D-Link DWL-3500AP - AirPremier Wireless Switching 108G Access Point Administrator's Manual page 145

- WPA and WPA2—If you have a mix of clients, some of which support WPA2 and
others which support only the original WPA, select both. This lets both WPA and
WPA2 client stations associate and authenticate, but uses the more robust WPA2 for
clients who support it. This WPA configuration allows more interoperability, at the
expense of some security.
set bss wlan0bssvap0 wpa-allowed on
set bss wlan0bssvap0 wpa2-allowed on
3. Enable Pre-Authentication
If you set WPA versions to "WPA2" or "Both", you can enable pre-authentication for
WPA2 clients.
Enable pre-authentication if you want WPA2 wireless clients to send pre-authentication
packet. The pre-authentication information will be relayed from the access point the client
is currently using to the target access point. Enabling this feature can help speed up
authentication for roaming clients who connect to multiple access points.
To enable pre-authentication for WPA2 clients, enter the following command:
set bss wlan0bssvap0 rsn-preauthentication on
To disable pre-authentication for WPA2 clients, enter the following command:
set bss wlan0bssvap0 rsn-preauthentication on
The pre-authentication option does not apply if you set the WPA Version to support "WPA"
clients because the original WPA does not support this pre-authentication
4. Set the Cipher Suite you want to use.
- TKIP Only: Temporal Key Integrity Protocol (TKIP).
set bss wlan0bssvap0 wpa-cipher-tkip on
set bss wlan0bssvap0 wpa-cipher-ccmp off
- CCMP (AES) Only—Counter mode/CBC-MAC Protocol (CCMP) is an encryption
method for IEEE 802.11i that uses the Advanced Encryption Algorithm (AES).
set bss wlan0bssvap0 wpa-cipher-tkip off
set bss wlan0bssvap0 wpa-cipher-ccmp on
- TKIP and CCMP (AES)—When you enable both authentication algorithms, both
TKIP and AES clients can associate with the access point. WPA clients must have
either a valid TKIP key or a valid CCMP (AES) key to be able to associate with the
AP.
set bss wlan0bssvap0 wpa-cipher-tkip on
set bss wlan0bssvap0 wpa-cipher-ccmp on
5. Set the Authentication Server.
If you do not want to use the global RADIUS server for this VAP, you must disable the
global RADIUS server and specify an IP address and RADIUS key for the VAP, as shown
in the following commands:
DLINK-AP# set bss wlan0bssvap0 radius-ip 10.23.6.13
DLINK-AP# set bss wlan0bssvap0 radius-key thisISmyKey
You can enable RADIUS Accounting if you want to track and measure the resources a
particular user has consumed such system time, amount of data transmitted and received,
B CLI for AP Configuration
Access Point CLI Commands 145