Page 1 Motorola RFS Series Wireless LAN Switches WiNG System Reference Guide...
Page 2 © 2010 Motorola, Inc. All rights reserved. MOTOROLA and the Stylized M Logo are registered in the US Patent & Trademark Office. Symbol is a registered trademark of Symbol Technologies, Inc. All other product or service names are the property of their respective owners.
Page 3: Table Of Contents
Contents Chapter 1. Overview 1.1 Hardware Overview ................1-2 1.1.1 Physical Specifications .
Page 4 TOC-2 Motorola RF Switch System Reference Guide 3.4 Viewing Switch Firmware Information ............3-29 3.4.1 Editing the Switch Firmware .
Page 5 TOC-3 4.7.10 Voice Statistics ..............4-128 4.8 Viewing Access Port Adoption Defaults .
Page 6 TOC-4 Motorola RF Switch System Reference Guide 5.5 Layer 3 Mobility................5-47 5.5.1 Configuring Layer 3 Mobility .
Page 7 TOC-5 6.5.2 Defining Static NAT Translations ............6-61 6.5.3 Configuring NAT Interfaces .
Page 8 A.1 Motorola’s Enterprise Mobility Support Center ........
Page 9 TOC-7 B.3.3 Configuring the Switch for Adaptive AP Adoption ......... . . B-13 B.4 Establishing Basic Adaptive AP Connectivity .
Page 10 TOC-8 Motorola RF Switch System Reference Guide...
Page 11: About This Guide
Interface (CLI) and Management Information Base (MIB) commands used to configure the Motorola RF Switches. • RF Management Software Users Guide - Describes how to use Motorola RFMS to set up and monitor your switch in respect to areas of good RF throughput and defined physical barriers.
Page 12: Notational Conventions
Motorola RF Switch System Reference CAUTION: Indicates conditions that can cause equipment damage or data loss. WARNING! Indicates a condition or procedure that could result in personal injury or equipment damage. Notational Conventions The following additional notational conventions are used in this document: •...
Page 13: Chapter 1. Overview
Overview A Motorola RF Switch is a centralized management solution for wireless networking. It connects to non-legacy Access Ports through Layer 2 or Layer 3 (Layer 2 is preferable, if the situation allows it). Access ports function as radio antennas for data traffic management and routing. System configuration and intelligence for the wireless network resides with the switch.
Page 14: Hardware Overview
1-2 Motorola RF Switch Systen Reference 1.1 Hardware Overview The RFS4000, RFS6000 and RFS7000 are rack-mountable devices that manage all inbound and outbound traffic on the wireless network. They provide security, network service and system management applications. Unlike traditional wireless infrastructure devices that reside at the edge of a network, the switch uses centralized, policy-based management to apply sets of rules or actions to all devices on the wireless network.
Page 15 Overview Operating Temperature 0°C - 40°C (32°F - 104°F) Operating Humidity 5% - 85% RH, non-condensing A power cord is not supplied with a RFS4000, RFS6000 or RFS7000 model switch. Use only a correctly rated power cord certified for the country of operation...
Page 16: Software Overview
WLAN. The cable(s) are used with the Ethernet ports on the front panel of the switch. SWITCH NOTE: On an RFS6000 and RFS7000, Motorola recommends connecting via the Management Ethernet (ME) interface to better ensure secure and easier management.
Page 17: Infrastructure Features
Motorola RFMS can help optimize the positioning and configuration of a switch in respect to a WLAN’s MU throughput requirements and can help detect rogue devices. For more information, refer to the Motorola Web site.
Page 18 1-6 Motorola RF Switch Systen Reference 1. In-service Diagnostics – In-service diagnostics provide a range of automatic health monitoring features ensuring both the system hardware and software are in working order. In-service-diagnostics continuously monitor available physical characteristics (as detailed below) and issue log messages when warning or error thresholds are reached.
Page 19 Overview 1.2.1.7 Hardware Abstraction Layer and Drivers HAL) The Hardware Abstraction Layer ( provides an abstraction library with an interface hiding hardware/ platform specific data. Drivers include platform specific components such as Ethernet, Flash Memory storage and thermal sensors. 1.2.1.8 Redundancy Using switch redundancy, up to 12 switches can be configured in a redundancy group (and provide group monitoring).
Page 20: Wireless Switching
1-8 Motorola RF Switch Systen Reference To contact Motorola Support in the event of a password reset requirement, go to http://www.motorola.com/ Business/US-EN/Support CAUTION: Only a qualified installation professional should set or restore the access point’s radio and power management configuration in the event of a password reset.
Page 21 Overview • DHCP • Switch fully qualified domain name (FQDN) • Static IP addresses The benefits of an AAP deployment include: • Centralized Configuration Management & Compliance - Wireless configurations across distributed sites can be centrally managed by the wireless switch or cluster. •...
Page 22 The uplink and downlink rate limits are usually configured on the radius server using Motorola vendor specific attributes. The switch extracts the rate limits from radius server response. When such attributes are not present, the global settings on the switch are then applied.
Page 23 1-11 Overview • User based VLAN assignment — Allows the switch to extract VLAN information from the Radius server. • User based QoS — Enables QoS for the MU based on settings within the Radius Server.
Page 24 1-12 Motorola RF Switch Systen Reference 1.2.2.7 Voice Prioritization The switch has the capability of having its QoS policy configured to prioritize network traffic requirements for associated MUs. Use QoS to enable voice prioritization for devices using voice as its transmission priority.
Page 25 • 802.11e admission control — 1 byte: channel utilization% and 1 byte: MU count is sent in QBSS Load Element in beacons to MU. • Motorola load balancing element (proprietary) — 2 byte: MU Count are sent in beacon to MU. For more information on Access Port adoption in a layer 3 environment, see...
Page 26 1-14 Motorola RF Switch Systen Reference AP Balancing Across Multiple Switches At adoption, the AP solicits and receives multiple adoption responses from the switches on the network. These adoption responses contain preference and loading information the AP uses to select the optimum switch to be adopted by.
Page 27 Overview MU Move Command As a value added proprietary feature between Motorola infrastructure products and Motorola MUs, a move command has been introduced. The move command permits an MU to roam between ports connected to the same switch without the need to perform the full association and authentication defined by the 802.11 standard.
Page 28 1-16 Motorola RF Switch Systen Reference disconnect. With QoS, a VoIP conversation (a real-time session), receives priority, maintaining a high level of voice quality. Voice QoS ensures: • Strict Priority • Spectralink Prioritization • VOIP Prioritization (IP ToS Field) • Multicast Prioritization...
Page 29 1-17 Overview 1.2.2.14 Wireless Layer 2 Switching The switch supports the following layer 2 wireless switching techniques: • WLAN to VLAN • MU User to VLAN • WLAN to GRE 1.2.2.15 Automatic Channel Selection Automatic channel selection works sequentially as follows: 1.
Page 30 1-18 Motorola RF Switch Systen Reference Limiting Users Per VLAN Not all VLANs within a single WLAN must have the same DHCP pool size. Assign a user limit to each VLAN to allow the mapping of different pool sizes. Specify the VLAN user limit. This specifies the maximum number of MUs associated with a VLAN (for a particular WLAN).
Page 31: Wired Switching
1-19 Overview for future VLAN assignment. To configure Multiple VLANs for a single WLAN, see Assigning Multiple VLANs per WLAN on page 4-31. 1.2.3 Wired Switching The switch includes the following wired switching features: • DHCP Servers • DHCP User Class Options •...
Page 32: Management Features
• A Command Line Interface (CLI) accessible via the serial port or through Telnet or a Secure Shell (SSH) application • A CLI Service mode enabling the capture of system status information that can be sent to Motorola personnel for use in problem resolution •...
Page 33: Security Features
1-21 Overview 1.2.5 Security Features Switch security can be classified into wireless security and wired security. The switch includes the following wireless security features: • Encryption and Authentication • MU Authentication • Secure Beacon • MU to MU Disallow • 802.1x Authentication •...
Page 34 KeyGuard is Motorola’s proprietary dynamic WEP solution. Motorola (upon hearing of the vulnerabilities of WEP) developed a non standard method of rotating keys to prevent compromises. Basically, KeyGuard is TKIP without the message integrity check. KeyGuard is proprietary to Motorola MUs only. For information on configuring KeyGuard for a WLAN, see Configuring WEP 128 / KeyGuard on page 4-55.
Page 35 1-23 Overview uses the MAC address of the MU as both the username and password (this configuration is also expected on the Radius server). MAC-Auth supports all encryption types, and (in case of 802.11i) the handshake is completed before the Radius lookup begins. For information on configuring 802.1x EAP for a WLAN, see Configuring MAC Authentication on page 4-46.
Page 36 NOTE: The Motorola RF Management Software is recommended to plan the deployment of the switch. Motorola RFMS can help optimize the positioning and configuration of a switch in respect to a WLAN’s MU throughput requirements and can help detect rogue...
Page 37 With this most recent switch firmware release, the switch can provide rogue device detection data to the Motorola RF Management software application (or Motorola RFMS). Motorola RFMS uses this data to refine the position and display the rogue on a site map representative of the physical dimensions of the actual radio coverage area of the switch.
Page 38 1-26 Motorola RF Switch Systen Reference allowed. If the action is to mark, the packet is tagged for priority. The switch supports the following types of ACLs: • IP Standard ACLs • IP Extended ACLs • MAC Extended ACLs • Wireless LAN ACLs...
Page 39: Supported Access Ports/Points
NAC 802.1x support (printers, phones, PDAs etc.). For information on configuring NAC support, see Configuring NAC Server Support on page 4-51. 1.2.6 Supported Access Ports/Points A RF switch supports the adoption of the following Motorola Enterprise Access Ports and Access Points: • AP100 • AP300 • AP-4131 •...
Page 40: Ieee Standards Support
1-28 Motorola RF Switch Systen Reference 1.3 IEEE Standards Support IEEE Standard Supported Notes IEEE 802.11a The IEEE 802.11a standard is fully supported on the following Switch Platforms: • WS2000 • WS5100 • RFS6000 • RFS7000 The IEEE 802.11a standard is...
Page 41 1-29 Overview IEEE Standard Supported Notes IEEE 802.11g The IEEE 802.11g standard is fully supported on the following Switch Platforms: • WS2000 • WS5100 • RFS6000 • RFS7000 The IEEE 802.11g standard is fully supported on the following AP Platforms: •...
Page 42 1-30 Motorola RF Switch Systen Reference IEEE Standard Supported Notes IEEE 802.11i We fully support the 802.11i standard for encryption and authentication. Additionally we also implement 802.11i PMK Caching, Opportunistic PMK Caching and Pre-Authentication. The IEEE 802.11i standard is fully...
Page 43 1-31 Overview IEEE Standard Supported Notes IEEE 802.1x Full support IEEE 802.1x authentication ether with a fully functional integrated RADIUS server built into our RF Switches and Access Points or an external RADIUS server such as Microsoft IAS, Microsoft NPS, Cisco Secure ACS, Free RADIUS and Juniper Steel Belted RADIUS (to name a few).
Page 44 1-32 Motorola RF Switch Systen Reference IEEE Standard Supported Notes IEEE 802.3u The IEEE 802.3u (100BASE-T) standard is fully supported on the following Switch Platforms: • WS2000 • WS5100 • RFS6000 • RFS7000 The IEEE 802.3u (100BASE-T) standard is fully supported on the following AP Platforms: •...
Page 45: Standards Support
1-33 Overview IEEE Standard Supported Notes IEEE 802.1P The IEEE 802.1P (QoS) standard is fully supported on the following Switch Platforms: • WS2000 • WS5100 • RFS6000 • RFS7000 The IEEE 802.1P (QoS) standard is fully supported on the following AP Platforms: •...
Page 46 1-34 Motorola RF Switch Systen Reference Standard Supported Notes RFC 826 ARP RFC 1122 Requirements for Internet Hosts RFC 1519 CIDR RFC 1542 BOOTP BOOTP is implemented as part of the Integrated DHCP server. BOOTP clients are implemented on the AP5131, AP5181 and AP7131.
Page 47 1-35 Overview Standard Supported Notes SSL and TLS: RC4 128-bit and RSA 1024- and 2048-bit IPSec: DES-CBC, 3DES, AES-CBC RFC 2548 Microsoft Vendor- Specific RADIUS Attributes RFC 2716 PPP EAP-TLS RFC 2865 RADIUS Authentication Yes Integrated and Pass-through RFC 2866 RADIUS Accounting Integrated and Pass-through RFC 2867 RADIUS Tunnel Accounting...
Page 48 1-36 Motorola RF Switch Systen Reference Standard Supported Notes RFC 2674 Definitions of Managed We support everything except Objects for Bridges with Traffic the pBridge MIB. Classes, Multicast Filtering, and Virtual LAN Extensions RFC 2819 RMON MIB RFC 2863 Interfaces Group MIB...
Page 49: Chapter 2. Switch Web Ui Access And Image Upgrades
Switch Web UI Access and Image Upgrades The content of this chapter is segregated amongst the following: • Accessing the Switch Web UI • Switch Password Recovery • Upgrading the Switch Image • Auto Installation • AP-4131 Access Point to Access Port Conversion 2.1 Accessing the Switch Web UI This section provides information on how to access the controller's user interface.
Page 50: Connecting To The Switch Web Ui
This warning screen will continue to display on future login attempts until a self-signed certificate is implemented. Motorola recommends only using the default certificate for the first few login attempts until a self-signed certificate can be generated.
Page 51: Switch Password Recovery
System Reference Guide. However, Motorola periodically releases switch firmware that includes enhancements or resolutions to known issues. Verify your current switch firmware version with the latest version available from the Motorola Web site before determining if your system requires an upgrade. 2.3 Auto Installation The switch auto install function can be configured manually or using a DHCP server.
Page 52 2-4 Motorola RF Switch System Reference The compulsory parameters are: • configuration upgrade enable • cluster configuration upgrade enable • image upgrade enable Optional (only for the static case): • configuration file URL • cluster configuration file URL • image file URL •...
Page 53: Ap-4131 Access Point To Access Port Conversion
To convert an AP-4131 “fat” Access Point to a “thin” AP-4131 Access Port you need to load the port conversion version firmware. Refer to the files available with you Motorola Web site download package. To convert an AP-4131 Access Point 1.
Page 54 2-6 Motorola RF Switch System Reference 5. Reset the AP if you changed the AP's IP address, by displaying the System Summary and selecting the Reset AP option. If you reset the AP-4131 you will need to login as Admin again.
Page 55 Switch Web UI Access and Image Upgrades 10.Select when asked to confirm. 11.The AP-4131 will now reset, download and install the desired firmware. 12.Once the firmware download is complete, connect the AP-4131 to the PoE switch and the RF Switch The AP-4131 should adopt and operate as a “thin”...
Page 56 2-8 Motorola RF Switch System Reference...
Page 57: Chapter 3. Switch Information
Motorola RFMS can help optimize the positioning and configuration of a switch (and its associated radios) in respect to a WLAN’s MU throughput requirements and can help detect rogue devices.
Page 58: Setting The Switch Country Code
3-2 Motorola RF Switch System Reference NOTE: When the switch’s configuration is successfully updated (using the Web UI), the effected screen is closed without informing the user their change was successful. However, if an error were to occur, the error displays within the effected screen’s Status field and the screen remains displayed.
Page 59 Firmware Displays the current firmware version running on the switch. This version should be periodically compared to the most recent version available on the Motorola Web site, as versions with increased functionality are periodically released. AP License Count Displays the number of Access Port licenses currently available for the switch.
Page 60: Switch Dashboard Details
(to the Time Zone or Country parameters specifically). 3.1.3 Switch Dashboard Details Each Motorola RF Switch platform contains a dashboard which represents a high-level graphical overview of central switch processes and hardware. When logging into the switch, the dashboard should be the first place you go to assess overall switch performance and any potential performance issues.
Page 61 Switch Information 3.1.3.1 RFS4000 Switch Dashboard Dashboard screen displays the current health of the switch and is divided into fields representing the following important diagnostics: • Alarms • Ports • Environment • CPU/Memory • File Systems Apart from the sections mentioned above, it also displays the following status: Redundancy State Displays the Redundancy State of the switch.
Page 62 3-6 Motorola RF Switch System Reference Mobile Units Displays the total number of MUs associated with the switch. Up Time Displays the actual switch uptime. The Uptime is the current operational time of the device defined within the System Name field. Uptime is the cumulative time since the switch was last rebooted or lost power.
Page 63 Switch Information 3.1.3.2 RFS6000 Switch Dashboard Dashboard screen displays the current health of the switch and is divided into fields representing the following important diagnostics: • Alarms • Ports • Environment • CPU/Memory • File Systems Apart from the sections mentioned above, it also displays the following status: Redundancy State Displays the Redundancy State of the switch.
Page 64 3-8 Motorola RF Switch System Reference Mobile Units Displays the total number of MUs associated with the switch. Up Time Displays the actual switch uptime. The Uptime is the current operational time of the device defined within the System Name field. Uptime is the cumulative time since the switch was last rebooted or lost power.
Page 65 Switch Information 3.1.3.3 RFS7000 Switch Dashboard Dashboard screen displays the current health of the switch and is divided into fields representing the following important diagnostics: • Alarms • Ports • Environment • CPU/Memory • File Systems Apart from the sections mentioned above, it also displays the following status: Redundancy State Displays the Redundancy State of the switch.
Page 66 3-10 Motorola RF Switch System Reference Mobile Units Displays the total number of MUs associated with the switch. Up Time Displays the actual switch uptime. The Uptime is the current operational time of the device defined within the System Name field. Uptime is the cumulative time since the switch was last rebooted or lost power.
Page 67: Viewing Switch Statistics
3-11 Switch Information 3.1.4 Viewing Switch Statistics Switch Statistics tab displays an overview of the recent network traffic and RF status for the switch. To display the Switch Statistics tab: 1. Select Switch from the main menu tree. 2. Click the Switch Statistics tab at the top of the Switch screen.
Page 68 3-12 Motorola RF Switch System Reference Avg. Bit Speed Displays the average bit speed for the switch over last 30 seconds and 1 hour. Use the average bit speed value to help determine overall network speeds and troubleshoot network congestion.
Page 69: Viewing Switch Port Information
3-13 Switch Information 3.2 Viewing Switch Port Information Port screen displays configuration, runtime status, and statistics of the ports on the switch. SWITCH NOTE: The ports available vary by switch platform. RFS6000: ge1, ge2, ge3, ge4, ge5, ge6, ge7, ge8, me1, up1 RFS7000: ge1, ge2, ge3, ge4, me1 RFS4000: ge1, ge2, ge3, ge4, ge5, up1 The port types are defined as follows:...
Page 70 3-14 Motorola RF Switch System Reference 2. Select the Configuration tab to display the following read-only information: Name Displays the current port name. The port names available vary by switch. RFS6000: ge1, ge2, ge3, ge4, ge5, ge6, ge7, ge8, me1, up1, wan RFS7000: ge1, ge2, ge3, ge4, me1 RFS4000: ge1, ge2, ge3, ge4, ge5.
Page 71 3-15 Switch Information 1. Select a port from the table displayed within the Configuration screen. 2. Click the Edit button. Port Change Warning screen displays, stating any change to the port setting could disrupt access to the switch. Communication errors may occur even if modifications made are successful. 3.
Page 72: Viewing The Ports Runtime Status
3-16 Motorola RF Switch System Reference Name Displays the read-only name assigned to the port. Speed Select the speed at which the port can receive and transmit the data. Select from the following range: • 10 Mbps • 100 Mbps •...
Page 73: Reviewing Port Statistics
3-17 Switch Information 2. Select the Runtime tab to display the following read-only information: Name Displays the port’s current name. MAC Address Displays the port’s MAC Address. This value is read-only, set at the factory and cannot be modified. Oper Status Displays the link status of the port.
Page 74 3-18 Motorola RF Switch System Reference 2. Select the Statistics tab. 3. Refer to the Statistics tab to display the following read-only information: Name Defines the port name. The port names available vary by switch. RFS6000: ge1, ge2, ge3, ge4, ge5, ge6, ge7, ge8, me1, up1, wan...
Page 75 3-19 Switch Information 3.2.3.1 Detailed Port Statistics To view detailed statistics for a port: 1. Select a port from the table displayed within the Statistics screen. 2. Click the Details button. 3. The Interface Statistics screen displays. This screen displays the following statistics for the selected port: Name Displays the port name.
Page 76 3-20 Motorola RF Switch System Reference Output Unicast Displays the number of unicast packets (packets directed towards a single Packets destination address) transmitted from the interface. Output NonUnicast Displays the number of unicast packets transmitted from the interface. Packets Output Total Packets Displays the total number of packets transmitted from the interface.
Page 77: Power Over Ethernet (Poe)
3-21 Switch Information • Input Bytes • Input Pkts Dropped • Output Pkts Total • Output Pkts Error • Input Pkts Total • Input Pkts Error • Output Pkts NUCast • Input Pkts NUCast • Output Bytes • Output Pkts Dropped 3.
Page 78 3-22 Motorola RF Switch System Reference 2. Select the SWITCH NOTE: The PoE screen is available on the RF6000 and RFS4000 switches. The RFS7000 switch does not have Power over Ethernet on any ports and will not display the PoE tab.
Page 79: Editing Port Poe Settings
3-23 Switch Information Priority Displays the priority mode for each of the PoE ports. The priority options are: • Critical • High • Low Limit (watts) Displays the power limit in watts for each of the PoE ports. The maximum power limit per port is 36 watts.
Page 80: Configuring Wan Interface Cards
3-24 Motorola RF Switch System Reference 3.2.6 Configuring WAN Interface Cards The RFS6000 switch supports 3G Wireless WAN cards using the ExpressCard slot. In order to use a 3G Wireless WAN card with the switch, it must first be initialized on a laptop. For activation and initialization information, refer to the instructions included with the card.
Page 81: Viewing Switch Configurations
Motorola RFMS can help optimize the positioning and configuration of a switch (and its associated radios) in respect to a WLAN’s MU throughput requirements and can help detect rogue devices.
Page 82: Viewing The Detailed Contents Of A Config File
3.3.1 Viewing the Detailed Contents of a Config File The View screen displays the entire contents of a configuration file. Motorola recommends a file be reviewed carefully before it is selected from the Config Files screen for edit or designation as the switch startup configuration.
Page 83: Transferring A Config File
3-27 Switch Information Use the up and down navigation facilities on the right-hand side of the screen to view the entire page. 3. The Page parameter displays the portion of the configuration file in the main viewing area. The total number of pages in the file are displayed to the right of the current page. The total number of lines in the file display in the Status field at the bottom of the screen.
Page 84 3-28 Motorola RF Switch System Reference 1. Click the Transfer Files button on the bottom of the Configuration screen. 2. Refer to the Source field to define the location and address information for the source config file. From Select the location representing the source file’s current location using the From drop-down menu.
Page 85: Viewing Switch Firmware Information
3-29 Switch Information 3.4 Viewing Switch Firmware Information The switch can store (retain) two software versions (primary and secondary). Information supporting the two versions displays within the Firmware screen. The Version column displays the version string. The Build Time is the date and time each version was generated. Install represents the date and time the upgrade was performed.
Page 86: Editing The Switch Firmware
3-30 Motorola RF Switch System Reference 3. Refer to the Patch field for a listing of the patches available to the switch. The name and version of each patch file is displayed. Each patch file has an associated .txt file designation. The text file describes nuances associated with the file that may make it optimal for use with the switch.
Page 87: Updating The Switch Firmware
3-31 Switch Information 1. Select an image from the table in the Firmware screen. 2. Click the Global Settings button. 3. Select the Enable Image Failover checkbox to load an alternative firmware version if the WLAN module fails to load the selected version successfully after 2 reboot attempts. 4.
Page 88: Switch File Management
3-32 Motorola RF Switch System Reference 5. From the Using drop down menu, select either FTP or TFTP as a medium to update the firmware. a. Use to get the firmware update from a File Transfer Protocol (FTP) server. A user account must be established on the FTP server specified for the firmware update.
Page 89 3-33 Switch Information 1. Select Switch > File Management from the main menu tree. 2. Refer to the Status field to specify the details of the source file. From Use the From drop-down menu to select the source file’s current location. The options include Wireless Switch and Server.
Page 90 3-34 Motorola RF Switch System Reference 1. Select Wireless Switch from the From drop-down menu 2. Use the Browse button to locate a target file for the file transfer. 3. Use the drop-down menu (within the Target field) and select Wireless Switch.
Page 91 3-35 Switch Information 1. Refer to the Source field to specify the source file. Use the From drop-down menu and select Wireless Switch. 2. Use the Browse button and select a file for transfer. 3. Use the drop-down menu (within the Target field) and select Server. This defines the transfer location of the configuration file.
Page 92: Viewing Files
3-36 Motorola RF Switch System Reference 1. Refer to the Source field to specify the details of the source file. Use the From drop-down menu and select Server. 2. Provide the name of the File. 3. Use the Using drop-down menu to configure whether the file transfer is conducted using FTP, TFTP, or SFTP.
Page 93 3-37 Switch Information • Compact Flash • USB 1 • USB 2 SWITCH NOTE: USB 1 is available on the RFS6000 and RFS7000 switches. USB2 and Compact Flash are only available on the RFS7000 switch. Transfer files between the switch and the server from any one of the above mentioned locations. Since compact flash (CF) and USB are external memory locations, the File System window displays the status of these devices.
Page 94: Configuring Automatic Updates
Enable this option for either the firmware, configuration file, or cluster configuration file. Motorola recommends leaving this setting disabled if a review of a new file is required before it is automatically uploaded by the switch.
Page 95 3-39 Switch Information Protocol Use the Protocol drop-down menu to specify the FTP, TFTP, HTTP, SFTP, resident switch FLASH medium used for the file update from the server. FLASH is the default setting. Password Enter the password required to access the server. SWITCH NOTE: In addition to the Protocols listed on the RFS7000, users can also auto-...
Page 96 3-40 Motorola RF Switch System Reference 5. Select the Start Update button to begin the file updates for the enabled switch configuration, cluster configuration, or firmware facilities. 6. Click the Apply button to save the changes to the configuration. 7. Click the Revert button to revert back to the last saved configuration.
Page 97: Viewing The Switch Alarm Log
3-41 Switch Information 3.7 Viewing the Switch Alarm Log Use the Alarm Log screen as an initial snapshot for alarm log information. Expand alarms (as needed) for greater detail, delete alarms, acknowledge alarms, or export alarm data to a user-specified location for archive and network performance analysis.
Page 98: Viewing Alarm Log Details
3-42 Motorola RF Switch System Reference Time Stamp Displays the date, year, and time the alarm was raised (as well as the time zone of the system). The time stamp only states the time the alarm was generated, not the time it was acknowledged.
Page 99: Viewing Switch Licenses
3-43 Switch Information 2. Select an alarm and click the Details button. 3. Refer to the Alarm Details Alarm Message for the following information: Description Displays the details of the alarm log event. This information can be used in conjunction with the Solution Possible Causes items to troubleshoot the...
Page 100 License Key Enter the license key required to install a particular feature. The license key is returned when you supply the switch serial number to Motorola support. Feature Name Enter the name of the feature you wish to install/upgrade using the license.
Page 101 3-45 Switch Information License Usage Lists the number of license in use. Determine whether this number adequately represents the number of switches needed to deploy. License Key The license key for the feature installed/upgraded.
Page 102: How To Use The Filter Option
3-46 Motorola RF Switch System Reference 3.9 How to use the Filter Option Use the Filter Option to sort the display details of screen that employ the filtering option as a means of sorting how data is displayed within the screen.
Page 103: Chapter 4. Network Setup
Network Setup This chapter describes the Network Setup menu information used to configure the switch. This chapter consists of the following switch Network configuration activities: • Displaying the Network Interface • Viewing Network IP Information • Viewing and Configuring Layer 2 Virtual LANs •...
Page 104: Displaying The Network Interface
4-2 Motorola RF Switch System Reference Guide 4.1 Displaying the Network Interface The main Network interface displays a high-level overview of the configuration (default or otherwise) as defined within the Network main menu. Use the information to determine if items require additional configuration using the sub-menu items under the main Network menu item.
Page 105 Network Setup 2. Refer to the following information to discern if configuration changes are warranted: DNS Servers Displays the number of DNS Servers configured thus far for use with the switch. For more information, see Viewing Network IP Information on page 4-4.
Page 106: Viewing Network Ip Information
4-4 Motorola RF Switch System Reference Guide 4.2 Viewing Network IP Information Use the Internet Protocol screen to view and configure network-associated IP details. The Internet Protocol screen contains tabs supporting the following configuration activities: • Configuring DNS • Configuring IP Forwarding •...
Page 107 Network Setup 6. Click the Global Settings button to open a screen that allows the domain lookup to be enabled/disabled and the domain name to be specified. For more information, see Configuring Global Settings on page 4-5. 4.2.1.1 Adding an IP Address for a DNS Server Add an IP address for a new domain server using the screen.
Page 108: Configuring Ip Forwarding
4-6 Motorola RF Switch System Reference Guide 6. Click Cancel to close the dialog without committing updates to the running configuration. 4.2.2 Configuring IP Forwarding The IP Forwarding table lists all the routing entries to route the packets to a specific destination. To view the IP forwarding configuration: 1.
Page 109 Network Setup Protocol Displays the name of the routing protocol with which this route was obtained. Possible values are: • Static — Routes are statically added by the operator. • DHCP — Routes obtained from the DHCP server. • Connected — Routes automatically installed by the switch for directly connected networks based on interface IP addresses.
Page 110: Viewing Address Resolution
4-8 Motorola RF Switch System Reference Guide 7. Click Cancel to close the dialog without committing updates to the running configuration. 4.2.3 Viewing Address Resolution Address Resolution table displays the mapping of layer three (IP) addresses to layer two (MAC) addresses.
Page 111: Viewing And Configuring Layer 2 Virtual Lans
Network Setup 4.3 Viewing and Configuring Layer 2 Virtual LANs A virtual LAN (VLAN) is similar to a Local Area Network (LAN), however devices do not need to be connected to the same segment physically. Devices operate as if connected to the same LAN, but could be connected at different physical connections across the LAN segment.
Page 112: Editing The Details Of An Existing Vlan By Port
4-10 Motorola RF Switch System Reference Guide Allowed VLANs Displays VLAN tags allowed on this interface Tagged Native VLAN Displays if the Native VLAN for each port is tagged or not. The column displays a green check mark if the Native VLAN is tagged. If the Native VLAN is not tagged, the column will display a red “x”.
Page 113: Viewing And Configuring Ports By Vlan
4-11 Network Setup 4. Use the Edit screen to modify the VLAN’s mode, access VLAN, and allowed VLAN designation. 5. Use the Edit screen to modify the following: Name Displays a read-only field and with the name of the Ethernet to which the VLAN is associated.
Page 114 4-12 Motorola RF Switch System Reference Guide 2. Select the Ports by VLAN tab. VLAN details are displayed within the VLANs by Port tab. 3. Highlight an existing VLAN and click the Edit button. The system displays a Port VLAN Change Warning message stating that changing VLAN designations could disrupt access to the switch.
Page 115: Configuring Switch Virtual Interfaces
4-13 Network Setup 6. Click to use the changes to the running configuration and close the dialog. 7. Click Cancel to close the dialog without committing updates to the running configuration. 4.4 Configuring Switch Virtual Interfaces A Switch Virtual Interface (SVI) is required for layer 3 (IP) access to the switch or to provide layer 3 service on a VLAN.
Page 116 4-14 Motorola RF Switch System Reference Guide DHCP Displays whether the DHCP client is enabled or not. A green check mark defines the DHCP client as enabled for the interface. A red X means the interface is disabled. Primary IP Address Displays the IP address for the virtual interface.
Page 117 4-15 Network Setup 3. Click the button. 4. Enter the VLAN ID for the switch virtual interface. 5. Provide a Description for the VLAN, representative of the VLAN’s intended operation within the switch managed network. 6. The Primary IP Settings field consists of the following: a.
Page 118: Viewing Virtual Interface Statistics
4-16 Motorola RF Switch System Reference Guide 2. Select the Configuration tab and click the Edit button. The screen displays with the name of the VLAN in the upper left-hand side. The VLAN ID cannot be modified and should be used to associate the VLAN ID with the description and IP address assignments defined.
Page 119 4-17 Network Setup 2. Select the Statistics tab. Refer to the following to assess the network throughput of existing virtual interfaces: Name Displays the user-defined interface name. The corresponding statistics are displayed along the row. The statistics are the total traffic to the interface since its creation.
Page 120 4-18 Motorola RF Switch System Reference Guide Packets In Error Displays the number of error packets coming into the interface. • Runt frames — Packets shorter than the minimum Ethernet frame length (64 bytes). • CRC errors — The Cyclical Redundancy Check (CRC) is the 4 byte field at the end of every frame.
Page 121 4-19 Network Setup 3. The Interface Statistics screen displays the following content: Name Displays the title of the logical interface selected. MAC Address Displays physical address information associated with the interface. This address is read-only (hard-coded at the factory) and cannot be modified. Input Bytes Displays the number of bytes received by the interface.
Page 122 4-20 Motorola RF Switch System Reference Guide 4.4.2.2 Viewing the Virtual Interface Statistics Graph The switch Web UI continuously updates its virtual interface statistics, even when the graph is closed. Periodically display the virtual statistics graph for the latest information as network performance information is required.
Page 123: Viewing And Configuring Switch Wlans
4-21 Network Setup 4. Refer to the Status field for the current state of the requests made from applet. This field displays error messages if something goes wrong in the transaction between the applet and the switch. 5. Click Close to close the dialog.
Page 124 4-22 Motorola RF Switch System Reference Guide 2. Click the Configuration tab. Configuration tab displays the following details: Switch Switch field displays the IP address of the cluster member associated with each WLAN. When clustering is enabled on the switch and...
Page 125 4-23 Network Setup Authentication Displays the type of authentication used with the specified WLAN. Click the Edit button to modify the WLAN’s current authentication scheme. For information on configuring an authentication scheme for a WLAN, see Configuring Authentication Types on page 4-33.
Page 126 4-24 Motorola RF Switch System Reference Guide 7. Click the Push Splash.. button to push the No Service page from the switch to all the adopted AAPs. The No Service page notifies the client user that a critical resource such as a RADIUS server is not available at that time.
Page 127 4-25 Network Setup Manual mapping of Use this option (it is selected by default) for custom WLAN to Radio mappings. WLANs When this option is disabled, the user cannot conduct Radio – WLAN mapping. Additionally, the user cannot enable WLANs with an index higher than 16. (The WLAN numbers will depend on the device on which this feature is enabled).
Page 128 4-26 Motorola RF Switch System Reference Guide 4. Click the Edit button. The Wireless LANs Edit screen is divided into the following user-configurable fields: • Switch IP • Configuration • Authentication • Encryption • Advanced 5. The Switch field displays the IP address of the cluster member associated with each WLAN. When...
Page 129 4-27 Network Setup Deny Static MU Enabling this option provides WLAN based configuration to allow only traffic from those mobile units whose IP is present in the layer 3 entity table. If the IP entry is not present in the layer 3 entity table, the event will be logged and the packet dropped.
Page 130 4-28 Motorola RF Switch System Reference Guide NOTE: When configuring wireless settings for Adaptive APs, all configuration must be done through the switch and not from the AP management console. Making changes directly in the AP management console can lead to unstable operation of the Adaptive AP.
Page 131 For detailed information on configuring WEP 128 for the WLAN, see Configuring WEP 128 / KeyGuard on page 4-55. KeyGuard Uses a Motorola proprietary encryption mechanism to protect data. For detailed information on configuring KeyGuard for the WLAN, see Configuring WEP 128 / KeyGuard on page 4-55.
Page 132 4-30 Motorola RF Switch System Reference Guide 9. Refer to the Advanced field for the following information: If using a Syslog server to conduct accounting for the switch, select the Syslog Accounting Mode option from the Accounting Mode drop-down menu. Once selected, a...
Page 133 4-31 Network Setup MCast Addr 2 The second address also takes packets (where the first 4 bytes match the first 4 bytes of the mask) and sends them immediately over the air instead of waiting for the DTIM period. Any multicast/broadcast that does not match this mask will go out only on DTIM Intervals.
Page 134 4-32 Motorola RF Switch System Reference Guide 6. Configure the Multiple VLAN Mapping for WLAN table as required to add or remove multiple VLANS for the selected WLAN. Multiple VLANs per WLAN are mapped (by default) to a regular VLAN and are not supported on an adaptive AP.
Page 135 4-33 Network Setup 4.5.1.3 Configuring Authentication Types Refer to the following to configure the WLAN authentication options available on the switch: • Configuring 802.1x EAP • Configuring Kerberos • Configuring Hotspots • Configuring an Internal Hotspot • Configuring External Hotspot •...
Page 136 Once an MU and server prove their identity, they can encrypt all communications to assure privacy and data integrity. Kerberos can only be used with Motorola clients. CAUTION: Kerberos makes no provisions for host security. Kerberos assumes that it is running on a trusted host with an untrusted network.
Page 137 4-35 Network Setup 5. Click the Config... button to the right of the Kerberos checkbox. The Kerberos screen displays. 6. Specify a case-sensitive Realm Name. The realm name is the name domain/realm name of the KDC Server. A realm name functions similarly to a DNS domain name.
Page 138 4-36 Motorola RF Switch System Reference Guide 3. Customized internal web pages (using the Advanced feature in hotspot configuration) When users visit a public hotspot and wants to browse a Web page, they can boot up their laptop or device and associate with the local Wi-Fi network by entering the correct SSID.
Page 139 4-37 Network Setup from an external source (like an FTP server) and hosting them on the switch. For more information, Configuring Advanced Hotspot on page 4-44. NOTE: The appearance of the Hotspot screen differs depending on which option is selected from the drop-down menu. You may want to research the options available before deciding which hotspot option to select.
Page 140 4-38 Motorola RF Switch System Reference Guide 3. Select the Hotspot button from within the Authentication field. Click the Config button to the right of the Hotspot checkbox. Ensure Internal is selected from within the This WLAN’s Web Pages are of drop-down menu.
Page 141 4-39 Network Setup Main Logo URL Displays the URL for the main logo image displayed on the Failed page when using the switch’s internal Web server. This option is only available if Internal is chosen from the drop-down menu above. Descriptive Text Specify any additional text containing instructions or information for the users who access the Failed page.
Page 142 4-40 Motorola RF Switch System Reference Guide Small Logo URL The Small Logo URL is the URL for a small logo image displayed on the Failed page when using the internal Web server. This option is only available if Internal chosen from the drop-down menu above.
Page 143 4-41 Network Setup 10.Refer to the field, and enter any IP address (for internal or external Web sites) that may be Allow List accessed by the Hotspot user without authentication. NOTE: In multi-switch hotspot environments if a single switch’s internal pages are configured for authentication on the other switches, those switches will redirect to their own internal pages instead.
Page 144 4-42 Motorola RF Switch System Reference Guide 3. Select the Hotspot button from within the Authentication field. Click the Config button to the right of the Hotspot checkbox. Ensure External is selected from within the This WLAN’s Web Pages are of drop-down menu.
Page 145 4-43 Network Setup Failed Page URL Define the complete URL for the location of the Failed page. The Failed screen assumes that the hotspot authentication attempt has failed, you are not allowed to access the Internet and you need to provide correct login information to access the Web.
Page 146 4-44 Motorola RF Switch System Reference Guide 16.Click Cancel to close the dialog without committing updates to the running configuration. NOTE: While using the External web pages option: 1. Configure the Internal Web pages for a particular WLAN. 2. Copy the Internal Web pages corresponding to the WLAN from the switch to the external Web server.
Page 147 4-45 Network Setup 4. Select the Hotspot button from within the Authentication field. Ensure Advanced is selected from within the This WLAN’s Web Pages are of the drop-down menu. Once the properties of the advanced hotspot have been defined, the file can be installed on the switch and used to support the hotspot.
Page 148 4-46 Motorola RF Switch System Reference Guide 5. Refer to the field, and enter any IP address (for internal or external Web sites) that may be Allow List accessed by the Hotspot user without authentication. 6. Check the Use System Name in Hotspot URL...
Page 149 (default users are admin with superuser privileges and operator with monitor privileges). No secondary authentication source is specified. However, Motorola recommends using an external Radius Server as the primary user authentication source and the local switch Radius Server as the secondary user authentication source.
Page 150 To configure an external Radius Server for EAP 802.1x, Hotspot, or Dynamic MAC ACL WLAN support: NOTE: To optimally use an external Radius Server with the switch, Motorola recommends defining specific external Server attributes to best utilize user privilege values for specific switch permissions.
Page 151 4-49 Network Setup 6. Refer to the Server field and define the following credentials for a primary and secondary Radius server. RADIUS Server Enter the IP address of the primary and secondary server acting as the Radius user Address authentication data source. RADIUS Port Enter the TCP/IP port number for the primary and secondary server acting as the Radius user authentication data source.
Page 152 Configuring an External Radius Server for Optimal Switch Support The switch’s external Radius Server should be configured with Motorola RF Switch specific attributes to best utilize the user privilege values assignable by the Radius Server. The following two values should be configured on the external Server for optimal use with the switch: •...
Page 153 4-51 Network Setup access, configure the Radius Server with two attributes. Once with a value 1 for monitor access and then with a value 2 for the helpdesk role. Multiple roles can also be defined by configuring the Radius Server with attribute 1 and value 3 (or monitor value 1 and helpdesk value 2).
Page 154 4-52 Motorola RF Switch System Reference Guide 1. Select Network > Wireless LANs from the main menu tree. 2. Select an existing WLAN from those displayed with the Configuration tab. 3. Click on the Edit button. 4. Select either the 802.1x,...
Page 155 4-53 Network Setup Server Timeout Enter a value (between 1 and 300 seconds) to indicate the number of elapsed seconds causing the switch to time out on a request to the primary or secondary NAC server. Server Retries Enter a value between 1 and 100 to indicate the number of times the switch attempts to reach the primary or secondary server before giving up.
Page 156 4-54 Motorola RF Switch System Reference Guide 11.Refer to the Status field for the current state of the requests made from applet. This field displays error messages if something goes wrong in the transaction between the applet and the switch.
Page 157 Generate button. The pass key can be any alphanumeric string. The switch, other proprietary routers, and Motorola MUs use the algorithm to convert an ASCII string to the same hexadecimal number. MUs without Motorola adapters need to use WEP keys manually configured as hexadecimal numbers.
Page 158 Generate button. The pass key can be any alphanumeric string. The switch and Motorola MUs use the algorithm to convert an ASCII string to the same hexadecimal number. MUs without Motorola adapters need to use WEP keys manually configured as hexadecimal numbers.
Page 159 4-57 Network Setup Configuring WPA/WPA2 using TKIP and CCMP Wi-Fi Protected Access (WPA) is a robust encryption scheme specified in the IEEE Wireless Fidelity (Wi-Fi) standard, 802.11i. WPA provides more sophisticated data encryption than WEP. WPA is designed for corporate networks and small-business environments where more wireless traffic allows quicker discovery of encryption keys by an unauthorized person.
Page 160 4-58 Motorola RF Switch System Reference Guide 5. Select the Broadcast Key Rotation checkbox to enable periodically changing the broadcast key for this WLAN. Only broadcast key changes when required by associated MUs to reduce the transmissions of sensitive key information. This value is enabled by default.
Page 161 4-59 Network Setup Opportunistic Key Opportunistic Key Caching allows the switch to use a PMK derived with a Caching client on one Access Port with the same client when it roams over to another Access Port. Upon roaming, the client does not have to conduct 802.1x authentication and can start sending/receiving data sooner.
Page 162: Viewing Wlan Statistics
4-60 Motorola RF Switch System Reference Guide 4.5.2 Viewing WLAN Statistics Statistics screen displays read-only statistics for each WLAN. Use this information to assess if configuration changes are required to improve network performance. If a more detailed set of WLAN...
Page 163 4-61 Network Setup Avg BPS Displays the average bit speed in Mbps for the selected WLAN. This includes all packets sent and received. % Non-UNI Displays the percentage of the total packets for the selected WLAN that are non- unicast packets. Non-unicast packets include broadcast and multicast packets. Retries Displays the average number of retries for all MUs associated with the selected WLAN.
Page 164 4-62 Motorola RF Switch System Reference Guide Details screen contains the following fields: • Information • Traffic • RF Status • Errors Information in black represents the statistics from the last 30 seconds and information in blue represents statistics from the last hour.
Page 165 4-63 Network Setup 6. Refer to the RF Status field for the following information: Avg MU Signal Displays the average RF signal strength in dBm for all MUs associated with the selected WLAN. The number in black represents this statistics for the last 30 seconds and the number in blue represents this statistics for the last hour.
Page 166 4-64 Motorola RF Switch System Reference Guide 2. Click the Graph button. WLAN Statistics screen displays for the select port. The WLAN Statistics screen provides the option of viewing the graphical statistics of the following parameters: • Pkts per sec •...
Page 167: Configuring Wmm
WLAN. NOTE: The Motorola RF Management Software is recommended to plan the deployment of the switch. Motorola RFMS can help optimize the positioning and configuration of a switch in respect to a WLAN’s MU throughput requirements. For more information, refer to the Motorola Web site.
Page 168 4-66 Motorola RF Switch System Reference Guide 1. Select Network > Wireless LANs from the main menu tree. 2. Click the tab. tab displays the following information: Displays the WLANs numerical identifier. This field is displayed in a two part format.
Page 169 4-67 Network Setup Transmit Ops Displays the maximum duration a device can transmit after obtaining a transmit opportunity. For higher-priority traffic categories, this value should be set to a low number. CW Min The CW Min is combined with the CW Max to make the Contention screen. From this range, a random number is selected for the back off mechanism.
Page 170 4-68 Motorola RF Switch System Reference Guide 4. Select the QoS Mappings button to revise the existing mappings of access category to 802.1p and DSCP to access category settings. With a drastic increase in bandwidth absorbing network traffic (VOIP, multimedia, etc.), the importance of data prioritization is critical to effective network management.
Page 171 4-69 Network Setup 4.5.3.1 Editing WMM Settings WLAN WMM configuration affects your upstream traffic parameters. Use Configuring WMM on page 4-111 to configure downstream traffic parameters. Use the WMM Edit screen to modify existing Access Category settings for the WLAN selected within the WMM screen. This could be necessary in instances when data traffic has changed and high-priority traffic (video and voice) must be accounted for by modifying AIFSN Transmit Ops and CW values.
Page 172: Configuring The Nac Inclusion List
4-70 Motorola RF Switch System Reference Guide Transmit Ops Defines the maximum duration a device can transmit after obtaining a transmit opportunity. For higher-priority traffic categories, this value should be set to a low number. CW Minimum The CW Minimum is combined with the CW Maximum to make the Contention screen.
Page 173 4-71 Network Setup To view the attributes of a NAC Include list: 1. Select Network > Wireless LANs from the main menu tree. 2. Select the NAC Include List Configuration tab to view and configure NAC enabled devices. 3. The Include Lists field displays the list of devices that can be included on a WLAN (a printer for example).
Page 174 4-72 Motorola RF Switch System Reference Guide 4.5.4.1 Adding an Include List to a WLAN To add a device to a WLAN’s include list configuration: 1. Select Network > Wireless LANs from the main menu tree. 2. Select the NAC Include tab to view and configure NAC Include enabled devices.
Page 175 4-73 Network Setup 8. Click to save and add the new configuration and close the dialog window. 9. Click Cancel to close the dialog without committing updates to the running configuration. 4.5.4.3 Mapping Include List Items to WLANs To assign include list items to one or more WLANs: 1.
Page 176: Configuring The Nac Exclusion List
4-74 Motorola RF Switch System Reference Guide 4.5.5 Configuring the NAC Exclusion List The switch provides a means to bypass NAC for 802.1x devices without a NAC agent. For Motorola handheld devices (like the MC9000), authentication is achieved using an exclusion list.
Page 177 4-75 Network Setup 5. The Configured WLANs field displays the available switch WLANs. Associate a list item in the Exclude Lists field with multiple WLANs. For information on mapping NAC Exclude list’s items to WLANs, see Mapping Exclude List Items to WLANs on page 4-76.
Page 178 4-76 Motorola RF Switch System Reference Guide 3. Click the button in the List Configuration field. 4. The List Name displays the read-only name of the list for which you wish to add more devices. 5. Enter the Host Name for the device you wish to add for the selected exclude list.
Page 179: Nac Configuration Examples Using The Switch Cli
The following are NAC include list, exclude list, and WLAN configuration examples using the switch CLI interface: 4.5.6.1 Creating an Include List Since few devices require NAC, Motorola recommends using the "bypass-nac-except-include-list" option. Refer to the commands below to create a NAC Include List: 1. Create a NAC include list.
Page 180 4-78 Motorola RF Switch System Reference Guide 3. Associate the exclude list to a WLAN. RF Switch(config-wireless-client-list) #wlan 1 RF Switch(config-wireless-client-list) # 4.5.6.3 Configuring the WLAN for NAC Many handheld devices are required to bypass NAC, and a few laptops and desktops are required to be NAC validated.
Page 181 4-79 Network Setup RF Switch (config-wireless) #wlan 1 radius-server secondary radius-key my-rad-secret-2 RF Switch (config-wireless) # 4. Configure the NAC server’s timeout and re-transmit settings. The timeout parameter configures the duration for which the switch waits for a response from the Radius server before attempting a retry. This is a global setting for both the primary and secondary server.
Page 182: Viewing Associated Mu Details
• Viewing MU Voice Statistics NOTE: The Motorola RF Management Software is a recommended utility to plan the deployment of the switch and view its configuration once operational. Motorola RFMS can help optimize switch positioning and configuration in respect to a WLAN’s MU throughput requirements and can help detect rogue devices.
Page 183: Viewing Mu Details
4-81 Network Setup MAC Name Displays the MAC name associated with each MU's MAC Address. The MAC Name is a user-created name used to identify individual mobile unit MAC Addresses with a user-friendly name. IP Address Displays the unique IP address for the MU. Use this address as necessary throughout the applet for filtering and device intrusion recognition and approval.
Page 184 4-82 Motorola RF Switch System Reference Guide 3. Select a MU from the table in the Status screen and click the Details button. 4. Refer to the following read-only MU’s transmit and receive statistics:. MAC Address Displays the Hardware or Media Access Control (MAC) address for the MU.
Page 185 4-83 Network Setup Voice Displays whether or not the MU is a voice capable device. Traffic from a voice enabled MU is handled differently than traffic from MUs without this capability. MUs grouped to particular WLANs can be prioritized to transmit and receive voice traffic over data traffic.
Page 186: Configuring Mobile Units
4-84 Motorola RF Switch System Reference Guide 4. Check the Trigger Beacon Request box to enable Radio Resource Management services on the selected MU. 5. In the Measurement Duration field, enter a time interval between 500-1000(in K-us) to specify how often the Radio Resource Measurement services will poll the selected MU for traffic information.
Page 187: Viewing Mu Statistics
4-85 Network Setup 4. When using clustering and the Cluster GUI feature is enabled, a pull-down menu will be available to select which cluster members’ MUs are displayed. To view MUs from all cluster members, select from the pull-down menu. To view MUs from a specific cluster member, select that member’s IP address from the pull-down menu.
Page 188 4-86 Motorola RF Switch System Reference Guide 2. Click the Statistics tab. 3. Select the Last 30s checkbox to display MU statistics gathered over the last 30 seconds. This option is helpful for assessing MU performance trends in real-time. 4. Select the Last HR checkbox to display MU statistics gathered over the last hour.
Page 189 4-87 Network Setup % Non Unicast Displays the percentage of the total packets for the selected MU that are non- unicast packets. Non-unicast packets include broadcast and multicast packets. Retries Displays the average number of retries per packet. A high number in this field could indicate possible network or hardware problems.
Page 190 4-88 Motorola RF Switch System Reference Guide Information in black represents the statistics from the last 30 seconds and information in blue represents statistics from the last hour. Use both sets of data to trend statistics in real time versus a measurable period (1 hour).
Page 191: Viewing Mu Voice Statistics
4-89 Network Setup % Gave Up Pkts Displays the percentage of packets the switch gave up on for the selected MU. % of Undecryptable Displays the percentage of undecryptable packets (packets that could not be Pkts processed) for the selected MU. 8.
Page 192 4-90 Motorola RF Switch System Reference Guide 2. Click the Voice Statistics tab. The Voice Statistics table displays the following information: Call Index Displays the numerical identifier assigned to each Access Port. MAC Address Displays MAC Address Voice Protocol Displays which voice protocol is being used for the selected call. Voice protocols include: •...
Page 193: Viewing Access Port Information
AP licenses and on a per platform basis and will typically be lower than 256. NOTE: The Motorola RF Management Software is a recommended utility to plan the deployment of the switch and view its configuration once operational. Motorola RFMS can help optimize the positioning and configuration of a switch and Access Ports in respect to a WLAN’s MU throughput requirements.
Page 194 Description Displays a user-assigned name for the radio. AP Type Displays the type of Access Port detected. The switches support Motorola AP 100, AP300 and AP650 model Access Ports and AP-4131, AP-5131 and AP-7131 model Access Points. Type Use the Type to identify whether the radio is 802.11b, 802.11bg and 802.11bgn or 802.11a and 802.11an.
Page 195 4-93 Network Setup State Displays the radio’s current operational mode. If the radio is set as a Detector AP, the state is "Detector", otherwise the state is "Normal". VLAN Displays the name of the VLAN currently used with each Access Port radio. 4.
Page 196 4-94 Motorola RF Switch System Reference Guide 11.When using clustering and the Cluster GUI feature is enabled, a pull-down menu will be available to select which cluster members’ Access Port radios are displayed. To view Access Port radios from all cluster members, select All from the pull-down menu.
Page 197 4-95 Network Setup 5. To use the AP as a Client Bridge, check the Client Bridge checkbox and configure the following information: Mesh Network When Client Bridge is enabled, enter the name of the Mesh Network that the Name selected radio will be a Client Bridge on. Max Client Bridge When Client Bridge is enabled, specify the maximum number of base bridges per Mesh Associations...
Page 198 WMM admission control is a mechanism for limiting traffic on a given access category. Per the recommendation of the 802.11e specification, Motorola limits support of this feature to voice and video. The switch configures the AP to broadcast that admission control is configured by default on AP300s(not clear).
Page 199 4-97 Network Setup 7. Check the Use Default Values option checkbox to set the Username and Password to factory default values. The Access Port can get disconnected if the 802.1x authenticator is not configured accordingly. NOTE: 802.1x username and password information is only passed to adopted Access Ports when the Username and Password are set.
Page 200 MU RSSI information. RSSI data (as obtained by at least three detecting radios) can be used by the Motorola RFMS application to triangulate the location of an MU on a site map representative of the actual physical dimensions of the switch radio coverage area.
Page 201 4-99 Network Setup 11.The following read-only information is displayed: MAC Address The Base Radio MAC is the radio's first MAC address when it is adopted by the Switch. Radio Type Radio type identifies whether the radio is an 802.11b, 802.11bg and 802.11bgn or 802.11a and 802.11an radio.
Page 202 4-100 Motorola RF Switch System Reference Guide 15.Antenna Gain relates the intensity of an antenna in a given direction to the intensity that would be produced by a hypothetical antenna that radiates equally in all directions and has no losses.
Page 203 4-101 Network Setup Specify a Request To Send (RTS) threshold (in bytes) for use by the WLAN's adopted RTS Threshold Access Ports. RTS is a transmitting station's signal that requests a Clear To Send (CTS) response from a receiving station. This RTS/CTS procedure clears the air where many MUs are contending for transmission time.
Page 204 4-102 Motorola RF Switch System Reference Guide DTIM Periods Select the DTIM periods button to specify a period for Delivery Traffic Indication Messages (DTIM) for BSS IDs 1-4. This is a divisor of the beacon interval (in milliseconds), for example, 10:100. (See "Beacon Interval“ above). A DTIM is periodically included in the beacon frame transmitted from adopted Access Ports.
Page 205 4-103 Network Setup 23.Click to use the changes to the running configuration and close the dialog. 24.Click Cancel to close the dialog without committing updates to the running configuration. Configuring Rate Settings Use the Rate Settings screen to define a set of basic and supported rates as well as the MCS data rates (only for AP 7131, AP 7181, and AP 650) for the target radio.
Page 206 4-104 Motorola RF Switch System Reference Guide NOTE: For AP 7131, AP 7181, and AP 650 the Rate Settings screen contains MCS data rates in addition to the basic rates. You can select the Enable Short Guard Interval option in the 11n Modulation Coding Schemes (MCS) section to increase the data rates.
Page 207: Viewing Ap Statistics
4-105 Network Setup 3. Click the button to display a screen containing settings for adding a radio 4. Enter the device MAC Address (the physical MAC address of the radio). Ensure that this address is the actual hard-coded MAC address of the device. 5.
Page 208 4-106 Motorola RF Switch System Reference Guide 2. Click the Statistics tab. 3. To select the time frame for the radio statistics, select either Last 30s Last Hr above the statistics table. • Select the Last 30s radio button to display statistics for the last 30 seconds for the radio.
Page 209 4-107 Network Setup % Non-UNI Displays the percentage of packets for the selected radio that are non-unicast packets. Non-unicast packets include broadcast and multicast packets. Retries Displays the average number of retries for all MUs associated with the selected radio. 5.
Page 210 4-108 Motorola RF Switch System Reference Guide 5. Refer to the Traffic field for the following information Pkts per second Displays the average total packets per second that cross the selected radio. The Rx column displays the average total packets per second received on the selected radio.
Page 211: Configuring Wlan Assignment
4-109 Network Setup 10.Click Cancel to close the dialog without committing updates to the running configuration. 4.7.2.2 Viewing AP Statistics in Graphical Format Access Port Radios Statistics tab has an option for displaying detailed Access Port radio statistics in a graph. This information can be used to chart associated switch radio performance and help diagnose radio performance issues.
Page 212 4-110 Motorola RF Switch System Reference Guide 3. Select a radio from the table to view WLAN assignment information. WLAN Assignment tab is divided into two fields: Select Radios Assigned WLANs. 4. Refer to the Select Radios field for the following information Index Displays the numerical index (device identifier) used with the radio.
Page 213: Configuring Wmm
4-111 Network Setup 3. Select a radio from the table and click the Edit button. Select Radio/BSS field displays the WLANs associated to each of the BSSIDs used by the radios within the radio table. Use Select/Change Assigned WLANs field to edit the WLAN assignment. 4.
Page 214 4-112 Motorola RF Switch System Reference Guide 2. Click the tab. WMM information displays per radio with the following information: Index Displays the identifier assigned to each Radio index, each index is assigned a unique identifier such as (1/4, 1/3, etc.).
Page 215 4-113 Network Setup 4.7.4.1 Editing WMM Settings Use the Edit screen to modify a WMM profile's properties (AIFSN, Tx Op, Cw Min, and CW Max). Modifying these properties may be necessary as Access Categories are changed and transmit intervals need to be adjusted to compensate for larger data packets and contention windows.
Page 216: Configuring Access Point Radio Bandwidth
4-114 Motorola RF Switch System Reference Guide 9. Click to use the changes to the running configuration and close the dialog. 10.Click Cancel to close the dialog without committing updates to the running configuration. 4.7.5 Configuring Access Point Radio Bandwidth...
Page 217 4-115 Network Setup To configure a group of radios together: 1. Select Network > Access Port Radios from the main menu tree. 2. Go to the Configuration tab. 3. Select a radio you wish to add to a group and click the Edit button.
Page 218: Viewing Active Calls (Ac) Statistics
4-116 Motorola RF Switch System Reference Guide 2. Click the Group tab. Group information displays per radio with the following data: Group Id Displays the Group Id associated with each adopted radio. Radio Configured The Index is the numerical index (device identifier) used with the device radio. Use...
Page 219: Viewing Mesh Statistics
4-117 Network Setup 2. Click the VCAC Statistics tab. 3. The following statistics are displayed: Index Displays the numerical identifier assigned to each Access Port. Description Displays the names assigned to each of the APs. The AP name can be configured on the Access Port Radios Configuration page.
Page 220 4-118 Motorola RF Switch System Reference Guide 2. Click the Mesh Statistics tab. 3. The following statistics are displayed: Mesh Index Displays the numerical identifier assigned to each mesh member AP. MAC Address Displays the Media Access Control (MAC) address for each Access Port.
Page 221: Smart Rf
4-119 Network Setup % Non-UNI % Non-Uni is the percentage of the total packets for the selected radio that are non-unicast packets. Non-unicast packets include broadcast and multicast packets. Retries Displays the total number of retries for each Access Port. 4.7.9 Smart RF When invoked by an administrator, Smart RF (or self-monitoring at run time) instructs radios to change to a specific channel and begin beaconing using their maximum available transmit power.
Page 222 4-120 Motorola RF Switch System Reference Guide • Extensible to future smart-tuning. For example, distinguish between AP to AP interference and static interference 4.7.9.3 Viewing Smart RF Information To view Smart RF information: 1. Select Network > Access Port Radios from the main menu tree.
Page 223 Displays the name assigned to the AP. The AP name can be configured on the Access Port Radios Configuration page. AP Type Displays the type of Access Port detected. The switches support Motorola AP 100, AP300 and AP650 model Access Ports and AP-4131, AP-5131 and AP-7131 model Access Points.
Page 224 Displays the Media Access Control (MAC) Address of the selected AP. AP Type Displays the type of Access Port detected. The switches support Motorola AP 100, AP300 and AP650 model Access Ports and AP-4131, AP-5131 and AP-7131 model Access Points.
Page 225 Displays the name assigned to the AP. The AP name can be configured on the Access Port Radios Configuration page. AP Type Displays the type of Access Port detected. The switches support Motorola AP 100, AP300 and AP650 model Access Ports and AP-4131, AP-5131 and AP-7131 model Access Points.
Page 226 4-124 Motorola RF Switch System Reference Guide Radio Type Displays the radio type of the corresponding APs. Available types are: • 802.11a • 802.11an • 802.11b • 802.11bg • 802.11bgn AP Location Displays the current location for the selected AP. The location can be configured on the Access Port Radios Configuration page.
Page 227 4-125 Network Setup 1. Select Network > Access Port Radios from the main menu tree. 2. Click the Smart RF 3. Click the Smart RF History button 4. The Smart RF History window displays the Index number and Assignment History of Smart RF activity.
Page 228 4-126 Motorola RF Switch System Reference Guide 3. Click the Smart RF Settings button 4. Click the Check All Boxes option in the Smart RF Global Settings dialogue to check every box in the configuration window. To uncheck all boxes, click this box a second time.
Page 229 4-127 Network Setup Remove To remove a channel from the configured list, select one or more channels from the Available box and click the Remove button. Number of Rescuers Assign a number of radios to dedicate as rescuers. The valid range is between 1 and 5.
Page 230: Voice Statistics
4-128 Motorola RF Switch System Reference Guide 11.Click the Calibration Status button to open a dialogue with the following calibration status information: Last Calibration Start Displays the date and time that the last Smart RF calibration began. Time Last Calibration End Displays the date and time that the last Smart RF calibration ended.
Page 231 4-129 Network Setup 2. Click the Voice Statistics tab. 3. The following statistics are displayed: Index Displays the numerical identifier assigned to each Access Port. Description Displays the names assigned to each of the APs. The AP name can be configured on the Access Port Radios Configuration page.
Page 232: Viewing Access Port Adoption Defaults
4-130 Motorola RF Switch System Reference Guide 4. Selecting a radio from the table will display the following details of individual calls: Index Displays the numerical identifier assigned to each MU. Protocol Displays which voice protocol is being used for the selected call. Voice protocols include: •...
Page 233 4-131 Network Setup 1. Select Network > Access Port Adoption Defaults from the main menu tree. 2. Click the Configuration tab. 3. Refer to the following information as displayed within the Configuration tab: Type Displays whether the radio is an 802.11b, 802.11bg and 802.11bgn or 802.11a and 802.11an radio.
Page 234 4-132 Motorola RF Switch System Reference Guide CAUTION: An Access Port is required to have a DHCP provided IP address before attempting layer 3 adoption, otherwise it will not work. Additionally, the Access Port must be able to find the IP addresses of the switches on the network.
Page 235 4-133 Network Setup 4. Click the Edit button to display a screen to change the radio adoption default values for the currently selected radio type (802.11b, 802.11bg and 802.11bgn or 802.11a and 802.11an). Properties field displays the Model family for the selected Access Port. The Model is read only and cannot be modified.
Page 236 4-134 Motorola RF Switch System Reference Guide 11.After first selecting a channel, select a power level in dBm for RF signal strength in the Desired Power (dBm) field. The optimal power level for the specified channel is best determined by a site survey prior to installation.
Page 237 4-135 Network Setup RTS Threshold Specify a Request To Send (RTS) threshold (in bytes) for use by the WLAN's adopted Access Ports. RTS is a transmitting station's signal that requests a Clear To Send (CTS) response from a receiving station. This RTS/CTS procedure clears the air where many MUs (or nodes) are contending for transmission time.
Page 238 4-136 Motorola RF Switch System Reference Guide DTIM Period Specify a period for the Delivery Traffic Indication Message (DTIM). This is a divisor of the beacon interval (in milliseconds), for example, 10:100. (See "Beacon Interval" above). A DTIM is periodically included in the beacon frame transmitted from adopted Access Ports.
Page 239 4-137 Network Setup Supported Rates allow an 802.11 network to specify the data rate it supports. When a station attempts to join the network, it checks the data rate used on the network. If a rate is selected as a basic rate, it is automatically selected as a supported rate.
Page 240: Configuring Layer 3 Access Port Adoption
4-138 Motorola RF Switch System Reference Guide 4.8.2 Configuring Layer 3 Access Port Adoption The configuration activity required for adopting Access Ports in a layer 3 environment is unique. In a layer 3 environment, switch discovery is attempted in the following ways: •...
Page 241 4-139 Network Setup 2. Click the WLAN Assignment tab. The Assigned WLANs tab displays two fields: Select Radios/BSS Select/Change Assigned WLANs. 3. With the Select Radios/BSS field, select the radio type to configure (802.11b, 802.11bg and 802.11bgn or 802.11a and 802.11an) from the Select Radio drop-down menu.
Page 242: Configuring Wmm
4-140 Motorola RF Switch System Reference Guide 6. Click Apply to save the changes made within the screen. 7. Click Revert to cancel the changes made and revert back to the last saved configuration. 4.8.4 Configuring WMM Use the tab to review each radio type, as well as the Access Category that defines the data (Video, Voice, Best Effort, and Background) the radio has been configured to process.
Page 243 4-141 Network Setup ECW Min The ECW Min is combined with the ECW Max to define the Contention Window. From this range, a random number is selected for the back off mechanism. Lower values are used for higher priority traffic. ECW Max The ECW Max is combined with the ECW Min to make the Contention Window.
Page 244: Configuring Access Ports
4-142 Motorola RF Switch System Reference Guide 6. Enter a value between 0 and 15 for the Contention Window minimum value. The CW Minimum is combined with the CW Maximum to make the Contention Window. From this range, a random number is selected for the back off mechanism. Lower values are used for higher priority traffic.
Page 245 4-143 Network Setup 3. Refer to the Adopted AP screen for the following information: Switch Switch field displays the IP address of the cluster member associated with each AP. When clustering is enabled on the switch and Cluster GUI is enabled, the Switch field will be available on the AP configuration screen.
Page 246: Viewing Unadopted Access Ports
4-144 Motorola RF Switch System Reference Guide 6. Click the Convert to Sensor button to convert the selected adopted AP300 to a sensor that can be used with the Wireless Intrusion Detection System (WIDS) application. NOTE: Both Access Ports and standalone Access Points can be converted to sensors.
Page 247 4-145 Network Setup Unadopted AP tab displays the following information: Index Displays a numerical identifier used to associate a particular Access Port with a set of statistics and can help differentiate the Access Port from other Access Ports with similar attributes. MAC Address Displays the unique Hardware or Media Access Control (MAC) address for the Access Port.
Page 248: Access Port Configuration
4-146 Motorola RF Switch System Reference Guide 3. Click the Export button to export the contents of the table to a Comma Separated Values file (CSV). CAUTION: An Access Port is required to have a DHCP provided IP address before attempting layer 3 adoption, otherwise it will not work.
Page 249 4-147 Network Setup Syslog Mode For the selected AAP, this option enables or disables logging to an external Syslog server. LLDP Settings Enables the Link Layer Discovery Protocol (LLDP), which is a protocol that enables devices to advertise their capabilities and media-specific configuration information.
Page 250 4-148 Motorola RF Switch System Reference Guide Native VLAN ID Assign a unique VLAN ID (from 1 to 4094) to each VLAN modified. The VLAN ID associates a frame with a specific VLAN and provides the information the access point needs to process the frame across the network. Therefore, it may be practical to assign a name to a VLAN representative or the area or type of network traffic it represents.
Page 251: Viewing Sensor Information
4-149 Network Setup 2. Click the Configuration tab. 3. Click the Syslog Config button. 4. Check the Enable Logging to Syslog Server option to enable logging to an external Syslog server. Select the logging level from the drop-down menu. 5. Enter the IP address of the external Syslog server in the Syslog Server IP Addr field.
Page 252 4-150 Motorola RF Switch System Reference Guide 2. Click the Sensor tab. 3. Specify the global default VLAN ID and the Ping Interval for all sensors and click the Apply button. 4. In the Default Configuration section, give the default configuration values of the WIPS server. Unselect...
Page 253: Configuring Secure Wispe
4-151 Network Setup 4.9.5 Configuring Secure WiSPe To configure Secure WiSPe: 1. Select Network > Access Port from the main menu tree. 2. Click the Secure WiSPe tab. 3. Enter a Default Pre-Shared Secret used for Secure WiSPe authentication. The shared secret must be between 8 and 64 characters.
Page 254: Configuring Adaptive Ap Firmware
4-152 Motorola RF Switch System Reference Guide 6. To enable Secure Mode, click the Enable Secure Mode button to enable secure-mode to a set of APs. The AP’s MAC Address and mode will be saved in the running configuration. If secure-mode is set to enable, it means that WISP-e transactions for this AP will be secured.
Page 255 4-153 Network Setup 1. Enable or disable Adaptive AP Automatic Update (AAP Automatic Update). AAP Automatic Check this box to enable automatic update of Access Port or Adaptive AP firmware Update when an Access Port or Adaptive AP associates with the switch. The AP image file used for automatic update are specified in the AP Image Upload Table below.
Page 256 4-154 Motorola RF Switch System Reference Guide 5. Specify the AP Image File. You can browse the switch file systems using the browser icon. AP images must be on the flash, system, nvram, or usb file systems in order for them to be selected.
Page 257 4-155 Network Setup 3. Select an AP image from the AP Image Upload Table and click the Update AAP Image button. AP Type identifies the Access Port model. MAC Address is the MAC address of the AP selected. Version gives you the current firmware version on the Access Port. Use this information to assess whether the software requires an upgrade for better compatibility with the Switch.
Page 258: Multiple Spanning Tree
4-156 Motorola RF Switch System Reference Guide server where all the AP images reside. User ID is the ID to log in to the SFTP server. Password is the SFTP password used while logging in. Path gives you the path of the AP image residing in the server.
Page 259: Configuring A Bridge
4-157 Network Setup • Viewing and Configuring Bridge Instance Details • Configuring a Port • Viewing and Configuring Port Instance Details 4.10.1 Configuring a Bridge Use the Bridge tab to configure the Bridge. This window displays bridge configuration details for the switch To configure the MSTP bridge:.
Page 260 4-158 Motorola RF Switch System Reference Guide MST Config. Name Enter a name for the MST region. This is used when configuring multiple regions within the network. Each switch running MSTP is configured with a unique MST region name. This helps when keeping track of MSTP configuration changes.
Page 261: Viewing And Configuring Bridge Instance Details
4-159 Network Setup Bridge Hello Time Displays the configured Hello Time. If this is the root bridge, the value is equal to the configured Hello Time. CIST Bridge Forward Enter the CIST bridge forward delay value received from the root bridge. If this is Delay the root bridge, the value will be equal to the Configured Forward Delay.
Page 262 4-160 Motorola RF Switch System Reference Guide 2. Select the Bridge Instance tab. Bridge Instance tab displays the following: Displays the ID of the MSTP instance. Bridge Priority Displays the bridge priority for the associated instance. The Bridge Priority is assigned to an individual bridge based on whether it is selected as the root bridge.
Page 263: Configuring A Port
4-161 Network Setup 3. Click the button. 4. Enter a value between 1 and 15 as the Instance ID. 5. Click to save and commit the changes. 6. The Bridge Instance tab will now display the new instance ID. 7. Click Cancel to disregard the new Bridge Instance ID.
Page 264 4-162 Motorola RF Switch System Reference Guide 2. Select the Port Port tab displays the following information (ensure you scroll to the right to view the numerous port variables described): Index Displays the port index. Admin MAC Enable Displays the status of the Admin MAC. Change the status using the Edit button.
Page 265 4-163 Network Setup AdminPort PortFast Displays the whether BPDU Guard is currently enabled for this port. Bpdu Guard When set for a bridge, all PortFast-enabled ports having the bpdu-guard set to default shut down the port on receiving the BPDU. When this occurs, the BPDU is not processed.
Page 266 4-164 Motorola RF Switch System Reference Guide Oper Edge Port Oper Edge Port Displays whether the port is currently an edge port. Admin Point-to-Point Displays the point-to-point status as ForceTrue or ForceFalse. ForceTrue indicates this port should be treated as connected to a point-to-point link. ForceFalse indicates this port should be treated as having a shared connection.
Page 267: Viewing And Configuring Port Instance Details
4-165 Network Setup Port Path Cost Port Path Cost displays the path cost for the specified port index. The default path cost depends on the speed of the interface. Speed Default path cost <=100000 bits/sec 200000000 <=1000000 bits/sec 20000000 <=10000000 bits/sec 2000000 <=100000000 bits/sec 200000...
Page 268 4-166 Motorola RF Switch System Reference Guide 2. Select the PortInstance tab. The Port Instance table displays the following: Displays the instance ID. Index Displays the port index. State Displays the MSTP state for the port for that instance. Role Displays the MSTP state of the port.
Page 269: Igmp Snooping
4-167 Network Setup 4.10.4.1 Editing a Port Instance Configuration To edit and reconfigure Port Instance parameters. 1. Select a row from the port table and click the Edit button. Most of the MSTP Port Instance parameters can be reconfigured, as indicated below. Port Instance ID Read-only indicator of the instance ID used as a basis for other modifications.
Page 270: Igmp Snoop Querier Configuration
4-168 Motorola RF Switch System Reference Guide 2. Select the IGMP Snoop Config IGMP Snoop Config tab displays the following information: Snoop Enable Select to enable IGMP Snooping on the switch. If disabled, snooping on a per VLAN basis is also disabled.
Page 271 4-169 Network Setup To view and configure IGMP Snoop Querier Configuration details: 1. Select Network > IGMP Snooping from the main menu tree. 2. Select the IGMP Snoop Querier Config IGMP Snoop Querier Config tab displays the following information: Max Response Time Specifies the maximum allowed time before sending a responding report.
Page 272: Wired Hotspot
4-170 Motorola RF Switch System Reference Guide Max Response Time The maximum time allowed in seconds before sending a responding report for a host. Operational State The current operational state of IGMP Querier for this VLAN. Displays 'querier' if IGMP Snoop Querier is enabled on this VLAN. Displays 'disabled' otherwise.
Page 273 4-171 Network Setup 2. Select the Configuration tab. Configuration tab displays the following information: Vlan Index Enter a Vlan index between 1 and 4094. Enable Click the Enable button to enable a hotspot. Vlan Index The Vlan index on which the hotspot is enabled. Primary RADIUS Server IP/ This is the IP address of the Primary RADIUS server and the port on which the Port...
Page 274 4-172 Motorola RF Switch System Reference Guide 1. Select Network > Wired Hotspot from the main menu tree. Select an existing hotspot entry from those displayed within the Configuration tab and click the Edit button. The following screen is displayed.
Page 275 4-173 Network Setup Main Logo URL Displays the URL for the main logo image displayed on the Login page when using the switch’s internal Web server. This option is only available if Internal is chosen from the drop-down menu above. Descriptive Text Specify any additional text containing instructions or information for the users who access the Login page.
Page 276 4-174 Motorola RF Switch System Reference Guide Small Logo URL The Small Logo URL is the URL for a small logo image displayed on the Failed page when using the internal Web server. This option is only available if Internal chosen from the drop-down menu above.
Page 277 4-175 Network Setup 2. Select an existing hotspot entry from those displayed within the Configuration tab and click the Edit button. Ensure External is selected from within the This VLAN’s Web Pages are of the drop-down menu. 3. Refer to the External Web Pages field and provide the Login, Welcome, and Failed Page URLs used by the external Web server to support the hotspot.
Page 278 4-176 Motorola RF Switch System Reference Guide NOTE: When using hotspot features in a cluster environment, additional steps must be taken when specifying the external URLs. In order for the browser to return the login iinformation correctly, the IP address and port must be specified as part of the URL in the following format: http://external_url<login | welcome | fail>.html?ip_address=a.b.c.d&port=x...
Page 279 4-177 Network Setup 3. Click the Edit button. Ensure that Advanced is selected from the This WLAN’s Web Pages are of the drop-down menu. NOTE: Advanced hotspot configuration is not permissible using the switch Web UI. Refer to the switch CLI or other advanced configuration options to define a hotspot with advanced properties.
Page 280 4-178 Motorola RF Switch System Reference Guide h. Once the location and settings for the advanced hotspot configuration have been defined, click the Install button to use the hotspot configuration with the switch. 5. Refer to the field, and enter any IP address (for internal or external Web sites) that may be Allow List accessed by the Hotspot user without authentication.
Page 281 4-179 Network Setup 4.12.1.4 Configuring a RADIUS Server 1. Select Network > Wired Hotspot > Edit > Radius Configuration. The Radius Configuration screen opens up. The Radius Configuration screen contains tabs for defining the Radius server settings. 2. Refer to the Radius field and define the following credentials for a primary and secondary Radius server.
Page 282 4-180 Motorola RF Switch System Reference Guide Server Retries Enter a value between 1 and 100 seconds to indicate the number of times the switch attempts to reach the primary or secondary Radius server before giving up. Dynamic Check this option to enable RADIUS Dynamic Authorization. RADIUS Dynamic...
Page 283: Chapter 5. Switch Services
Switch Services This chapter describes the Services main menu information available for the following switch configuration activities.: • Displaying the Services Interface • DHCP Server Settings • Configuring Secure NTP • Configuring Switch Redundancy & Clustering • Layer 3 Mobility •...
Page 284: Displaying The Services Interface
5-2 Motorola RF Switch System Reference 5.1 Displaying the Services Interface Refer to the Services main menu interface to review a summary describing the availability of several central features within the Services main menu item. NOTE: When the switch’s configuration is successfully updated (using the Web UI), the effected screen is closed without informing the user their change was successful.
Page 285: Dhcp Server Settings
Switch Services Layer 3 Mobility Displays whether Layer 3 Mobility is currently enabled or disabled. Layer 3 mobility is a mechanism which enables a MU to maintain the same Layer 3 address while roaming throughout a multi-VLAN network. This enables the transparent routing of IP datagrams to MUs during their movement, so data sessions can be initiated while they roam (in for voice applications in particular).
Page 286: Configuring The Switch Dhcp Server
5-4 Motorola RF Switch System Reference 5.2.1 Configuring the Switch DHCP Server The switch contains an internal Dynamic Host Configuration Protocol (DHCP) Server. DHCP can provide the dynamic assignment of IP addresses automatically. DHCP is a protocol that includes mechanisms for IP address allocation and delivery of host-specific configuration parameters from a DHCP server to a host.
Page 287 Switch Services 5. Refer to the following as displayed within Network Pool field. Displays the name of the IP pool from which IP addresses can be issued to DHCP Pool Name client requests on the current interface. The pool is the range of IP addresses available.
Page 288 5-6 Motorola RF Switch System Reference • A p-peer (peer-to-peer node) uses directed calls to communicate with a known NetBIOS name server, such as a Windows Internet Name Service (WINS) server, for the IP address of a NetBIOS machine. • A...
Page 289 Switch Services 2. Click the button at the bottom of the screen. 3. Enter the name of the IP pool from which IP addresses can be issued to client requests on this interface. 4. Provide the Domain name as appropriate for the interface using the pool.
Page 290 5-8 Motorola RF Switch System Reference 7. From the Network field, use the Associated Interface drop-down menu to define the switch interface is used for the newly created DHCP configuration. Use VLAN1 as a default interface if no others have been defined.
Page 291 Switch Services 3. Click the Insert button to display an editable field wherein the name and value of the DHCP option can be added. Name the option as appropriate, assign a Code (numerical identifier) and use the Type drop-down options to specify a value of ip or ascii to the DHCP global option. Highlight an entry from within the Global Options screen and click the Remove button to delete the name and value.
Page 292: Viewing The Attributes Of Existing Host Pools
5-10 Motorola RF Switch System Reference 6. Select the Enable Multiple User Class checkbox if multiple user class support is needed. 7. Use the DDNS Servers field to define the IP addresses of the DNS servers. 8. Click to save and add the changes to the running configuration and close the dialog.
Page 293: Configuring Excluded Ip Address Information
5-11 Switch Services Client Name Displays the name of the client requesting DHCP Server support over this interface. This name is ready only cannot be modified using the host pool edit option. Client ID Displays the client Identifier, based on this identifier static IP is assigned. Hardware address and Client Identifier should not be configured on a same host pool.
Page 294 5-12 Motorola RF Switch System Reference 3. Click the Edit button to modify the IP address range displayed. For more information, see Editing the Properties of an Existing DHCP Pool on page 5-5. 4. To delete an existing DHCP pool from the list of those available to the switch, highlight the pool from...
Page 295: Configuring The Dhcp Server Relay
5-13 Switch Services 5.2.4 Configuring the DHCP Server Relay Refer to the Relay tab to view the current DHCP Relay configurations for available switch VLAN interfaces. The Relay tab also displays the VLAN interfaces for which the DHCP Relay is enabled/configured. The Gateway Interface address information is helpful in selecting the interface suiting the data routing requirements between the External DHCP Server and DHCP client (present on one of the switch’s available VLANs).
Page 296 5-14 Motorola RF Switch System Reference 2. Click the Relay tab. 3. Refer to the Interfaces field for the names of the interfaces available to route information between the DHCP Server and DHCP clients. If this information is insufficient, consider creating a new IP pool or edit an existing pool.
Page 297: Viewing Ddns Bindings
5-15 Switch Services c. Click to save and add the changes to the running configuration and close the dialog. d. Click Cancel to close the dialog without committing updates to the running configuration. 5.2.5 Viewing DDNS Bindings DDNS Bindings tab displays mappings between client IP addresses and domain names. DDNS keeps a domain name linked to a changing IP address.
Page 298: Viewing Dhcp Bindings
5-16 Motorola RF Switch System Reference 5.2.6 Viewing DHCP Bindings The Bindings tab displays addresses and expiration times. There are two types of bindings, manual and automatic. Manual bindings map a hardware address to a IP address statically. Automatic bindings dynamically map a hardware address to an IP address from a pool of available addresses.
Page 299 5-17 Switch Services 2. Select the Dynamic Bindings tab. 3. Refer to the contents of the Dynamic Bindings tab for the following: Displays the IP address for each client whose MAC Address is listed in the MAC IP Address Address / Client ID column. This column is read-only and cannot be modified. Displays the MAC address (client hardware ID) of the client using the switch’s MAC Address / DHCP Server to access switch resources.
Page 300: Configuring The Dhcp User Class
5-18 Motorola RF Switch System Reference 5.2.8 Configuring the DHCP User Class The DHCP server assigns IP addresses to clients based on user class option names. Clients with a defined set of user class option names are identified by their user class name.
Page 301 5-19 Switch Services 3. Click the button from the User Class Name section. The DHCP server groups clients based on user class option values. DHCP Clients with the defined set of user class option values are identified by class. a. Enter the User Class Name to create a new client.
Page 302: Configuring Dhcp Pool Class
5-20 Motorola RF Switch System Reference 3. Select an existing DHCP user class name from the list and click on the Edit button from the DHCP User Class Name section. a. The User Class Name is a display field and cannot be modified.
Page 303 5-21 Switch Services 2. Select the Pool Class tab to view the DHCP pool class details. 3. Refer to the Pool Class Names field to configure a pool class. A pre configured pool and class must exist to configure a pool class. Address Ranges section displays the address ranges associated with the pool class.
Page 304 5-22 Motorola RF Switch System Reference 7. Refer to the Status field. It displays the current state of the requests made from the applet. Requests are any “SET/GET” operation from the applet. The Status field displays error messages if something goes wrong in the transaction between the applet and the switch.
Page 305: Configuring Secure Ntp
5-23 Switch Services 5.3 Configuring Secure NTP Secure Network Time Protocol (SNTP) is central for networks that rely on their switch to supply system time. Without an SNTP implementation, switch time is unpredictable, which can result in data loss, failed processes and compromised security.
Page 306 5-24 Motorola RF Switch System Reference 2. Select the Configuration tab. 3. An ACL Id must be created before it is selectable from any of the drop-down menus. Refer to the Access Group field to define the following: Supply a numeric ACL ID from the drop-down menu to provide the ACL full access.
Page 307: Configuring Symmetric Key
5-25 Switch Services Broadcast Delay Enter the estimated round-trip delay (between 1 and 999999 seconds) for SNTP broadcasts between the SNTP broadcast server and the switch. Define the interval based on the priority of receiving accurate system time frequently. Typically, no more than one packet per minute is necessary to synchronize the switch to within a millisecond of the SNTP broadcast server.
Page 308: Defining A Ntp Neighbor Configuration
5-26 Motorola RF Switch System Reference Displays the authentication value used to secure the credentials of the server Key Value providing system time to the switch. If a checkmark appears, a trusted key has been associated with a domain name. A Trusted Key trusted key is added when a public key is known, but cannot be securely obtained.
Page 309 5-27 Switch Services necessary, modify the attributes of an existing peer or server configuration or create a new neighbor peer or server SNTP configuration. To review the switch’s existing NTP neighbor configurations: 1. Select Services > Secure NTP from the main menu tree. 2.
Page 310: Adding An Ntp Neighbor
5-28 Motorola RF Switch System Reference 6. Click the button to define a new peer or server configuration that can be added to the existing configurations displayed within the NTP Neighbor tab.For more information, see Adding an NTP Neighbor on page 5-28.
Page 311 5-29 Switch Services 9. Use the NTP Version drop-down menu to select the version of SNTP to use with this configuration Currently version three and version four implementations of NTP are available. The latest version is NTPv4, but the official Internet standard is NTPv3. 10.If necessary, select the No Authentication checkbox to allow communications with the NTP resource...
Page 312: Viewing Ntp Associations
5-30 Motorola RF Switch System Reference 5.3.5 Viewing NTP Associations The interaction between the switch and a SNTP server constitutes an association. SNTP associations can be either a peer association (the switch synchronizes to the another system or allows another system to synchronize to it), or a server association (only the switch synchronizes to the SNTP resource, not the other way around).
Page 313 5-31 Switch Services Delay (sec) Displays the round-trip delay (in seconds) for SNTP broadcasts between the SNTP server and the switch. Offset (sec) Displays the calculated offset between the switch and SNTP server. The switch adjusts its clock to match the server's time value. The offset gravitates toward zero over time, but never completely reduces its offset to zero.
Page 314: Viewing Ntp Status
5-32 Motorola RF Switch System Reference 5.3.6 Viewing NTP Status Refer to the NTP Status tab to display performance (status) information relative to the switch’s current NTP association. Verifying the switch’s SNTP status is important to assess which resource the switch is currently getting its system time from, as well as the time server’s current differences in time attributes as compared...
Page 315: Configuring Switch Redundancy & Clustering
5-33 Switch Services The total round-trip delay in seconds. This variable can take on both positive and Root delay negative values, depending on the relative time and frequency offsets. The values that normally appear in this field range from negative values of a few milliseconds to positive values of several hundred milliseconds.
Page 316 5-34 Motorola RF Switch System Reference on the other switches at the same time. This is done by the cluster-protocol running on WS1, by duplicating the commands and sending them to the group over the virtual connection: After sending the command to other members, the cluster-management protocol (at WS1) waits for a response from the members of the redundancy group.
Page 317: Configuring Redundancy Settings
5-35 Switch Services • Managing Clustering Using the Web UI 5.4.1 Configuring Redundancy Settings To configure switch redundancy: 1. Select Services > Redundancy from the main menu tree. The Redundancy screen displays with the Configuration tab selected. NOTE: MUs on an independent WLAN will not see any disruptions on a switch fail-over. 2.
Page 318 5-36 Motorola RF Switch System Reference Heartbeat Period is the interval heartbeat messages are sent. Heartbeat Heartbeat Period messages discover the existence and status of other members within the group. Configure an interval between 1 and 255 seconds. The default value is 5seconds.
Page 319 5-37 Switch Services 3. To enable Dynamic AP Load Balancing check the Enable Dynamic AP Load Balancing box and configure the parameters below: Runtime/Schedule Select Runtime or Schedule to determine when load balancing will run. If Runtime is selected, load balancing will initiate anytime a new active switch is added to the redundancy group.
Page 320: Reviewing Redundancy Status
5-38 Motorola RF Switch System Reference 5.4.2 Reviewing Redundancy Status The switch is capable of displaying the status of the collective membership of the cluster. Use this information to assess the overall health and performance of the group. NOTE: When ETH2 of one of the group members is unplugged, the other members report that this member as gone, but an AP will continue to be adopted by the switch with no ETH2 connectivity.
Page 321 5-39 Switch Services AP Licenses in group Displays the number of Access Ports that can be adopted in the redundancy group. This value is calculated when a member starts-up, is added, is deleted or a license changes (downgrade and upgrade.) This value is equal to the highest license level of its members.
Page 322 5-40 Motorola RF Switch System Reference Adoption capacity on Displays the AP adoption capability for this switch. Compare this value with the this switch adoption capacity for the entire cluster to determine if the cluster members (or this switch) have adequate adoption capabilities. For information on licensing rules...
Page 323: Configuring Redundancy Group Membership
5-41 Switch Services 5.4.3 Configuring Redundancy Group Membership The redundancy group should be disabled to conduct an Add/Delete operation. There are a minimum of 2 members needed to comprise a Redundancy Group, including the initiating switch To configure switch redundancy memberships: 1.
Page 324 5-42 Motorola RF Switch System Reference AP License Count Displays the number of Access Port licenses installed on this member. AAP License Count Displays the number of Adaptive AP licenses installed on this member. Mode The Redundancy Mode could be Active or Standby depending on the mode configuration on the member.
Page 325 5-43 Switch Services 4. Refer to the following redundancy member information: IP Address Displays the IP addresses of the members of the redundancy group. There are a minimum of 2 members needed to define a redundancy group, including this current module. Displays the current status of this group member.
Page 326: Redundancy Group License Aggregation Rules
5-44 Motorola RF Switch System Reference Rogue APs Displays the number of Rogue APs detected by each member. Use this information to discern whether these radios represent legitimate threats to other members of the redundancy group. Self Healing Radios Displays the number of self healing radios on each detected member. These radios can be invaluable if other radios within the redundancy group were to experience problems requiring healing by another radio.
Page 327 5-45 Switch Services • In a redundancy group of three switches (S1, S2 and S3), if S1 has X licenses, S2 has Y licenses and S3 has Z licenses, the license count is X+Y+Z (the aggregation of each switch). • A cluster license is re-calculated whenever a new switch brings existing licenses to a group or an existing switch’s license value changes (increases or decreases).
Page 328: Managing Clustering Using The Web Ui
5-46 Motorola RF Switch System Reference 5.4.5 Managing Clustering Using the Web UI Managing clustering in the Web UI is done through the Cluster GUI feature. The Cluster GUI feature updates many key screens in the Web UI allowing you to see APs and MUs managed by all active members of a cluster.
Page 329: Layer 3 Mobility
5-47 Switch Services 5.5 Layer 3 Mobility Refer to the following sections to configure Layer 3 Mobility: • Configuring Layer 3 Mobility • Defining the Layer 3 Peer List • Reviewing Layer 3 Peer List Statistics • Reviewing Layer 3 MU Status 5.5.1 Configuring Layer 3 Mobility Layer 3 mobility is a mechanism enabling a MU to maintain the same Layer 3 address while roaming throughout a multi-VLAN network.
Page 330 5-48 Motorola RF Switch System Reference • A full mesh of GRE tunnels can be established between mobility peers. Each tunnel is between a pair of switches and can handle data traffic for all MUs (for all VLANs) associated directly or indirectly with the •...
Page 331: Defining The Layer 3 Peer List
5-49 Switch Services 6. Select the Enable Mobility checkbox to enable a MU to maintain the same Layer 3 address while roaming throughout a multi-VLAN network. 7. Select the All WLANs On button to enable mobility for each WLAN listed. If unsure if you want to enable mobility for each WLAN, manually select just those you want to enable.
Page 332: Reviewing Layer 3 Peer List Statistics
5-50 Motorola RF Switch System Reference 5. Click the button to display a screen used for adding the IP address to the list of addresses available for MU Layer 3 roaming. Enter the IP addresses in the area provided and click the...
Page 333: Reviewing Layer 3 Mu Status
5-51 Switch Services 3. Refer to the following information within the Peer Statistics tab: Peer IP Displays the IP addresses of the peer switches within the mobility domain. Each peer can support up to 500 MUs. JOIN Events Displays the number of JOIN messages sent and received. JOIN messages sent/rcvd advertise the presence of MUs entering the mobility domain for the first time.
Page 334 5-52 Motorola RF Switch System Reference 2. Select the MU Status tab.
Page 335: Configuring Self Healing
5-53 Switch Services 5.6 Configuring Self Healing The switch supports a feature called Self Healing that enables radios to take corrective action when one or more radios fail. To enable the feature the user must specify radio neighbors that would self heal if either one goes down.
Page 336: Configuring Self Healing Neighbor Details
5-54 Motorola RF Switch System Reference 5. Click the Revert button to disregard any changes made within this screen and revert back to the last saved configuration. 5.6.1 Configuring Self Healing Neighbor Details The Neighbor Details page displays all the radios configured on the switch and their neighbor designations.
Page 337 5-55 Switch Services Action Displays the self healing action configured for the radio. Options include: • Raise Power - The transmit power of the radio is increased when a neighbor radio is not functioning as expected. • Open Rates - Radio rates are decreased to support all rates when a neighbor radio is not functioning as expected.
Page 338: Configuring Switch Discovery
5-56 Motorola RF Switch System Reference 3. Select an existing neighbor and click the Edit button. The radio index and description display in the upper right corner of the screen. The Available Radios value represents the radios that can be added as a neighbor for the target radio.
Page 339: Configuring Discovery Profiles
5-57 Switch Services Recently Found Devices tab to view a table of devices discovered by the current discovery process. Each discovered device compatible with the locating switch is displayed in a shaded color to distinguish it from non-compatible devices. CAUTION: Switch discovery can be a time consuming operation. However, the switch discovery operation is a standalone process.
Page 340 IP address and SNMP version. Motorola recommends editing a profile only if some of its attributes are still valid, if the profile is obsolete, delete it and create a new one.
Page 341: Viewing Discovered Switches
5-59 Switch Services 5.7.1.1 Adding a New Discovery Profile If the contents of an existing profile are no longer relevant to warrant modification using the Edit function, then a new switch discovery profile should be created To create a new switch discovery profile: 1.
Page 342 5-60 Motorola RF Switch System Reference displayed in a shaded color to distinguish it from non-compatible devices. The switch Web UI enables users display the Web UI of the discovered device in a separate browser window. To view the devices located by the switch: 1.
Page 343 5-61 Switch Services Device Location Displays the device location defined to the discovered device. The location would have been assigned using the Switch > Configuration screen. Profile used for Displays the profile selected from within the Discovery Profiles tab and used with Discovery the Start Discovery function to discover devices within the switch managed network.
Page 344: Locationing
The Motorola Geofencing architecture provides a dynamic solution by locating all clients and enforcing ACLs for each client based on it’s current location. This capability is no easy feat and is only made possible with the following three core components of the WiNG architecture which closely interact to provide physical security without compromising mobility.
Page 345: Sole - Smart Opportunistic Location Engine
5-63 Switch Services provide accurate asset locationing information across multiple networks in real-time. This solution can also be packaged as a locationing appliance. 5.8.2 SOLE - Smart Opportunistic Location Engine SOLE is an on-board location engine using a combination of innovative algorithms to determine location based on asset type.
Page 346: Defining Site Parameters
5-64 Motorola RF Switch System Reference SOLE is capable of receiving input of location from external 3rd party location engines such as Aeroscout and Ekahau. SOLE also has a self learning process that adapts with a changing environment. SOLE also provides an open platform for supporting new architectures, future algorithms or newer asset types.
Page 347 5-65 Switch Services width of the site is then mapped out on the X and Y axes. Those length and width along with the height are entered into the field below. Define the Dimensions and Unit of measure used to define the site size: Length Enter the length of the site.
Page 348: Configuring Sole Parameters
5-66 Motorola RF Switch System Reference 5.8.3.1 Adding AP Location Information 1. To add AP Location information for your site: Select Services > RTLS from the main menu tree. 2. Select the Site tab. 3. Click the button. 5.8.4 Configuring SOLE Parameters To configure the switch’s internal SOLE locationing engine:...
Page 349 MU Locate Interval value and revert back to the last saved configuration. NOTE: AP coordinates can only be configured in the Command Line Interface. For more information on configuring AP coordinates please consult the Motorola RF Switch CLI Reference. 7. The MU MAC table allows you to manually add or remove MAC Addresses which can be located by the SOLE engine.
Page 350: Configuring Aeroscout Parameters
Zone 0. NOTE: Zone configuration can be defined using the CLI interface only. For information on Zone Configuration please see the Motorola RF Switch CLI Reference. 5.8.5 Configuring Aeroscout Parameters To configure the switch to work with an external Aeroscout RTLS engine: .Services...
Page 351 5-69 Switch Services 4. Enter the Multicast MAC Address used for all Aeroscout tags to send updates via multicast to the MAC address specified. Typically the MAC address will start with 01-0C-CC-XX-XX-XX. NOTE: To use the onboard SOLE engine to locate Aeroscout tags, site parameters, AP location (Command Line Interface only) and Zone configuration (optional, Command Line Interface only) must be configured.
Page 352: Configuring Ekahau Parameters
Zone 0. NOTE: Zone configuration can be defined using the CLI interface only. For information on Zone Configuration please see the Motorola RF Switch CLI Reference. 5.8.6 Configuring Ekahau Parameters To configure the switch to work with an external Ekahau RTLS engine: .Services...
Page 353 5-71 Switch Services 4. Enter the Multicast MAC Address used for all Ekahau tags to send updates via multicast to the MAC address specified. Typically the MAC address will start with 01-0C-CC-XX-XX-XX. NOTE: To use the onboard SOLE engine to locate Ekahau tags, site parameters, AP location (Command Line Interface only) and Zone configuration (optional, Command Line Interface only) must be configured.
Page 354 CLI interface only. When no zones are configured, the switch defaults the entire site to Zone 0. NOTE: Zone configuration can be defined using the CLI interface only. For information on Zone Configuration please see the Motorola RF Switch CLI Reference.
Page 355: Chapter 6. Switch Security
Switch Security This chapter describes the security mechanisms available to the switch. This chapter describes the following security configuration activities: • Displaying the Main Security Interface • Access Point Detection • Wireless Intrusion Detection / Protection • Configuring Firewalls and Access Control Lists •...
Page 356 6-2 Motorola RF Switch System Reference Guide To view main menu security information: 1. Select Security from the main menu tree. 2. Refer to the following information to discern if configuration changes are warranted: Access Port Intrusion Displays the Enabled or Disabled state of the switch to detect potentially hostile Detection Access Ports (the definition of which defined by you).
Page 357: Access Point Detection
Switch Security 6.2 Access Point Detection Use the Access Point Detection menu options to view and configure the detection of other Access Points. The Access Point Detection screen consists of the following tabs: • Enabling and Configuring AP Detection • Authorized / Ignored APs •...
Page 358 6-4 Motorola RF Switch System Reference Guide 3. Enable AP assisted scanning and timeout intervals as required. Enable Select the Enable checkbox to enable associated Access Ports to detect potentially hostile Access Points (the definition of which defined by you). Once detected, the Access Points can be added to a list of APs either approved or denied from interoperating within the switch managed network.
Page 359 Switch Security BSS MAC Address Displays the MAC address of the Allowed AP(s). The MAC addresses displayed are defined by clicking the button and entering a specific MAC address or by allowing all MAC addresses to be allowed. The list of MAC addresses allowed can Edit be modified by highlighting an existing entry, clicking the button and revising...
Page 360: Authorized / Ignored Aps
6-6 Motorola RF Switch System Reference Guide 5. Refer to the BSS MAC Address field to define the following: Any MAC Address/ Click the Any MAC Address radio button to allow any MAC address detected on Specific MAC the network as an Allowed AP. This is not necessary if a specific MAC address is Address used with this index.
Page 361: Unauthorized Aps (Ap Reported)
Switch Security ESSID Displays the SSID of each approved AP. Authorized/Ignored Displays authorized APs. 4. The Number of Approved APs is simply the sum of all of approved Access Point MAC Addresses detected. 5. Select the Display Adopted APs check box. 6.
Page 362: Unauthorized Aps (Mu Reported)
6-8 Motorola RF Switch System Reference Guide Signal Strength (in Displays the Relative Signal Strength Indicator (RSSI) for the detected (and dBm) unapproved) AP. AP’s with a strong signal may pose a more significant risk within the switch managed network.
Page 363: Ap Containment
Switch Security 3. The Unauthorized APs (MU Reported) table displays the following information: BSS MAC Address Displays the MAC Address of each Unapproved AP. These MAC addresses are Access Points observed on the network (by associated MUs), but have yet to be added to the list of approved APs, and are therefore interpreted as a threat on the network.
Page 364: Wireless Intrusion Detection / Protection
6-10 Motorola RF Switch System Reference Guide 3. To enable the AP containment feature, check the Enable Containment checkbox and specify a Containment Interval between 20 and 5000 milliseconds. The Containment Interval field determines the interval after which broadcast 802.11 de-authentication messages will be sent.
Page 365 6-11 Switch Security 2. Click the Configuration tab. The MU Intrusion Detection tab consists of the following two fields: • Collection Settings • Violation Parameters 3. Within the Collection Settings field, set the Detection Window interval (in seconds) the switch uses to scan for MU violations.
Page 366: Viewing Filtered Mus
6-12 Motorola RF Switch System Reference Guide CAUTION: Setting MU threshold values too low can jeopardize MU performance or break the MU’s connection. NOTE: Setting a violation parameter to 0 will disable that option. 5. When using the Frames with known bad ESSIDs violation parameter it is necessary to enter a list of known bad ESSIDs for the violation parameter.
Page 367 6-13 Switch Security 2. Click on the Filtered MUs tab. The Filtered MUs tab displays the following read-only information for detected MUs: MAC Address Displays the MU’s MAC address. Defer to this address as the potentially hostile MU’s identifier. Radio Index The radio index displays the index of the detected MU.
Page 368: Configuring Firewalls And Access Control Lists
6-14 Motorola RF Switch System Reference Guide Violation Type Displays the reason the violation occurred for each detected MU. Use the Violation Type to discern whether the detected MU is truly a threat on the switch managed network (and must be removed) or can be interpreted as a non threat. The following violation types are possible: •...
Page 369: Acl Overview
6-15 Switch Security applied ACLs to verify the packet has the required permissions to be forwarded, based on the criteria specified in the access lists. NOTE: If a packet does not meet any of the criteria specified in the ACL, the packet is dropped.
Page 370 6-16 Motorola RF Switch System Reference Guide 6.4.1.1 Router ACLs Router ACLs are applied to Layer 3 or VLAN interfaces. If an ACL is already applied in a particular direction on an interface, applying a new one will replace the existing ACL. Router ACLs are applicable only if the switch acts as a gateway, and traffic is inbound only.
Page 371 6-17 Switch Security • Extended IP ACL— Uses a source IP address, destination IP address and IP protocol type as basic matching criteria. It can also include other parameters specific to a protocol type, like the source and destination ports for TCP/UDP protocols. •...
Page 372: Precedence Order
6-18 Motorola RF Switch System Reference Guide In general, a Wireless-LAN ACL can be used to filter wireless to wireless, wireless to wired and wired to wireless traffic. Typical wired to wired traffic can be filtered using a Layer 2 port based ACL rather than a WLAN ACL.
Page 373: Attaching An Acl On A Wlan Interface/Port
6-19 Switch Security 6.4.2 Attaching an ACL on a WLAN Interface/Port Use the Attach-WLAN tab to view and assign an ACL to a WLAN on the switch. If a MAC ACL is being attached, create a ACL entry to allow arp with least precedence. NOTE: WLAN based ACLs allows users to enforce rules/ACLs on both the inbound and outbound direction, as opposed to Layer 2 ACLs, which just support the inbound direction.
Page 374: Attaching An Acl Layer 2/Layer 3 Configuration
6-20 Motorola RF Switch System Reference Guide 6.4.2.1 Adding or Editing a New ACL WLAN Configuration After creating an ACL, it can be applied to one or more WLANs on the switch. To attach an ACL to a WLAN: 1. Select Security >...
Page 375 6-21 Switch Security 3. Click the Attach-L2/L3 tab. 4. Refer to the following information as displayed within the Attach tab: Interface The interface to which the switch is configured. It can be one of the following: • ge 1-8 for RFS6000 and it is ge 1-5 RFS4000 •...
Page 376: Configuring The Role Based Firewall
6-22 Motorola RF Switch System Reference Guide 4. Click the button. 5. Use the Interface drop-down menu to select the interface to configure on the switch. Available options include – ge 1-8, up 1, VLAN 1 (plus those VLANs created thus far) and Tunnel n (where n equals the name(s) of those tunnels created thus far).
Page 377 6-23 Switch Security 3. Click the Attach Role tab. 4. Refer to the following information as displayed within the Attach Role tab: Role Priority Displays the priority assigned to the role as determined by the Sequence Number associated with the role. Role Name Displays the role name assigned to each role.
Page 378: Attaching Adaptive Ap Wlans
6-24 Motorola RF Switch System Reference Guide 3. Click the Attach Role tab. 4. Click the button. 5. Select a Role Name from the drop-down menu. Role Names can be added in the Configuration > Role tab. 6. Use the...
Page 379 6-25 Switch Security 4. The Attach AAP WLAN tab contains the following read-only information: WLAN Index The WLAN Index displays the list of attached WLANs with ACLs. IP ACL Displays the IP ACL configured for the WLAN interface in the inbound/outbound direction.
Page 380 6-26 Motorola RF Switch System Reference Guide 4. On the Attach AAP WLAN tab select a WLAN and click the Edit button: WLAN Index Enter the WLAN Index to attach the WLAN with ACLs. The range is <0-2>. IP ACL Select an IP ACL configured for the WLAN interface in the inbound/outbound direction.
Page 381: Attaching Adaptive Ap Lans
6-27 Switch Security IP ACL Select an IP ACL configured for the WLAN interface in the inbound/outbound direction. Inbound/Outbound Select either the Inbound or Outbound radio button to define which direction the ACL applies. 5. Refer to the Status field for the state of the requests made from applet. This field displays error messages if something goes wrong in the transaction between the applet and the switch.
Page 382: Configuring Wireless Filters
6-28 Motorola RF Switch System Reference Guide 5. Select an interface and click on Edit to modify the LAN Index, IP ACL and MAC ACL values. For more information see,Editing an Adaptive AP LAN on page 6-28. 6.4.6.1 Editing an Adaptive AP LAN To Edit an AAP LANs page: 1.
Page 383 6-29 Switch Security 4. The Wireless Filters tab contains the following read-only information: MU-ACL Index Displays a numerical identifier used to associate a particular ACL to a range of MAC addresses (or a single MAC address) that are either allowed or denied access to the switch managed network.
Page 384: Editing An Existing Wireless Filter
6-30 Motorola RF Switch System Reference Guide Authentication Displays the authentication scheme configured for the devices comprising this WLAN. Encryption Displays the encryption method configured for the devices comprising this WLAN. 6. If the properties of an existing filter fulfill to your needs but still require modification to better filter...
Page 385: Adding A New Wireless Filter
6-31 Switch Security 7. Modify the existing Starting MAC for the target Index or leave the Starting MAC value as is and just modify the Ending MAC Address or Allow/Deny designation. 8. Modify the existing Ending MAC for the target Index. Enter the same Starting MAC address within the Ending MAC field to use only the Starting MAC...
Page 386: Associating An Acl With Wlan
6-32 Motorola RF Switch System Reference Guide 6. Enter the a hex value for the Starting MAC address. This is the beginning MAC address either allowed or denied access to the switch managed network. 7. Enter the a hex value for the Ending MAC address.
Page 387: Configuring The Firewall
6-33 Switch Security 5. Click the Memberships button. 6. Select the box to the right of each WLAN you want associated with the ACL. Selecting a WLAN maps it the MAC address range and allow or deny designation assigned to it. Consequently, be sure you are not restricting MU traffic for a WLAN that requires those MAC addresses to interact with the switch.
Page 388 6-34 Motorola RF Switch System Reference Guide ACLs field displays the list of ACLs currently associated with the switch. An ACL contains an ordered list of ACEs. Each ACE specifies a permit or deny designation and a set of conditions the packet must satisfy to match the ACE.
Page 389 6-35 Switch Security 4. Click the button. 5. Select an ACL Type from the drop-down menu. The following options are available: • Standard IP List – Uses source IP addresses for matching operations. • Extended IP List – Uses source and destination IP addresses and optional protocol information for matching operations.
Page 390 6-36 Motorola RF Switch System Reference Guide 4. Click the button within the Associated Rules field. 5. Use the Precedence field to enter a precedence (priority) value between 1 and 5000. The rules within an ACL will be applied to packets based on their precedence value. Rules with lower precedence are always applied first.
Page 391 6-37 Switch Security 1. Select Security > Wireless Firewall from the main tree menu. 2. Click the Configuration tab. 3. Click the tab. 4. Select an ACL from the ACLs field. The rules associated with the selected ACL display in the Associated Rules section. 5.
Page 392: Configuring Layer 2 Firewall
6-38 Motorola RF Switch System Reference Guide 12.Refer to the Status field for the state of the requests made from applet. This field displays error messages if something goes wrong in the transaction between the applet and the switch. 13.Click to use the changes to the running configuration and close the dialog.
Page 393 6-39 Switch Security ARP Trust Displays the ARP trust status for the selected L2 interface. Trusted ARP packets are also used to update the DHCP Snoop Table to prevent IP spoof and arp-cache- poisoning attacks. By default, none of the physical or aggregate interfaces are ARP trusted.
Page 394: Configuring Wlan Firewall Rules
6-40 Motorola RF Switch System Reference Guide 5. Configure the following values for each new Layer 2 configuration: Interface Name Assign the interface to be associated with the Layer 2 firewall. Available Layer 2 interfaces are ge 1-8 and up1.
Page 395 6-41 Switch Security 4. The WLAN tab contains the following information: WLAN Index Displays the WLAN index number. This number is configured on the wireless LAN configuration page. Broadcast Storm Displays the Broadcast Storm Threshold for each interface. When the rate of Threshold broadcast packets exceeds the high threshold configured for an interface, packets are throttled till the rate falls below the configured rate.
Page 396 6-42 Motorola RF Switch System Reference Guide MU Deauthenticate Displays whether or not mobile unit de-authentication is enabled for each WLAN. MU Deauthenticate is enabled any associated mobile unit which hit the thresholds configured for Allowed MU denies per second will be deauthenticated.
Page 397: Configuring Denial Of Service (Dos) Attack Firewall Rules
6-43 Switch Security 5. To create a new WLAN Firewall rule configure the following information: WLAN Index Select a WLAN index number from the pull-down menu. This number is configured on the wireless LAN configuration page. Broadcast Storm Enter the Broadcast Storm Threshold for each interface. When the rate of Threshold broadcast packets exceeds the high threshold configured for an interface, packets are throttled till the rate falls below the configured rate.
Page 398 6-44 Motorola RF Switch System Reference Guide 4. The DoS Attack tab contains the following information: Type Displays the Denial of Service attack type. The switch currently supports enabling or disabling 28 types of DoS attack filters. Check Enabled This field will show a green checkmark next to the Denial of Service Attack filters that are enabled on the switch firewall.
Page 399: Configuring The Role
6-45 Switch Security Attack Count Displays the number of times that each DoS attack have been observed by the switch firewall. Clicking the Clear Stats button on this page will reset all Attack Counts to 0. Last Occurrence Displays the amount of time since each DoS attack has been observed by the switch firewall.
Page 400 6-46 Motorola RF Switch System Reference Guide 3. Click the Role tab. 4. Select the checkbox Role Assignment Immediate and click Apply to assign the role immediately. 5. Role configuration screen displays the following information: Sequence Number Displays the sequence number associated with each role. Sequence numbers determine the order that role are applied.
Page 401 6-47 Switch Security 7. To edit an existing role, click the Edit button and modify the filter settings. 8. To remove a role, select that rule from the table and click the Delete button. A confirmation will be displayed before the rule is deleted from the switch. 6.4.15.1 Creating a new Role To add new role: 1.
Page 402 6-48 Motorola RF Switch System Reference Guide AP Location Select an AP Location filter, if any, to apply to the role. Available AP Location filters are: • Exact: The role will only be applied to APs with the exact location string specified in the role •...
Page 403: Configuring Firewall Logging Options
6-49 Switch Security 6. Refer to the Status field for the state of the requests made from applet. This field displays error messages if something goes wrong in the transaction between the applet and the switch. 7. Click to use the changes to the running configuration and close the dialog. 8.
Page 404 6-50 Motorola RF Switch System Reference Guide 4. Select the Syslog logging levels for each of the following log types: ARP Log ARP Log field displays the level of Syslog logging enabled for excessive ARP on an interface. The logging level uses standard Syslog levels of: •...
Page 405: Reviewing Firewall And Acl Statistics
6-51 Switch Security Multicast Log Multicast Log field displays the level of syslog logging enabled for excessive multicast on an interface. The logging level uses standard Syslog levels of: • Emergency • Alert • Critical • Error • Warning • Notice •...
Page 406 6-52 Motorola RF Switch System Reference Guide 2. Click the Statistics tab. 3. From the Statistics section select the Statistics tab. 4. Refer to the following information as displayed within the Statistics tab: Interface Interface displays the physical/virtual interfaces used to add the ACL association to the switch.
Page 407 6-53 Switch Security 5. Select an interface and click the Details button to display a more robust set of statistics for the selected interface. 6. Click the Export to export the selected ACL attribute to a user specified location. 6.4.17.2 Viewing DHCP Snoop Entry Statistics To review DHCP Snoop Entry statistics: 1.
Page 408 6-54 Motorola RF Switch System Reference Guide 4. Refer to the following information as displayed within the DHCP Snoop Entry tab: Client IP Address Displays the DHCP Client IP Address for each entry. VLAN ID Displays the VLAN ID number, if any, for each entry in the DHCP Snoop Entry table.
Page 409 6-55 Switch Security 3. From the Statistics section select the Role tab. 4. Refer to the following information as displayed within the Role tab: Role Name Displays the Role Names for all roles that are active and have mobile units associated with them.
Page 410 6-56 Motorola RF Switch System Reference Guide 3. From the Statistics section select the AAP LAN tab. 4. Refer to the following information as displayed within the AAP LAN tab: AP MAC Address Displays the MAC Address of all Adaptive APs.
Page 411 6-57 Switch Security 3. From the Statistics section select the AAP WLAN tab. 4. Refer to the following information as displayed within the AAP WLAN tab: ACL ID Displays the ACL ID for each attached AAP WLAN ACL. ACL IDs can be modified in the Security Policy Edit screen.
Page 412: Configuring Nat Information
6-58 Motorola RF Switch System Reference Guide 6.5 Configuring NAT Information Network Address Translation NAT provides the translation of an Internet Protocol (IP) address within one network to a different, known IP address within another network. One network is designated as the private network, while the other is public.
Page 413 6-59 Switch Security 3. Refer to the following information as displayed within the Dynamic Translation tab. Type Displays the NAT type as either: • Inside - Applies NAT on packets arriving on interfaces marked as inside. These interfaces should be private networks not accessible from outside (public) networks.
Page 414 6-60 Motorola RF Switch System Reference Guide 5. Select an existing NAT configuration and click the Delete button to remove it from the list of available configurations. 6. Click the button to display a screen to create a new NAT configuration and add it to the list of available configurations.
Page 415: Defining Static Nat Translations
6-61 Switch Security 9. Enter the IP address to be used during NAT in the NAT Address text field. 10.Refer to the Status field for the state of the requests made from applet. This field displays error messages if something goes wrong in the transaction between the applet and the switch. 11.Click to use the changes to the running configuration and close the dialog.
Page 416 6-62 Motorola RF Switch System Reference Guide 3. Refer to the following information as displayed within the Static Translation tab. Type Displays the NAT type as either: • Inside - The set of networks subject to translation. These are the internal addresses you are trying to prevent from being exposed to the outside world.
Page 417 6-63 Switch Security 3. Click the button. 4. Define the NAT Type from the drop-down menu. Options include: • Inside - The set of networks subject to translation. These are the internal addresses you are trying to prevent from being exposed to the outside world. •...
Page 418: Configuring Nat Interfaces
6-64 Motorola RF Switch System Reference Guide 6.5.3 Configuring NAT Interfaces The NAT Interface is the VLAN used to route switch data traffic between the source and destination address locations within the switch-managed network. Any of the default VLANs is available as the NAT interface, in addition to any other VLANs created.
Page 419: Viewing Nat Status
6-65 Switch Security d. Refer to the Status field for the state of the requests made from applet. This field displays error messages if something goes wrong in the transaction between the applet and the switch. e. Click to use the changes to the running configuration and close the dialog. f.
Page 420: Configuring Ike Settings
Setting IKE Policies • Viewing SA Statistics NOTE: By default, the IKE feature is enabled. Motorola does not support disabling the IKE server. NOTE: The default isakmp policy will not be picked up for IKE negotiation if another crypto isakmp policy is created. For the default isakmp policy to be picked up for AAP adoption you must first create the default isakmp policy as a new policy with default parameters.
Page 421 6-67 Switch Security 2. Click the Configurations tab. During IKE negotiations, peers must identify themselves to one another. Thus, the configuration you define is the identification medium for device recognition. 3. Set a Keep Alive interval (in seconds) the switch uses for monitoring the continued presence of a peer and report of the client's continued presence.
Page 422: Setting Ike Policies
6-68 Motorola RF Switch System Reference Guide 9. If the properties of an existing peer IP address and key are no longer relevant and cannot be edited, click button to create a new pre-shared key a. Select the Peer IP Address checkbox...
Page 423 6-69 Switch Security 2. Click the IKE Policies tab. 3. Refer to the values displayed within the IKE Policies tab to determine if an existing policy requires revision, removal or a new policy requires creation. Sequence Number Displays the sequence number for the IKE policy. The available range is from 1 to 10,000, with 1 being the highest priority value.
Page 424 SA Lifetime Displays an integer for the SA lifetime. With longer lifetimes, security defines future IPSec security associations quickly. Encryption strength is great enough to ensure security without using fast rekey times. Motorola recommends using the default value. DH Group Displays the Diffie-Hellman (DH) group identifier.
Page 425: Viewing Sa Statistics
SA Lifetime Define an integer for the SA lifetime. With longer lifetimes, security defines future IPSec security associations quickly. Encryption strength is great enough to ensure security without using fast rekey times. Motorola recommends using the default value. DH Group Set the Diffie-Hellman group identifier.
Page 426 6-72 Motorola RF Switch System Reference Guide 2. Click the SA Statistics tab. 3. Refer to the information displayed within SA Statistics tab to discern the following: Index Displays the alpha-numeric name (index) used to identify individual SAs. Phase 1 done Displays whether this index is completed with the phase 1 (authentication) credential exchanged between peers.
Page 427: Configuring Ipsec Vpn
Security associations are unidirectional and established per security protocol. To configure IPSec security associations, Motorola uses the Crypto Map entries. Crypto Map entries created for IPSec pull together the various parts used to set up IPSec security associations. Crypto Map entries include transform sets.
Page 428: Defining The Ipsec Configuration
6-74 Motorola RF Switch System Reference Guide • Create Crypto Map entries When IKE is used to establish security associations, the IPSec peers can negotiate the settings they use for the new security associations. Therefore, specify lists (such as lists of acceptable transforms) within the Crypto Map entry.
Page 429 6-75 Switch Security 2. Click the Configuration tab. 3. Refer to the Configuration field to define the following: SA Lifetime (secs) For IKE based security associations, define a SA Lifetime (in seconds) forcing the periodic expiration and re-negotiation of peer credentials. Thus, continually validating the peer relationship.
Page 430 6-76 Motorola RF Switch System Reference Guide ESP Encryption Displays the ESP Encryption Transform used with the index. Options include: Scheme • None - No ESP encryption is used with the transform set. • ESP-DES - ESP with the 56-bit DES encryption algorithm.
Page 431 6-77 Switch Security 4. Revise the following information as required to render the existing transform set useful. Name The name is read-only and cannot be modified unless a new transform set is created. AH Authentication Select the Use AH checkbox (if necessary) to modify the AH Transform Scheme Authentication scheme.
Page 432 6-78 Motorola RF Switch System Reference Guide 3. Click the button. 4. Define the following information as required for the new transform set. Name Create a name describing this new transform set. AH Authentication Select the Use AH checkbox to define the AH Transform Authentication scheme.
Page 433: Defining The Ipsec Vpn Remote Configuration
6-79 Switch Security 6.7.2 Defining the IPSec VPN Remote Configuration Use the IPSec VPN Remote tab to configure the DNS and/or WINS Servers used to route packets to the remote end of the IPSec VPN tunnel. The Remote tab is also used for defining the IP address range used within the IPSec VPN tunnel and configuring the authentication scheme for user permissions within the IPSec VPN tunnel.
Page 434: Configuring Ipsec Vpn Authentication
6-80 Motorola RF Switch System Reference Guide Starting IP Address Enter the numerical IP address used as the starting address for the range defined. If the Ending IP address is left blank, only the starting address is used for the remote destination.
Page 435 Radius Server, IP address, port, NAS ID and shared secret password. Motorola recommends only modifying an existing Radius Server when its current configuration is no longer viable for providing user authentication. Otherwise, define a new Radius Server.
Page 436: Configuring Crypto Maps
6-82 Motorola RF Switch System Reference Guide 8. If you require a new Radius Server be configured, click the button. Set this server’s designation as a primary or secondary Radius Server (using the checkboxes), define the server IP address, port and shared secret password. Click when completed to save the changes.
Page 437 6-83 Switch Security 2. Click the Crypto Maps tab. The Crypto Maps screen is divided into 5 tabs, each serving a unique function in the overall Crypto Map configuration. Refer to the following: • Crypto Map Entries • Crypto Map Peers •...
Page 438 6-84 Motorola RF Switch System Reference Guide 2. Click the Crypto Maps tab and select Crypto Map Entries. 3. Review the following Crypto Map attributes to determine if an existing Crypto Map requires revision, deletion or if a new Crypto Map needs to be created.
Page 439 6-85 Switch Security 6. Click the button to define the attributes of a new Crypto Map. a. Assign a Seq # (sequence number) to distinguish one Crypto Map from the another. b. Assign the Crypto Map a Name to differentiate from others with similar configurations. c.
Page 440 6-86 Motorola RF Switch System Reference Guide 7. Click to save the new Crypto Map and display it within the Crypto Map tab. 6.7.4.2 Crypto Map Peers To review, revise or add Crypto Map peers: 1. Select Security > IPSec VPN from the main menu tree.
Page 441 6-87 Switch Security 6. If a new peer requires creation, click the button. a. Define the Seq # /Name for the new peer. b. Enter the name of the IKE Peer used with the Crypto Map to build an IPSec security association. 7.
Page 442 6-88 Motorola RF Switch System Reference Guide IKE Peer Displays the IKE peer used with the Crypto Map to build an IPSec security association. ACL ID Displays the ACL ID the Crypto Map’s data flow uses to establish access permissions.
Page 443 6-89 Switch Security use the transform set for protecting the data flow. A new manual security association cannot be generated without the selection of a transform set. A default transform set is available (if none are defined). 7. Click when completed to save the configuration of the Crypto Map security association.
Page 444 6-90 Motorola RF Switch System Reference Guide 6.7.4.4 Crypto Map Transform Sets A transform set is a combination of security protocols and algorithms defining how the switch protects data. To review, revise or add a Crypto Map transform set: 1. Select Security >...
Page 445 6-91 Switch Security a. Select the #/Name. b. Enter the name of the Transform set used with the Crypto Map. 7. Click when completed to save the configuration of the Crypto Map transform set. 6.7.4.5 Crypto Map Interfaces To review the interfaces currently available to the Crypto Maps or assign an interface: NOTE: A Crypto Map cannot get applied to more than one interface at a time.
Page 446: Viewing Ipsec Security Associations
6-92 Motorola RF Switch System Reference Guide 6.7.5 Viewing IPSec Security Associations Refer to the IPSec SAs tab to review the various security associations (SAs) between the local and remote peers comprising an IPSec VPN connection. The IPSec SA tab displays the authentication and encryption schemes used between the VPN peers as well other device address information.
Page 447 6-93 Switch Security The switch can display a maximum of 600 security associations. To enable a search through the list, the Security > IPSec VPN screen provides a page navigation facility. Up to 30 security associations display per page. The following navigation and pagination options are available: View All Displays all SAs in one screen.
Page 448: Configuring The Radius Server
Configuring Radius User Groups • Viewing Radius Accounting Logs NOTE: For hotspot deployment, Motorola recommends using the switch’s onboard Radius server and built-in user database. This is the easiest setup option and offers a high degree of security and accountability.
Page 449 6-95 Switch Security Apart from EAP authentication, the switch allows the enforcement of user-based policies. User-based policies include dynamic VLAN assignment and access based on time of day. The switch uses a default trustpoint. A certificate is required for EAP TTLS,PEAP and TLS Radius authentication (configured with the Radius service).
Page 450: Using The Switch's Radius Server Versus An External Radius
(default users are admin with superuser privileges and operator with monitor privileges). No secondary authentication source is specified. However, Motorola recommends using an external Radius Server as the primary authentication source and the local switch Radius Server as the secondary user authentication source.
Page 451: Defining The Radius Configuration
6-97 Switch Security 6.8.3 Defining the Radius Configuration To configure Radius support on the switch: 1. Select Security > Radius Server from the main menu. 2. Ensure the Configuration tab is selected. 3. Click the Start the RADIUS server link to use the switch’s own Radius server to authenticate users accessing the switch managed network.
Page 452 6-98 Motorola RF Switch System Reference Guide 6.8.3.1 Radius Client Configuration A Radius client implements a client/server mechanism enabling the switch to communicate with a central server to authenticate users and authorize access to the switch managed network. A Radius client is often an embedded device since it alleviates the need to store detailed user information locally.
Page 453: Configuring Radius Authentication And Accounting
6-99 Switch Security 2. Ensure the Configuration tab is selected. 3. Select the Proxy Servers tab from the bottom of the Configuration tab. The Proxy Servers tab displays the user ID suffix (index), IP address and port number of the switch’s existing proxy server configurations.
Page 454 6-100 Motorola RF Switch System Reference Guide 2. Select the Authentication tab. 3. Refer to the Authentication field to define the following Radius authentication information: EAP and Auth Type Specify the EAP type for the Radius server. • PEAP uses a TLS layer on top of EAP as a carrier for other EAP modules. PEAP is an ideal choice for networks using legacy EAP authentication methods.
Page 455 6-101 Switch Security Cert Trustpoint Click the View/Change button to specify the trustpoint from which the Radius server automatically grants certificate enrollment requests. A trustpoint is a representation of a CA or identity pair. A trustpoint contains the identity of the CA, CA-specific configuration parameters, and an association with one enrolled identity certificate.
Page 456: Configuring Radius Users
6-102 Motorola RF Switch System Reference Guide Domain Admin Enter the Administrator User password Password LDAP Agent Retry Defines the time interval after which the LDAP Agent will try to reconnect with the Timeout LDAP server if the previous join attempt had failed.
Page 457 6-103 Switch Security 3. Refer to the following to assess whether an existing user can be used with the local Radius server as is, requires modification or if a new user is required. User ID Displays the username for this specific user. The name assigned should reflect the user’s identity and perhaps their status within the switch managed network (guest versus secure user).
Page 458: Configuring Radius User Groups
6-104 Motorola RF Switch System Reference Guide Access Duration Defines the authentication period set by the user. Check this option to enter a user- defined interval in the text field. NOTE: It is strictly recommended to set “Hotspot Simultaneous Users” to “1”...
Page 459 6-105 Switch Security 2. Select the Groups tab. 3. Refer to the user groups listed to review the following read-only attributes for each group: Name Displays the unique name assigned to each group. The group name should be indicative of the user population within and their shared activity within the switch managed network.
Page 460 6-106 Motorola RF Switch System Reference Guide This value is read-only within the Groups tab. Click Edit to modify the access assignments of an existing group or click to create a new group with unique access assignments. 6. To modify the attributes of an existing group, select the group from the list of groups displayed and click Edit button.
Page 461: Viewing Radius Accounting Logs
6-107 Switch Security Time of Access Start Set the time the group is authenticated to interoperate. Each user within the group is authenticated with the local Radius server. Those group members successfully authenticated are allowed access to the switch using the restrictions defined for the group.
Page 462: Creating Server Certificates
6-108 Motorola RF Switch System Reference Guide 2. Select the Accounting Logs tab. 3. Refer to the following information as displayed within the Accounting Logs tab. Filename Displays the name of each accounting log file. Use this information to differentiate files with similar attributes.
Page 463: Using Trustpoints To Configure Certificates
6-109 Switch Security Server Certificates screen displays two tabs supporting the following: • Using Trustpoints to Configure Certificates • Configuring Trustpoint Associated Keys 6.9.1 Using Trustpoints to Configure Certificates Each certificate is digitally signed by a trustpoint. The trustpoint signing the certificate can be a certificate authority, corporation or individual.
Page 464 6-110 Motorola RF Switch System Reference Guide Common Name (CN) If there is a common name (IP address) for the organizational unit making the certificate request, it displays here. Issued By Country (C) Displays the country of the certificate issuer.
Page 465 6-111 Switch Security 3. Use this wizard for: • Creating a new self-signed certificate or certificate request • Uploading an external certificate • Delete Operations 4. Select the Create new certificate radio button to generate a new self-signed certificate or prepare a certificate request which can be sent to a Certificate Authority (CA).
Page 466 6-112 Motorola RF Switch System Reference Guide certificate request. Once the values of the certificate are defined, the user can configure and enroll the trustpoint. Select a trustpoint for the new certificate. • Use existing trustpoint - Select an existing trustpoint from the drop-down menu.
Page 467 City name is San Jose. This is a required field. Organization Define an Organization for the organization used in the Self-Signed Certificate. By default, it is Motorola, Inc. The user is allowed to modify the Organization name. This is a required field. Organization Unit Enter an Org.
Page 468 6-114 Motorola RF Switch System Reference Guide Email Address Provide an email address used as the contact address for issues relating to this certificate request. FQDN Enter a fully qualified domain name (FQDN) is an unambiguous domain name that specifies the node's position in the DNS tree hierarchy absolutely. To distinguish an FQDN from a regular domain name, a trailing period is added.
Page 469 6-115 Switch Security If you selected to prepare a certificate request in the page 2, the wizard continues, prompting the user for the required information to complete the certificate request. Click Next to continue. 9. Check the Copy the certificate request to clipboard option to add the contents of the certificate request to the clipboard which can then be copied to other locations.
Page 470 6-116 Motorola RF Switch System Reference Guide Using the Wizard Delete Operation The wizard can also be used to delete entire trustpoints, the certificate used with a trustpoint or the CA root certificate use with a trustpoint. Delete trustpoint properties as they become obsolete or the properties of a certificate are no longer relevant to the operation of the switch.
Page 471: Configuring Trustpoint Associated Keys
6-117 Switch Security 2. Select and use the Delete trustpoint and all certificates inside it drop-down menu to define the target trustpoint for removal. 3. Select and use the Remove certificates from this trustpoint drop-down menu define the trustpoint that will have either its Server Certificate CA Root Certificate removed...
Page 472 6-118 Motorola RF Switch System Reference Guide 6.9.2.1 Adding a New Key If none of the keys listed within the Keys tab are suitable for use with a certificate, consider creating a new key pair. 1. Select Security > Server Certificates from the main menu tree.
Page 473: Configuring Enhanced Beacons And Probes
6-119 Switch Security The drop-down menu contains the log files listed within the Server Certificate screen. 6. Use the drop-down menu to define whether the target log file is to be sent to the system's local disk (Local Disk) or to an external server (Server). 7.
Page 474 • Time when the AP was detected. This information is used by the Motorola RF Management application (or Motorola RFMS) to locate the rogue AP. Motorola RFMS uses this information to physically locate the position of rogues and authorized devices within a site map representative of the physical dimensions of the actual device deployment area.
Page 475 6-121 Switch Security 5. Use the Scan Time value to enter the duration of the scan. The radio scans each channel for the defined interval. The default value is 100 milliseconds. 6. Define a Max Number of APs value to set the number of detected APs displayed in the Beacon Found table.
Page 476: Configuring The Probe Table
AP forwards the MU’s probe request information to the switch. The switch maintains a table of the probe requests the AP300 receives from MUs. In conjunction with the Motorola RF Management application, the AP locates the rogue MU and displays its location within a Motorola RFMS maintained site map. To configure enhanced beacons: 1.
Page 477: Reviewing Found Beacons
6-123 Switch Security 802.11a Radios: Click the Enable All button to allow an AP’s 802.11a radio to receive MU probe requests and forward them to the switch. 802.11a Radios: Click the Disable button to stop AP’s 802.11a radios from forwarding MU probe requests to the switch.
Page 478: Reviewing Found Probes
6-124 Motorola RF Switch System Reference Guide Signal Strength Displays the signal strength when the unadopted AP was detected. (dBm) Heard Channel Displays the channel frequency when the unadopted AP was detected. Heard Time Displays the time when the unadopted AP was detected.
Page 479: Chapter 7. Switch Management
Switch Management This chapter describes the Management Access main menu items used to configure the switch. This chapter consists of the following switch management activities: • Displaying the Management Access Interface • Configuring Access Control • Configuring SNMP Access • Message Parameters •...
Page 480: Configuring Access Control
7-2 Motorola RF Switch System Reference Guide To display the main Management screen: 1. Select Management Access from the main menu tree. 2. Refer to the Current Status field to review the following read-only information: Firmware In Use Firmware In Use value displays the software version currently running on the switch.
Page 481 Switch Management 1. Select Management Access > Access Control from the main menu tree. 2. Refer to the Management Settings field to enable or disable the following switch interfaces: Secure Management Select this checkbox to allow management VLAN access to switch resources. The (on Management management VLAN is used to establish an IP connection to the switch from a VLAN only)
Page 482: Configuring Snmp Access
7-4 Motorola RF Switch System Reference Guide HTTPS Trustpoint Use the Trustpoint drop-down menu to select the local or default trustpoint used with a HTTPS session with the switch. For information on creating a new certificate, see Creating Server Certificates on page 6-108.
Page 483: Configuring Snmp V1/V2 Access
Switch Management NOTE: The SNMP facility cannot retrieve a configuration file directly from its SNMP interface. First deposit the configuration file to a computer, then FTP the file to the switch. NOTE: When accessing the switch via a SNMP client ensure that UDP traffic is allowed on port 161 for the network being used for the switch and the SNMP client.
Page 484: Configuring Snmp V3 Access
7-6 Motorola RF Switch System Reference Guide 2. Refer to the Community Name Access Control parameters for the following information: Community Name Displays the read-only or read-write name used to associate a site-appropriate name for the community. The name is required to match the name used within the remote network management software.
Page 485 Switch Management based Access Control Model (VACM) for access control. The architecture supports the concurrent use of different security, access control, and message processing techniques. Refer to the screen to review the current SNMP v3 configuration. An Existing User Name can be selected and edited, enabled or disabled.
Page 486: Accessing Snmp V2/V3 Statistics
7-8 Motorola RF Switch System Reference Guide 4. Highlight an existing v3 entry and click the Edit button to modify the password for the Auth Protocol and Priv Protocol. For additional information, see Editing an Existing SNMP v1/v2 Community Name on page 7-6 5.
Page 487 Switch Management To edit an SNMP v3 user profile: 1. Select Management Access > SNMP Access from the main menu tree. 2. Select the Statistics tab from within the SNMP Access screen. 3. Refer to the following read-only statistics displayed within the SNMP Access Statistics screen: V2/V3 Metrics Displays the individual SNMP Access events capable of having a value tracked for them.
Page 488: Message Parameters
7-10 Motorola RF Switch System Reference Guide 7.3.4 Message Parameters To view Message Parameters: 1. Select Management Access > SNMP Access from the main menu tree. 2. Select the Message Parameters tab from within the SNMP Access screen. 3. Refer to the following parameters displayed with in Message Parameters screen.
Page 489: Enabling Trap Configuration
7-11 Switch Management 7.4.1 Enabling Trap Configuration If unsure whether to enable a specific trap, select it and view a brief description that may help your decision. Expand all items to explode each trap category and view all the traps that can be enabled. Traps can either be enabled by group or as individual traps within each parent category.
Page 490 7-12 Motorola RF Switch System Reference Guide Mobility Displays a list of sub-items (trap options) specific to the Mobility configuration option. Select an individual trap within this subsection and click the Enable button to enable this specific trap or highlight the Mobility trap family parent item and click Enable all sub-items to enable all traps within the Mobility category.
Page 491 7-13 Switch Management 7.4.1.1 Configuring E-mail Notifications To enable e-mail notification: 1. Select Management Access > SNMP Trap Configuration from the main menu tree. 2. Click the Email Configuration button to launch a dialogue where you can configure outgoing E-mail servers and addresses for alerts.
Page 492: Configuring Trap Thresholds
7-14 Motorola RF Switch System Reference Guide 4. Configure the mail-to section of the page as follows: To Address(es) Specify an e-mail address or addresses that notifications will be sent to. To add an e-mail address to the list, enter the email address in the To Address(es) field and click the Add button.
Page 493 7-15 Switch Management 3. Refer to the following information for thresholds descriptions, conditions, editable threshold values and units of measurement. Threshold Name Displays the target metric for the data displayed to the right of the item. It defines (Description) a performance criteria used as a target for trap configuration. Threshold Conditions Displays the criteria used for generating a trap for the specific event.
Page 494 7-16 Motorola RF Switch System Reference Guide 6. Click the Apply button to save changes made to the screen since the last saved configuration. 7. Click the Revert button to revert the screen back to its last saved configuration. Changes made since the...
Page 495: Wireless Trap Threshold Values
7-17 Switch Management 7.4.2.1 Wireless Trap Threshold Values The table below lists the Wireless Trap threshold values for the switch: # Threshold Name Condition Station Range Radio Range WLAN Range Wireless Units Service Range 1 Packets per Second Greater than A decimal A decimal A decimal...
Page 496: Configuring Snmp Trap Receivers
7-18 Motorola RF Switch System Reference Guide 7.5 Configuring SNMP Trap Receivers Refer to the Trap Receivers screen to review the attributes of existing SNMP trap receivers (including destination address, port, community and trap version). A new v2c or v3 trap receiver can be added to the existing list by clicking the button.
Page 497: Editing Snmp Trap Receivers
7-19 Switch Management 5. Click the button to display a sub-screen used to assign a new Trap Receiver IP Address, Port Number and v2c or v3 designation to the new trap. Add trap receivers as needed if the existing trap receiver information is insufficient. For more information, see Adding SNMP Trap Receivers on page 7-19.
Page 498 7-20 Motorola RF Switch System Reference Guide 2. Click the button at the bottom of the screen. 3. Create a new (non DNS name) destination IP address for the new trap receiver to be used for receiving the traps sent by the SNMP agent.
Page 499: Configuring Management Users
7-21 Switch Management 7.6 Configuring Management Users Refer to the Users screen to view the administrative privileges assigned to different switch users. You can modify the roles and access modes assigned to each user. The Users screen also allows you to configure the authentication methods used by the switch.
Page 500 7-22 Motorola RF Switch System Reference Guide 4. Click on the Edit button to modify the associated roles and access modes of the selected user. By default, the switch has two default users – Admin and Operator. Admin’s role is that of a superuser and Operator the role will be monitored (read only).
Page 501 7-23 Switch Management Network Network Administrator has privileges to configure all wired and wireless Administrator parameters like IP config, VLANs, Layer 2/Layer 3 security, WLANs, radios, IDS and hotspot. System Administrator Select System Administrator to allow the user to configure general settings like NTP, boot parameters, licenses, perform image upgrade, auto install, manager redundancy/clustering and control access.
Page 502 7-24 Motorola RF Switch System Reference Guide 4. Enter the new authentication password for the user in the Password field and reconfirm within the Confirm Password field. 5. Select the user role from the options provided in the Associated Roles field.
Page 503 7-25 Switch Management 7. Refer to the Status field for an indication of any problems that may have arisen. The Status is the current state of the requests made from applet. This field displays error messages if something goes wrong in the transaction between the applet and the switch. 8.
Page 504 7-26 Motorola RF Switch System Reference Guide 7.6.1.3 Creating a Guest Admin and Guest User Optionally, create a guest administrator for creating guest users with specific usernames, start and expiry times and passwords. Each guest user can be assigned access to specific user groups to ensure they are limited to just the group information they need, and nothing additional.
Page 505: Configuring Switch Authentication
7-27 Switch Management 7.6.2 Configuring Switch Authentication The switch provides the capability to proxy authenticate requests to a remote Radius server. Refer to the Authentication tab to view and configure the Radius Server used by the local user to log into the switch. NOTE: The Radius configuration described in this section is independent of other Radius Server configuration activities performed using other parts of the switch.
Page 506 7-28 Motorola RF Switch System Reference Guide 6. Refer to the bottom half of the Authentication screen to view the Radius Servers configured for switch authentication. The servers are listed in order of their priority. Index Displays a numerical Index for the Radius Server to help distinguish this Radius Server from other servers with a similar configuration.
Page 507 7-29 Switch Management 3. Select an existing Radius Server from those listed and click the Edit button at the bottom of the screen. 4. Modify the following Radius Server attributes as necessary: Radius Server Index Displays the read-only numerical Index value for the Radius Server to help distinguish this server from other servers with a similar configuration (if necessary).
Page 508 7-30 Motorola RF Switch System Reference Guide 1. Select Management Access > Users from the main menu tree. The Users screen displays. 2. Select the Authentication tab. 3. Click the button at the bottom of the screen. 4. Configure the following Radius Server attributes: Radius Server IP Provide the IP address of the external Radius server.
Page 509 7-31 Switch Management Vendor ID Vendor ID The Motorola vendor ID is 388 Radius VSAs There are two radius VSAs used for management user authentication. VSA Name Attribute Number Type Values Symbol-Service-Type Integer (Decimal) • Monitor Role: Value is 1.
Page 510 7-32 Motorola RF Switch System Reference Guide...
Page 511: Chapter 8. Diagnostics
NOTE: HTTPS must be enabled to access the switch applet. Ensure HTTPS access has been enabled before using the login screen to access the switch applet. NOTE: The Motorola RF Management Software is a recommended utility to plan the deployment of the switch and view its configuration once operational. Motorola RFMS can help optimize the positioning and configuration of a switch and assist in the troubleshooting of performance issues as they are encountered in the field.
Page 512: Switch Environment
8-2 Motorola RF Switch System Reference Guide NOTE: When the switch’s configuration is successfully updated (using the Web UI), the effected screen is closed without informing the user their change was successful. However, if an error were to occur, the error displays within the effected screen’s Status field and the screen remains displayed.
Page 513: Cpu Performance
Diagnostics 5. Use the Temperature Sensors field to monitor the CPU and system temperatures. This information is extremely useful in assessing if the switch exceeds its critical limits. SWITCH NOTE: A RF7000 Series Switch has six sensors. 6. Refer to the Fans field to monitor the CPU and system fan speeds.
Page 514: Switch Memory Allocation
8-4 Motorola RF Switch System Reference Guide 7. Click the Revert button to revert back to the last saved configuration. 8.1.3 Switch Memory Allocation Use the Memory tab to periodically assess the switch’s memory load. 1. Select Diagnostics from the main tree menu.
Page 515: Switch Memory Processes
Diagnostics 1. Select Diagnostics from the main tree menu. 2. Select the Disk tab. 3. This Disk tab displays the status of the switch flash, nvram, and system disk resources. Each field displays the following: • Free Space Limit • Free INodes •...
Page 516: Other Switch Resources
8-6 Motorola RF Switch System Reference Guide 2. Select the Processes 3. The Processes tab has 2 fields: • General • Processes by highest memory consumption 4. Refer to the General field to review the number of processes in use and percentage of memory usage per process.
Page 517: Configuring System Logging
Diagnostics 2. Select the Other Resources tab. Keep the Cache allocation in line with cache expectations required within the switch managed network. 3. Define the maximum limit for each resource accordingly as you expect these resources to be utilized within the switch managed network. 4.
Page 518 8-8 Motorola RF Switch System Reference Guide 2. Select the Log Options tab. 3. Select the Enable Logging Module checkbox to enable the switch to log system events to a user defined log file or a syslog server. 4. Select the Enable Logging to Buffer checkbox to enable the switch to log system events to a buffer.
Page 519: File Management
Diagnostics 8. Click Apply to save the changes made to the screen. This will overwrite the previous configuration. 9. Click the Revert button to move the display back to the last saved configuration. 8.2.2 File Management Use the File Mgt tab to view existing system logs.
Page 520 Log Files on page 8-12. 8.2.2.1 Viewing the Entire Contents of Individual Log Files Motorola recommends the entire contents of a log file be viewed to make an informed decision whether to transfer the file or clear the buffer. The View screen provides additional details about a target file by allowing the entire contents of a log file to be reviewed.
Page 521 8-11 Diagnostics 3. Select an individual log file whose properties you wish to display in detail and click the View button. 4. Refer to the following for information on the elements that can be viewed within a log file: Timestamp Displays the date, year and time of day the log file was initially created.
Page 522 8-12 Motorola RF Switch System Reference Guide Mnemonic Use the Mnemonic as a text version of the severity code information. A mnemonic is convention for the classification, organization, storage and recollection of switch information. Description Displays a high-level overview of the event, and (when applicable) message type, error or completion codes for further clarification of the event.
Page 523: Reviewing Core Snapshots
8-13 Diagnostics 10.If Server has been selected as the source, enter the User ID credentials required to send the log file to the target location. 11.If Server has been selected as the source, use the Password parameter to enter the password required to send the log file to the target location.
Page 524: Transferring Core Snapshots
8-14 Motorola RF Switch System Reference Guide Size (Bytes) Displays the size of the core file in bytes. Displays the date and time the core file was generated. This information may be Created useful in troubleshooting issues. 3. Select a target file and click the Delete button to remove the selected file.
Page 525: Reviewing Panic Snapshots
8-15 Diagnostics 11.Specify the appropriate Path to the target directory on the local system disk or server as configured using parameter. If the local disk option is selected, use the browse button to specify the location on the local disk. 12.Refer to the Status field for the current state of the requests made from applet.
Page 526: Viewing Panic Details
8-16 Motorola RF Switch System Reference Guide Size Displays the size of the panic file in bytes. Displays the date and time the panic file was created. The panic file is created after Created the system reboots, however the panic information within the file contains the date and time the panic actually occurred.
Page 527 8-17 Diagnostics 2. Select a record from those available and click the Transfer button. 3. Use the From drop-down menu to specify the location from which the file is sent. If only the applet is available as a transfer location, use the default switch option. 4.
Page 528: Debugging The Applet
8-18 Motorola RF Switch System Reference Guide 8.5 Debugging the Applet Refer to the Applet Debugging screen to debug the applet. This screen allows you to view and debug system events by a criticality level you define. 1. Select Diagnostics >...
Page 529: Configuring A Ping
8-19 Diagnostics • None - no impact. 6. Select the message deployed when a bug is raised. What Kind of message should be seen field allows you to select a range of parameters for returned messages while debugging. Move your mouse pointer over a message checkbox for a message description.
Page 530: Modifying The Configuration Of An Existing Ping Test
8-20 Motorola RF Switch System Reference Guide 2. Refer to the following information displayed within the Configuration tab: Description Displays the user assigned description of the ping test. The name is read-only. Use this title to determine whether this test can be used as is or if a new ping test is required.
Page 531: Adding A New Ping Test
8-21 Diagnostics 3. Modify the following information (as needed) to edit the existing ping test: Description If necessary, modify the description for the ping test. Ensure this description is representative of the test, as this is the description displaying within the Configuration tab.
Page 532: Viewing Ping Statistics
8-22 Motorola RF Switch System Reference Guide 3. Enter the following information to define the properties of the new ping test: Test Name Enter a short name for the ping test to describe either the target destination of the ping packet or the ping test’s expected result. Use the name provided in combination with the ping test description to convey the overall function of the test.
Page 533 8-23 Diagnostics 2. Select the Statistics tab. 3. Refer to the following content within the Statistics tab to assess the connection with the target device: Destination IP Displays the numeric (non DNS address) destination for the device transmitted the ping packets. Packets Sent Displays the number of packets transmitted to the target device IP address.
Page 534 8-24 Motorola RF Switch System Reference Guide...
Page 535: Motorola's Enterprise Mobility Support Center
The AP7131N supports a US only SKU, AP7131N-US. This SKU could be placed indoors or outdoors. However, a recent change to the FCC rules now prevents the use of this SKU outdoors. Motorola has created a new SKU, the AP7131N-USO, that can be used both indoors and outdoors. While operating outdoors, the new SKU can only operate on channels 52-64.
Page 536: Outdoor Sku Support For Ap650
A-2 Motorola RF Switch System Reference Guide A.3.1 Outdoor SKU Support for AP650 AP650-OUS is the new hardware SKU introduced on AP650 for outdoor placements in the US.If the AP model is an outdoor SKU, you can specify the placement to be either Indoor or Outdoor. Channels are allowed based on this configuration.
Page 537: Adaptive Ap Overview
An adaptive AP (AAP) is an AP-5131 Access Point that can adopt like an AP300 (Layer 3). The management of an AAP is conducted by the switch, once the Access Point connects to a Motorola RFS6000 or RFS7000 model switch and receives its AAP configuration.
Page 538: Adaptive Ap Management
B-4 Motorola RF Switch System Reference Guide • Adaptive AP Management • Types of Adaptive APs • Licensing • Switch Discovery • Securing a Configuration Channel Between Switch and AP • Adaptive AP WLAN Topology • Configuration Updates • Securing Data Tunnels between the Switch and AAP •...
Page 539: Licensing
These dependent mode AP configurations are a software variant of the AP-5131 and will be functional only after the Access Point is adopted by a wireless switch. After adoption, the dependent mode AP receives its configuration from the switch and starts functioning like other adaptive Access Points. For ongoing operation, the dependent mode AP-5131 needs to maintain connectivity with the switch.
Page 540: Securing A Configuration Channel Between Switch And Ap
B-6 Motorola RF Switch System Reference Guide ** The AP-5131 uses an encryption key to hash passphrases and security keys. To obtain the encryption passphrase, configure an AP-5131 with the passphrase and export the configuration file. B.1.5.2 Manual Adoption Configuration A manual switch adoption of an AAP can be conducted using: •...
Page 541: Configuration Updates
• Independent WLANs - Independent WLANs are local to an AAP and can be configured from the switch. You must specify a WLAN as independent to stop traffic from being forwarded to the switch. Independent WLANs behave like WLANs on a standalone Access Point. •...
Page 542: Remote Site Survivability (Rss
B-8 Motorola RF Switch System Reference Guide B.1.11 Remote Site Survivability (RSS) RSS can be used to turn off RF activity on an AAP if it loses adoption (connection) to the switch. RSS State Independent WLANs Extended WLANs RSS Enabled...
Page 543: Aap Radius Proxy Support
3. Configure the client bridge back haul WLAN, base bridge and client bridge radios on the switch using the Command Line Interface (CLI) commands listed below. Client Bridge Back Haul WLAN Configuration: RFS7000(config-wireless)#wlan 1 enable RFS7000(config-wireless)#wlan 1 ssid meshWlan RFS7000(config-wireless)#wlan 1 independent RFS7000(config-wireless)#wlan 1 client-bridge-backhaul enable Base Bridge Radio Configuration: (AP5131 that is wired to the switch) RFS7000(config-wireless)#radio add 1 “base bridge radio mac”...
Page 544: Supported Adaptive Ap Topologies
WLAN with Adaptive AP Radius Proxy. NOTE The Motorola RF Series Wireless Switches support Adaptive AP Radius proxy without specifying realm information. If AAP Proxy Radius is enabled without specifying realm information, the onboard Radius server can no longer be used to authenticate users.
Page 545: Topology Deployment Considerations
LAN1. If the WAN Interface is used, explicitly configure WAN as the default gateway interface. • Motorola recommends using the LAN1 interface for adoption in multi-cell deployments. • If you have multiple independent WLANs mapped to different VLANs, the AAP's LAN1 interface requires trunking be enabled with the correct management and native VLAN IDs configured.
Page 546: Extended Vlan With Mesh Networking
Converting an AP-5131 or AP-7131 model Access Point into an AAP requires: • A version 2.0 or higher firmware running on the Access Point. • A Motorola RF Switch running firmware version 3.1 or later. • The appropriate switch licenses providing AAP functionality on the switch.
Page 547: Configuring The Switch For Adaptive Ap Adoption
Configuration. B.3.3 Configuring the Switch for Adaptive AP Adoption The tasks described below are configured on a Motorola RF switch. For information on configuring the switch for AAP support, see http://www.motorola.com/Business/US-EN/Support. To adopt an AAP on a switch: 1. Ensure enough licenses are available on the switch to adopt the required number of AAPs.
Page 548 B-14 Motorola RF Switch System Reference Guide 1. Select System Configuration -> Adaptive AP Setup from the Access Point’s menu tree. 2. Select the Auto Discovery Enable checkbox. Enabling auto discovery will allow the AAP to be detected by a switch once its connectivity medium has been configured (by completing steps 3-6).
Page 549: Switch Configuration
Vendor Specific Option 43 and sent in the DHCP Offer. B.4.2 Switch Configuration A Motorola RF Switch (running firmware version 3.1 or later) requires an explicit adaptive configuration to adopt an Access Point (if IPSec is not being used for adoption). The same licenses currently used for AP300 adoption can be used for an AAP.
Page 550 B-16 Motorola RF Switch System Reference Guide 3. Ensure the Adopt unconfigured radios automatically option is NOT selected. 4. When disabled, there is no automatic adoption of non-configured radios on the network. Additionally, default radio settings will NOT be applied to Access Ports when automatically adopted.
Page 551 B-17 Additionally, a WLAN can be defined as independent using the NOTE "wlan <index> independent" command from the config-wireless context. For AAP to work properly with RFS7000 you need to have SWITCH NOTE independent and extended WLANs mapped to a different VLAN than the ge port.
Page 552: Adaptive Ap Deployment Considerations
B-18 Motorola RF Switch System Reference Guide Once an AAP is adopted by the switch, it displays within the switch Access Port Radios screen (under the Network parent menu item) as an AP-5131, AP-5181 or AP-7131 within the AP Type column.
Page 553 B-19 The sample output is as follows: ! configuration of RFS6000 version 1.0 aaa authentication login default none service prompt crash-info hostname RFS6000-1 username admin password 1 8e67bb26b358e2ed20fe552ed6fb832f397a507d username admin privilege superuser username operator password 1 fe96dd39756ac41b74283a9292652d366d73931f To configure the ACL to be used in the CRYPTO MAP ip access-list extended AAP-ACL permit ip host 10.10.10.250 any rule-precedence 20 spanning-tree mst cisco-interoperability enable spanning-tree mst config...
Page 554 B-20 Motorola RF Switch System Reference Guide xyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxxyxyxyx wireless no adopt-unconf-radio enable manual-wlan-mapping enable wlan 1 enable wlan 1 ssid qs5-ccmp wlan 1 vlan 200 wlan 1 encryption-type ccmp wlan 1 dot11i phrase 0 Symbol123 wlan 2 enable wlan 2 ssid qs5-tkip...
Page 555 B-21 radio add 3 00-15-70-00-79-12 11bg aap5131 radio 3 bss 1 3 radio 3 bss 2 4 radio 3 bss 3 2 radio 3 channel-power indoor 6 8 radio 3 rss enable radio add 4 00-15-70-00-79-12 11a aap5131 radio 4 bss 1 5 radio 4 bss 2 6 radio 4 channel-power indoor 48 4 radio 4 rss enable...
Page 556 B-22 Motorola RF Switch System Reference Guide switchport trunk allowed vlan add 1-9,100,110,120,130,140,150,160,170, switchport trunk allowed vlan add 180,190,200,210,220,230,240,250, static-channel-group 1 interface ge4 switchport access vlan 1 interface me1 ip address dhcp interface sa1 switchport mode trunk switchport trunk native vlan 1...
Page 557: General Troubleshooting
• Miscellaneous Issues • System Logging Mechanism C.1.1 Wireless Switch Issues This section describes various issues that may occur when working with a Motorola RF Series Switch. Possible issues include: • Switch Does Not Boot Up • Switch Does Not Obtain an IP Address through DHCP •...
Page 558 C-2 Motorola RF Switch System Reference Guide C.1.1.1 Switch Does Not Boot Up The Motorola RF Series Switch does not boot up to a username prompt via CLI console or Telnet. The table below provides suggestions to troubleshoot this issue.
Page 559 When configuring the switch, it is easy to overlook the fact that the host computer is running the browser while the Motorola RF Series Switch is providing the data to the browser. Occasionally, while using the Web UI the switch does not respond or appears to be running very slow; this could be a symptom of the host computer or the network, and not the switch itself.
Page 560: Access Port Issues
1 stop bit no flow control All else... Contact Motorola Support. C.1.2 Access Port Issues This section describes various issues related to Access Ports within the Motorola RF Series Switch network. Possible issues include: • Access Ports are Not Adopted •...
Page 561: Mobile Unit Issues
60 seconds. after converting to a Detector AP All else... Contact Motorola Support. C.1.2.3 Sensor Port frequently goes up and down Possible Problem Suggestions to Correct This may be caused by the sensor being unable to find its server. Ensure Sensor Port flapping (going that the detection configuration is correct and that all cables are secure.
Page 562: Miscellaneous Issues
Verify that a long preamble is used with Spectralink phones. Spectralink phones C.1.4 Miscellaneous Issues This section describes various miscellaneous issues related to the Motorola RF Series Switch which don’t fall into any of the previous categories. Possible issues include: •...
Page 563: System Logging Mechanism
Contact Motorola Support. C.1.5 System Logging Mechanism The Motorola RF Series Switch provides subsystem logging to a Syslog server. There are two Syslog systems, local and remote. Local Syslog records system information locally, on the switch. The remote Syslog sends messages to a remote host.
Page 564: Not Able To Snmp Walk For A Get
C-8 Motorola RF Switch System Reference Guide C.2.2 Not able to SNMP WALK for a GET • Check whether the MIB browser has IP connectivity to the SNMP agent on the switch. Use IP Ping from the client system which has the MIB Browser.
Page 565: Radius Troubleshooting
To access the Motorola RF Series Switch using password recovery: CAUTION: Using this recovery procedure erases the switch’s current configuration and data files from the switch /flash dir. Only the switch’s license keys are retained. You should be able to log in using the default username and password (admin/superuser) and restore the switch’s previous configuration (only if it has been exported to a secure...
Page 566 C-10 Motorola RF Switch System Reference Guide • Add a Radius client in AAA context • Ensure that key password in AAA/EAP context is set to the key used to generate imported certificates • DO NOT forget to SAVE! C.3.2.2 Radius Server does not reply to my requests Ensure the following have been attempted: •...
Page 567: Troubleshooting Radius Accounting Issues
"enable" and should also the status of the configured detection scheme. • Check for the "Motorola AP" flag in rulelist context. If it is set to "enable", then all the detected APs will be added in approved list context.
Page 568: Troubleshooting Firewall Configuration Issues
3. Check whether Host-1/Host-2 and Host-3 are on the same IP subnet. If not, add proper NAT entries for configured LANs under FireWall context. 4. After last step, check again, that IP Ping from Host1 to the Interface on the Trusted Side of the Motorola RF Series Switch works.
Page 569 C-13 C.5.0.2 How to block the request from host on untrusted to host on trusted side based on packet classification. 1. Add a new Classification Element with required Matching Criteria 2. Add a new Classification Group and assigned the newly created Classification Element. Set the action required.
Page 570 C-14 Motorola RF Switch System Reference Guide...
Page 571: Open Source Software Used
Open Source Software Information Product Name: AP650 For instructions on obtaining a copy of any source code being made publicly available by Motorola related to software used in this Motorola product, you may send a request in writing to: MOTOROLA, INC.
Page 572 D-2 Motorola RF Switch System Reference Guide Name Version License dropbear 0.51 http://matt.ucc.asn.au/dropbear/dropbear.html Drop Bear License e2fsprogs 1.40.11 http://e2fsprogs.sourceforge.net/ GNU General Public License 2.0 4.1.2 http://gcc.gnu.org/ GNU General Public License 2.0 http://www.gnu.org/software/gdb/ GNU General Public License 2.0 genext2fs 1.4.1 http://genext2fs.sourceforge.net/ GNU General Public License 2.0...
Page 573 Name Version License openwrt truck-r15025 http://www.openwrt.org/ GNU General Public License 2.0 opkg truck-r4564 http://code.google.com/p/opkg/ GNU General Public License 2.0 pkg-config 0.22 http://pkg-config.freedesktop.org/wiki/ GNU General Public License 2.0 2.4.3 http://ppp.samba.org/ppp/ BSD Style Licenses quilt 0.47 http://savannah.nongnu.org/projects/quilt/ GNU General Public License 2.0 4.1.2 http://www.gnu.org/software/sed/ GNU General Public...
Page 574 D-4 Motorola RF Switch System Reference Guide D.2 OSS Licenses D.2.1 GNU General Public License 2.0 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
Page 575 any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language.
Page 576 D-6 Motorola RF Switch System Reference Guide a. Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b. Accompany it with a written offer, valid for at least three years, to give any third party, for a charge...
Page 577 directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances.
Page 578: Gnu Lesser General Public License 2.1
D-8 Motorola RF Switch System Reference Guide THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Page 579 Finally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.
Page 580 D-10 Motorola RF Switch System Reference Guide "Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.
Page 581 D-11 refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices. Once this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.
Page 582 D-12 Motorola RF Switch System Reference Guide modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)
Page 583 D-13 11.If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all.
Page 584: Bsd Style Licenses
D-14 Motorola RF Switch System Reference Guide TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16.IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY...
Page 585: Open Ssl License
D-15 D.2.5 Open SSL License LICENSE ISSUES ============== The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses.
Page 586: Zlib License
D-16 Motorola RF Switch System Reference Guide This package is an SSL implementation written by Eric Young (eay@cryptsoft.com). The implementation was written so as to conform with Netscapes SSL. This library is free for commercial and non-commercial use as long as the following conditions are adhered to.
Page 587: Drop Bear License
D-17 1. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required. 2.
Page 588 D-18 Motorola RF Switch System Reference Guide loginrec.h atomicio.h atomicio.c and strlcat() (included in util.c) are from OpenSSH 3.6.1p2, and are licensed under the 2 point BSD license. loginrec is written primarily by Andre Lucas, atomicio.c by Theo de Raadt.
Page 590 MOTOROLA INC. 1303 E. ALGONQUIN ROAD SCHAUMBURG, IL 60196 http://www.motorola.com 72E-132942-01 Revision C December 2010...

This manual is also suitable for:

Rfs4000 4.3 Rfs6000 4.3 Rfs7000 4.3

Motorola RFS Series System Reference Manual

Chapter 1. Overview

Chapter 2. Switch Web UI Access and Image Upgrades

Chapter 3. Switch Information

Chapter 4. Network Setup

Chapter 5. Switch Services

Chapter 6. Switch Security

Chapter 7. Switch Management

Chapter 8. Diagnostics

Quick Links

Troubleshooting

Related Manuals for Motorola RFS Series

Summary of Contents for Motorola RFS Series