000#reset board Reboot system now? <y/n>: y Username: RoamAbout Access Point 3000 Configuration Guide A-13...
Page 140: Show History
Command Groups show history This command shows the contents of the command history buffer. Syntax show history Default Setting None Command Mode Exec Command Usage • The history buffer size is fixed at 10 commands. • Use the up or down arrow keys to scroll through the commands in the history buffer. Example In this example, the show history command lists the contents of the command history buffer: RoamAbout 3000#show history config exit show history RoamAbout 3000# A-14...
Page 141: Show Line
Command Groups show line This command displays the console port’s configuration settings. Syntax show line Default Setting None Command Mode Exec Example The console port settings are fixed at the values shown below. RoamAbout 3000#show line Console Line Information ====================================================== databits parity : none speed : 9600 stop bits ====================================================== RoamAbout 3000# Note: The Initial Configuration section of the Access Point 3000 Hardware Installation Guide describes how to configure terminal emulation software to connect to the Access Point through the console port.
Page 142: System Management Commands
Command Groups System Management Commands The commands in Table A‐5 are used to configure the user name, password, system logs, browser management options, clock settings, and a variety of other system information. Table A-5 System Management Commands Command Function Mode Page Country Setting Sets the country code for correct radio operation Sets the access point country code Exec A-18 country Device Designation Configures information that uniquely identifies this device Customizes the command line prompt A-20...
Page 143 Command Groups Table A-5 System Management Commands (continued) Command Function Mode Page Enables Telnet access to this access A-30 ip telnet-server point. Event Logging Controls logging of error messages Controls logging of error messages A-31 logging on Adds a syslog server host IP address that A-31 logging host will receive logging messages...
Page 144: Country
Command Groups country This command configures the access point’s country code, which identifies the country of operation and sets the authorized radio channels. Note: You must reboot the Access Point for the country setting to take effect. Syntax country <country_code> country_code is a two character code that identifies the country of operation. Table A‐6 lists the codes. Table A-6 Country Codes Country Code Country Code Country Code Country Code Albania Ecuador Latvia Russia Algeria Egypt...
Page 145 Korea Qatar Republic Dominican Kuwait Romania Republic Default Setting US ‐ for units sold in the United States 99 (no country set) ‐ for units sold in other countries Command Mode Exec Command Usage The available Country Code settings can be displayed by using the country ? command. Example RoamAbout 3000#country ? Note: Once you set the country code, you cannot change it. RoamAbout Access Point 3000 Configuration Guide A-19...
Page 146: Prompt
Default Setting RoamAbout 3000 Command Mode Global Configuration Examples RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#prompt RBTR3 RBTR3(config)# RBTR3#configure Enter configuration commands, one per line. End with CTRL/Z RBTR3(config)#no prompt RoamAbout 3000(config)# A-20...
Page 147: System Contact
Default Setting Blank Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#system location Third Floor South Hall RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-21...
Page 148: System Name
Default Setting RoamAbout AP Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000#(config)#system name RoamAbout AP RoamAbout 3000(config)# username This command configures the user name for management access. Syntax username name name is the name of the user. Length: 3‐16 characters, case sensitive Default Setting admin Command Mode Global Configuration...
Page 149: Password
Default Setting password Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#password Az24K Confirm new password: Az24K RoamAbout 3000(config)# com-port Enables or disables the Access Point 3000’s com port. Syntax com-port <enable | disable> enable allows access to the AP through its com port. disable denies access to the AP through its com port. Default Setting Enable ...
Page 150: Ip Http Port
Default Setting Command Mode Global Configuration Command Usage • If you change the HTTP port number, clients attempting to connect to the HTTP server must specify the port number in the URL, in this format: http://device:port_number. • You cannot configure the HTTP and HTTPS servers to use the same port. • Configurable range restricted to 80 and 1024 through 65535. (This prevents the use of common reserved TCP port numbers below 1024.) Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#ip http port 1024 RoamAbout 3000(config)# Related Commands ip http server page A‐25 A-24...
Page 151: Ip Http Server
Default Setting Enabled Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#ip http server RoamAbout 3000(config)# Related Commands ip http port page A‐24 RoamAbout Access Point 3000 Configuration Guide A-25...
Page 152: Ip Https Port
Default Setting Command Mode Global Configuration Command Usage • If you change the HTTPS port number, clients attempting to connect to the HTTPS server must specify the port number in the URL, in this format: https://device:port_number. • You cannot configure the HTTP and HTTPS servers to use the same port. • Configurable range restricted to 443 and 1024 through 65535. (This prevents the use of common reserved TCP port numbers below 1024.) Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#ip https port 49153 RoamAbout 3000(config)# Related Commands ip https server page A‐27 A-26...
Page 153: Ip Https Server
If you enable HTTPS, you must indicate it in the URL: https://device[port_number] • When you start HTTPS, the connection is established by: – The client authenticating the server using the server’s digital certificate. – The client and server negotiating a set of security protocols to use for the connection. – The client and server generation of session keys for encrypting and decrypting data. – The client and server establishing a secure encrypted connection. A padlock icon should appear in the status bar for Internet Explorer 5.x. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#ip https server RoamAbout 3000(config)# Related Commands ip https port page A‐26 RoamAbout Access Point 3000 Configuration Guide A-27...
Page 154: Ip Ssh-Server
Note: After boot up, the SSH server requires approximately two minutes to generate host encryption keys. The SSH server is disabled while the keys are being generated. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#ip ssh-server enable RoamAbout 3000(config)# Related Commands ip ssh‐server port page A‐29 A-28...
Page 155: Ip Ssh-Server Port
<port number> port number is the UDP port number to use for SSH. Range: 1‐22, 24‐79, 81‐442, 444‐2312, 2314‐65535 Default Setting Command Mode Global Configuration Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#ip ssh-server port 24 RoamAbout 3000(config)# Related Commands ip ssh‐server page A‐28 RoamAbout Access Point 3000 Configuration Guide A-29...
Page 156: Ip Telnet-Server
Use this command to enable Telnet access to this access point. Use the no version of this command to disable Telnet access. Syntax ip telnet-server <enable> no ip telnet-server Default Setting Enable Command Mode Global Configuration Command Usage Telnet allows you to manage the access point from anywhere in the network. Telnet is not secure from hostile attacks. Therefore, it is recommended to use the Secure Shell (SSH). Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#ip telnet-server enable RoamAbout 3000(config)# Related Commands A-30...
Page 157: Logging On
Command Mode Global Configuration Command Usage The logging process controls error messages saved to memory. You can use the logging level command to control the type of error messages that are stored in memory. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#logging on RoamAbout 3000(config)# logging host This command specifies a syslog server host that will receive logging messages. Use the no form to remove syslog server host. Syntax logging host <1-4> <host_name | host_ip_address> <port #> no logging host • 1‐4 specifies an index value by which you identify each logging host. (You can specify up to ...
Page 158 Command Groups Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#logging host 1 10.1.0.3 514 RoamAbout 3000(config)# A-32...
Page 159: Logging Console
This command initiates logging of error messages to the console. Use the no form to disable logging to the console. Syntax logging console no logging console Default Setting Disabled Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#logging console RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-33...
Page 160: Logging Level
Normal but significant condition, such as cold start Informational Informational messages only Debug Debugging messages * There are only Critical, Notice, and Informational messages for the current firmware. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#logging level alert RoamAbout 3000(config)# A-34...
Page 161: Logging Facility-Type
<type> type ‐ A number that indicates the facility used by the syslog server to dispatch log messages to an appropriate service. Range: 16‐23 Default Setting Command Mode Global Configuration Command Usage The command specifies the facility type tag sent in syslog messages (refer to RFC 3164.) This type has no effect on the kind of messages reported by the access point. However, it may be used by the syslog server to sort messages or to store messages in the corresponding database. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#logging facility 19 RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-35...
Page 162: Show Logging
Command Groups show logging This command displays the logging configuration. Syntax show logging Default Setting None Command Mode Exec Example RoamAbout 3000#show logging Logging Information ============================================ Syslog State : Enabled Logging Host State : Enabled Logging Console State : Enabled Server Domain name/IP : 10.1.0.13...
Page 163: Show Events
Default Setting Command Mode Exec Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#show events Event Logs ====================================================== Jan 07 20:41:40 Information: PPPoE send PADI Jan 07 20:41:10 Information: PPPoE send PADI Jan 07 20:40:40...
Page 164: Logging Clear
Command Groups logging clear Clears the event log of all messages. Syntax logging clear Default Setting Command Mode Global Configuration Command Usage N/A. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#logging clear RoamAbout 3000(config)# Related Commands show events page A‐37 A-38...
Page 165: Sntp-Server Ip
137.92.140.80 192.43.244.18 Command Mode Global Configuration Command Usage When SNTP client mode is enabled using the sntp‐server enable command, the sntp‐server ip command specifies the time servers from which the access point polls for time updates. The access point will poll the time servers in the order specified until a response is received. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#sntp-server ip 1 10.1.0.19 RoamAbout 3000(config)# Related Commands sntp‐server enable page A‐40 show sntp page A‐43 RoamAbout Access Point 3000 Configuration Guide A-39...
Page 166: Sntp-Server Enable
Syntax sntp-server enable no sntp-server enable Default Setting Disabled Command Mode Global Configuration Command Usage The time acquired from time servers is used to record accurate dates and times for log events. Without SNTP, the access point only records the time starting from the factory default set at the last bootup (i.e., 00:14:00, January 1, 1970). Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#sntp-server enable RoamAbout 3000(config)# Related Commands sntp‐server ip page A‐39 show sntp page A‐43 A-40...
Page 167: Sntp-Server Date-Time
Default Setting 00:00:00, January 1, 1970 Command Mode Global Configuration Example This example sets the system clock to 14:37 January 18, 2004: RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#sntp-server date-time Enter Year<1970-2100>: 2004 Enter Month<1-12>: 1 Enter Day<1-31>: 18 Enter Hour<0-23>: 14 Enter Min<0-59>: 37 RoamAbout 3000(config)# Related Commands sntp‐server enable page A‐40...
Page 168: Sntp-Server Daylight-Saving
Default Setting Disabled Command Mode Global Configuration Command Usage The command sets the system clock back one hour during the specified period. Example This sets daylight savings time to be used from July 1st to September 1st. RoamAbout 3000(config)#sntp-server daylight-saving Enter Daylight saving from which month<1-12>: 6 and which day<1-31>: 1 Enter Daylight saving end to which month<1-12>: 9 and which day<1-31>: 1 RoamAbout 3000(config)# A-42...
Page 169: Sntp-Server Timezone
Command Mode Global Configuration Command Usage This command sets the local time zone relative to the Coordinated Universal Time (UTC, formerly Greenwich Mean Time or GMT), based on the earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#sntp-server timezone +8 RoamAbout 3000(config)# show sntp This command displays the current time and configuration settings for the SNTP client. Command Mode Exec Example RoamAbout 3000#show sntp SNTP Information =========================================================...
Page 170: Show System
Default Setting None Command Mode Exec Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#system name R&D RoamAbout 3000(config)#exit RoamAbout 3000#show system System Information ==================================================================== Serial Number : 034830992141 System Up time : 0 days, 5 hours, 8 minutes, 42 seconds...
Page 171: Show Version
Command Groups show version This command displays the software version for the system. Default Setting None Command Mode Exec Example RoamAbout 3000#show version Version v2.6.7 RoamAbout 3000# PPPoE Commands The commands described in this section configure PPPoE (Point‐to‐Point Protocol over Ethernet) management tunnel connection parameters for the Ethernet port. Table A-8 PPPoE Commands Command Function Mode Page Enables PPPoE on the Ethernet interface IC-E A-46 ip pppoe...
Page 172: Ip Pppoe
Default Setting Disabled Command Mode Interface Configuration (Ethernet) Command Usage The access point uses a PPPoE connection, or tunnel, only for management traffic between the access point and a remote PPPoE server (typically at an ISP). Examples of management traffic that may initiated by the access point and carried over a PPPoE tunnel are RADIUS, Syslog, or DHCP traffic. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#ip pppoe RoamAbout 3000(if-ethernet)# A-46...
Page 173: Pppoe Ip Allocation Mode
Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#pppoe ip allocation mode static RoamAbout 3000(if-ethernet)# Related Commands pppoe local ip page A‐51 pppoe remote ip page A‐52 RoamAbout Access Point 3000 Configuration Guide A-47...
Page 174: Pppoe Ipcp Dns
Default Setting Disabled Command Mode Interface Configuration (Ethernet) Command Usage DNS servers are used to translate host computer names into IP addresses. PPPoE clients can request a primary and secondary DNS server from the network connection device at the remote end of the PPPoE tunnel. This request is passed to the remote end during the IP Control Protocol (IPCP) negotiation phase during session initialization. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#pppoe ipcp dns RoamAbout 3000(if-ethernet)# A-48...
Page 175: Pppoe Lcp Echo-Interval
Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#pppoe lcp echo-interval 30 RoamAbout 3000(if-ethernet)# Related Commands pppoe lcp echo‐failure page A‐50 RoamAbout Access Point 3000 Configuration Guide A-49...
Page 176: Pppoe Lcp Echo-Failure
Command Usage Echo requests are used to verify the integrity of the link through the PPPoE tunnel. Devices at either end of the link can issue an echo‐request. Devices receiving an echo‐request must return an echo‐reply. If a link is busy with large data transfers, the echo‐reply may not be issued in a timely manner causing the link to timeout. If you experience this kind of problem, try extending the echo interval or timeout. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#pppoe lcp echo-failure 5 RoamAbout 3000(if-ethernet)# Related Commands pppoe lcp echo‐interval page A‐49 A-50...
Page 177: Pppoe Local Ip
Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#pppoe local ip 10.7.1.200 RoamAbout 3000(if-ethernet)# Related Commands pppoe ip allocation mode page A‐47 pppoe remote ip page A‐52 RoamAbout Access Point 3000 Configuration Guide A-51...
Page 178: Pppoe Remote Ip
Command Mode Interface Configuration (Ethernet) Command Usage If you set the pppoe ip allocation mode to static, you must use this command to specify the remote IP address and the pppoe local ip command to set the local IP address. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#pppoe remote ip 192.168.1.20 RoamAbout 3000(if-ethernet)# Related Commands pppoe ip allocation mode page A‐47 pppoe local ip page A‐51 A-52...
Page 179: Pppoe Username
You must enter a user name with this command, and a password with the pppoe password command. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#pppoe username mike RoamAbout 3000(if-ethernet)# Related Commands pppoe password page A‐54 RoamAbout Access Point 3000 Configuration Guide A-53...
Page 180: Pppoe Password
Interface Configuration (Ethernet) Command Usage You must enter a password with this command, and a user name with the pppoe username command. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#pppoe password 12345 Confirm password: 12345 RoamAbout 3000(if-ethernet)# Related Commands pppoe username page A‐53 A-54...
Page 181: Pppoe Service-Name
Command Usage The service name is normally optional, but may be required by some service providers. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#pppoe service-name classA RoamAbout 3000(if-ethernet)# pppoe restart This command restarts the PPPoE connection with updated parameters. Command Mode Interface Configuration (Ethernet) Command Usage This command restarts PPPoE service using the most recently configured parameters.
Page 182: Show Pppoe
Command Groups show pppoe This command shows information about the PPPoE configuration. Command Mode Privileged Exec Example RoamAbout 3000#show pppoe PPPoE Information ====================================================== State : Link up Username : mike Service Name : classA IP Allocation Mode : Static DNS Negotiation : Enabled Local IP : 10.7.1.200 Echo Interval...
Page 183: Snmp Commands
Command Groups SNMP Commands The access point includes an on‐board agent that supports Simple Network Management Protocol (SNMP) versions 1, 2c, and 3. Access to the on‐board agent using SNMP v1 and v2c is controlled by community strings. To communicate with the access point, a management station must first submit a valid community string for authentication. Access to the access point using SNMP v3 provides additional security features that cover message integrity, authentication, and encryption; as well as controlling notifications that are sent to specified user targets. Table A‐9 lists the SNMP commands to control access to this access point from management stations using (SNMP), as well as the hosts that will receive trap messages. Table A-9 SNMP Commands Command Function Mode Page Sets up the community access string to A-58 snmp-server community permit access to SNMP commands Sets the system contact string A-59 snmp-server contact Enables SNMP service and traps...
Page 184: Snmp-Server Community
• string ‐ Community string that acts like a password and permits access to the SNMP protocol. Maximum length: 23 characters, case sensitive • ro ‐ Specifies read‐only access. Authorized management stations are only able to retrieve MIB objects. • rw ‐ Specifies read/write access. Authorized management stations are able to both retrieve and modify MIB objects. Default Setting • public ‐ Read‐only access. • private ‐ Read/write access. Command Mode Global Configuration Command Usage If you enter a community string without specifying ro or rw option, the string defaults to read only. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server community alpha rw RoamAbout 3000(config)# A-58...
Page 185: Snmp-Server Contact
255 characters) Default Setting Contact Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server contact Steve RoamAbout 3000(config)# Related Commands snmp‐server location page A‐62 RoamAbout Access Point 3000 Configuration Guide A-59...
Page 186: Snmp-Server Enable Server
Default Setting Enabled Command Mode Global Configuration Command Usage • This command enables both authentication failure notifications and link‐up‐down notifications. • The snmp‐server host command specifies the host device that will receive SNMP notifications. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server enable server RoamAbout 3000(config)# Related Commands snmp‐server host page A‐61 A-60...
Page 187: Snmp-Server Host
Default Setting Host Address: None Community String: public Command Mode Global Configuration Command Usage The snmp‐server host command is used in conjunction with the snmp‐server enable server command to enable SNMP notifications. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server host 1 10.1.19.23 WWing RoamAbout 3000(config)# Related Commands snmp‐server enable server page A‐60 RoamAbout Access Point 3000 Configuration Guide A-61...
Page 188: Snmp-Server Location
This command sets the system location string. Use the no form to remove the location string. Syntax snmp-server location text no snmp-server location text is the string that describes the system location. (Maximum length: 255 characters) Default Setting None Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server location WW-19 RoamAbout 3000(config)# Related Commands snmp‐server contact page A‐59 A-62...
Page 189: Show Snmp
Command Groups show snmp This command displays the SNMP configuration settings. Syntax show snmp Default Setting None Command Mode Exec Example RoamAbout 3000#show snmp SNMP Information ============================================== Service State : Enable Community (ro) : ***** Community (rw) : ***** EngineId :80:00:07:e5:80:00:00:31:d2:00:00:00:16 EngineBoots:17 Trap Destinations: 10.1.19.23, Community: *****, State: Enabled 0.0.0.0, Community: *****, State: Disabled...
Page 190: Snmp-Server Trap
Command Groups snmp-server trap This command enables the access point to send specific SNMP traps (i.e., notifications). Use the no form to disable specific trap messages. Syntax snmp-server trap <trap> no snmp-server trap <trap> trap is one of the SNMP trap messages listed in Table A‐10: Table A-10 SNMP Trap Messages Message Description dot11InterfaceAFail The 802.11a interface failed dot11InterfaceGFail The 802.11g interface failed dot11StationAssociation A client station successfully associated with the access point dot11StationAuthentication A client station was successfully authenticated A client station was successfully re-associated with the...
Page 191 The access point is up and running. Default Setting All traps enabled Command Mode Global Configuration Command Usage This command is used in conjunction with the snmp‐server host and snmp‐server enable server commands to enable SNMP notifications. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server trap dot11StationAssociation RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-65...
Page 192: Snmp-Server Engine-Id
This command is used for SNMP v3. It is used to uniquely identify the access point among all access points in the network. Use the no form to delete the engine ID. Syntax snmp-server engine-id <engine-id> no snmp-server engine-id engine‐id ‐ Enter the engine‐id in hexadecimal (5 ‐32 characters). Default Setting Enabled Command Mode Global Configuration Command Usage • This command is used in conjunction with the snmp‐server user command. • Entering this command invalidates all engine IDs that have been previously configured. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server engine-id 1a:2b:3c:4d:00:ff RoamAbout 3000(config)# A-66...
Page 193: Snmp-Server User
Command Groups snmp-server user This command configures the SNMP v3 users that are allowed to manage the access point. Use the no form to delete an SNMP v3 user. Syntax snmp-server user no snmp-server user <user-name> user‐name is the user‐defined string for the SNMP user. (32 characters maximum) Default Setting None Command Mode Global Configuration Command Usage • Up to ten SNMPv3 users can be configured on the access point. • The SNMP engine ID is used to compute the authentication/privacy digests from the pass phrase. You should therefore configure the engine ID with the snmp‐server engine‐id command before using this configuration command. • The access point enables SNMP v3 users to be assigned to three pre‐defined groups. Other groups cannot be defined. The available groups are: – RO ‐ A read‐only group using no authentication and no data encryption. Users in this group use no security, either authentication or encryption, in SNMP messages they send to the agent. This is the same as SNMP v1 or SNMP v2c. – RWAuth ‐ A read/write group using authentication, but no data encryption. Users in this group send SNMP messages that use an MD5 key/password for authentication, but not a DES key/password for encryption. – RWPriv ‐ A read/write group using authentication and data encryption. Users in this ...
Page 194 – Group Name is the name of the SNMP group to which the user is assigned (32 characters maximum). There are three pre‐defined groups: RO, RWAuth, or RWPriv. – Authtype is the authentication type used for user authentication: “md5” or “none.” – Passphrase is the user password required when authentication or data encryption is used (8 – 32 characters). – Privacy is the encryption type used for SNMP data encryption: “des” or “none.” Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server user User Name<1-32> :dave Group Name<1-32> :RWPriv md5(Auth) Passphrase<8-32>:davepass1 des(Priv) Passphrase<8-32>:davepass2 RoamAbout 3000(config)# A-68...
Page 195: Snmp-Server Targets
• port‐number is the UDP port that is used on the receiving management station for notifications. Default Setting None Command Mode Global Configuration Command Usage The SNMPv3 user name that is specified in the target must first be configured using the snmp-server user command. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server targets mytraps 192.168.1.33 dave RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-69...
Page 196: Snmp-Server Filter
• filter‐id is the user‐defined name that identifies this filter. Maximum length: 32 characters • filter‐type specifies whether this filter includes or excludes messages from the specified subtree‐oid. Options: include or exclude. Include means that notifications that are part of the subtree will be filtered out. Exclude means that notifications that are part of the subtree will be sent. • subtree‐oid is a valid SNMP object identifier (OID) whose messages you want to include in this filter or exclude from this filter. The string must be preceded with a period (.). For example, .1.3.6.1. Default Setting None Command Mode Global Configuration Example RoamAbout 3000#config Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server filter 1 include .1.2.840.114222 RoamAbout 3000(config)# Related Commands snmp‐server filter‐assignments page A‐71 A-70...
Page 197: Snmp-Server Filter-Assignments
• target‐id specifies the name of a user‐defined notification target to associate with a filter. Use show snmp target to view a list of notification targets defined for this access point. • filter‐id is the user‐defined name that identifies the filter to associate with this notification target. Use show snmp filter to view a list of filters defined for this access point. Default Setting None Command Mode Global Configuration Example RoamAbout 3000#config Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server filter-assignments 10 1 RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-71...
Page 198: Snmp-Server Group
Command Mode Global Configuration Command Usage Users assigned to the snmp‐server group must have the same privileges. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#snmp-server group Group Name<1-32> :RAPriv 1. NoAuthNoPriv 2. AuthNoPriv 3. AuthPriv Select the security level<1,2,3>:[1]: 3 Write right<none,write>: none RoamAbout 3000(config)#...
Page 199: Show Snmp Groups
Users must be assigned to groups that have the same security levels. If a user who has “AuthPriv” security (uses authentication and encryption) is assigned to a read‐only (RO) group, the user will not be able to access the database. An AuthPriv user must be assigned to the RWPriv group with the AuthPriv security level. Use the snmp‐server engine‐id command to define the SNMP v3 engine before assigning users to groups. Use the snmp‐server user command to assign users to one of the three groups and set the appropriate authentication and encryption types to be used. To view the current SNMP v3 engine ID, use the show snmp command. To view SNMP users and group settings, use the show snmp users or show snmp group‐assignments commands. Command Mode Exec Example RoamAbout 3000#show snmp groups GroupName SecurityModel :USM SecurityLevel :NoAuthNoPriv GroupName :RWAuth SecurityModel :USM SecurityLevel :AuthNoPriv GroupName :RWPriv SecurityModel :USM SecurityLevel :AuthPriv RoamAbout 3000# RoamAbout Access Point 3000 Configuration Guide A-73...
Page 200: Show Snmp Users
Command Groups show snmp users This command displays the SNMP v3 users and settings. Command Mode Exec Example RoamAbout 3000#show snmp users ============================================= UserName :dave GroupName :RWPriv AuthType :MD5 Passphrase:**************** PrivType :DES Passphrase:**************** ============================================= UserName :steve GroupName ============================================= UserName :john GroupName :RWAuth AuthType :MD5 Passphrase:**************** ============================================= RoamAbout 3000# show snmp group-assignments This command displays the SNMP v3 user group assignments.
Page 201: Show Snmp Target
Command Groups show snmp target This command displays the SNMP v3 notification target settings. Command Mode Exec Example RoamAbout 3000#show snmp target Host ID : dave User : dave IP Address : 192.168.1.10 UDP Port : 162 ============================= Host ID : steve User : steve IP Address : 192.168.1.12...
Page 202: Show Snmp Filter-Assignments
Command Groups show snmp filter-assignments This command displays the targets for which SNMP filters control notifications to send. Command Mode Exec Example RoamAbout 3000#show snmp filter-assignments TargetID FilterID RoamAbout 3000# Flash/File Commands The commands listed in Table A‐11 are used to manage the system code or configuration files. Table A-11 Flash/File Commands Command Function Mode Page Specifies the file or image used to start up the system...
Page 203: Bootfile
<filename> filename is the name of the image file. Default Setting None Command Mode Exec Command Usage • The file name should not contain slashes (\ or /), the leading letter of the file name should not be a period (.), and the maximum length for file names is 32 characters. (Valid characters: A‐Z, a‐z, 0‐9, “.”, “‐”, “_”) • If the file contains an error, it cannot be set as the default file. Example RoamAbout 3000#bootfile ets-img.bin RoamAbout 3000# copy This command copies a boot file, code image, diagnostic‐configuration, or configuration file from an FTP/TFTP server to the access point’s flash memory, or copies a configuration file or diagnostic configuration from the the access point’s flash memory to an FTP/TFTP server. When you save the configuration settings to a file on a FTP/TFTP server, that file can later be downloaded to the access point to restore system operation. The success of the file transfer depends on the accessibility of the FTP/TFTP server and the quality of the network connection. Syntax copy <ftp | tftp> file copy config <ftp | tftp> • tftp is the keyword that allows you to copy to/from a TFTP server.
Page 204 • Only a configuration file can be uploaded to an FTP/TFTP server, but every type of file can be downloaded to the access point. • The destination file name should not contain slashes (\ or /), the leading letter of the file name should not be a period (.), and the maximum length for file names on the FTP/TFTP server is 255 characters or 32 characters for files on the access point. (Valid characters: A‐Z, a‐z, 0‐9, “.”, “‐”, “_”) • Due to the size limit of the flash memory, the access point only supports two operation code files. Examples The following examples show how to upload and download the configuration settings to a file on the TFTP server: RoamAbout 3000#copy config tftp 1. syscfg 2. cfg_diag Select the type of download<1,2>: [1]:1 TFTP Destination file name:ets_310.cfg TFTP Server IP:196.192.18.1 FTP Username:[admin]: FTP Password:[password]: RoamAbout 3000# The following example shows how to download a configuration file: RoamAbout 3000#copy ftp file 1.
Page 205: Delete
Example This example shows how to delete the test.cfg configuration file from flash memory. RoamAbout 3000#delete test.cfg Are you sure you wish to delete this file? <y/n>:y RoamAbout 3000# Related Commands bootfile page A‐77 dir page A‐80...
Page 206: Dir
Description File Name The name of the file. Type (2) Operation Code and (5) Configuration file File Size The length of the file in bytes. Example The following example shows how to display all file information: RoamAbout 3000#dir File Name Type File Size -------------------------- ---- ----------- dflt-img.bin 1107688 ets-img.bin...
Page 207: Radius Client Commands
Command Groups RADIUS Client Commands Remote Authentication Dial‐in User Service (RADIUS) is a logon authentication protocol that uses software running on a central server to control access for RADIUS‐aware devices to the network. An authentication server contains a database of credentials, such as users names and passwords, for each wireless client that requires access to the access point. RADIUS client commands are listed in Table A‐12. Table A-12 RADIUS Client Commands Command Function Mode Page Specifies the RADIUS server A-82 radius-server address Sets the RADIUS encryption key A-82 radius-server key Sets the RADIUS server network port A-83 radius-server port Enables or disables the RADIUS server port...
Page 208: Radius-Server Address
• secondary ‐ Secondary server. • host_ip_address ‐ IP address of server. • host_name ‐ Host name of server. Range: 1‐20 characters Default Setting None Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#radius-server address 192.168.1.25 RoamAbout 3000(config)# radius-server key This command sets the RADIUS encryption key. Syntax radius-server [secondary] key <key_string> • secondary is the secondary server. • key_string is the encryption key used to authenticate logon access for client. Do not use blank spaces in the string. Maximum length: 20 characters Default Setting...
Page 209: Radius-Server Port
Syntax radius-server [secondary] port <port_number> • secondary is the secondary server. • port_number is the RADIUS server UDP port used for authentication messages. Range: 1024‐ 65535 Default Setting 1812 Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#radius-server port 1024 RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-83...
Page 210: Radius-Server Port-Accounting
• <enable | disable> enables or disables the use of the accounting port Default Setting Port number: 1813 Disable Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#radius-server port-accounting 1813 RoamAbout 3000(config)#radius-server port-accounting enable RoamAbout 3000(config)# radius-server retransmit This command sets the number of retries. Syntax radius-server [secondary] retransmit number_of_retries • secondary is the secondary server. • number_of_retries is the number of times the access point will try to authenticate logon ...
Page 211: Radius-Server Timeout
[secondary] timeout number_of_seconds • secondary is the secondary server. • number_of_seconds is the number of seconds the access point waits for a reply before re‐ sending a request. Range: 1‐60 Default Setting Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#radius-server timeout 10 RoamAbout 3000(config)# radius-server timeout-interim This command sets the interval to send accounting updates from the access point to the server for this session. This value can be overridden by the RADIUS server. Syntax radius-server timeout [secondary] number_of_seconds • secondary is the secondary server. • number_of_seconds is the number of seconds the access point waits for a reply before re‐ sending a request. Range: 60 seconds (one minute) to 86400 seconds (one day) Default Setting 3600 seconds (one hour).
Page 212: Radius-Server Secondary
This command specifies the configuration for the secondary RADIUS server. Syntax radius-server secondary [address] [key] [port] [port-accounting] [retransmit] [timeout] [timeout-interim] Use the descriptions of the radius‐server commands to set these parameters for the secondary radius‐server. Default Setting See radius‐server address, radius‐server key, radius‐server port, radius‐server port‐accounting, radius‐ server retransmit, radius‐server timeout, radius‐server timeout‐interim. Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#radius-server secondary address 192.168.1.25 RoamAbout 3000(config)# A-86...
Page 213: Show Radius
Command Groups show radius This command displays the current settings for the RADIUS server. Default Setting None Command Mode Exec Example RoamAbout 3000#show radius Radius Server Information ======================================== : 192.168.1.25 Port : 1812 : ***** Retransmit Timeout : 10 Accounting Port : 0 InterimUpdate : 3600 ======================================== Radius Secondary Server Information ======================================== : 0.0.0.0...
Page 214: X Port Authentication Commands
Command Groups 802.1x Port Authentication Commands The access point supports IEEE 802.1x access control for wireless clients. This control feature prevents unauthorized access to the network by requiring a 802.1x client application to submit user credentials for authentication. Client authentication is then verified via by a RADIUS server using EAP (Extensible Authentication Protocol) before the access point grants client access to the Table A-13 network. The commands are listed in Table A-13 802.1x Access Control Commands Command Function Mode Page Configures 802.1x as disabled, IC-W A-89 802.1x supported, or required IC-W: VAP Sets the interval at which the IC-W A-91 802.1x broadcast-key-refresh-rate...
Page 215 Command Groups 802.1x This command configures 802.1x as optionally supported or as required for wireless clients. Use the no form to disable 802.1x support. Syntax 802.1x <supported | required> no 802.1x • supported ‐ Authenticates clients that initiate the 802.1x authentication process. • required ‐ Requires 802.1x authentication for all clients. Default Setting Disabled Command Mode Interface Configuration (Wireless) Interface Configuration (Wireless): VAP Command Usage • Configures 802.1x for the default interface and up to seven VAPs per radio interface. • When 802.1x is disabled, the access point does not support 802.1x authentication for any station. After successful 802.11 association, each client is allowed to access the network. • When 802.1x is supported, the access point supports 802.1x authentication only for clients initiating the 802.1x authentication process (i.e., the access point does NOT initiate 802.1x authentication). For stations initiating 802.1x, only those stations successfully authenticated are allowed to access the network. For those stations not initiating 802.1x, access to the network is allowed after successful 802.11 association. • When 802.1x is required, the access point enforces 802.1x authentication for all 802.11 associated stations. If 802.1x authentication is not initiated by the station, the access point will initiate authentication. Only those stations successfully authenticated with 802.1x are allowed to access the network. • 802.1x does not apply to the 10/100Base‐TX port. RoamAbout Access Point 3000 Configuration Guide A-89...
Page 216 Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless a)#802.1x supported RoamAbout 3000(if-wireless a)#vap 1 RoamAbout 3000(if-wireless a: VAP[1])#802.1x supported RoamAbout 3000(if-wireless a: VAP[1])#exit RoamAbout 3000# Related Commands show interface wireless page A‐151 802.1x broadcast‐key‐refresh‐rate page A‐91...
Page 217: 802.1X Broadcast-Key-Refresh-Rate
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless a)#802.1x broadcast-key-refresh-rate 5 RoamAbout 3000(if-wireless a)#vap 1 RoamAbout 3000(if-wireless a: VAP[1])#802.1x broadcast-key-refresh-rate 5 RoamAbout 3000(if-wireless a: VAP[1])#exit RoamAbout 3000# Related Commands show interface wireless page A‐151 802.1x page A‐89...
Page 218: 802.1X Session-Key-Refresh-Rate
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless a)#802.1x session-key-refresh-rate 5 RoamAbout 3000(if-wireless a)#vap 1 RoamAbout 3000(if-wireless a: VAP[1])#802.1x session-key-refresh-rate 5 RoamAbout 3000(if-wireless a: VAP[1])#exit RoamAbout 3000# Related Commands show interface wireless page A‐151 802.1x page A‐89...
Page 219: 802.1X Session-Timeout
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless a)#802.1x session-timeout 300 RoamAbout 3000(if-wireless a)#vap 2 RoamAbout 3000(if-wireless a: VAP[2])#802.1x session-timeout 300 RoamAbout 3000(if-wireless a: VAP[2])# RoamAbout 3000(if-wireless a: VAP[2])#exit RoamAbout 3000# Related Commands show interface wireless page A‐151...
Page 220: 802.1X Supplicant
802.1x supplicant. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#802.1x supplicant user User Name<1-32> : RBT3K-AND Password<1-32> :password Confirm password<1-32> :password RoamAbout 3000(config)#802.1x supplicant...
Page 221: Mac-Access Permission
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless g)#mac-access permission denied RoamAbout 3000(if-wireless g)#vap 3 RoamAbout 3000(if-wireless g: VAP[3])#mac-access permission denied RoamAbout 3000(if-wireless g: VAP[3])#end RoamAbout 3000(if-wireless g)# Related Commands mac‐access entry page A‐96 show authentication page A‐100...
Page 222: Mac-Access Entry
RoamAbout 3000(if-wireless g)#mac-access entry 00-01-f4-cc-99-1a allowed RoamAbout 3000(if-wireless g)#mac-access entry 00-01-f4-cc-99-1a denied This MAC address 00-01-f4-cc-99-1a filter permission status has been changed !! RoamAbout 3000(if-wireless g)# mac-access entry 00-01-f4-cc-99-1a delete RoamAbout 3000(if-wireless g)#vap 4 RoamAbout 3000(if-wireless g: VAP[4])#mac-access entry 00-01-ff-cc-99 allowed...
Page 223 Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless g)#mac-authentication server remote RoamAbout 3000(if-wireless g)#vap 5 RoamAbout 3000(if-wireless g: VAP[5])#mac-authentication server remote RoamAbout 3000(if-wireless g: VAP[5])#end RoamAbout 3000(if-wireless g)# Related Commands mac‐access entry page A‐96 mac‐access permission page A‐95...
Page 224: Mac-Authentication Server
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g Enter Wireless configuration commands, one per line. RoamAbout 3000((if-wireless g)#mac-authentication session-timeout 30 RoamAbout 3000(if-wireless g)#vap 3 RoamAbout 3000(if-wireless g: VAP[3])#mac-authentication session-timeout 60 RoamAbout 3000(if-wireless g: VAP[3])#end RoamAbout 3000(if-wireless g)# Related Commands mac‐authentication server page A‐97...
Page 225: Mac-Authentication Password
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless a)#mac-authentication password 73V3n RoamAbout 3000(if-wireless a)#vap 6 RoamAbout 3000(if-wireless a: VAP[6])#mac-authentication password 8i9H7 RoamAbout 3000(if-wireless a: VAP[6])#end RoamAbout 3000(if-wireless a)# Related Commands mac‐authentication server page A‐97...
Page 226: Show Authentication
Command Groups show authentication This command shows all 802.1x authentication settings, as well as the address filter table. Syntax show authentication Command Mode Exec Example RoamAbout 3000#show authentication 802.11a Authentication Server Information VAP AuthMode SessionTimeout Password Default Local MAC ============================================================================ Default LOCAL 0 min 00000 ALLOWED LOCAL 0 min 11111 ALLOWED LOCAL 0 min...
Page 227: Filtering Commands
Command Groups Filtering Commands The commands listed in Table A‐14 are used to filter communications between wireless clients, control access to the management interface from wireless clients, and filter traffic using specific Ethernet protocol types. Table A-14 Filtering Commands Command Function Mode Page Changes ibss-relay control mode to A-102 filter ibss-relay either All VAP or Per VAP Prevents wireless clients from A-103 filter wireless-ap-manage accessing the management interface Checks the Ethernet type for all A-103 filter ethernet-type enable...
Page 228: Filter Ibss-Relay
Default Setting All VAP Command Mode Global Configuration Command Usage Set to the default mode, All VAP, clients associated with any IBSS enabled radio interfaces and VAPs can establish wireless communications with each other through the AP. Set to Per VAP mode, clients associated with a specific IBSS enabled radio interface or VAP can establish wireless communications through the AP only with other clients associated with that radio interface or VAP. This command can disable wireless‐to‐wireless communications between clients communicating through the access point. However, it does not affect communications between wireless clients and the wired network. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#filter ibss-relay RoamAbout 3000(config)# Related Commands ibss‐relay A-102...
Page 229: Filter Wireless-Ap-Manage
Default Setting Disabled Command Mode Global Configuration Command Usage This command is used in conjunction with the filter ethernet‐type protocol command to determine which Ethernet protocol types are to be filtered. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#filter ethernet-type enable RoamAbout 3000(config)# Related Commands filter ethernet‐type protocol page A‐104 RoamAbout Access Point 3000 Configuration Guide A-103...
Page 230: Filter Ethernet-Type Protocol
<protocol> protocol is the Ethernet protocol type. (Options: ARP, RARP, Berkeley‐Trailer‐Negotiation, LAN‐Test, X25‐Level‐3, Banyan, CDP, DEC XNS, DEC‐MOP‐Dump‐Load, DEC‐MOP, DEC‐LAT, Ethertalk, Appletalk‐ARP, Novell‐IPX(old), Novell‐IPX(new), EAPOL, Telxon‐TXP, Aironet‐DDP, Enet‐Config‐Test) Default Setting None Command Mode Global Configuration Command Usage Use the filter ethernet‐type enable command to enable filtering for Ethernet types specified in the filtering table, or the no filter ethernet‐type enable command to disable all filtering based on the filtering table. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#filter ethernet-type protocol ARP RoamAbout 3000(config)# Related Commands filter ethernet‐type enable page A‐103 A-104...
Page 231: Show Filters
Command Groups show filters This command shows the filter options and protocol entries in the filter table. Syntax show filters Command Mode Exec Example RoamAbout 3000#show filters Protocol Filter Information ========================================================== IBSS Relay Control :All VAP Mode 802.11a VAP0 :DISABLED 802.11b/g VAP0 :ENABLED VAP1 :ENABLED VAP1 :ENABLED VAP2 :ENABLED VAP2 :ENABLED VAP3 :ENABLED...
Page 232: Interface Commands
Command Groups Interface Commands The commands described in Table A‐15 are used to configure connection parameters for the Ethernet port and wireless interface. Table A-15 Interface Commands (Ethernet and Wireless) Command Function Mode Page General Interface Enters specified interface configuration A-109 interface mode Ethernet Interface Specifies an authentication key for CDP IC-E A-110 cdp authentication packets Set CDP in auto-enable mode A-111 cdp auto-enable...
Page 233 Command Groups Table A-15 Interface Commands (Ethernet and Wireless) (continued) Command Function Mode Page Configures the service set identifier IC-W A-129 ssid IC-W: VAP Configures the rate at which beacon IC-W A-130 beacon-interval signals are transmitted from the access point Configures the rate at which stations in IC-W A-131...
Page 234 Command Groups Table A-15 Interface Commands (Ethernet and Wireless) (continued) Command Function Mode Page Specifies dynamic keys or a pre-shared IC-W A-147 wpa-mode IC-W: VAP Defines a WPA preshared-key value IC-W A-148 wpa-preshared-key IC-W: VAP Enters Virtual Access Point (VAP) IC-W A-149 configuration mode for the specified VAP...
Page 235: Interface
Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)# To specify the 802.11a radio interface, enter the following command: RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless a)# RoamAbout Access Point 3000 Configuration Guide A-109...
Page 236: Cdp Authentication
This command specifies an authentication key to use for Cabletron Discovery Protocol (CDP) packets. Use the no form to remove an authentication key. Syntax cdp authentication <authentication code> no cdp-authentication-code authentication code a character string up to 16 bytes to use as an authentication key for CDP packets. Default Setting None Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#cdp authentication asdfg RoamAbout 3000(config)# Related Commands cdp auto‐enable page A‐111 cdp enable page A‐113 A-110...
Page 237: Cdp Auto-Enable
Syntax cdp auto-enable Default Setting Auto Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#cdp auto-enable RoamAbout 3000(config)# Related Commands cdp authentication page A‐110 cdp disable page A‐112 cdp hold‐time page A‐114 show cdp page A‐116 RoamAbout Access Point 3000 Configuration Guide A-111...
Page 238: Cdp Disable
Command Groups cdp disable This command disables Cabletron Discovery Protocol (CDP) on this AP. Syntax cdp disable Default Setting Auto Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#cdp disable RoamAbout 3000(config)# Related Commands cdp auto‐enable page A‐111 cdp enable page A‐113 show cdp page A‐116 A-112...
Page 239: Cdp Enable
Default Setting Auto Command Mode Global Configuration Command Usage If you set CDP to enable mode, specify a transmit frequency. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#cdp enable RoamAbout 3000(config)# Related Commands cdp authentication page A‐110 cdp disable page A‐112 cdp hold‐time page A‐114 cdp tx‐frequency page A‐115 show cdp page A‐116 RoamAbout Access Point 3000 Configuration Guide A-113...
Page 240: Cdp Hold-Time
This command specifies amount of time in seconds that the AP retains an AP neighbor entry after receiving last Cabletron Discovery Protocol (CDP) hello packet. Syntax cdp hold-time <seconds> <seconds> amount of time to retain AP neighbor entry. Range: 15‐600 Default Setting 180 seconds Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#cdp hold-time 300 RoamAbout 3000(config)# Related Commands cdp auto‐enable page A‐111 cdp enable page A‐113 cdp tx‐frequency page A‐115 show cdp page A‐116 A-114...
Page 241: Cdp Tx-Frequency
<seconds> <seconds> amount of time betwen AP tramission. Range: 5‐900 Default Setting 60 seconds Command Mode Global Configuration Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#cdp tx-frequency 120 RoamAbout 3000(config)# Related Commands cdp auto‐enable page A‐111 cdp enable page A‐113 cdp hold‐time page A‐114 show cdp page A‐116 RoamAbout Access Point 3000 Configuration Guide A-115...
Page 242: Show Cdp
Command Groups show cdp This command displays the Cabletron Discovery Protocol (CDP) global settings. Syntax show cdp <neighbor|port|traffic> neighbor displays the cdp neighbor entries port displays the cdp port traffic displays cdp traffic statistics Default Setting Command Mode Exec A-116...
Page 243: Related Commands
: 10.2.191.52 Neighbor MAC Address : 00-E0-63-BB-93-C2 Time Mark : 0 days, 0 hours, 0 minutes, 57 seconds Device Type : Dot1d Bridge Description : Enterasys Networks 6H303-48 Rev 05.05.01 03/14/03--11:10 Port : 14 --------------------------------------------------------------------- Neighbor IP Address : 10.2.43.200...
Page 244: Dns
Command Usage The primary and secondary name servers are queried in sequence. Example This example specifies two domain‐name servers. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#dns primary-server 192.168.1.55 RoamAbout 3000(if-ethernet)#dns secondary-server 10.1.0.55 RoamAbout 3000(if-ethernet)# Related Commands show interface ethernet page A‐123 A-118...
Page 245: Ip Address
Command Groups ip address This command sets the IP address for the (10/100Base‐TX) Ethernet interface. Use this command to set the IP address for the access point when not setting the IP address from a DHCP server. Use the no form to restore the default IP address. Syntax ip address <ip-address> <netmask> <gateway> no ip address • ip‐address is the IP address • netmask is the network mask for the associated IP subnet. This mask identifies the host address bits used for routing to specific subnets • gateway is the IP address of the default gateway Default Setting IP address: 192.168.1.1 Netmask: 255.255.255.0 Command Mode Interface Configuration (Ethernet) Command Usage • You must assign an IP address to this device to gain management access over the network or to connect the access point to existing IP subnets. You can manually configure a specific IP address using this command, or direct the device to obtain an address from a DHCP server using the ip dhcp command. Valid IP addresses consist of four numbers, 0 to 255, separated by periods. Anything outside this format will not be accepted by the configuration program. • DHCP is enabled by default. To manually configure a new IP address, you must first disable the DHCP client with the no ip dhcp command. RoamAbout Access Point 3000 Configuration Guide A-119...
Page 246 Reboot system now? <y/n>: y Username: admin Password:******** RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#ip address 192.168.1.2 255.255.255.0 192.168.1.3 RoamAbout 3000(if-ethernet)# Related Commands ip dhcp page A‐121 A-120...
Page 247: Ip Dhcp
Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#ip dhcp DHCP client state has changed. Please reset AP for change to take effect. RoamAbout 3000(if-ethernet)#exit RoamAbout 3000#reset board Reboot system now? <y/n>: y...
Page 248: Shutdown
Default Setting Interface enabled Command Mode Interface Configuration (Ethernet) Command Usage This command allows you to disable the Ethernet port due to abnormal behavior (e.g., excessive collisions), and re‐enable it after the problem has been resolved. You may also want to disable the Ethernet port for security reasons. Example The following example disables the Ethernet port. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#shutdown RoamAbout 3000(if-ethernet)# A-122...
Page 249: Show Interface Ethernet
Command Groups show interface ethernet This command displays the status for the Ethernet interface. Syntax show interface [ethernet] Default Setting Ethernet interface Command Mode Exec Example RoamAbout 3000#show interface ethernet Ethernet Interface Information ======================================== IP Address : 192.168.1.2 Subnet Mask : 255.255.255.0 Default Gateway : 192.168.1.3 Primary DNS : 192.168.1.55 Secondary DNS : 10.1.0.55...
Page 250: Description
Use this command for the default interface or any of the seven VAPs configurable per radio interface. Example The following example shows setting the description for the default interface and a VAP. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#description RD-AP#3-G RoamAbout 3000(if-wireless g)#vap 4 RoamAbout 3000(if-wireless g: VAP[4])#description RD-AP#3-GV4 RoamAbout 3000(if-wireless g: VAP[4])#end RoamAbout 3000(if-wireless g)# A-124...
Page 251: Secure-Access
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a RoamAbout 3000(if-wireless a)#no secure-access RoamAbout 3000(if-wireless a)#vap 2 RoamAbout 3000(if-wireless a: VAP[2])#no secure-access RoamAbout 3000(if-wireless a: VAP[2])#end RoamAbout 3000(if-wireless a)# RoamAbout Access Point 3000 Configuration Guide A-125...
Page 252: Speed
802.11b only: 1, 2, 5.5, 11 802.11g only, or 802.11b and 802.11g: 1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, 54 Mbps Default Setting 54 Mbps Command Mode Interface Configuration (Wireless) Command Usage • The maximum transmission distance is affected by the data rate. The lower the data rate, the longer the transmission distance. Please refer to the table for maximum distances in Appendix C. • When turbo mode is enabled (see turbo page A‐128) for 802.11a, the effective maximum speed specified by this command is double the entered value (e.g., setting the speed to 54 Mbps limits the effective maximum speed to 108 Mbps). Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#speed 36 RoamAbout 3000(if-wireless g)# A-126...
Page 253: Channel
Interface Configuration (Wireless) Command Usage • The available channel settings are limited by local regulations, which determine the number of channels that are available. • When multiple access points are deployed in the same area, be sure to choose a channel separated by at least four channels for 802.11a to avoid having the channels interfere with each other, and at least five channels for 802.11b/g. • For most wireless adapters, the channel for wireless clients is automatically set to the same as that used by the access point to which it is linked. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#channel 1 RoamAbout 3000(if-wireless g)# RoamAbout Access Point 3000 Configuration Guide A-127...
Page 254: Turbo
Default Setting Disabled Command Mode Interface Configuration (Wireless ‐ 802.11a) Command Usage • The normal 802.11a wireless operation mode provides connections up to 54 Mbps. Turbo Mode is an enhanced mode (not regulated in IEEE 802.11a) that provides a higher data rate of up to 108 Mbps. Enabling Turbo Mode allows the access point to provide connections up to 108 Mbps. • In normal mode, the access point provides a channel bandwidth of 20 MHz, and supports the maximum number of channels permitted by local regulations (e.g., 12 channels for the United States). In Turbo Mode, the channel bandwidth is increased to 40 MHz to support the increased data rate. However, this reduces the number of channels supported (e.g., 5 channels for the United States). Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a RoamAbout 3000(if-wireless a)#turbo RoamAbout 3000(if-wireless a)# A-128...
Page 255: Ssid
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#ssid RD-AP#3-G RoamAbout 3000(if-wireless g)#vap 3 RoamAbout 3000(if-wireless g: VAP[3])#ssid RD-AP#3-GV3 RoamAbout 3000(if-wireless g: VAP[3})#end RoamAbout 3000(if-wireless g)# RoamAbout Access Point 3000 Configuration Guide A-129...
Page 256: Beacon-Interval
This command configures the rate at which beacon signals are transmitted from the access point. Syntax beacon-interval <interval> interval is the rate for transmitting beacon signals. Range: 20‐1000 milliseconds. Default Setting Command Mode Interface Configuration (Wireless) Command Usage The beacon signals allow wireless clients to maintain contact with the access point. They may also carry power‐management information. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#beacon-interval 150 RoamAbout 3000(if-wireless g)# A-130...
Page 257: Dtim-Period
MAC layer forwards broadcast/multicast traffic. This parameter is necessary to wake up stations that are using Power Save mode. • The DTIM is the interval between two synchronous frames with broadcast/multicast information. The default value of 2 indicates that the access point will save all broadcast/ multicast frames for the Basic Service Set (BSS) and forward them after every second beacon. • Using smaller DTIM intervals delivers broadcast/multicast frames in a more timely manner, causing stations in Power Save mode to wake up more often and drain power faster. Using higher DTIM values reduces the power used by stations in Power Save mode, but delays the transmission of broadcast/multicast frames. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#dtim-period 100 RoamAbout 3000(if-wireless g)# RoamAbout Access Point 3000 Configuration Guide A-131...
Page 258: Fragmentation-Length
256‐2346 bytes Default Setting 2346 Command Mode Interface Configuration (Wireless) Command Usage • If the packet size is smaller than the preset Fragment size, the packet will not be segmented. • Fragmentation of the PDUs (Package Data Unit) can increase the reliability of transmissions because it increases the probability of a successful transmission due to smaller frame size. If there is significant interference present, or collisions due to high network utilization, try setting the fragment size to send smaller fragments. This will speed up the retransmission of smaller frames. However, it is more efficient to set the fragment size larger if very little or no interference is present because it requires overhead to send multiple frames. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#fragmentation-length 512 RoamAbout 3000(if-wireless g)# A-132...
Page 259: Preamble
• long sets the preamble to long • short sets the preamble to short Default Setting long Command Mode Interface Configuration (Wireless) Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#preamble short RoamAbout 3000(if-wireless g)# RoamAbout Access Point 3000 Configuration Guide A-133...
Page 260: Ibss Relay
Example The following example shows enabling the ibss‐relay on the default interface and on a VAP. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless g)#ibss-relay RoamAbout 3000(if-wireless g)#vap 1 RoamAbout 3000(if-wireless g: VAP[1])#ibss-relay RoamAbout 3000(if-wireless g: VAP[1])#end...
Page 261: Rts-Threshold
• Access points contending for the wireless medium may not be aware of each other. The RTS/CTS mechanism can solve this “Hidden Node” problem. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless g)#rts-threshold 256 RoamAbout 3000(if-wireless g)# RoamAbout Access Point 3000 Configuration Guide A-135...
Page 262: Authentication
VAP. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a RoamAbout 3000(if-wireless a)#authentication shared RoamAbout 3000(if-wireless a)#vap 1 RoamAbout 3000(if-wireless a: VAP[1])#authentication shared RoamAbout 3000(if-wireless a: VAP[1])#end RoamAbout 3000(if-wireless a)# Related Commands encryption page A‐137 key page A‐138...
Page 263: Encryption
• Although WEP keys are not needed for WPA, you must enable WEP encryption in order to enable all types of encryption in the access point. Example The following example shows setting WEP encryption for the default interface and a VAP. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#encryption RoamAbout 3000(if-wireless g)#vap 6 RoamAbout 3000(if-wireless g: VAP[6])#encryption RoamAbout 3000(if-wireless g: VAP[6])#end RoamAbout 3000(if-wireless g)# Related Commands key page A‐138...
Page 264: Key
• To enable Wired Equivalent Privacy (WEP), use the authentication command to specify the “shared key” authentication type, use the encryption command to specify the key length, and use the key command to configure at least one key. • If WEP is enabled, all wireless clients must be configured with the same shared keys to communicate with the access point. • The encryption length specified in the encryption command and the key command must match. • The encryption index, length and type configured in the access point must match those configured in the clients. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#key 3 128 hex 12345123451234512345123456 RoamAbout 3000(if-wireless g)# Related Commands authentication page A‐136 encryption page A‐137 A-138...
Page 265: Transmit-Key
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a RoamAbout 3000(if-wireless a)#transmit-key 3 RoamAbout 3000(if-wireless a)#vap 4 RoamAbout 3000(if-wireless a: VAP[4])#transmit-key 3 RoamAbout 3000(if-wireless a: VAP[4])#end RoamAbout 3000(if-wireless a)# RoamAbout Access Point 3000 Configuration Guide A-139...
Page 266: Transmit-Power
Default Setting full Command Mode Interface Configuration (Wireless) Command Usage • The “min” keyword indicates minimum power. • The longer the transmission distance, the higher the transmission power required. But to support the maximum number of users in an area, you must keep the power as low as possible. Power selection is not just a trade off between coverage area and maximum supported clients. You also have to ensure that high strength signals do not interfere with the operation of other radio devices in your area. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#transmit-power half RoamAbout 3000(if-wireless g)# A-140...
Page 267: Max-Association
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#max-association 32 RoamAbout 3000(if-wireless g)#vap 1 RoamAbout 3000(if-wireless g: VAP[1])#max-association 10 RoamAbout 3000(if-wireless g: VAP[1])#end RoamAbout 3000(if-wireless g)# RoamAbout Access Point 3000 Configuration Guide A-141...
Page 268: Multicast-Data-Rate
Syntax multicast-data-rate <rate> rate is the data rate number you enter. Options: 802.11a: 6, 12, 24 Mbps 802.11b only or 802.11b and 802.11g: 1, 2, 5.5, 11 Mbps 802.11g only: 1, 2, 5.5, 11, 12, 24 Mbps Default Setting none Command Mode Interface Configuration (Wireless) Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#multicast-data-rate 11 RoamAbout 3000(if-wireless g)# A-142...
Page 269: Multicast-Cipher
Command Groups multicast-cipher This command defines the cipher algorithm used for broadcasting and multicasting when using Wi‐Fi Protected Access (WPA) security. Syntax multicast-cipher <AES | TKIP | WEP> • AES ‐ Advanced Encryption Standard • TKIP ‐ Temporal Key Integrity Protocol • WEP ‐ Wired Equivalent Privacy Default Setting Command Mode Interface Configuration (Wireless) Interface Configuration (Wireless): VAP Command Usage • Use this command for the default interface or any of the seven VAPs configurable per radio interface. • WPA enables the access point to support different unicast encryption keys for each client. However, the global encryption key for multicast and broadcast traffic must be the same for all clients. This command sets the encryption type that is supported by all clients. • If any clients supported by the access point are not WPA enabled, the multicast‐cipher algorithm must be set to WEP. • WEP is the first generation security protocol used to encrypt data crossing the wireless medium using a fairly short key. Communicating devices must use the same WEP key to encrypt and decrypt radio signals. WEP has many security flaws, and is not recommended for transmitting highly sensitive data. • TKIP provides data encryption enhancements including per‐packet key hashing (i.e., changing the encryption key on each packet), a message integrity check, an extended initialization vector with sequencing rules, and a re‐keying mechanism. • TKIP defends against attacks on WEP in which the un‐encrypted initialization vector in encrypted packets is used to calculate the WEP key. TKIP changes the encryption key on each packet, and rotates not just the unicast keys, but the broadcast keys as well. TKIP is a replacement for WEP that removes the predictability that intruders relied on to determine ...
Page 270: Unicast-Cipher
The following example shows setting the multi‐cast cipher for the default interface and a VAP. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a RoamAbout 3000(if-wireless a)#multicast-cipher TKIP RoamAbout 3000(if-wireless a)#vap 5 RoamAbout 3000(if-wireless a: VAP[5])#multicast-cipher AES RoamAbout 3000(if-wireless a: VAP[5])#end RoamAbout 3000(if-wireless a)# unicast-cipher This command defines the cipher algorithm used for communicating over a network between the access point and a client.
Page 271: Wpa-Clients
Command Groups wpa-clients This command defines whether Wi‐Fi Protected Access (WPA) is required, optionally supported, or not supported for client stations. Syntax wpa-clients <not-supported | required | supported> • not‐supported ‐ Access point does not support clients using WPA. • required ‐ Supports only clients using WPA. • supported ‐ Support clients with or without WPA. Default Setting Supported Command Mode Interface Configuration (Wireless) Interface Configuration (Wireless): VAP Command Usage • Use this command for the default interface or any of the seven VAPs configurable per radio interface. • Wi‐Fi Protected Access (WPA) provides improved data encryption, which was weak in WEP, and user authentication, which was largely missing in WEP. WPA uses the following security mechanisms. • Enhanced Data Encryption through TKIP • WPA uses Temporal Key Integrity Protocol (TKIP). TKIP provides data encryption enhancements including per‐packet key hashing (i.e., changing the encryption key on each packet), a message integrity check, an extended initialization vector with sequencing rules, and a re‐keying mechanism. • Enterprise‐level User Authentication via 802.1x and EAP • To strengthen user authentication, WPA uses 802.1x and the Extensible Authentication Protocol (EAP). Used together, these protocols provide strong user authentication via a central RADIUS authentication server that authenticates each user on the network before they join it. WPA also employs “mutual authentication” to prevent a wireless client from accidentally joining a rogue network. RoamAbout Access Point 3000 Configuration Guide A-145...
Page 272 VAP. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#wpa-client required RoamAbout 3000(if-wireless g)#vap 7 RoamAbout 3000(if-wireless g: VAP[7])#wpa-client supported RoamAbout 3000(if-wireless g: VAP[7])#end RoamAbout 3000(if-wireless g)# Related Commands wpa‐mode page A‐147 A-146...
Page 273: Wpa-Mode
The following example shows setting wpa‐mode for the default interface and a VAP. RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a RoamAbout 3000(if-wireless a)#wpa-mode pre-shared-key RoamAbout 3000(if-wireless a)#vap 4 RoamAbout 3000(if-wireless a: VAP[4])#wpa-mode dynamic RoamAbout 3000(if-wireless a: VAP[4])#end RoamAbout 3000(if-wireless a)# Related Commands wpa‐clients page A‐145 wpa‐preshared‐key page A‐148...
Page 274: Wpa-Preshared-Key
Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless g)#wpa-preshared-key ASCII agoodsecret RoamAbout 3000(if-wireless g)#vap 2 RoamAbout 3000(if-wireless g: VAP[2])#wpa-preshared-key ASCII 6buQ3! RoamAbout 3000(if-wireless g: VAP[2])#end RoamAbout 3000(if-wireless g)# Related Commands wpa‐clients page A‐145 wpa‐mode page A‐147...
Page 275: Vap
• Use this command to select the VAP to configure, and to enter VAP configuration mode • Once in VAP mode, use the authentication and security commands to configure the selected Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g Enter Wireless configuration commands, one per line. RoamAbout 3000(if-wireless g)#vap 1 RoamAbout 3000(if-wireless g: VAP[1])# RoamAbout Access Point 3000 Configuration Guide A-149...
Page 276: Shutdown
Interface Configuration (Wireless) Interface Configuration (Wireless): VAP Examples RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#shutdown RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless g RoamAbout 3000(if-wireless g)#no shutdown RoamAbout 3000#configure Enter configuration commands, one per line.
Page 277: Show Interface Wireless
<a | g> <vap#> • a is the 802.11a radio interface • g is the 802.11g radio interface • vap# is the vap on the a or g radio interface that you want to view Default Setting None Command Mode Exec Example RoamAbout 3000#show interface wireless g Wireless Interface Information =========================================================== ----------------Identification----------------------------- Description : RoamAbout AP3000 - 802.11 b/g SSID : RD-AP#3 802.11g band : 802.11g...
Page 278: Show Station
This command shows the wireless clients associated with the access point. Syntax show station Default Setting None Command Mode Exec Example RoamAbout 3000#show station Station Table Information ========================================================== 802.11a Channel : 149 if-wireless A [default] No 802.11a Stations. if-wireless A VAP [1] No 802.11a Stations. if-wireless A VAP [2] No 802.11a Stations.
Page 279: Iapp Commands
Syntax iapp no iapp Default Enabled Command Mode Global Configuration Command Usage The current 802.11 standard does not specify the signaling required between access points in order to support clients roaming from one access point to another. In particular, this can create a problem for clients roaming between access points from different vendors. This command is used to enable or disable 802.11f handover signaling between different access points, especially in a multi‐vendor environment. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#iapp RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-153...
Page 280: Qos Commands
Command Groups QoS Commands When you configure QoS (Quality of Service) on the access point, you can select specific network traffic, prioritize it, and use congestion‐management and congestion‐avoidance techniques to provide preferential treatment. Implementing QoS in your wireless LAN makes network performance more predictable and bandwidth utilization more effective. Eight classes are defined for the priority. Network managers determine actual mappings. The highest priority is seven and the lowest priority is 0. For example, if you select 5 as the priority, 5 receives higher priority than those set with 0, 1, 2, 3, or 4 and lower priority than those set with 6 and 7 as their priority. Use the commands described in Table A‐16 to configure QoS parameters. Table A-16 QoS Commands Command Function Mode Page Sets classifications by which to set A-155 qos mode priorities. Sets priorities for up to ten MAC A-156 qos mac-addr addresses when using source or destination addresses to classify QoS.
Page 281: Qos Mode
Command Mode Global Configuration Command Usage • After you select SA or DA, use the qos mac-addr command to enter the MAC addresses and the priority. • After you select Ether‐type, use the qos ether-type command to enter the Ethernet protocol type and the priority. • If you select 802.1p, the priorities are based on the device (switch) attached. No further configuration is necessary. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#qos mode SA RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-155...
Page 282: Qos Mac-Addr
0 ‐ 7 is the priority. Default Setting None Command Mode Global Configuration Example RoamAbout 3000#configure RoamAbout 3000(config)#qos mac-addr 00-01-f4-32-62-ac 6 RoamAbout 3000(config)# qos ether-type This command allows you to enter the Ethernet types in the Ethernet type table, and the priority class. The Ethernet type must be specified in the format HEX 0000‐FFFF. Note: You must configure at least one Ethernet type classification before the Ether type-based qos mode will take affect.
Page 283: Svp
This command displays the status of SVP mode. Syntax show svp Default Setting None Command Mode Exec Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)# show svp SVP: Disabled RoamAbout 3000(config)# RoamAbout Access Point 3000 Configuration Guide A-157...
Page 284: Rogue Ap Commands
Command Groups Rogue AP Commands ʺRogue APʺ describes an access point that is not authorized to participate on the network. It may not have the proper security settings in place. Rogue APs can potentially allow unauthorized users access to the network. In addition, a legitimate client may mistakenly associate to a Rogue AP with invalid encryption settings and not to the AP that has been configured for it to use. This can cause a denial of service problem. This feature scans the airwaves and collects information about access points in the area. It lists neighbor access points found during the scan in the Neighbor AP Detection Status page after the scan is complete. In addition, if RADIUS is enabled, it performs a RADIUS server look up for the MAC address of each access point found. It reports access points whose MAC addresses it finds in the RADIUS server in the Neighbor AP Detection status list. It reports access points whose MAC addresses it does not find as rogue APs in the syslog. Use the commands described in Table A‐16 to configure and use rogue AP. Table A-17 Rogue AP Commands Command Function Mode Page Enables the rogue AP feature on the A-159 rogue-ap enable radio interfaces. Sets amount of time to scan each A-160 rogue-ap duration...
Page 285: Rogue-Ap Enable
Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#rogue-ap interface-a enable configure either syslog or trap or both to receive the rogue APs detected. Related Commands RoamAbout Access Point 3000 Configuration Guide A-159...
Page 286: Rogue-Ap Duration
[interface-a | interface-g] duration <time> time is the duration in milliseconds. Range: 100‐1000 milliseconds Default Setting 350 milliseconds Command Mode Global Configuration Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#rogue-ap interface-a duration 400 RoamAbout 3000(config)# Related Commands rogue‐ap enable page A‐159 rogue‐ap interduration page A‐161 rogue‐ap interval page A‐162 A-160...
Page 287: Rogue-Ap Interduration
Range: 1000‐30000 milliseconds Default Setting 3000 milliseconds Command Mode Global Configuration Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#rogue-ap interface-a interduration 15000 RoamAbout 3000(config)# Related Commands rogue‐ap enable page A‐159 rogue‐ap duration page A‐160 rogue‐ap interval page A‐162 RoamAbout Access Point 3000 Configuration Guide A-161...
Page 288: Rogue-Ap Interval
[interface-a | interface-g] interval <time> time is the amount of time in minutes. Range: 30‐10080 minutes Default Setting 720 minutes Command Mode Global Configuration Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#rogue-ap interface-a interval 960 RoamAbout 3000(config)# Related Commands rogue‐ap enable page A‐159 rogue‐ap duration page A‐160 rogue‐ap interduration page A‐161 A-162...
Page 289: Rogue-Ap [Interface-A | Interface-G] Scan
Default Setting Command Mode Global Configuration Command Usage Scans the specified radio interface only. To scan all radio interfaces, use the rogue‐ap scan command. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#rogue-ap interface-a scan RoamAbout 3000(config)# Related Commands rogue‐ap enable page A‐159 rogue‐ap scan page A‐165 rogue‐ap sortmode page A‐166 rogue‐ap radius page A‐164 RoamAbout Access Point 3000 Configuration Guide A-163...
Page 290: Rogue-Ap Radius
Syntax rogue-ap radius <enable> no rogue-ap radius enable causes the AP to look up MAC addresses in the RADIUS server and thus to identify rogue APs as APs whose MAC addresses do not exist in the RADIUS server. Default Setting None Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#rogue-ap radius enable RoamAbout 3000(config)# Related Commands rogue‐ap enable page A‐159 rogue‐ap [interface‐a | interface‐g] scan page A‐163 rogue‐ap scan page A‐165 A-164...
Page 291: Rogue-Ap Scan
Default Setting None Command Mode Global Configuration Command Usage Use this command to scan all radio interfaces. Use the rogue‐ap [interface‐a] [interface‐g] interval command to scan specified radio interfaces. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#rogue-ap scan Related Commands rogue‐ap enable page A‐159 rogue‐ap [interface‐a | interface‐g] scan page A‐163 rogue‐ap sortmode page A‐166 rogue‐ap radius page A‐164 RoamAbout Access Point 3000 Configuration Guide A-165...
Page 292: Rogue-Ap Sortmode
<BSSID | Channel | SSID | RSSID> BSSID sorted by BSSID Channel sorted by Channel SSID sorted by SSID RSSID sorted by RSSID Default Setting BSSID Command Mode Exec Command Usage Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#rogue-ap sortmode SSID RoamAbout 3000(config)# Related Commands rogue‐ap enable page A‐159 rogue‐ap [interface‐a | interface‐g] scan page A‐163 rogue‐ap scan page A‐165 A-166...
Page 293: Show Rogue-Ap
Command Groups show rogue-ap This command displays rogue AP settings and results of a rogue AP scan for both the 802.11a and 802.11g interfaces. Syntax show rogue-ap Default Setting None Command Mode Exec Command Usage RoamAbout Access Point 3000 Configuration Guide A-167...
Page 294 Command Groups Example RoamAbout 3000#show rogue-ap 802.11a Channel : Rogue AP Setting ======================================================= Rogue AP Detection : Enabled Rogue AP Authentication : Enabled Rogue AP Scan Interval : 720 minutes Rogue AP Scan Duration : 100 milliseconds Rogue AP Scan InterDuration: 1000 milliseconds 802.11a Channel : Rogue AP Status...
Page 295 Command Groups Related Commands rogue‐ap enable page A‐159 rogue‐ap [interface‐a | interface‐g] scan page A‐163 rogue‐ap scan page A‐165 RoamAbout Access Point 3000 Configuration Guide A-169...
Page 296: Vlan Commands
Command Groups VLAN Commands The access point can employ VLAN tagging support to control access to network resources and increase security. VLANs separate traffic passing between the access point, associated clients, and the wired network. You can assign a VLAN to each of the access points radio interfaces, a management VLAN for the access point, and a VLAN to up to 64 associated clients. Each wireless client associated to the access point is assigned to the native VLAN ID (a number between 1 and 4095) for the radio interface. If IEEE 802.1x is being used to authenticate wireless clients, specific VLAN IDs can be configured on the RADIUS server to be assigned to each client. Using IEEE 802.1x and a central RADIUS server, up to 64 VLAN IDs can be mapped to specific wireless clients. The access point allows traffic tagged with assigned VLAN IDs or the native VLAN ID to access clients associated on the radio interface. When VLAN support is enabled, the access point tags traffic passing to the wired network with the appropriate VLAN ID, either an assigned client VLAN ID, native VLAN ID, or the management VLAN ID. Traffic received from the wired network must also be tagged with one of these known VLAN IDs. Received traffic that has an unknown VLAN ID or no VLAN tag is dropped. When VLAN support is disabled, the access point does not tag traffic passing to the wired network and ignores the VLAN tags on any received frames. When setting up VLAN IDs for each user on the RADIUS server, be sure to use the RADIUS attributes and values as indicated in Table A‐18. Table A-18 VLAN ID RADIUS Attributes Number RADIUS Attribute Value Tunnel-Type VLAN (13) Tunnel-Medium-Type Tunnel-Private-Group-ID VLANID (1 to 4095 in hexadecimal) Note: The specific configuration of RADIUS server software is beyond the scope of this guide.
Page 297: Vlan Commands
Command Groups Table A-19 VLAN Commands Command Function Mode Page Enables management VLAN for the access A-174 management-vlan point Sets the management VLAN ID for the access A-173 management-vlanid point Enables vlan on the specified radio interface IC-W A-174 vlan Sets the native VLAN ID for the selected radio IC-W A-175...
Page 298: Management-Vlan
• Changing the VLAN status of the access point requires a system reboot. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#management-vlan enable Reboot system now? <y/n>: n VLAN functionality will not take effect until the next reset occurs!! RoamAbout 3000(if-wireless a)# Related Commands management‐vlanid page A‐173...
Page 299: Management-Vlanid
VLAN ID. Range: 1-4094 Default Setting Command Mode Global Configuration Command Usage • The management VLAN is for managing the access point. For example, the access point allows traffic that is tagged with the specified VLAN to manage the access point via remote management, SSH, SNMP, Telnet, and so on. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#management-vlanid 3 RoamAbout 3000(config)# Related Commands management‐vlan page A‐172 RoamAbout Access Point 3000 Configuration Guide A-173...
Page 300: Vlan
• If the VLAN ID has not been configured for a client on the RADIUS server, then the frames are tagged with the native VLAN ID of the radio interface. • When using IEEE 802.1x to dynamically assign VLAN IDs, the access point must have 802.1x authentication enabled and a RADIUS server configured. Wireless clients must also support 802.1x client software. • Traffic entering the Ethernet port must be tagged with a VLAN ID that matches the access point’s management VLAN ID, a radio interface native VLAN ID, or with a VLAN tag that matches one of the wireless clients currently associated with the access point. Example RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a RoamAbout 3000(if-wireless a)#vlan enable Reboot system now? <y/n>: y Username: Related Commands native‐vlanid page A‐175 A-174...
Page 301: Native-Vlanid
RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RoamAbout 3000(config)#interface wireless a RoamAbout 3000(if-wireless a)#native-vlanid 3 RoamAbout 3000(if-wireless a)#vap 6 RoamAbout 3000(if-wireless a: VAP[6])#native-vlanid 30 RoamAbout 3000(if-wireless a: VAP[6])#end RoamAbout 3000(if-wireless a)# Related Commands vlan page A‐174 RoamAbout Access Point 3000 Configuration Guide A-175...
Page 302: Untagged-Vlanid
Ethernet port. Syntax untagged-vlanid <id> <id> is the VLANID to use for untagged packets. Range: 1 to 4095 Default Setting Command Mode Interface Ethernet Example RoamAbout 3000# RoamAbout 3000#configure Enter configuration commands, one per line. End with CTRL/Z RRoamAbout 3000(config)#interface ethernet Enter Ethernet configuration commands, one per line. RoamAbout 3000(if-ethernet)#untagged-vlanid 10 RoamAbout 3000(if-ethernet)# A-176...
Page 303: Appendix B: Default Settings
Default Settings This Appendix lists the access point system defaults. To reset the access point defaults, refer to the CLI command “reset configuration” from the Exec level prompt. Feature Parameter Default Identification System Name RoamAbout AP Administration User Name admin Password password Com Port Enabled TCP/IP DHCP Enabled HTTP Server Enabled HTTP Port HTTPS Server Enabled HTTPS Port SSH Server Enabled SSH Server Port IP Telnet Server Enabled IP Address...
Page 304 Feature Parameter Default PPPoE Settings Disabled IP Allocation Mode Automatically allocated IPCP DNS Disabled Link Control Protocol (LCP) 10 (seconds) Echo Interval Link Control Protocol (LCP) 3 (seconds) Echo Failure Local IP Address 0.0.0.0 Remote IP Address 0.0.0.0 MAC Authentication MAC Authentication Local MAC MAC Access Permission...
Page 305 Feature Parameter Default Rogue AP Interface a Disable Interface b/g Disable Duration 350 (milliseconds) Interduration 3000 (milliseconds) Interval 720 (minutes) Authentication Disabled SNMP Status Enabled Community (Read Only) public Community (Read/Write) private Contact contact Host public (community string) Engine ID (SNMPv3 Enabled Trap Destination Enable (all traps)
Page 306 Feature Parameter Default Native VLAN ID Description RoamAbout AP3000 - 802.11a Network Name (SSID) RoamAbout Default Network Name Secure Access Enabled Turbo Mode Disabled Auto Channel Select Enabled Transmit Power Full Maximum Tx Data Rate 54 Mbps Beacon Interval 100 ms Data Beacon Rate (DTIM) 2 Beacons Fragmentation Length...
Page 307 Feature Parameter Default Wireless Interface 802.11b/g Radio Settings Enabled Description RoamAbout AP3000 - 802.11 b/g Network Name (SSID) RoamAbout Default Network Name Native VLAN ID Secure Access Enabled Radio Channel Auto Channel Select Disabled Fragmentation length 2346 Bytes Working Mode b &...
Page 308 Feature Parameter Default Wireless Security 802.11b/g Authentication Type Setup Open System Data Encryption Setup Disabled WPA Clients Supported WPA Mode Dynamic Multicast Cipher Mode Unicast Cipher Mode WEP Transmit Key Number B-6 Default Settings...
Page 309: Appendix C: Troubleshooting
Troubleshooting Troubleshooting Steps Check the following items before contacting technical support. If wireless clients cannot access the network, check the following: Be sure the access point and the wireless clients are configured with the same Service Set ID (SSID). b. If authentication or encryption are enabled, ensure that the wireless clients are properly configured with the appropriate authentication or encryption keys. If authentication is being performed through a RADIUS server, ensure that the clients are properly configured on the RADIUS server. d. If authentication is being performed through IEEE 802.1x, be sure the wireless users have installed and properly configured 802.1x client software. If MAC address filtering is enabled, be sure the client’s address is included in the local filtering database or on the RADIUS server database. If the wireless clients are roaming between access points, make sure that all the access points and wireless devices in the Extended Service Set (ESS) are configured to the same SSID, and authentication method. If the access point cannot be configured using Telnet, a Web browser, or SNMP software: Be sure to have configured the access point with a valid IP address, subnet mask and default gateway. b. If VLANs are enabled on the access point, the management station should be configured to send tagged frames with a VLAN ID that matches the access point’s native VLAN (default VLAN 1, see page 6‐82**). However, to manage the access point from a wireless client, the AP Management Filter should be disabled (page 6‐52**). Check that you have a valid network connection to the access point and that the Ethernet port or the wireless interface that you are using has not been disabled. d. If you are connecting to the access point through the wired Ethernet interface, check the network cabling between the management station and the access point. If you are connecting to the access point from a wireless client, ensure that you have a valid connection to the access point. If you cannot connect using Telnet, you may have exceeded the maximum number of concurrent Telnet sessions permitted (i.e, four sessions). Try connecting again at a later time. RoamAbout Access Point 3000 Configuration Guide C-1...
Page 310: Maximum Distance Tables
Maximum Distance Tables If you cannot access the on‐board configuration program via a serial port connection: Be sure you have set the terminal emulator program to VT100 compatible, 8 data bits, 1 stop bit, no parity and 9600 bps. b. Check that the null‐modem serial cable conforms to the pin‐out connections provided in the RoamAbout Access Point 3000 Hardware Installation Guide. If you forgot or lost the password: You can set the access point to its default configuration by pressing the reset button on the back panel for 5 seconds or more. You will loose all of your configuration settings. Then, use the default user name “admin” with the password “password” to access the management interface. If all other recovery measures fail, and the access point is still not functioning properly, take any of these steps: Reset the access point’s hardware using the console interface, Web interface, or through a power reset. b. Reset the access point to its default configuration by pressing the reset button on the back panel for 5 seconds or more. You will loose all of your configuration settings. Then, use the default user name “admin” with the password “password” to access the management interface. Maximum Distance Tables Table C‐1 through Table C‐3 list the wireless distances. Note: Maximum distances posted below are actual tested distance thresholds. However, there are many variables such as barrier composition and construction and local environmental interference that may impact your actual distances and cause you to experience distance thresholds far lower than those posted in the following tables.
Page 311: C-3 802.11G Wireless Distance Table
Maximum Distance Tables Table C-3 802.11g Wireless Distance Table Speed and Distance Ranges Environment Mbps Mbps Mbps Mbps Mbps Mbps Mbps Mbps Mbps Mbps Mbps Mbps Outdoors 82 m 100 m 300 m 330 m 350 m 450 m 470 m 485 m 495 m 510 m...
Page 312 Maximum Distance Tables C-4 Troubleshooting...
Page 313: Index
Index Numerics country code configuring A-18 802.1x hardware version, displaying A-45 CSMA/CA description 4-66 HTTPS A-27 A-135 enable options 4-66 HTTPS server command A-27 session key refresh rate 4-67 session timeout 4-67 Default IP address IAPP A-153 802.1x supplicant 4-14 Default settings ibss-relay command A-134...
Page 314 MAC Authentication table 4-68 RADIUS MAC 4-67 downloading A-77 mac-access RADIUS, logon authentication A-81 software entry A-96 Remote Authentication Dial-in User displaying version 4-39, A-45 permission A-95 Service See RADIUS downloading 4-40 mac-authentication Request to Send See RTS SSID A-129 server A-97 Reset...
Page 315 Username changing 4-38 length 4-38 mode A-149 VLAN configuration 4-49, A-174 management ID A-173 native ID 4-49, A-175 Web management configuration page descriptions default username and password initial configuration WEP 4-62, A-137 configuring 4-62, 4-65, A-137 shared key 4-65, A-138 Wired Equivalent Protection See WEP Wireless network configurations A-147...
Page 316 Index-4...

Enterasys ROAMABOUT 3000 Configuration Manual

Preface

Chapter 1: Introduction

Chapter 2: Network Configuration

Chapter 3: Initial Configuration

Chapter 4: Advanced Configuration

Appendix A: Using the Command Line Interface

Quick Links

Related Manuals for Enterasys ROAMABOUT 3000

Summary of Contents for Enterasys ROAMABOUT 3000