USRobotics Network Card Instant802 APSDK User Manual

Navigating to Wireless Settings

Navigating to Ethernet (Wired) Settings

To set the wired address for an access point, click the Advanced menu’s Ethernet (Wired) Settings tab, and

update the fields as described below.

Ethernet (Wired) Settings - 90

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Setting the DNS Name

Field

Description

DNS Name

Enter the DNS name for the access point in the text box.

This is the host name. It may be provided by your ISP or network administrator,

or you can provide your own.

The rules for system names are:

• This name can be up to 20 characters long.

• Only letters, numbers, and dashes are allowed.

• The name must start with a letter and end with either a letter or a number.

Managing Guest Access

You can provide controlled guest access over an isolated network and a secure internal LAN on the same

Professional Access Point by using VLANs. You can also configure an access point for guest access only,

without maintaining a separate secure LAN. The Guest settings on the Ethernet (Wired) Settings tab are

required only if you want to use VLANs. For information about configuring an access point for guest access

only, see “Configuring Guest Access without Virtual LANs” on page 124.

Configuring an Internal LAN and a Guest Network

A Local Area Network (LAN) is a communications network covering a limited area, for example, one floor

of a building. A LAN connects multiple computers and other network devices like storage and printers.

Ethernet is the most common technology for implementing a LAN. Wi-Fi (IEEE) is another very popular

LAN technology.

The Professional Access Point allows you to configure two different LANs on the same access point: one

for a secure internal LAN and another for a public guest network with no security and little or no access to

internal resources. To configure these networks, you need to provide both wireless and Ethernet (wired)

settings.

Information on how to configure the Ethernet (wired) settings is provided in the sections below.

(For information on how to configure the wireless settings, see “Wireless Settings” on page 97. For an

overview of how to set up the Guest interface, see “Guest Login” on page 121.)

Enabling and Disabling Guest Access

The Professional Access Point ships with the Guest Access feature disabled by default. If you want to

provide guest access while also maintaining a secure, internal network on your access point, enable Guest

Ethernet (Wired) Settings - 91

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Access on the Ethernet (Wired) Settings tab.

Field

Description

Guest Access

By default, the Professional Access Point ships with Guest Access disabled.

• To enable Guest Access, click Enabled.

• To disable Guest Access, click Disabled.

Specifying a Virtual Guest Network

If you enable Guest Access, you must represent both an Internal and a Guest Network on this access point

virtually, by connecting the LAN port on the access point to a tagged port on a VLAN-capable switch and

then defining two different virtual LANs on the Ethernet (Wired) Settings page. (For more information, see

“Guest Login” on page 121.)

Choose virtually separate internal and guest LANs as described below.

Field

Description

Guest Access

• Select Enabled to enable Guest Access. (If you choose this option, you must

select VLANs on the next setting For Guest access, use, and then provide

details on VLAN or wired setting for the Guest Network on the rest of the

page.)

• Select Disabled to disable Guest Access

For Guest access, use

Specify a virtually separate guest network on this access point:

• Choose VLAN on Ethernet Port. This will enable the VLAN settings where you

must provide a VLAN ID. See also “Configuring Guest Interface Ethernet

(Wired) Settings” on page 95.

Caution: If you reconfigure the Guest and Internal interfaces to use VLANs,

you may lose connectivity to the access point. First, be sure to verify that the

switch and DHCP server you are using can support VLANs per the IEEE

802.1Q standard. After configuring the VLAN on the Advanced menu’s

Ethernet (Wired) Settings page, physically reconnect the Ethernet cable on the

switch to the tagged packet (VLAN) port. Then, reconnect via the Web User

Interface to the new IP address. (If necessary, check with the infrastructure

support administrator regarding the VLAN and DHCP configurations.)

Enabling and Disabling Virtual Wireless Networks on the Access Point

If you want to configure the Internal network as a VLAN (whether or not you have a Guest network

configured), you can enable Virtual Wireless Networks on the access point.

You must enable this feature if you want to configure additional virtual networks on VLANs on the

Advanced menu’s Virtual Wireless Networks page as described in “Virtual Wireless Networks” on

Ethernet (Wired) Settings - 92

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

page 125.

Field

Description

Virtual Wireless Networks

(Using VLANs on Ethernet Port)

• Select Enabled to enable VLANs for the Internal network and for

additional networks. If you choose this option, you can run the Internal

network on a VLAN whether or not you have Guest Access configured

and you can set up additional networks on VLANs using the Advanced

menu’s Virtual Wireless Networks page as described in “Virtual Wireless

Networks” on page 125.

• Select Disabled to disable the VLAN for the Internal network, and for any

additional virtual networks on this access point.

Configuring Internal Interface Ethernet Settings

To configure Ethernet (Wired) settings for the Internal LAN, fill in the fields as described below.

Field

Description

MAC Address

Shows the MAC address for the Internal network interface for the LAN port on this

access point. This is a read-only field.

VLAN ID

If you choose to configure Internal and Guest networks by VLANs, this field is ena-

bled.

Provide a number between 1 and 4094 for the Internal VLAN.

This will cause the access point to send DHCP requests with the VLAN tag. The

switch and the DHCP server must support VLAN IEEE 802.1Q frames. The access

point must be able to reach the DHCP server.

Ethernet (Wired) Settings - 93

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Connection Type

You can select DHCP or Static IP.

The Dynamic Host Configuration Protocol (DHCP) is a protocol that specifies how a

centralized server can provide network configuration information to devices on the

network. A DHCP server offers a lease to the client. The information supplied

includes the IP addresses and netmask plus the address of its DNS servers and

gateway.

Static IP indicates that all network settings are provided manually. You must provide

the IP address for the Professional Access Point, its subnet mask, the IP address of

the default gateway, and the IP address of at least one DNS name server.

If you select DHCP, the Professional Access Point will acquire its IP Address, subnet

mask, and DNS and gateway information from the DHCP Servers.

If you select Static IP, fill in the Static IP Address, Subnet Mask, and Default Gateway

fields.

Caution: If you do not have a DHCP server on the Internal network and do not plan

to use one, the first thing you must do after bringing up the access point is change

the connection type from DHCP to static IP. When you change the connection type

to static IP, you can either assign a new Static IP Address to the access point or

continue using the default address. USRobotics recommends assigning a new

address so that if later you bring up another Professional Access Point on the same

network, the IP addresses for the two APs will be unique.

If you need to recover the default static IP address, you can do so by resetting the

access point to the factory defaults as described in “Reset Configuration” on

page 171.

Static IP Address

Subnet Mask

Enter the static IP address in the text boxes.

This field is enabled only if you selected Static IP as the connection type.

Enter the Subnet Mask in the text boxes. You must obtain this information from your

ISP or network administrator.

This field is enabled only if you selected Static IP as the connection type.

Default Gateway

Enter the Default Gateway in the text boxes.

This field is enabled only if you selected Static IP as the connection type.

DNS Nameservers

The Domain Name Service (DNS) is a system that resolves the descriptive name

(domainname) of a network resource (for example, www.usr.com) to its numeric

IP address (for example, 66.93.138.219). A DNS server is called a Nameserver.

There are usually two Nameservers; a Primary Nameserver and a Secondary

Nameserver.

You can choose Dynamic or Manual mode.

• If you choose Manual, assign static IP addresses for the DNS servers manually.

• If you choose Dynamic, the IP addresses for the DNS servers will be assigned

automatically via DHCP. This option is only available if you specified DHCP for the

Connection Type.

Ethernet (Wired) Settings - 94

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Configuring Guest Interface Ethernet (Wired) Settings

To configure Ethernet (Wired) Settings for the Guest interface, fill in the fields as described below.

Field

Description

MAC Address

Shows the MAC address for the Guest interface for the LAN port on this access

point. This is a read-only field.

VLAN ID

If you choose to configure Internal and Guest networks by VLANs, this field will be

enabled.

Provide a number between 1 and 4094 for the Guest VLAN. Be sure to assign a dif-

ferent VLAN ID than the one used for the Internal network.

Subnet

Shows the subnetwork address for the Guest interface. For example, 192.168.1.0.

Updating Settings

To apply your changes, click Update.

Ethernet (Wired) Settings - 95

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Ethernet (Wired) Settings - 96

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Wireless Settings

Wireless settings describe aspects of the local area network (LAN) related specifically to the radio device

in the access point (802.11 Mode and Channel) and to the network interface to the access point (MAC

address for access point and wireless network name, also known as SSID).

The following sections describe how to configure the wireless address and related settings on the

Professional Access Point:

•

Configuring 802.11d Regulatory Domain Support

Configuring the Radio Interface

Configuring Internal LAN Wireless Settings

Configuring Guest Network Wireless Settings

Understanding Security Issues on Wireless Networks

Navigating to Wireless Settings

To set the wireless address for an access point, click the Advanced menu’s Wireless Settings tab, and

update the fields as described below.

Wireless Settings - 97

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Configuring 802.11d Regulatory Domain Support

You can enable or disable IEEE 802.11d Regulatory Domain Support to broadcast the access point

country code information as described below.

Field

Description

802.11d Regulatory Domain Support

Enabling support for IEEE 802.11d on the access point causes the access

point to broadcast which country it is operating in as a part of its beacons:

• To enable 802.11d regulatory domain support click Enabled.

• To disable 802.11d regulatory domain support click Disabled.

Note: IEEE 802.11d defines standard rules for the operation of IEEE 802.11

wireless LANs in any country without reconfiguration. IEEE 802.11d allows

client devices to operate in any country without reconfiguration.

Wireless Settings - 98

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Configuring the Radio Interface

The radio interface allows you to set the radio Channel and 802.11 mode as described below.

Field

Description

Mode

The Mode defines the Physical Layer (PHY) standard being used by the radio.

Select one of these modes:

• IEEE 802.11b

• IEEE 802.11g

Channel

Select the Channel. The range of channels is 1 through 11.

The Channel defines the portion of the radio spectrum the radio uses for trans-

mitting and receiving. Each mode offers a number of channels, depending on

how the spectrum is licensed by national and transnational authorities such as

the Federal Communications Commission (FCC) or the International Telecom-

munication Union (ITU-R).

The default is Auto, which picks the least busy channel at startup time.

Configuring Internal LAN Wireless Settings

The Internal Settings describe the MAC Address and Network Name (also known as the SSID) for the

internal Wireless LAN (WLAN) as described below.

Field

Description

MAC Address

Shows the MAC address for the Internal interface for this access point. This is

a read-only field that you cannot change.

Although this access point is physically a single device, it can be represented

on the network as two or more nodes each with a unique MAC Address. This is

accomplished by using multiple Basic Service Set Identifiers (BSSIDs) for a

single access point.

The MAC address shown for the Internal access point is the BSSID for the

Internal interface.

Wireless Network Name (SSID)

Enter the SSID for the internal WLAN.

The Service Set Identifier (SSID) is an alphanumeric string of up to 32 charac-

ters that uniquely identifies a wireless local area network. It is also referred to

as the Network Name. There are no restrictions on the characters that may be

used in an SSID.

Wireless Settings - 99

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Configuring Guest Network Wireless Settings

The Guest Settings describe the MAC Address (read-only) and wireless network name (SSID) for the Guest

Network as described below. Configuring an access point with two different network names (SSIDs) allows

you to implement the Guest interface feature on the Professional Access Point. For more information, see

“Guest Login” on page 121.

Field

Description

MAC Address

Shows the MAC address for the Guest interface for this access point. This is a

read-only field.

Although this access is point is physically a single device, it can be represented

on the network as two or more nodes each with a unique MAC Address. This is

accomplished by using multiple Basic Service Set Identifiers (BSSID) for a sin-

gle access point.

The MAC address shown for the Guest access point is the BSSID for the

Guest interface.

Wireless Network Name (SSID)

Enter the SSID for the guest network.

The Service Set Identifier (SSID) is an alphanumeric string of up to 32 charac-

ters that uniquely identifies a wireless local area network. It is also referred to

as the Network Name. There are no restrictions on the characters that may be

used in an SSID.

For the guest network, provide an SSID that is different from the internal SSID

and easily identifiable as the guest network.

If you are configuring an access point for guest access only, without

also maintaining a separate, secure network, you do not need to spec-

ify a Guest network SSID. You will have only one network: the Internal

network.

Updating Settings

To apply your changes, click Update.

Wireless Settings - 100

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Security

The following sections describe how to configure security settings on the Professional Access Point:

•

•

How Do I Know Which Security Mode to Use?

Comparison of Security Modes for Key Management, Authentication and Encryption Algorithms

Does Prohibiting the Broadcast of SSID Enhance Security?

How Does Station Isolation Protect the Network?

•

Navigating to Security Settings

Configuring Security Settings

•

Broadcast SSID, Station Isolation, and Security Mode

None

Static WEP

IEEE 802.1x

WPA/WPA2 Personal (PSK)

WPA/WPA2 Enterprise (RADIUS)

•

When to Use WPA/WPA2 Personal (PSK)

Understanding Security Issues on Wireless Networks

Wireless mediums are inherently less secure than wired mediums. For example, an Ethernet NIC trans-

mits its packets over a physical medium such as coaxial cable or twisted pair. A wireless NIC broadcasts

radio signals over the air allowing a wireless LAN to be easily tapped without physical access or sophisti-

cated equipment. A hacker equipped with a laptop, a wireless NIC, and a bit of knowledge can easily

attempt to compromise your wireless network. By using a sophisticated antenna on the client, a hacker

may even be able to connect to the network from many miles away.

The Professional Access Point provides a number of authentication and encryption schemes to ensure

that your wireless infrastructure is accessed only by the intended users. The details of each security mode

are described in the sections below.

How Do I Know Which Security Mode to Use?

In general, USRobotics recommends that on your Internal network you use the most robust security mode

that is feasible in your environment. When configuring security on the access point, you first must choose

the security mode. Then, in some modes you must choose an authentication algorithm and whether to

allow clients not using the specified security mode to associate.

Security - 101

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Wi-Fi Protected Access (WPA) with Remote Authentication Dial-In User Service (RADIUS) using the

CCMP (AES) encryption algorithm provides the best data protection available and is clearly the best

choice if all client devices are equipped with WPA supplicants. However, backward compatibility or

interoperability issues with clients or even with other access points may require that you configure WPA

with RADIUS with a different encryption algorithm or choose one of the other security modes.

However, security may not be as much of a priority on some types of networks. If you are simply providing

internet and printer access, None may be the appropriate choice. To prevent clients from accidentally

discovering and connecting to your network, you can disable the broadcast SSID so that your network

name is not advertised. If the network is sufficiently isolated from access to sensitive information, this may

offer enough protection in some situations.

Following is a brief discussion of the factors that make one mode more secure than another, a description

of each mode offered, and when to use each mode.

Comparison of Security Modes for Key Management, Authentication and Encryption

Algorithms

The major factors that determine the effectiveness of a security protocol are:

•

How the protocol manages keys

Presence or absence of integrated user authentication in the protocol

Encryption algorithm or formula the protocol uses to encode and decode the data

Following is a list of the security modes available on the Professional Access Point along with a description

of the key management, authentication, and encryption algorithms used in each mode. Each discussion

includes suggestions as to when one mode might be more appropriate than another.

•

When to Use No Security

When to Use Static WEP

When to Use IEEE 802.1x

When to Use WPA/WPA2 Enterprise (RADIUS)

When to Use No Security

None is a security mode option. In this mode, the data is not encrypted. Instead, the data is sent as plain

text across the network. No key management, data encryption, or user authentication is used.

RECOMMENDATIONS

None is not recommended for regular use on the Internal network because the Internal network should

have some level of security. Use None on the Internal network for initial setup, testing, or problem solving

only.

Security - 102

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

SEE ALSO

For information on how to configure this mode, see “None” on page 108 under “Configuring Security

Settings”.

When to Use Static WEP

Static Wired Equivalent Privacy (WEP) is a data encryption protocol for 802.11 wireless networks. All

wireless stations and access points on the network are configured with a static 64-bit (40-bit secret key +

24-bit initialization vector (IV)) or 128-bit (104-bit secret key + 24-bit IV) Shared Key for data encryption.

Key Management

Encryption Algorithm

User Authentication

Static WEP uses a fixed key that is

provided by the administrator. WEP

keys are indexed in different slots

(up to four on the Professional

Access Point).

An RC4 stream cipher is used to

encrypt the frame body and cyclic

redundancy checking (CRC) of each

802.11 frame.

If you set the Authentication Algorithm

to Shared Key, this protocol provides

a rudimentary form of user authenti-

cation.

However, if the Authentication Algo-

rithm is set to Open System, no

authentication is performed.

The client devices must have the

same key indexed in the same slot

to access data on the access point.

If the algorithm is set to Both, only

WEP clients are authenticated.

RECOMMENDATIONS

Static WEP was designed to provide security equivalent of sending unencrypted data through an Ethernet

connection, however it has major flaws and it does not provide even this intended level of security.

Therefore, Static WEP is not recommended as a secure mode. The only time to use Static WEP is when

interoperability issues make it the only option available to you and you are not concerned with the potential

of exposing the data on your network.

SEE ALSO

For information on how to configure Static WEP security mode, see “Static WEP” on page 108 under

“Configuring Security Settings”.

When to Use IEEE 802.1x

IEEE 802.1x is the standard for passing the Extensible Authentication Protocol (EAP) over an 802.11

wireless network using a protocol called EAP Encapsulation Over LANs (EAPOL). This is a newer, more

secure standard than Static WEP.

Security - 103

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Key Management

Encryption Algorithm

User Authentication

IEEE 802.1x provides dynamically-

generated keys that are periodically

refreshed.

An RC4 stream cipher is used to

encrypt the frame body and cyclic

redundancy checking (CRC) of each

802.11 frame.

IEEE 802.1x mode supports a vari-

ety of authentication methods, like

certificates, Kerberos, and public

key authentication with a RADIUS

server.

There are different Unicast keys for

each station.

You have a choice of using the Pro-

fessional Access Point embedded

RADIUS server or an external

RADIUS server. The embedded

RADIUS server supports Protected

EAP (PEAP) and MSCHAP V2.

RECOMMENDATIONS

IEEE 802.1x mode is a better choice than Static WEP because keys are dynamically generated and

changed periodically. However, the encryption algorithm used is the same as that of Static WEP and is

therefore not as reliable as the more advanced encryption methods such as TKIP and CCMP (AES) used

in Wi-Fi Protected Access (WPA) or WPA2.

Additionally, compatibility issues may be cumbersome because of the variety of authentication methods

supported and the lack of a standard implementation method.

Therefore, IEEE 802.1x mode is not as secure a solution as Wi-Fi Protected Access (WPA) or WPA2.

SEE ALSO

For information on how to configure IEEE 802.1x security mode, see “IEEE 802.1x” on page 114 under

“Configuring Security Settings”.

When to Use WPA/WPA2 Personal (PSK)

Wi-Fi Protected Access 2 (WPA2) Personal Pre-Shared Key (PSK) is an implementation of the Wi-Fi

Alliance IEEE 802.11i standard, which includes Advanced Encryption Algorithm (AES), Counter mode/

CBC-MAC Protocol (CCMP), and Temporal Key Integrity Protocol (TKIP) mechanisms. This mode offers

the same encryption algorithms as WPA 2 with RADIUS but without the ability to integrate a RADIUS

server for user authentication.

This security mode is backward compatible for wireless clients that support only the original WPA.

Key Management

Encryption Algorithms

User Authentication

WPA/WPA2 Personal (PSK) pro-

vides dynamically-generated keys

that are periodically refreshed.

• Temporal Key Integrity Protocol

The use of a Pre-Shared (PSK) key

provides user authentication similar

to that of shared keys in WEP.

(TKIP)

• Counter mode/CBC-MAC Proto-

col (CCMP) Advanced Encryption

Standard (AES)

There are different Unicast keys for

each station.

Security - 104

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

RECOMMENDATIONS

WPA/WPA2 Personal (PSK) is not recommended for use with the Professional Access Point when WPA/

WPA2 Enterprise (RADIUS) is an option.

USRobotics recommends that you use WPA/WPA2 Enterprise (RADIUS) mode instead, unless you have

interoperability issues that prevent you from using this mode.

For example, some devices on your network may not support WPA or WPA2 with EAP talking to a

RADIUS server. Embedded printer servers or other small client devices with very limited space for

implementation may not support RADIUS. For such cases, USRobotics recommends that you use WPA/

WPA2 Personal (PSK).

SEE ALSO

For information on how to configure this security mode, see “WPA/WPA2 Personal (PSK)” on page 115.

When to Use WPA/WPA2 Enterprise (RADIUS)

Wi-Fi Protected Access 2 (WPA2) with Remote Authentication Dial-In User Service (RADIUS) is an

implementation of the Wi-Fi Alliance IEEE 802.11i standard, which includes Advanced Encryption

Standard (AES), Counter mode/CBC-MAC Protocol (CCMP), and Temporal Key Integrity Protocol (TKIP)

mechanisms. This mode requires the use of a RADIUS server to authenticate users. WPA/WPA2

Enterprise (RADIUS) provides the best security available for wireless networks.

This security mode also provides backward compatibility for wireless clients that support only the original

WPA.

Key Management

Encryption Algorithms

User Authentication

WPA/WPA2 Enterprise (RADIUS)

mode provides dynamically-gener-

ated keys that are periodically

refreshed.

• Temporal Key Integrity Protocol

Remote Authentication Dial-In User

Service (RADIUS)

(TKIP)

• Counter mode/CBC-MAC Proto-

col (CCMP) Advanced Encryption

Standard (AES)

You have a choice of using the Pro-

fessional Access Point embedded

RADIUS server or an external

RADIUS server. The embedded

RADIUS server supports Protected

EAP (PEAP) and MSCHAP V2.

There are different Unicast keys for

each station.

RECOMMENDATIONS

WPA/WPA2 Enterprise (RADIUS) mode is the recommended mode. The CCMP (AES) and TKIP

encryption algorithms used with WPA modes are far superior to the RC4 algorithm used for Static WEP or

IEEE 802.1x modes. Therefore, CCMP (AES) or TKIP should be used whenever possible. All WPA modes

allow you to use these encryption schemes, so WPA security modes are recommended above the others

when using WPA is an option.

Additionally, this mode incorporates a RADIUS server for user authentication, which gives it an edge over

WPA/WPA2 Personal (PSK) mode.

Use the following guidelines for choosing options within the WPA/WPA2 Enterprise (RADIUS) mode

security mode:

Security - 105

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

1. The best security you can have to-date on a wireless network is WPA/WPA2 Enterprise (RADIUS)

mode using CCMP (AES) encryption algorithm. AES is a symmetric 128-bit block data encryption

technique that works on multiple layers of the network. It is the most effective encryption system

currently available for wireless networks. If all clients or other APs on the network are WPA/CCMP

compatible, use this encryption algorithm. If all clients are WPA2 compatible, choose to support only

WPA2 clients.

2. The second best choice is WPA/WPA2 Enterprise (RADIUS) with the encryption algorithm set to Both

(that is, both TKIP and CCMP). This lets WPA clients without CCMP associate, uses TKIP for encrypt-

ing Multicast and Broadcast frames, and allows clients to select whether to use CCMP or TKIP for Uni-

cast (access-point-to-single-station) frames. This WPA configuration allows more interoperability, at

the expense of some security. Clients that support CCMP can use it for their Unicast frames. If you

encounter access-point-to-station interoperability problems with the Both encryption algorithm setting,

then you will need to select TKIP instead.

3. The third best choice is WPA/WPA2 Enterprise (RADIUS) with the encryption algorithm set to TKIP.

Some clients have interoperability issues with CCMP and TKIP enabled at same time. If you encounter

this problem, then choose TKIP as the encryption algorithm. This is the standard WPA mode, and

most interoperable mode with client wireless software security features. TKIP is the only encryption

algorithm that is being tested in Wi-Fi WPA certification.

SEE ALSO

For information on how to configure this security mode, see “WPA/WPA2 Enterprise (RADIUS)” on

page 117 under “Configuring Security Settings”.

Does Prohibiting the Broadcast of SSID Enhance Security?

You can prohibit the broadcast of the AP’s SSID to discourage stations from automatically discovering

your access point. When the access point’s SSID broadcast is prohibited, the network name is not

displayed in the List of Available Networks on a client device. Instead, the client must have the exact network

name configured in the supplicant before the client will be able to connect.

Prohibiting the SSID broadcast is sufficient to prevent clients from accidentally connecting to your network,

but it will not prevent even the simplest of attempts by a hacker to connect or to monitor insecure traffic.

This offers a minimum level of protection on an otherwise exposed network (such as a guest network)

where the priority is making it easy for clients to get a connection and where no sensitive information is

available.

How Does Station Isolation Protect the Network?

When Station Isolation is enabled, the access point blocks communication between wireless clients. The

access point allows data traffic between its wireless clients and wired devices on the network, but not

among wireless clients.

The traffic blocking extends to wireless clients connected to the network via WDS links; these clients

cannot communicate with each other when Station Isolation is on. See “Wireless Distribution System” on

page 153 for more information about WDS.

Security - 106

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Navigating to Security Settings

To set the security mode, click the Advanced menu’s Security tab, and update the fields as described

below.

Configuring Security Settings

The following configuration information explains how to configure security modes on the access point.

Keep in mind that each wireless client that wants to exchange data with the access point must be

configured with the same security mode and encryption key settings consistent with access point security.

Broadcast SSID, Station Isolation, and Security Mode

To configure security on the access point, select a security mode and fill in the related fields as described

in the following table. You can also allow or prohibit the Broadcast SSID and enable or disable Station

Security - 107

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Isolation as extra precautions as mentioned below.

Field

Description

Broadcast SSID

Select the Broadcast SSID setting by clicking Allow or Prohibit.

By default, the access point broadcasts the Service Set Identifier (SSID) in its

beacon frames.

You can prohibit this broadcast to discourage stations from automatically dis-

covering your access point. When the access point’s broadcast SSID is sup-

pressed, the network name will not be displayed in the List of Available Networks

on a client device. Instead, the client must have the exact network name con-

figured in the supplicant before the client will be able to connect.

You can use the Command Line Interface to prohibit the broadcast of the SSID

on the Guest Network. For the command syntax, see “Set the Broadcast SSID

(Allow or Prohibit)” on page 215.

Station Isolation

Select Off to disable station isolation or On to enable it.

• When station isolation is Off, wireless clients can communicate with one

another normally by sending traffic through the access point.

• When station isolation is On, the access point blocks communication

between wireless clients. The access point allows data traffic between its

wireless clients and wired devices on the network, but not among wireless

clients. The traffic blocking extends to wireless clients connected to the

network via WDS links; these clients cannot communicate with each other

when station isolation is on. See “Wireless Distribution System” on page 153

for more information about WDS.

Security Mode

Select the Security Mode. Select one of the following:

•

None

Static WEP

IEEE 802.1x

WPA/WPA2 Personal (PSK)

WPA/WPA2 Enterprise (RADIUS)

None

None means that any data transferred to and from the Professional Access Point is not encrypted.

There are no further options for this mode.Running without security can be useful during initial network

configuration or for problem solving, but it is not recommended for regular use on the Internal network

because it is not secure.

Static WEP

Wired Equivalent Privacy (WEP) is a data encryption protocol for 802.11 wireless networks. All wireless

stations and access points on the network are configured with a static 64-bit (40-bit secret key + 24-bit ini-

Security - 108

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

tialization vector (IV)) or 128-bit (104-bit secret key + 24-bit IV) Shared Key for data encryption.

You cannot mix 64-bit and 128-bit WEP keys between the access point and its clients.

Static WEP is not the most secure mode available, but it offers more protection than None as it does pre-

vent an outsider from easily sniffing out unencrypted wireless traffic. (For more secure modes, see the sec-

tions on “IEEE 802.1x” on page 114, “WPA/WPA2 Enterprise (RADIUS)” on page 117, or “WPA/WPA2

Personal (PSK)” on page 115.)

WEP encrypts data moving across the wireless network based on a static key. (The encryption algorithm is

a stream cipher called RC4.)

The access point uses a key to transmit data to the clients. Each client must use that same key to decrypt

data it receives from the access point.

Clients can use different keys to transmit data to the access point. (Or they can all use the same key, but

this is less secure because it means one station can decrypt the data being sent by another.)

If you selected Static WEP as the security mode, provide the following on the access point settings:

Security - 109

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Transfer Key Index

Select a key index. Key indexes 1 through 4 are available. The default is 1.

The transfer key index indicates which WEP key the access point will use to encrypt

the data it transmits.

Key Length

Key Type

Specify one of the following lengths for the key:

•

64 bits

128 bits

Select one of the following key types:

•

ASCII

Hex

Characters Required

WEP Keys

Indicates the number of characters required in the WEP key.

The number is updated automatically based on how you set Key Length and Key

Type.

You can specify up to four WEP keys. In each text box, enter a string of characters

for one key.

If you selected ASCII, enter any combination of integers and letters 0-9

a-z, and

A-Z

If you selected HEX, enter hexadecimal digits (any combination of 0-9and a-for

A-F).

Use the same number of characters for each key as specified in the Characters

Required field. These are the RC4 WEP keys shared with the stations using the

access point.

Each client must be configured to use one of these same WEP keys in the same

slot as specified here on the access point. (See “Rules to Remember for Static

WEP” on page 111.)

Security - 110

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Authentication Algorithm

The authentication algorithm defines the method used to determine whether a client

is allowed to associate with an access point when static WEP is the security mode.

Specify the authentication algorithm you want to use by choosing one of the follow-

ing:

•

Open System

Shared Key

Both

Open System authentication allows any client to associate with the access point

whether that client has the correct WEP key or not. This algorithm is also used in

None, IEEE 802.1x, and WPA modes. When the authentication algorithm is set to

Open System, any client can associate with the access point.

That a client is allowed to associate does not ensure that the client can exchange

traffic with an access point. A client must have the correct WEP key to be able to

successfully access and decrypt data from an access point, and to transmit reada-

ble data to the access point.

Shared Key authentication requires the client to have the correct WEP key in order to

associate with the access point. When the authentication algorithm is set to Shared

Key, a station with an incorrect WEP key will not be able to associate with the

access point.

Both is the default. When the authentication algorithm is set to Both:

• Clients configured to use WEP in shared key mode must have a valid WEP key

in order to associate with the access point.

• Clients configured to use WEP in an open system mode (shared key mode not

enabled) will be able to associate with the access point even if they do not have

the correct WEP key.

Rules to Remember for Static WEP

•

All clients must have the Wireless LAN (WLAN) security set to WEP, and all clients must have one of

the WEP keys specified on the access point in order to decode access-point-to-station data transmis-

sions.

•

The access point must have all keys used by clients for station-to-access-point transmit so that it can

decode the station transmissions.

The same key must occupy the same slot on all nodes (access point and clients). For example, if the

access point defines abc123key as WEP key 3, then the clients must define that same string as WEP

key 3.

•

On some wireless client software (like Funk Odyssey), you can configure multiple WEP keys and

define a client transfer key index, then set the stations to encrypt the data they transmit using different

keys. This ensures that neighbouring APs cannot decode each other’s transmissions.

Security - 111

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Example of Using Static WEP

For a simple example, suppose that you configure three WEP keys on the access point. In this example,

the Transfer Key Index for the access point is set to 3. This means that the WEP key in slot 3 is the key

that the access point will use to encrypt the data it sends.

Figure 7. Setting the Access Point Transfer Key on the Access Point.

You must then set all clients to use WEP and provide each client with one of the slot and key combinations

you defined on the access point.

The following example will set WEP key 1 on a Windows client.

Security - 112

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Figure 8. Providing a Wireless Client with a WEP Key

If you have a second client, that client also needs to have one of the WEP keys defined on the access

point. You could give it the same WEP key that you gave to the first station. Or, for a more secure solution,

you could give the second station a different WEP key (key 2, for example) so that the two stations cannot

decrypt each other’s transmissions.

STATIC WEP WITH TRANSFER KEY INDEXES ON CLIENT DEVICES

Some Wireless client software, such as like Funk Odyssey, lets you configure multiple WEP keys and set a

transfer index on the client; then you can specify different keys to be used for station-to-access-point

transmissions. (The standard Windows wireless client software does not allow you to do this.)

To build on the previous example, using Funk Odyssey client software you could give each of the clients

WEP key 3 so that they can decode the access point transmissions with that key and also give client 1

WEP key 1 and set this as the client 1’s transfer key index. You could then give client 2 WEP key 2 and set

this as client 2’s transfer key index.

Figure 9 illustrates the dynamics of the access point and two clients using multiple WEP keys and a

transfer key index.

Security - 113

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Figure 9. Example of Using Multiple WEP Keys and Transfer Key Index on Client Devices

can decrypt WEP key 3

transmits in WEP key 1

Client Station 1

can decrypt WEP key 3

transmits in WEP key 2

WEP key 3

WEP key 2

Access Point transmits to both stations with WEP key 3

Client Station 2

IEEE 802.1x

IEEE 802.1x is the standard that defines port-based authentication and provides a framework for

implementing key management. Extensible Authentication Protocol (EAP) packets are sent over an IEEE

802.11 wireless network using a protocol called EAP Encapsulation Over LANs (EAPOL). IEEE 802.1x

provides dynamically-generated keys that are periodically refreshed. An RC4 stream cipher is used to

encrypt the frame body and cyclic redundancy checking (CRC) of each 802.11 frame.

The IEEE 802.1x security mode requires the use of a RADIUS server to authenticate users and requires

configuration of user accounts via the Cluster menu’s User Management page.

The access point requires a RADIUS server capable of EAP, such as the Microsoft Internet Authentication

Server or the Professional Access Point internal authentication server. To work with Windows clients, the

authentication server must support Protected EAP (PEAP) and MSCHAP V2.

When configuring IEEE 802.1x mode, you can use either the embedded RADIUS server or an external

RADIUS server that you provide. The Professional Access Point embedded RADIUS server supports

Protected EAP (PEAP) and MSCHAP V2.

If you use your own RADIUS server, you can use any of a variety of authentication methods that the IEEE

802.1x mode supports, including certificates, Kerberos, and public key authentication. Keep in mind,

however, that the clients must be configured to use the same authentication method being used by the

access point.

If you select IEEE 802.1x Security Mode, you must provide the following:

Security - 114

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Authentication Server

Select one of the following:

•

Built-in—To use the authentication server provided with the Professional Access

Point. If you choose this option, you do not have to provide the Radius IP and

Radius Key; they are automatically provided.

External—To use an external authentication server. If you choose this option you

must supply the Radius IP and Radius Key of the server you want to use.

Note: The RADIUS server is identified by its IP address and UDP port numbers for

the different services it provides.The RADIUS server User Datagram Protocol

(UDP) ports used by the access point are not configurable on the Professional

Access Point. (The access point is hard-coded to use RADIUS server UDP port

1812 for authentication and port 1813 for accounting.)

Radius IP

Enter the Radius IP in the text box.

The Radius IP is the IP address of the RADIUS server.

The Professional Access Point internal authentication server is 127.0.0.1

For information on setting up user accounts, see “User Management” on page 53.

Enter the Radius Key in the text box.

Radius Key

The Radius Key is the shared secret key for the RADIUS server. The text you enter

will be displayed as "*" characters to prevent others from seeing the RADIUS key

as you type.

(The Professional Access Point internal authentication server key is secret.)

This value is never sent over the network.

Enable RADIUS Accounting

Click Enable RADIUS Accounting if you want to track and measure the resources that a

particular user has consumed. Resources measured include system time, amount

of data transmitted and received, and so on.

WPA/WPA2 Personal (PSK)

Wi-Fi Protected Access 2 (WPA2) with Pre-Shared Key (PSK) is a Wi-Fi Alliance IEEE 802.11i standard,

which includes Advanced Encryption Algorithm (AES), Counter mode/CBC-MAC Protocol (CCMP), and

Temporal Key Integrity Protocol (TKIP) mechanisms. The Personal version of WPA2 employs a pre-

shared key (instead of using IEEE 802.1x and EAP as is used in the Enterprise WPA2 security mode). The

PSK is used for an initial check of credentials only.

This security mode is backward-compatible for wireless clients that support the original WPA.

If you select WPA/WPA2 Personal (PSK) Security Mode, you must provide the following:

Security - 115

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

WPA Versions

Select the types of clients you want to support:

•

WPA—If all clients on the network support the original WPA, but none support the newer

WPA2, then select WPA

•

WPA2—If all clients on the network support WPA2, USRobotics suggests using WPA2,

which provides the best security per the IEEE 802.11i standard.

Both—If you have a mix of clients, some of which support WPA2 and others which sup-

port only the original WPA, select Both. This option lets both WPA and WPA2 clients

associate and authenticate, but uses the more robust WPA2 for clients who support it.

This WPA configuration allows more interoperability, at the expense of some security.

Cipher Suites

Select the cipher you want to use from the list:

•

TKIP—TKIP (Temporal Key Integrity Protocol) is the default.

TKIP provides a more secure encryption solution than WEP keys. The TKIP

process more frequently changes the encryption key used and better ensures

that the same key will not be reused to encrypt data (a weakness of WEP). TKIP

uses a 128-bit temporal key shared by clients and access points. The temporal

key is combined with the client's MAC address and a 16-octet initialization vector

to produce the key that will encrypt the data. This ensures that each client uses a

different key to encrypt data. TKIP uses RC4 to perform the encryption, which is

the same as WEP. But TKIP changes temporal keys every 10,000 packets and

distributes them, thereby greatly improving the security of the network.

•

CCMP (AES)—Counter mode/CBC-MAC Protocol (CCMP) is an encryption method for

IEEE 802.11i that uses the Advanced Encryption Algorithm (AES). It uses a CCM

combined with Cipher Block Chaining Counter mode (CBC-CTR) and Cipher Block Chain-

ing Message Authentication Code (CBC-MAC) for encryption and message integrity.

Both—When the authentication algorithm is set to Both, both TKIP and AES cli-

ents can associate with the access point. WPA clients must have one of the fol-

lowing to be able to associate with the access point:

• A valid TKIP key

• A valid CCMP (AES) key

Clients not configured to use a WPA-PSK will not be able to associate with the

access point.

Security - 116

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Key

The Pre-shared Key is the shared secret key for WPA-PSK. Enter a string of at

least 8 characters to a maximum of 63 characters.

WPA/WPA2 Enterprise (RADIUS)

Wi-Fi Protected Access 2 (WPA2) with Remote Authentication Dial-In User Service (RADIUS) is an

implementation of the Wi-Fi Alliance IEEE 802.11i standard, which includes Advanced Encryption

Standard (AES), Counter mode/CBC-MAC Protocol (CCMP), and Temporal Key Integrity Protocol (TKIP)

mechanisms. The Enterprise mode requires the use of a RADIUS server to authenticate users, and

configuration of user accounts via the Cluster menu’s User Management page.

This security mode is backward-compatible with wireless clients that support the original WPA.

When configuring WPA2 Enterprise (RADIUS) mode, you can use either the built-in RADIUS server or an

external RADIUS server that you provide. The Professional Access Point built-in RADIUS server supports

Protected EAP (PEAP) and MSCHAP V2.

If you select WPA/WPA2 Enterprise (RADIUS) Security Mode, you must provide the following:

Field

Description

WPA Versions

Select the types of clients you want to support:

•

WPA—If all clients on the network support the original WPA, but none support the newer

WPA2, then select WPA

•

WPA2—If all clients on the network support WPA2, USRobotics suggests using WPA2,

which provides the best security per the IEEE 802.11i standard.

Both—If you have a mix of clients, some of which support WPA2 and others which sup-

port only the original WPA, select Both. This option lets both WPA and WPA2 clients

associate and authenticate, but uses the more robust WPA2 for clients who support it.

This WPA configuration allows more interoperability, at the expense of some security.

Security - 117

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Enable pre-authentication

If for WPA Versions you select WPA2 or Both, you can enable pre-authentication for

WPA2 clients.

Click Enable pre-authentication if you want WPA2 wireless clients to send pre-authen-

tication packet. The pre-authentication information will be relayed from the access

point the client is currently using to the target access point. Enabling this feature

can help speed up authentication for roaming clients who connect to multiple

access points.

This option does not apply if you selected WPA for WPA Versions because the orig-

inal WPA does not support this feature.

Cipher Suites

Select the cipher you want to use from the list:

•

TKIP—Temporal Key Integrity Protocol (TKIP) provides a more secure encryption

solution than WEP keys. The TKIP process more frequently changes the encryp-

tion key used and better ensures that the same key will not be reused to encrypt

data (a weakness of WEP). TKIP uses a 128-bit temporal key shared by clients

and access points. The temporal key is combined with the client's MAC address

and a 16-octet initialization vector to produce the key that will encrypt the data.

This ensures that each client uses a different key to encrypt data. TKIP uses

RC4 to perform the encryption, which is the same as WEP. But TKIP changes

temporal keys every 10,000 packets and distributes them, thereby greatly

improving the security of the network.

•

CCMP (AES)—Counter mode/CBC-MAC Protocol (CCMP) is an encryption method for

IEEE 802.11i that uses the Advanced Encryption Algorithm (AES). It uses a CCM

combined with Cipher Block Chaining Counter mode (CBC-CTR) and Cipher Block Chain-

ing Message Authentication Code (CBC-MAC) for encryption and message integrity.

Both—The default. When the authentication algorithm is set to Both, both TKIP

and AES clients can associate with the access point. Clients configured to use WPA

with RADIUS must have one of the following to be able to associate with the access

point:

• A valid TKIP RADIUS IP address and RADIUS Key

• A valid CCMP (AES) IP address and RADIUS Key

Clients not configured to use WPA with RADIUS will not be able to associate with

access point.

Authentication Server

Select one of the following from list:

•

Built-in—To use the authentication server provided with the Professional Access

Point. If you choose this option, you do not have to provide the Radius IP and

Radius Key; they are automatically provided.

External—To use an external authentication server. If you choose this option you

must supply a Radius IP and Radius Key of the server you want to use.

Note: The RADIUS server is identified by its IP address and UDP port numbers for

the different services it provides. On the Professional Access Point, the RADIUS

server User Datagram Protocol (UDP) ports used by the access point are not con-

figurable. The Professional Access Point is hard-coded to use RADIUS server UDP

port 1812 for authentication and port 1813 for accounting.

Security - 118

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Radius IP

Enter the Radius IP.

The Radius IP is the IP address of the RADIUS server.

(The Professional Access Point internal authentication server is 127.0.0.1.)

For information on setting up user accounts, see “User Management” on page 53.

Enter the Radius Key.

Radius Key

The Radius Key is the shared secret key for the RADIUS server. The text you enter

will be displayed as "*" characters to prevent others from seeing the RADIUS key

as you type.

(The Professional Access Point internal authentication server key is secret.)

This value is never sent over the network.

Enable RADIUS Accounting

Click Enable RADIUS Accounting if you want to enforce authentication for WPA clients

with user names and passwords for each client.

See also “User Management” on page 53.

Updating Settings

To apply your changes, click Update.

Security - 119

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Security - 120

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Guest Login

The Professional Access Point’s Guest Interface features allow you to configure the access point for

controlled guest access to an isolated network. You can configure the access point for guest access only,

or you can configure it to broadcast and function as two different wireless networks: a secure Internal LAN

and a public Guest network.

Guest clients can access the guest network without a user name or password. When guests log in, they

see a guest Welcome screen (also known as a captive portal).

The following sections are included here:

•

Configuring Guest Access Using Virtual LANs

•

Configuring a Guest Network on a Virtual LAN

Configuring the Welcome Screen (Captive Portal)

Using the Guest Network

Configuring Guest Access without Virtual LANs

•

Configuring a Guest Network on a Dedicated Access Point

Using the Guest Network

Configuring Guest Access Using Virtual LANs

If you implement the guest interface with VLANs, you can define unique parameters for guest connectivity

and isolate guest clients from other, more sensitive areas of the network. No security is provided on the

guest network; only None is allowed as the security mode.

Simultaneously, you can configure a secure internal network (using the same access point as your guest

interface) that provides full access to protected information behind a firewall and requires secure logins or

certificates for access.

The VLAN implementation of the Guest Interface uses the multiple BSSID and Virtual LAN (VLAN)

technologies that are built into the Professional Access Point. The Internal and Guest networks are

implemented as multiple BSSIDs on the same access point, each with different network names

(SSIDs) on the Wireless interface and different VLAN IDs on the Wired interface.

Configuring a Guest Network on a Virtual LAN

To configure the Guest interface on the Professional Access Point, perform these configuration steps:

1. To implement the Guest interface using VLANs, configure the access point to represent two virtually

separate networks as described in “Configuring a Guest Network on a Virtual LAN” on page 121.

2. Set up the guest Welcome screen for the guest captive portal as described in “Configuring the Wel-

come Screen (Captive Portal)” on page 123.

Guest Login - 121

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

If you want to configure the Guest and Internal networks on Virtual LAN (VLANs), the switch and

DHCP server you are using must support VLANs.

As a prerequisite step, configure a port on the switch for handling VLAN tagged packets as described

in the IEEE 802.1Q standard.

Guest Welcome Screen settings are shared among access points across the cluster. When you

update these settings for one access point, the configuration will be shared with the other access

points in the cluster. For more information about which settings are shared by the cluster and which

are not, see “Which Settings are Shared as Part of the Cluster Configuration and Which Are Not?” on

page 45.

To configure Internal and Guest networks on virtual LANs, do the following:

1. Use an Ethernet cable to make a wired connection from the LAN port on the access point to the LAN.

(Make sure this port is configured to handle VLAN tagged packets.)

2. Configure Ethernet (Wired) Settings for Internal and Guest networks on VLANs as described in “Ethernet

(Wired) Settings” on page 89.

(Start by enabling Guest Access and choosing For Internal and Guest access, use VLAN on Ethernet Port as

described in “Specifying a Virtual Guest Network” on page 92.)

3. Provide the radio interface settings and network names (SSIDs) for both Internal and Guest networks

as described in “Wireless Settings” on page 97.

The figure below shows an example of a Guest network implemented via VLAN; the dotted red lines

indicate dedicated guest connections.

Internet

DSL/T1

Firewall

Switch

Guest Client Station

Access Point

All access points and all connections, including guests, are administered from the same Professional

Access Point Web User Interface.

Guest Login - 122

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Configuring the Welcome Screen (Captive Portal)

You can set up or modify the Welcome screen that guest clients see when they open a Web browser or try

to browse the Web. To set up the captive portal, do the following.

1. Click the Advanced menu’s Guest Login tab.

2. Choose Enabled to activate the Welcome screen.

3. In the Welcome Screen Text field, type the text message that you would like guest clients to see on the

captive portal. Note that the default captive portal message directs users to www.usr.com after they

click Accept:

Thank you for using wireless Guest Access as provided by this Professional

Access Point. Upon clicking "Accept", you will gain access to our wireless

guest network. <form action="/accept.cgi" method="POST"><input type="hid-

den" name="URL" value="http://www.usr.com"><center><input type="submit"

name="submit" value="Accept"></center></form>

4. Click Update to apply the changes.

Using the Guest Network

Once the guest network is configured, a client can access the guest network as follows:

1. A guest client enters an area of coverage and scans for wireless networks.

Guest Login - 123

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

2. The guest network advertises itself via a Guest SSID or a similar name, depending on how the guest

SSID is specified in the Web User Interface for the Guest interface.

3. The guest chooses Guest SSID.

4. The guest starts a Web browser and receives a Guest Welcome screen.

5. The Guest Welcome Screen provides a button for the guest to click to continue.

6. The guest clicks the button and the guest client is enabled to use the guest network.

Configuring Guest Access without Virtual LANs

Configuring a Guest Network on a Dedicated Access Point

To configure an access point dedicated to guest access, you do not have to set up VLANs. All you have to

do is configure the Welcome screen as described in “Configuring the Welcome Screen (Captive Portal)” on

page 123.

Using the Guest Network

Once the captive portal is enabled on an access point that does not use VLANs, a client can access the

guest network as follows:

1. A guest client enters an area of coverage and scans for wireless networks.

2. The guest network advertises itself via a Internal SSID.

3. The guest chooses Internal SSID.

4. The guest starts a Web browser and receives a Guest Welcome screen.

5. The Guest Welcome Screen provides a button for the guest to click to continue.

6. The guest clicks the button and the guest client is enabled to use the guest network.

Guest Login - 124

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Virtual Wireless Networks

The following sections describe how to configure multiple wireless networks on Virtual LANs (VLANs):

•

Navigating to Virtual Wireless Network Settings

Configuring VLANs

Security Mode to Use?” on page 101.

Navigating to Virtual Wireless Network Settings

To set up multiple networks on VLANs, click the Advanced menu’s Virtual Wireless Networks tab, and update

the fields as described below.

Virtual Wireless Networks - 125

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Configuring VLANs

•

To configure additional networks on VLANs, you must first enable Virtual Wireless Networks on the

Ethernet (Wired) interface. See “Enabling and Disabling Virtual Wireless Networks on the Access

Point” on page 92.

•

If you configure VLANs, you may lose connectivity to the access point. First, be sure to verify that

the switch and DHCP server you are using can support VLANs per the IEEE 802.1Q standard.

After configuring VLANs, physically reconnect the Ethernet cable on the switch to the tagged

packet (VLAN) port. Then, reconnect via the Web User Interface to the new IP address. (If neces-

sary, check with the infrastructure support administrator regarding the VLAN and DHCP configura-

tions.)

Field

Description

Virtual Wireless Network

Choose one of the following from the drop-down list to identify an additional

network to configure:

•

One

Two

Status

You can enable or disable a configured network.

• To enable the specified network, click On.

• To disable the specified network, click Off.

Wireless Network Name (SSID)

Enter a name for the wireless network as a character string. This name will

apply to all access points on this network. As you add more access points, they

will share this SSID.

The Service Set Identifier (SSID) is an alphanumeric string of up to 32 charac-

ters

Note: If you are connected as a wireless client to the same access point that

you are administering, resetting the SSID will cause you to lose connectivity to

the access point. You will need to reconnect to the new SSID after you save

this new setting.

VLAN ID

Provide a number between 1 and 4094 for the Internal VLAN.

This will cause the access point to send DHCP requests with the VLAN tag.

The switch and the DHCP server must support VLAN IEEE 802.1Q frames.

The access point must be able to reach the DHCP server.

Check with the Administrator regarding the VLAN and DHCP configurations.

Virtual Wireless Networks - 126

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Broadcast SSID

Select the Broadcast SSID setting by clicking the "Allow" or "Prohibit" radio but-

ton.

By default, the access point broadcasts (allows) the Service Set Identifier

(SSID) in its beacon frames.

You can suppress (prohibit) this broadcast to discourage stations from auto-

matically discovering your access point. When the access point’s broadcast

SSID is suppressed, the network name will not be displayed in the List of Avail-

able Networks on a client device. Instead, the client must have the exact net-

work name configured in the supplicant before it will be able to connect.

Note: The Broadcast SSID you set here is specifically for this Virtual Network

(One or Two). Other networks continue to use the security modes already

configured: your original Internal network (configured on Advanced menu’s

Ethernet [Wired] page) uses the Broadcast SSID set on Advanced menu’s

Security page.

Security Mode

Select the Security Mode for this VLAN. Select one of the following:

•

None

• Static WEP

• IEEE 802.1x

• WPA/WPA2 Personal (PSK)

• WPA/WPA2 Enterprise (RADIUS)

Note: The Security mode you set here is specifically for this Virtual Network

(One or Two). Other networks continue to use the security modes already

configured:

• Your original Internal network uses the Security mode set on the Advanced

menu’s Security page.

• If a Guest VLAN is configured, it always uses None.

For a comparison of the available security modes, see “How Do I Know Which

Updating Settings

To apply your changes, click Update.

Virtual Wireless Networks - 127

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Virtual Wireless Networks - 128

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Radio

The following sections describe how to configure Radio Settings on the Professional Access Point:

•

Understanding Radio Settings

Navigating to Radio Settings

Configuring Radio Settings

Navigating to MAC Filtering Settings

Understanding Radio Settings

Radio settings directly control the behaviour of the radio device in the access point and its interaction with

the physical medium, that is, how and what type of electromagnetic waves the access point emits. You can

specify whether the radio is on or off, radio frequency (RF) broadcast channel, beacon interval (amount of

time between access point beacon transmissions), transmit power, IEEE 802.11 mode in which the radio

operates, and so on.

The Professional Access Point can broadcast in the following modes:

•

IEEE 802.11b

IEEE 802.11g

The IEEE mode along with other radio settings are configured as described in “Navigating to Radio

Settings” on page 130 and “Configuring Radio Settings” on page 130.

Radio - 129

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Navigating to Radio Settings

To specify radio settings, click the Advanced menu’s Radio tab, and update the fields as described below.

Configuring Radio Settings

Field

Description

Status (On/Off)

Specify whether you want the radio on or off by clicking On or Off.

Radio - 130

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Mode

The Mode defines the Physical Layer (PHY) standard being used by the radio.

Select one of these modes:

•

IEEE 802.1 1b

•

IEEE 802.11g (the default). This mode allows both 802.11b and 802.11g cli-

ents to connect to the access point. To enable 802.11g clients only and

deny acces to 802.11b clients, select a Basic rate that is not supported by

802.11b, such as 6Mbps. Basic rate options appear at the bottom of the

Radio tab.

Super G

Channel

Enabling Super G provides better performance by increasing radio throughput

for a radio mode. Keep in mind that with Super G enabled the access point

transmissions will consume more bandwidth.

• To enable Super G click Enabled.

• To disable Super G click Disabled.

The Channel defines the portion of the radio spectrum that the radio uses for

transmitting and receiving. The range of channels and the default channel are

determined by the Mode of the radio interface.

For most Modes, the default is Auto. Auto is the recommended mode because

it automatically detects the best channel choices based on signal strength, traf-

fic loads, and so on.

Beacon Interval

DTIM Period

The Beacon Interval value is set in milliseconds. Enter a value within the range

20–2000.

Beacon frames are transmitted by an access point at regular intervals to

announce the existence of the wireless network. The default behaviour is to

send a beacon frame once every 100 milliseconds (or 10 per second).

Specify a DTIM period within the range 1–255.

The Delivery Traffic Information Map (DTIM) message is an element included

in some Beacon frames. It indicates which clients, currently sleeping in low-

power mode, have data buffered on the access point awaiting pickup.

The DTIM period you specify here indicates how often the clients served by

this access point will check for buffered data still on the access point awaiting

pickup.

The measurement is the count of beacons. For example, if you set the DTIM

period to 1, clients will check for buffered data on the access point at every

beacon. If you set this to 10, clients will check at every 10th beacon.

Radio - 131

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Fragmentation Threshold

Specify a number within the range 256–2,346 to set the frame size threshold in

bytes.

The fragmentation threshold is a way of limiting the size of packets (frames)

transmitted over the network. If a packet exceeds the fragmentation threshold

set here, the fragmentation function will be activated and the packet will be

sent as multiple 802.11 frames.

If the packet being transmitted is equal to or less than the threshold, fragmen-

tation will not be used.

Setting the threshold to the largest value (2,346 bytes) effectively disables frag-

mentation.

Fragmentation involves more overhead both because of the extra work of

dividing up and reassembling of frames it requires, and because it increases

message traffic on the network. However, fragmentation can help improve net-

work performance and reliability if properly configured.

Sending smaller frames (by using lower fragmentation threshold) may help

with some interference problems; for example, with microwave ovens.

By default, fragmentation is off. USRobotics recommends not using fragmen-

tation unless you suspect radio interference. The additional headers applied to

each fragment increase the overhead on the network and can greatly reduce

throughput.

RTS Threshold

Specify an RTS Threshold value within the range 0–2347.

The RTS threshold specifies the packet size of a request to send (RTS) trans-

mission. This helps control traffic flow through the access point, especially one

with a lot of clients.

If you specify a low threshold value, RTS packets will be sent more frequently.

This will consume more bandwidth and reduce the throughput of the packet.

On the other hand, sending more RTS packets can help the network recover

from interference or collisions which might occur on a busy network, or on a

network experiencing electromagnetic interference.

Maximum Stations

Enter a value within the range 0–2007.

Specify the maximum number of stations allowed to access this access point at

any one time.

Radio - 132

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Transmit Power

Provide a percentage value to set the transmit power for this access point.

The default is to have the access point transmit using 100 percent of its power.

Recommendations:

• For most cases, USRobotics recommends using the default and having the

transmit power set to 100 percent. This is more cost-efficient because it

gives the access point a maximum broadcast range and reduces the

number of APs needed.

• To increase capacity of the network, place APs closer together and reduce

the value of the transmit power. This will help reduce overlap and interfer-

ence among APs. A lower transmit power setting can also keep your net-

work more secure because weaker wireless signals are less likely to

propagate outside of the physical location of your network.

Rate Sets

Select the transmission rate sets that you want the access point to support and

the basic rate sets you want the access point to advertise.

Rates are expressed in megabits per second.

•

Supported Rate Sets indicate rates that the access point supports. You can

select multiple rates. The access point will automatically choose the most

efficient rate based on factors like error rates and distance of clients from

the access point.

Basic Rate Sets indicate rates that the access point will advertise to the net-

work for the purposes of setting up communication with other APs and cli-

ents on the network. It is generally more efficient to have an access point

broadcast a subset of its supported rate sets.

The highest basic rate selected is also the access point’s multicast rate. To

transmit multicast packets at a higher rate than the default of 11Mbps, select

a higher Basic Rate.

Updating Settings

To apply your changes, click Update.

Radio - 133

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Radio - 134

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

MAC Filtering

A Media Access Control (MAC) address is a hardware address that uniquely identifies each node of a

network. All IEEE 802 network devices share a common 48-bit MAC address format, usually displayed as

a string of 12 hexadecimal digits separated by colons, for example FE:DC:BA:09:87:65

Each wireless network interface card (NIC) used by a wireless client has a unique MAC address.

You can control client access to your wireless network by switching on MAC Filtering and specifying a list

of approved MAC addresses. When MAC Filtering is on, only clients with approved MAC addresses can

access the network.

The following sections describe how to use MAC address filtering on the Professional Access Point:

•

Using MAC Filtering

Understanding Load Balancing

Navigating to MAC Filtering Settings

To enable filtering by MAC address, click the Advanced menu’s MAC Filtering tab, and update the fields as

described below.

MAC Filtering - 135

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Using MAC Filtering

This page allows you to control access to Professional Access Point based on Media Access Control

(MAC) addresses. You can choose to allow access by listed MAC addresses or prevent access by listed

MAC addresses.

For the Guest interface, MAC Filtering settings apply to both BSSes.

Field

Description

Filter

To set the MAC Address Filter, select one of the following options:

•

Allow only stations in the list

Allow any station unless in list

MAC Filtering - 136

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Stations List

To add a MAC Address to the Stations List, type the 48-bit MAC address into

the lower text boxes, then click Add.

The MAC Address is added to the Stations List.

To remove a MAC Address from the Stations List, select its 48-bit MAC

address, then click Remove.

The stations in the list will be either allowed to access or prevented from

accessing the access point depending on the value that you chose for Filter.

Updating Settings

To apply your changes, click Update.

MAC Filtering - 137

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

MAC Filtering - 138

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Load Balancing

The Professional Access Point allows you to balance the distribution of wireless client connections across

multiple access points. Using load balancing, you can prevent the performance degradation that results

when a single access point handles a disproportionate share of the wireless traffic.

The following sections describe how to configure Load Balancing on your wireless network:

•

•

Identifying the Imbalance: Overworked or Under-utilized Access Points

Specifying Limits for Utilization and Client Associations

Load Balancing and QoS

•

Navigating to Load Balancing Settings

Configuring Load Balancing

standing Clustering” on page 44 and “Navigating to Access Points Management” on page 44.)

Understanding Load Balancing

Like most configuration settings on the Professional Access Point, load balancing settings are shared

among clustered access points.

In some cases you might want to set limits for only one access point that is consistently over-utilized.

You can apply unique settings to an access point if it is operating in standalone mode. (See “Under-

Identifying the Imbalance: Overworked or Under-utilized Access Points

Comparison of Sessions data for multiple access points allows you to identify an access point that is

consistently handling a disproportionately large percentage of wireless traffic. This can happen when

location placement or other factors cause one access point to transmit the strongest signal to a majority of

clients on a network. By default, that access point will receive most of client requests while the other

access points stay idle much of the time.

Imbalances in distribution of wireless traffic across access points will be evident in Sessions statistics,

which will show higher utilization rates on overworked APs and higher Idle times on under-utilized APs. An

access point that is handling a disproportionate amount of traffic might also show slower data rates or

lower transmit and receive rates due to the overload.

Specifying Limits for Utilization and Client Associations

You can correct for imbalances in network access point utilization by enabling load balancing and setting

limits on utilization rates and number of client associations allowed per access point.

Load Balancing - 139

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Load Balancing and QoS

Load balancing contributes to Quality of Service (QoS) for Voice Over IP (VoIP) and other such time-

sensitive applications competing for bandwidth and timely access to the air waves on a wireless network.

For more information about configuring your network for QoS, see “Quality of Service” on page 143.

Navigating to Load Balancing Settings

In the Web User Interface, click the Advanced menu’s Load Balancing tab, and update the fields as

described in the next section.

Configuring Load Balancing

To configure load balancing, enable Load Balancing and set limits and behaviour to be triggered by a

Load Balancing - 140

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

specified utilization rate of the access point.

•

To view the current Utilization Rates for access points, click the Cluster menu’s Sessions tab. (See

“Sessions” on page 59.)

When clients are disassociated from an access point, the network will provide continuous service if

another access point is within range of the client. Clients should automatically retry the access

points to which they were originally connected and then try other APs on the subnet. Clients who

are disassociated from one access point will experience a seamless transition to another access

point on the same subnet.

•

Load Balancing settings apply to the access point load as a whole. When Guest access is ena-

bled, the settings apply to both Internal and Guest networks together.

Field

Description

Load Balancing

To enable load balancing on this access point, click Enable.

To disable load balancing on this access point, click Disable.

Utilization for No New Associations

Utilization rate limits relate to wireless bandwidth utilization.

Provide a bandwidth utilization rate percentage limit for this access point to

indicate when to stop accepting new client associations.

When the utilization rate for this access point exceeds the specified limit, no

new client associations will be allowed on this access point.

If you specify 0 in this field, all new associations will be allowed regardless of

the utilization rate.

Utilization for Disassociation

Utilization rate limits relate to wireless bandwidth utilization.

Provide a bandwidth utilization rate percentage limit for this access point to

indicate when to disassociate current clients.

When the utilization rate exceeds the specified limit, a client currently associ-

ated with this access point will be disconnected.

If you specify 0 in this field, current clients will never be disconnected regard-

less of the utilization rate.

Stations Threshold for Disassocia-

tion

Specify the number of clients that you want as a stations threshold for disasso-

ciation. If the number of clients associated with the access point at any one

time is equal to or less than the number you specify here, no client will be dis-

associated regardless of the Utilization for Disassociation value.

Theoretically, the maximum number of clients allowed is 2007.

USRobotics recommends setting the maximum to between 30 and 50

clients . This allows for a workable load on the access point, given that

bandwidth is shared among the access point clients.

Load Balancing - 141

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Updating Settings

To apply your changes, click Update Settings.

Load Balancing - 142

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Quality of Service

Quality of Service (QoS) provides you with the ability to specify parameters on multiple queues for

increased throughput and better performance of differentiated wireless traffic like Voice-over-IP (VoIP);

other types of audio, video, and streaming media; and traditional IP data.

The following sections describe how to configure Quality of Service queues on the Professional Access

Point:

•

Understanding QoS

•

QoS and Load Balancing

802.11e and WMM Standards Support

QoS Queues and Parameters to Coordinate Traffic Flow

•

Navigating to QoS Settings

Configuring QoS Queues

•

Configuring AP EDCA Parameters

Enabling/Disabling Wi-Fi Multimedia

Configuring Station EDCA Parameters

•

Configuring AP EDCA Parameters

Understanding QoS

A primary factor that affects QoS is network congestion due to an increased number of clients attempting

to access the air waves and higher traffic volume competing for bandwidth during a busy time of day. The

most noticeable degradation in service on a busy, overloaded network will be evident in time-sensitive

applications like video, Voice-over-IP (VoIP), and streaming media.

Unlike typical data files, which are less affected by variability in QoS, video, VoIP and streaming media

must be sent in a specific order at a consistent rate and with minimum delay between Packet

transmissions. If the quality of service is compromised, the audio or video will be distorted.

QoS and Load Balancing

By using a combination of load balancing (see “Load Balancing” on page 139) and QoS techniques, you

can provide a high quality of service for time-sensitive applications, even on a busy network. Load

balancing is a way of better distributing the traffic volume across access points. QoS is a means of

allocating bandwidth and network access based on transmission priorities for different types of wireless

traffic within a single access point.

802.11e and WMM Standards Support

QoS describes a range of technologies for controlling data streams on shared network connections. The

Quality of Service - 143

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

IEEE 802.11e task group is in the process of defining a QoS standard for transmission quality and

availability of service on wireless networks. QoS is designed to provide better network service by

minimizing network congestion; limiting Jitter, Latency, and Packet Loss; supporting dedicated bandwidth

for time-sensitive or mission critical applications; and prioritising wireless traffic for channel access.

As with all IEEE 802.11 working group standards, the goal is to provide a standard way of implementing

QoS features so that components from different companies are interoperable.

The Professional Access Point provides QoS based on the Wireless Multimedia (WMM) specification and

Wireless Multimedia (WMM) standards, which are implementations of a subset of 802.11e features.

Both access points and wireless clients can be WMM-enabled.

QoS Queues and Parameters to Coordinate Traffic Flow

Configuring QoS options on the Professional Access Point consists of setting parameters on existing

queues for different types of wireless traffic. You can configure different minimum and maximum wait times

for the transmission of packets in each queue based on the requirements of the media being sent. Queues

automatically provide minimum transmission delay for voice, video, multimedia, and mission-critical

applications and rely on best-effort parameters for traditional IP data.

For example, time-sensitive voice, video, and multimedia are given effectively higher priority for

transmission (lower wait times for channel access), while other applications and traditional IP data—which

are less time-sensitive but often more data-intensive—are expected to tolerate longer wait times.

The Professional Access Point implementation of QoS is based on the IEEE Wireless Multimedia (WMM)

standard. A Linux-based queuing class is used to tag packets and establish multiple queues. The queues

provided offer built-in prioritisation and routing based on the type of data being transmitted.

The Web User Interface provides a way for you to configure parameters on the queues.

QoS Queues and Type of Service (ToS) on Packets

QoS on the Professional Access Point uses WMM information in the IP packet header related to Type of

Service (T o S). Every IP packet sent over the network includes a ToS field in the header that indicates how

the data is to be prioritised and transmitted over the network. The ToS field consists of a 3- to 7-bit value

with each bit representing a different aspect or degree of priority for this data as well as other meta-

information (low delay, high throughput, high reliability, low cost, and so on).

For example, the ToS for FTP data packets is likely to be set for maximum throughput since the critical

consideration for FTP is the ability to transmit bulk data. Interactive feedback is a benefit in this situation

but certainly is less critical than the FTP data itself. VoIP data packets are set for minimum delay because

time is a critical factor in quality and performance for that type of data.

The access point examines the ToS field in the header of each packet that passes through the access

point. Based on the value in a packet’s ToS field, the access point prioritises the packet for transmission by

assigning it to one of the queues. This process occurs automatically, regardless of whether you

deliberately configure QoS or not.

A different type of data is associated with each queue. The queue and associated priorities and

parameters for transmission are as follows:

•

Data 0 (Voice). Highest priority queue, minimum delay. Time-sensitive data such as Voice over IP (VoIP)

Quality of Service - 144

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

is automatically sent to this queue.

•

Data 1 (Video). High priority queue, minimum delay. Time-sensitive data such as Video and other

streaming media are automatically sent to this queue.

Data 2 (Best Effort). Medium priority queue, medium throughput and delay. Most traditional IP data is

sent to this queue.

Data 3 (Background). Lowest priority queue, high throughput. Bulk data that requires maximum through-

put and is not time-sensitive is sent to this queue (FTP data, for example).

Packets in a higher priority queue will be transmitted before packets in a lower priority queue. Interactive

data in the queues labeled "Data 0" and "Data 1" is always sent first, best effort data in "Data 2" is sent

next, and Background (bulk) data in "Data 3" is sent last. Each lower-priority queue (class of traffic) gets

bandwidth that is left over after the higher classes of traffic have been sent. At an extreme end if you have

enough interactive data to keep the access point busy all the time, low priority traffic would never get sent.

Using the QoS settings in the Web User Interface, you can configure Enhanced Distributed Channel

Access (EDCA) parameters that determine how each queue is treated when it is sent by the access point

to the client or by the client to the access point.

Wireless traffic travels:

•

Downstream from the access point to the client

Upstream from client to access point

Upstream from access point to network

Downstream from network to access point

With WMM enabled, QoS settings on the Professional Access Point affect the first two of these; down-

stream traffic flowing from the access point to client (access point EDCA parameters) and the

upstream traffic flowing from the client to the access point (station EDCA parameters).

With WMM disabled, you can still set some parameters on the downstream traffic flowing from the

access point to the client (access point EDCA parameters).

Traffic flow to and from the network is not under control of the QoS settings on the access point.

EDCF Control of Data Frames and Arbitration Interframe Spaces

Data is transmitted over 802.11 wireless networks in frames. A Frame consists of a discrete portion of data

along with descriptive meta-information packaged for transmission on a wireless network.

A Frame is similar in concept to a Packet, the difference being that a packet operates on the Network

layer (layer 3 in the OSI model) whereas a frame operates on the Data-Link layer (layer 2 in the OSI

model).

Each frame includes a source and destination MAC address, a control field with protocol version, frame

type, frame sequence number, frame body (with the actual information to be transmitted) and frame check

sequence for error detection.

The 802.11 standard defines various frame types for management and control of the wireless

infrastructure, and for data transmission. 802.11 frame types are (1) management frames, (2) control

frames, and (3) data frames. Management and control frames, which manage and control the availability of

the wireless infrastructure, automatically have higher priority for transmission.

Quality of Service - 145

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

802.11e uses interframe spaces to regulate which frames get access to available channels and to

coordinate wait times for transmission of different types of data.

Management and control frames wait a minimum amount of time for transmission: they wait a short

interframe space (SIF). These wait times are built into 802.11 as infrastructure support and are not

configurable.

The Professional Access Point supports the Enhanced Distribution Coordination Function (EDCF) as

defined by the 802.11e standard. EDCF, which is an enhancement to the DCF standard and is based on

CSMA/CA protocol, defines the interframe space (IFS) between data frames. Data frames wait for an

amount of time defined as the arbitration interframe space (AIFS) before transmitting. The AIFS parameter

is configurable.

(Note that sending data frames in AIFS allows higher priority management and control frames to be sent in

SIFs first.)

The AIFS ensures that multiple access points do not try to send data at the same time but instead wait until

a channel is free.

Random Backoff and Minimum / Maximum Contention Windows

If an access point detects that the medium is in use, it uses the DCF random backoff timer to determine the

amount of time to wait before attempting to access a given channel again. Each access point waits a

random period of time between retries. The wait time (initially a random value within a range specified as

the Minimum Contention Window) increases exponentially up to a specified limit (Maximum Contention

Window). The random delay avoids most of the collisions that would occur if multiple APs got access to the

medium at the same time and tried to transmit data simultaneously. The greater the number of active users

on a network, the more significant the performance gains of the backoff timer will be due to the reduction in

the number of collisions and retransmissions.

Doubling continues on each try until MaxCW is reached

at which point this wait time is used on retries

until data is sent or until retries limit is reached

Backoff = re-doubled

Backoff = MinCW doubled

Initial Backoff = random number in

range of MinCW

Backoff time

in milliseconds

The random backoff used by the access point is a configurable parameter. To describe the random delay,

a Minimum Contention Window (cwMin) and a Maximum Contention Window (cwMax) is defined.

•

The value specified for the Minimum Contention Window is the upper limit of a range for the initial ran-

dom backoff wait time. The number used in the random backoff is initially a random number between 0

and the number defined for the Minimum Contention Window.

If the first random backoff time ends before successful transmission of the data frame, the access point

increments a retry counter, and doubles the value of the random backoff window. The value specified

in the Maximum Contention Window is the upper limit for this doubling of the random backoff. This

doubling continues until either the data frame is sent or the Maximum Contention Window size is

reached.

Quality of Service - 146

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Packet Bursting for Better Performance

The Professional Access Point includes 802.11e based packet bursting technology that increases data

throughput and speed of transmission over the wireless network. Packet bursting enables the transmission

of multiple packets without the extra overhead of header information. The effect of this is to increase

network speed and data throughput. The size of packet bursts allowed (maximum burst length) is a

configurable parameter.

Transmission Opportunity (TXOP) Interval for Client Stations

The Transmission Opportunity (TXOP) is an interval of time when a Wi-Fi Multimedia (WMM) client station

has the right to initiate transmissions onto the wireless medium (WM).

Navigating to QoS Settings

To set up queues for QoS, click the Advanced menu’s Quality of Service tab, and configure settings as

described below.

Configuring QoS Queues

Configuring Quality of Service (QoS) on the Professional Access Point consists of setting parameters on

existing queues for different types of wireless traffic, and effectively specifying minimum and maximum

wait times (via Contention Windows) for transmission. The settings described here apply to data

Quality of Service - 147

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

transmission behaviour on the access point only, not to that of the client stations.

•

For the Guest interface, QoS queue settings apply to the access point load as a whole (both

BSSes together).

Internal and Guest network traffic is always queued together.

Configuring Quality of Service includes:

•

Enabling/Disabling Wi-Fi Multimedia

frame Spaces” on page 145.

Configuring AP EDCA Parameters

AP Enhanced Distributed Channel Access (EDCA) Parameters affect traffic flowing from the access point

to the client station.

Field

Description

Queue

Queues are defined for different types of data transmitted from the access

point-to the client station:

Data 0 (Voice)

Highest priority queue, minimum delay. Time-sensitive data such as VoIP and

streaming media are automatically sent to this queue.

Data 1(Video)

Highest priority queue, minimum delay. Time-sensitive video data is

automatically sent to this queue.

Data 2 (best effort)

Medium priority queue, medium throughput and delay. Most traditional IP data

is sent to this queue.

Data 3 (Background)

Lowest priority queue, high throughput. Bulk data that requires maximum

throughput and is not time-sensitive is sent to this queue (FTP data, for exam-

ple).

For more information, see “QoS Queues and Parameters to Coordinate Traffic

Flow” on page 144.

AIFS

The Arbitration Inter-Frame Spacing (AIFS) specifies a wait time in milliseconds

(Inter-Frame Space)

for data frames.

Valid values for AIFS are 1 through 255.

For more information, see “EDCF Control of Data Frames and Arbitration Inter-

Quality of Service - 148

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

cwMin

This parameter is input to the algorithm that determines the initial random

backoff wait time for retry of a transmission.

(Minimum Contention Window)

Select a value from the list. The value selected for cwMin is the upper limit, in

milliseconds, of a range from which the initial random backoff wait time is

determined.

The first random number generated will be a number between 0 and the

number specified in cwMin.

If the first random backoff wait time expires before the data frame is sent, a

retry counter is incremented and the random backoff value (window) is dou-

bled. Doubling will continue until the size of the random backoff value reaches

the number defined in the Maximum Contention Window.

For more information, see “Random Backoff and Minimum / Maximum Conten-

cwMax

Select a value that is higher than cwMin.

(Maximum Contention Window)

The value specified for cwMax is the upper limit, in milliseconds, for the dou-

bling of the random backoff value. This doubling continues until either the data

frame is sent or the Maximum Contention Window size is reached.

Once the Maximum Contention Window size is reached, retries will continue

until a maximum number of retries allowed is reached.

For more information, see “Random Backoff and Minimum / Maximum Conten-

frame Spaces” on page 145.

Max. Burst

AP EDCA Parameter Only. The Max. Burst Length applies only to traffic flowing

(Maximum Burst Length)

from the access point to the client station.

This value specifies, in milliseconds, the Maximum Burst Length allowed for

packet bursts on the wireless network. A packet burst is a collection of multiple

frames transmitted without header information. The decreased overhead

results in higher throughput and better performance.

Valid values for maximum burst length are 0.0 through 999.9.

For more information, see “Packet Bursting for Better Performance” on

page 147.

Enabling/Disabling Wi-Fi Multimedia

By default, Wi-Fi MultiMedia (WMM) is enabled on the access point. With WMM enabled, QoS prioritisation

and coordination of wireless medium access is on. With WMM enabled, QoS settings on the Professional

Access Point control downstream traffic flowing from the access point to client station (access point EDCA

parameters) and the upstream traffic flowing from the station to the access point (station EDCA

parameters).

Disabling WMM will deactivate QoS control of station EDCA parameters on upstream traffic flowing from

the station to the access point

With WMM disabled, you can still set some parameters on the downstream traffic flowing from the access

Quality of Service - 149

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

point to the client station (access point EDCA parameters).

•

To disable WMM extensions, click Disabled.

To enable WMM extensions, click Enabled.

Configuring Station EDCA Parameters

Station Enhanced Distributed Channel Access (EDCA) Parameters affect traffic flowing from the client

station to the access point.

Field

Description

Queue

Queues are defined for different types of data transmitted from the client sta-

tion to the access point:

Data 0 (Voice)

Highest priority queue, minimum delay. Time-sensitive data such as VoIP and

streaming media are automatically sent to this queue.

Data 1(Video)

Highest priority queue, minimum delay. Time-sensitive video data is

automatically sent to this queue.

Data 2 (best effort)

Medium priority queue, medium throughput and delay. Most traditional IP data

is sent to this queue.

Data 3 (Background)

Lowest priority queue, high throughput. Bulk data that requires maximum

throughput and is not time-sensitive is sent to this queue (FTP data, for exam-

ple).

For more information, see “QoS Queues and Parameters to Coordinate Traffic

Flow” on page 144.

AIFS

The Arbitration Inter-Frame Spacing (AIFS) specifies a wait time (in millisec-

(Inter-Frame Space)

onds) for data frames.

For more information, see “EDCF Control of Data Frames and Arbitration Inter-

Quality of Service - 150

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

cwMin

This parameter is input to the algorithm that determines the initial random

backoff wait time (window) for retry of a transmission.

(Minimum Contention Window)

The value specified here in the Minimum Contention Window is the upper limit

(in milliseconds) of a range from which the initial random backoff wait time is

determined.

The first random number generated will be a number between 0 and the

number specified here.

If the first random backoff wait time expires before the data frame is sent, a

retry counter is incremented and the random backoff value (window) is dou-

bled. Doubling will continue until the size of the random backoff value reaches

the number defined in the Maximum Contention Window.

For more information, see “Random Backoff and Minimum / Maximum Conten-

cwMax

The value specified here in the Maximum Contention Window is the upper limit

(in milliseconds) for the doubling of the random backoff value. This doubling

continues until either the data frame is sent or the Maximum Contention Win-

dow size is reached.

(Maximum Contention Window)

Once the Maximum Contention Window size is reached, retries will continue

until a maximum number of retries allowed is reached.

For more information, see “Random Backoff and Minimum / Maximum Conten-

Understanding the Wireless Distribution System

TXOP Limit

Station EDCA Parameter Only (The TXOP Limit applies only to traffic flowing

(Transmission Opportunity Limit)

from the client station to the access point.)

The Transmission Opportunity (TXOP) is an interval of time when a WME

client station has the right to initiate transmissions onto the wireless medium

(WM).

This value specifies (in milliseconds) the Transmission Opportunity (TXOP) for

client stations; that is, the interval of time when a WMM client station has the

right to initiate transmissions on the wireless network.

Updating Settings

To apply your changes, click Update.

Quality of Service - 151

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Quality of Service - 152

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Wireless Distribution System

The Professional Access Point lets you connect multiple access points using a Wireless Distribution

System (WDS). WDS allows access points to communicate with one another wirelessly in a standardized

way. This capability is critical to providing a seamless experience for roaming clients and for managing

multiple wireless networks. It can also simplify the network infrastructure by reducing the amount of cabling

required.

The following sections describe how to configure the WDS on the Professional Access Point:

•

•

Using WDS to Bridge Distant Wired LANs

Using WDS to Extend the Network Beyond the Wired Coverage Area

Backup Links and Unwanted Loops in WDS Bridges

Security Considerations Related to WDS Bridges

•

Navigating to WDS Settings

Configuring WDS Settings

•

Example of Configuring a WDS Link

•

Navigating to Time Protocol Settings

Understanding the Wireless Distribution System

A Wireless Distribution System (WDS) is an 802.11f technology that wirelessly connects access points,

known as Basic Service Sets (BSS), to form what is known as an Extended Service Set (ESS).

A BSS generally equates to an access point deployed as a single-access-point wireless network. In

cases where multi-BSSID features make a single access point look like two or more access points to

the network, the access point has multiple unique BSSIDs.

Using WDS to Bridge Distant Wired LANs

In an ESS—a network of multiple access points—each access point serves part of an area that is too large

for a single access point to cover. You can use WDS to bridge distant Ethernets to create a single LAN.

For example, suppose that you have one access point that is connected to the network by Ethernet and

serving multiple clients in the Conference Room (LAN Segment 1), and another Ethernet-wired access

point serving stations in the West Wing offices (LAN Segment 2). You can bridge the Conference Room

Wireless Distribution System - 153

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

and West Wing access points with a WDS link to create a single network for clients in both areas.

Client Station

WDS Bridge

Client Station

"Conference Room" AP

Client Station

"West Wing" AP

LAN Segment 2

LAN Segment 1

Using WDS to Extend the Network Beyond the Wired Coverage Area

An ESS can extend the reach of the network into areas where cabling would be difficult, costly, or

inefficient.

For example, suppose you have an access point which is connected to the network by Ethernet and

serving multiple clients in one area ("East Wing" in this example) but cannot reach other clients which are

out of range. Suppose also that it is too difficult or too costly to wire the distant area with Ethernet cabling.

You can solve this problem by placing a second access point closer to second group of stations

("Poolside" in this example) and bridge the two APs with a WDS link. This extends your network wirelessly

by providing an extra hop to get to distant stations.

Client Station

WDS Bridge

Client Station

"East Wing" AP

"Poolside" AP

LAN

Backup Links and Unwanted Loops in WDS Bridges

Another use for WDS bridging, the creation of backup links, is not supported by the Professional Access

Point. The topic is included here to emphasize that you should not try to use WDS in this way; backup links

will result in unwanted, endless loops of data traffic.

If an access point provides Spanning Tree Protocol (STP), WDS can be used to configure backup paths

between access points across the network. For example, between two access points you could have both

Wireless Distribution System - 154

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

a primary path via Ethernet and a secondary (backup) wireless path via a WDS link. If the Ethernet

connection goes down, STP would reconfigure its map of the network and effectively fix the down network

segment by activating the backup wireless path.

The Professional Access Point does not provide STP. Without STP, it is possible that both connections, or

paths, may be active at the same time, resulting in an endless loop of traffic on the LAN.

Therefore, be sure not create loops with either WDS bridges or combinations of Wired (Ethernet)

connections and WDS bridges.

For more information, see the "Do not create loops" note under “Configuring WDS Settings” on page 156.

Security Considerations Related to WDS Bridges

Static Wired Equivalent Privacy (WEP) is a data encryption protocol for 802.11 wireless networks. Both

access points in a given WDS link must be configured with the same WDS security settings. For static

WEP, either a static 64-bit (40-bit secret key + 24-bit initialization vector (IV)) or 128-bit (104-bit secret key

+ 24-bit IV) Shared Key is specified for data encryption.

You can enable Static WEP on the WDS link (bridge). When WEP is enabled, all data exchanged between

the two access points in a WDS link is encrypted using a fixed WEP key that you provide. USRobotics

recommends using Static WEP for your WDS link and the highest level of security available for the

individual client networks that you are bridging.

For more information about the effectiveness of different security modes, see “Security” on page 101. This

topic also covers use of None as the security mode for access-point-to-station traffic on the Guest network,

which is intended for less sensitive data traffic.

Navigating to WDS Settings

To specify the details of traffic exchange from this access point to others, click the Advanced menu’s

Wireless Distribution System tab, and update the fields as described below.

Wireless Distribution System - 155

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Configuring WDS Settings

The following notes summarize critical guidelines regarding WDS configuration. Please read all the notes

Wireless Distribution System - 156

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

before proceeding with WDS configuration.

•

When using WDS, be sure to configure WDS settings on both access points participating in the

WDS link.

You can have only one WDS link between any pair of access points. That is, a remote MAC

address may appear only once on the WDS page for a particular access point.

Both access points participating in a WDS link must be on the same radio channel and use the

same IEEE 802.11 mode. (See “Radio” on page 129 for information on configuring the Radio

mode and channel.)

•

Do not create loops with either WDS bridges or combinations of Wired (Ethernet) connections

and WDS bridges. Spanning Tree Protocol (STP), which manages path redundancy and prevent

unwanted loops, is not available in the Professional Access Point. Keep these rules in mind when

working with WDS on the access point:

Any two access points can be connected by only a single path; either a WDS bridge (wireless) or

an Ethernet connection (wired), but not both.

Do not create backup links.

If you can trace more than one path between any pair of APs going through any combination of

Ethernet or WDS links, you have a loop.

You can only extend or bridge either the Internal or Guest network but not both.

To configure WDS on this access point, describe each access point intended to receive hand-offs and

send information to this access point. Each destination access point needs the following description:

Field

Description

Local Address

Indicates the Media Access Control (MAC) addresses for this access point.

This is a read-only field.

Remote Address

Bridge with

Specify the MAC address of the destination access point; that is, the access

point to which data will be sent and from which data will be received.

The Professional Access Point provides the capability of setting up guest and

internal networks on the same access point. (See “Guest Login” on page 121.)

The guest network typically provides internet access but isolates guest clients

from more sensitive areas of your internal network. It is common to have secu-

rity disabled on the guest network to provide open access. In contrast, the

internal network provides full access to protected information behind a firewall

and requires secure logins or certificates for access.

When using WDS to link one access point to another, you need to identify the

network within which you want the data exchange to occur. Specify the network

to which you want to bridge this access point:

•

Internal Network

Guest Network

Wireless Distribution System - 157

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

WEP

Specify whether you want Wired Equivalent Privacy (WEP) encryption enabled

for the WDS link.

•

Enabled

Disabled

Wired Equivalent Privacy (WEP) is a data encryption protocol for 802.11 wire-

less networks. Both access points on the WDS link must be configured with the

same security settings. For static WEP, a static 64-bit (40-bit secret key + 24-bit

initialization vector (IV)) or 128-bit (104-bit secret key + 24-bit IV) Shared Key

for data encryption.

Key Length

Key Type

If WEP is enabled, specify the length of the WEP key:

•

64 bits

128 bits

If WEP is enabled, specify the WEP key type:

•

ASCII

Hex

Characters Required

WEP Key

Indicates the number of characters required in the WEP key.

The number of characters required updates automatically based on how you

set key length and key type.

Enter a string of characters.

• If you selected ASCII as your key type, enter any combination of 0-9

and A-Z

a-z,

• If you selected HEX as your key type, enter hexadecimal digits (any combi-

nation of 0-9and a-for A-F).

These are the RC4 encryption keys shared with the stations using the access

point.

Example of Configuring a WDS Link

When using WDS, be sure to configure WDS settings on both access points on the WDS link.

For example, to create a WDS link between the pair of access points MyAP1and MyAP2do the following:

1. Open the Web User Interface for MyAP1 by entering the IP address for MyAP1 as a URL in the Web

browser address bar in the following form:

http://IPAddressOfAccessPoint

where IPAddressOfAccessPointis the address of MyAP1.

2. Navigate to the WDS tab on MyAP1 Web User Interface.

Wireless Distribution System - 158

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

The MAC address for MyAP1 (the access point you are currently viewing) will appear as the Local

Address at the top of the page.

3. Configure a WDS interface for data exchange with MyAP2.

Start by entering the MAC address for MyAP2 as the Remote Address, and fill in the rest of the fields to

specify the network (guest or internal), security, and so on. Save the settings by clicking Update.

4. Navigate to the radio settings on the Web User Interface (Advanced menu’s Radio tab) to verify or set

the mode and the radio channel on which you want MyAP1 to broadcast.

Remember that the two access points participating in the link, MyAP1 and MyAP2, must be set to the

same mode and be transmitting on the same channel.

For this example, suppose that you are using IEEE 802.11b mode and broadcasting on Channel 6.

(Choose Mode and Channel from the drop-down lists on the Radio tab.)

5. Now repeat steps 1–4 for MyAP2:

•

Open the Web User Interface for MyAP2 by using MyAP2’s IP address in a URL.

Navigate to the WDS tab on MyAP2 Web User Interface. MyAP2’s MAC address will show as the

Local Address.

•

Configure a WDS interface for data exchange with MyAP1, starting with the MAC address for

MyAP1.

Navigate to the radio settings for MyAP2 to verify that it is using the same mode and broadcasting

on the same channel as MyAP1. In this example, Mode is 802.11b and the channel is 6.

Be sure to save the settings by clicking Update.

Updating Settings

To apply your changes, click Update.

Wireless Distribution System - 159

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Wireless Distribution System - 160

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Time Protocol

The Network Time Protocol (NTP) is an Internet standard protocol that synchronizes computer clock times

on your network. NTP servers transmit Coordinated Universal Time (UTC, also known as Greenwich Mean

Time) to their client systems. NTP sends periodic time requests to servers, using the returned time stamp

to adjust its clock.

The timestamp is used to indicate the date and time of each event in log messages.

See http://www.ntp.org for more general information on NTP.

The following sections describe how to configure the Professional Access Point to use a specified NTP

server:

•

Enabling and Disabling a Network Time Protocol (NTP) Server

Navigating to Simple Network Management Protocol

Navigating to Time Protocol Settings

To enable an NTP server, click the Advanced menu’s Time Protocol tab, and update the fields as described

below.

Time Protocol - 161

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Enabling and Disabling a Network Time Protocol (NTP) Server

To configure your access point to use a network time protocol (NTP) server, first enable the use of NTP,

and then select the NTP server you want to use. (To shut down NTP service on the network, disable NTP

on the access point.

Time Protocol - 162

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

)

Field

Description

Network Time Protocol (NTP)

NTP provides a way for the access point to obtain and maintain its time from a

server on the network. Using an NTP server gives your access point the ability

to provide the correct time of day in log messages and session information.

(See

http://www.ntp.org for more general information on NTP.)

Choose either to enable or to disable the use of a network time protocol (NTP)

server:

•

Enabled

Disabled

NTP Server

If NTP is enabled, select the NTP server that you want to use.

You can specify the NTP server by host name or IP address. However, using

the host name is recommended because host names tend to be more constant

than IP addresses.

Updating Settings

To apply your changes, click Update.

Time Protocol - 163

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Time Protocol - 164

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

SNMP

The Simple Network Management Protocol (SNMP) is an Internet standard protocol that facilitates the

monitoring and managing of network devices. SNMP lets you monitor events on your network through an

SNMP software application.

The following sections describe how to configure SNMP on your network:

•

Understanding SNMP

Enabling and Disabling Simple Network Management Protocol (SNMP)

Configuring Your Network Management System

Rebooting and Upgrading Your Access Point Using SNMP

Understanding SNMP

SNMP defines a standard for recording, storing, and sharing information about network devices. SNMP is

a subset of Transmission Control Protocol/Internet Protocol (TCP/IP) that facilitates network management,

troubleshooting, and maintenance.

Key components of any SNMP-managed network are managed devices, SNMP agents, and a network

management system. The agents, store data about their devices in Management Information Bases

(MIBs) and return this data to the network management system when requested. Managed devices can be

network nodes such as access point base stations, routers, switches, bridges, hubs, servers, or printers.

The Professional Access Point can function as an SNMP managed device for seamless integration into

network management systems such as HP OpenView. The Professional Access Point supports the

following SNMP MIBs:

•

Standard SNMP MIBs

•

SNMP v1 and v2 MIBs

IEEE802.11 MIB

•

Proprietary MIB

•

USR5453-PRODUCTS MIB—stores product identification information.

USR5453-SYSTEM MIB—facilitates system-level requests, such as reboot and upgrade.

USR5453-WIRELESS-CHAN MIB—maintains channel assignment information for access points

in a cluster.

•

USR5453-WIRELESS-MIB—stores information about the wireless system, including peer statis-

tics, beacon report, radio, and client statistics tables.

SNMP - 165

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

For more information about SNMP, visit http://www.snmplink.org.

Navigating to Simple Network Management Protocol

To enable SNMP, click the Advanced menu’s SNMP tab and update the fields as described below.

Enabling and Disabling Simple Network Management Protocol

(SNMP)

To configure your access point to use Simple Network Management Protocol (SNMP) server, first enable

the SNMP option that you want to use, and then provide the name of the community or host that can use

SNMP - 166

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

the option.

Field

Description

Enable SNMP

SNMP provides a way for the access point to store management information

and to provide the information to a network-management system (NMS). (See

http://www.snmplink.org/ for more general information on SNMP.)

Choose to either enable (default) or disable use of Simple Network Manage-

ment Protocol:

Read-only Community Name (entire

MIB)

If SNMP is enabled, enter the name of the community that is allowed to make

information queries against the MIB.

The community name acts an as authentication mechanism. The name func-

tions as a password, and a request is considered authentic if the requester

knows the password.

The community name is alphanumeric; do not use special characters or

spaces.

Allow SNMP SET Requests

Choose to either enable or disable the honouring of SNMP SET requests:

•

Enable—Machines on the network that provide the correct community name

can issue SET requests.

Disable—(default) SET requests are not honoured.

SET requests are restricted to the USR5453-SYSTEM MIB and USR5453-

WIRELESS-CHAN MIB..

Read-write community name (for per- If SET requests are enabled, enter the name of the community that is allowed

mitted SETs)

to make SET requests.

The community name acts an as authentication mechanism. The name func-

tions as a password, and a request is considered authentic if the requester

knows the password.

The community name is alphanumeric; do not use special characters or

spaces.

Designate source of permitted SNMP

requests

Choose to either enable or disable designating the source of the SNMP

requests:

•

Enable—(default) A machine must be designated in the Source field in order

for its requests to be honoured.

Disable—Any machine in the network may issue requests.

SNMP - 167

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Description

Source (hostname or subnet)

If source designation is enabled, enter the IP address of the host or subnet that

is allowed to issue SNMP requests to the access point.

If you use this option, the Professional Access Point honours requests from the

specified host or subnet only.

If you also enable a read-write community, the specified source must be a

member of that community in order for the access point to honour the source’s

requests.

Note: Even if you explicitly name a machine or a subnet in this field, any

machine issuing a request must also know the proper community name in

order to have the request honoured.

To shut down SNMP on the access point, select Disable in the SNMP field.

Updating Settings

To apply your changes, click Update.

Configuring Your Network Management System

In order to access the USRobotics proprietary MIBs, you need to import the MIBs into your network

management system. You can find the MIB files in the Mib folder on the USRobotics CD-ROM. Refer to

your network management system for instructions on importing and compiling MIBs.

Rebooting and Upgrading Your Access Point Using SNMP

In addition to the reboot and upgrade functions built into the Professional Access Points Web User

Interface, you have the option of performing these functions through SNMP.

SNMP - 168

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Rebooting Your Access Point Using SNMP.

Name

USR5453SystemReboot

Module

USR5453-SYSTEM-MIB

OID

1.3.6.1.4.1.9086.3.2.1

Base Syntax

Description

OCTET STRING

Setting this object to 1 will cause the access point to reboot.

Upgrading your Access Point

Name

USR5453SystemUpgrade

USR5453-SYSTEM-MIB

1.3.6.1.4.1.9086.3.2.2

OCTET STRING

Module

OID

Base Syntax

Description

Setting this object to a name of a file causes the device to download the file from the path speci-

fied. Set this object to an FTP or HTTP URL in order to upgrade the access point's firmware.

FTP firmware upgrade:

ftp://username:password@IPaddress:FTPport/firmware-filename

By default username is anonymousand FTPport is 21

Examples:

ftp://testuser1:testuser1@192.168.1.99:22/5453_1.1.23.tar

ftp://192.168.1.100/5453_1.1.24.tar

HTTP firmware upgrade:

http://IPaddress:HTTPport/firmware-filename

By default HTTPport is 80

Example:

http://192.168.1.101:8000/5453_1.1.24.tar

SNMP - 169

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

SNMP - 170

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Reboot

For maintenance purposes or as a troubleshooting measure, you can reboot the Professional Access Point

as follows.

1. Click the Advanced menu’s Reboot tab.

2. Click the Reboot button.

The access point reboots. If the IP address of the access point changes after the reboot, you need to

specify the new address in your Web browser in order to access the Web User Interface.

Reset Configuration

If you are experiencing extreme problems with the Professional Access Point and have tried all other

troubleshooting measures, use the Reset Configuration function. This will restore factory defaults and clear

all settings, including settings such as a new password and wireless settings.

1. Click the Advanced menu’s Reset Configuration tab.

Reboot - 171

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

2. Click the Reset button.

Factory defaults are restored.If the IP address of the access point changes after the reset, you need to

specify the new address in your Web browser in order to access the Web User Interface.

Keep in mind that if you do reset the configuration from this page, you are doing so for this access

point only; not for other access points in the cluster.

For information on the factory default settings, see “Default Settings for the Professional Access Point”

on page 16.

If you cannot access the Web User Interface, you can reset the access point by using a thin object,

such as a paper clip, to press the Reset button until both the LAN and WLAN LEDs turn off briefly.

Upgrade

As new versions of the Professional Access Point firmware become available, you can upgrade the

Upgrade - 172

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

firmware on your devices to take advantages of new features and enhancements.

Do not upgrade the firmware from a wireless client that is associated with the access point you are

upgrading. Doing so will cause the upgrade to fail. Furthermore, all wireless clients will be disassoci-

ated and no new associations will be allowed.

If you are reading this section because you already tried to upgrade the firmware through a wireless

client, use a wired client to regain access to the access point as follows:

•

Create a wired Ethernet connection from a PC to the access point.

Open the Web User Interface.

Repeat the upgrade process using with the wired client.

The upgrade process may take several minutes during which time the access point will be unavailable.

Do not power down the access point while the upgrade is in process. When the upgrade is complete,

the access point will restart and resume normal operation.

You must upgrade firmware for each access point; you cannot upgrade firmware automatically across

the cluster.

To upgrade the firmware on a particular access point:

1. Navigate to Advanced menu’s Upgrade tab on the Web User Interface for that access point.

Upgrade - 173

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Information about the current firmware version is displayed and an option to upgrade a new firmware

image is provided.

2. If you know the path to the New Firmware Image file, enter it in the textbox. Otherwise, click the Browse

button and locate the firmware image file.

3. Click Update to apply the new firmware image.

A confirmation window describes the upgrade process.

4. Click OK to confirm the upgrade and start the process.

The firmware upgrade takes approximately 5 minutes, during which the Web User Interface dis-

plays a status message and progress bar. Do not power off the access point, and do not navigate

away from the upgrade page in your Web browser during the firmware upgrade.

When the upgrade is complete, the Web User Interface redisplays the Upgrade firmware page. You

can verify that the ugrade was successful by checking the firmware version shown on that page.

Backup/Restore

You can save a copy of the current settings on the Professional Access Point to a backup configuration file.

The backup file can be used at a later date to restore the access point to the previously saved

configuration.

•

Navigating to Backup and Restore Settings

Backing up Configuration Setting for an Access Point

Restoring Access Point Settings to a Previous Configuration

Navigating to Backup and Restore Settings

To backup or restore a configuration for an access point, click the Advanced menu’s Backup and Restore tab

and use the Web User Interface as described below.

Backup/Restore - 174

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Backing up Configuration Setting for an Access Point

To save a copy of the current settings on an access point to a backup configuration file (.cbkformat):

1. Click the download configuration link.

A File Download or Open dialogue is displayed.

2. Choose the Save option on this first dialogue.

This brings up a file browser.

3. Use the file browser to navigate to the directory where you want to save the file, and click Save to save

the file.

You can use the default file name (apconfig.cbk) or type a new name for the backup file, but be sure

to save the file with a .cbkextension.

Restoring Access Point Settings to a Previous Configuration

To restore the configuration on an access point to previously saved settings:

Backup/Restore - 175

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

1. Select the backup configuration file you want to use, either by typing the full path and file name in the

Restore field or by clicking Browse, selecting the file, and clicking Open.

(Only those files that were created with the Backup function and saved as .cbkbackup configuration

files are valid to use with Restore; for example, apconfig.cbk.)

2. Click the Restore button.

The access point will reboot.

When you click Restore, the access point will reboot. A reboot confirmation dialogue and follow-on

rebooting status message will be displayed. Wait a minute or two for the reboot process to com-

plete. Then try to access the Web User Interface as described in the next step; the Web User Inter-

face will not be accessible until the access point has rebooted.

3. When the access point has rebooted, access the Web User Interface either by clicking again on one of

the tabs (if the Web User Interface is still displayed) or by typing the IP address the Professional

Access Point as a URL in the address field of the Web browser. Enter the URL for the access point as

http://IPAddressOfAccessPoint

The Web User Interface displays the configuration settings restored from the backup file that you

selected.

Backup/Restore - 176

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Command Line Interface

In addition to the Web-based user interface, the Professional Access Point includes a command line

interface (CLI) for administering the access point. The CLI lets you view and modify status and

configuration information.

From the client station perspective, even a single deployed Professional Access Point broadcasting its

"network name" to clients constitutes a wireless network. Keep in mind that CLI configuration commands,

like Web User Interface settings, can affect a single access point running in stand-alone mode or

automatically propagate to a network of clustered access points that share the same settings. (For more

information on clustering, see “Access Points” on page 43. For information on how to set an access point

to stand-alone or cluster mode from the CLI, see “Set Configuration Policy for New Access Points” on

page 39)

This part of the Professional Access Point Administrator Guide introduces the interface and provides a

complete description of classes and their associated fields:

•

Class Structure, Commands, and Examples

Class and Field Reference

Class Structure, Commands, and Examples

The following topics in this appendix provide an introduction to the class structure upon which the CLI is

based, CLI commands, and examples of using the CLI to get or set configuration information on an access

point or cluster of APs:

•

Comparison of Settings Configurable with the CLI and Web User Interface

How to Access the CLI for an Access Point

•

Telnet Connection to the Access Point

SSH2 Connection to the Access Point

•

Quick View of Commands and How to Get Help

Command Usage and Configuration Examples

•

Understanding Interfaces as Presented in the CLI

Saving Configuration Changes

Basic Settings

Class Structure, Commands, and Examples - 177

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

•

Access Point and Cluster Settings

User Accounts

Status

Ethernet (Wired) Interface

Wireless Interface

Security

Enable/Configure Guest Login Welcome Page

Configuring Multiple BSSIDs on Virtual Wireless Networks

Wireless Distribution System

Time Protocol

Reboot the Access Point

Reset the Access Point to Factory Defaults

•

Keyboard Shortcuts and Tab Completion Help

CLI Class and Field Overview

Comparison of Settings Configurable with the CLI and Web

User Interface

The command line interface (CLI) and the Web User Interface to the Professional Access Point are

designed to suit the preferences and requirements for different types of users or scenarios. Most

administrators will probably use both interfaces in different contexts. Some features (such as Clustering)

can only be configured from the Web User Interface, and some details and more complex configurations

are only available through the CLI.

The CLI is particularly useful in that it provides an interface to which you can write programmatic scripts for

access point configurations. Also, the CLI may be less resource-intensive than a Web interface.

The following table shows a feature-by-feature comparison of which settings can be configured through the

CLI or the Web User Interface, and which are configurable with either.

Class Structure, Commands, and Examples - 178

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Feature or Setting

Configurable from CLI

Configurable

from Web User

Interface

Basic Settings

yes

• Getting/changing Administrator Password

• Getting/changing access point name and

location

• Viewing information like MAC, IP address,

and Firmware version

Access Point and Cluster Settings

Get existing settings only.

yes

You cannot set configuration policy or

other cluster features from the CLI.

Use for clustering settings.

User Accounts

yes

User Database Backup and Restore

You cannot backup or restore a user data- yes

base from the CLI.

To restore a user database, use the Web

User Interface as described in “Backing

Up and Restoring a User Database” on

page 56.

Sessions

The CLI does not provide session monitor- yes

ing information.

To view client sessions, use the Web User

Interface.

Channel Management

You cannot configure Channel Manage-

ment from the CLI.

yes

To configure channel management, use

the Web User Interface as described in

“Channel Management” on page 63.

Wireless Neighborhood

You cannot view the cluster-based "Wire-

less Neighborhood" from the CLI.

To view the wireless neighbourhood,use

the Web User Interface as described in

“Wireless Neighborhood” on page 71.

Status

yes

Class Structure, Commands, and Examples - 179

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Feature or Setting

Configurable from CLI

Configurable

from Web User

Interface

Ethernet (Wired) Interface

yes

You can configure all Ethernet (Wired) set-

tings from the CLI except "Connection

Type".

To change the Connection Type from

DHCP to Static IP addressing (or vice

versa), you must use the Web User Inter-

face.

Wireless Interface

yes

Security

Set Up Guest Access

Enable/Configure Guest Login Welcome Page

Configuring Multiple BSSIDs on Virtual Wire-

less Networks

yes

Radio Settings

yes

You can configure all Radio settings from

the CLI except for turning on/off Super G.

MAC Filtering

yes

Load Balancing

Quality of Service

Wireless Distribution System

Time Protocol

Reboot the Access Point

Reset the Access Point to Factory Defaults

Upgrade the Firmware

yes

You cannot upgrade the firmware from the

CLI. To upgrade firmware, use the Web

User Interface as described in “Upgrade”

on page 172.

Backup and Restore

You cannot backup or restore an access

point configuration from the CLI. To

backup or restore an access point configu-

ration, use the Web User Interface as

described in “Backup/Restore” on

page 174.

yes

Class Structure, Commands, and Examples - 180

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

How to Access the CLI for an Access Point

Use one of the following methods to access the command line interface (CLI) for the access point or

wireless network:

•

Telnet Connection to the Access Point

SSH2 Connection to the Access Point

Telnet Connection to the Access Point

If you already have your network deployed and know the IP address of your access point, you can use a

remote Telnet connection to the access point to view the system console over the network.

The default Static IP address is 192.168.1.10. If there is no DHCP server on the network, the

access point retains this static IP address at first-time startup. You can use the Detection Utility to

find the IP address of the access point. (For more about IP addressing, see “Understanding

Dynamic and Static IP Addressing on the Professional Access Point” on page 20)

1. Bring up a command window on your PC.

(For example, from the Start menu, select Run to bring up the Run dialogue, type cmdin the Open field,

and click OK.)

2. At the command prompt, type the following:

telnet IPAddressOfAccessPoint

where IPAddressOfAccessPointis the address of the access point you want to monitor.

(If your Domain Name Server is configured to map domain names to IP addresses via DHCP, you can

also telnet to the domain name of the access point.)

3. You will be prompted for an Administrator user name and password for the access point.

USR5453-AP login:

Password:

Enter the default Administrator username and password for the Professional Access Point (admin

admin), and press "Enter" after each. (The password is masked, so it will not be displayed on the

screen.)

When the user name and password is accepted, the screen displays the Professional Access Point

help command prompt.

USR5453-AP login: admin

Password:

Enter 'help' for help.

You are now ready to enter CLI commands at the command line prompt. In addition to commands that

affect the behavior or the access point, the CLI supports the following commands that pertain to Telnet

Class Structure, Commands, and Examples - 181

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

status:

Telnet Function

Telnet Command

Get the current Telnet status

Enable Telnet acess

get telnet status

set telnet status up

set telnet status down

set ssh gen-key yes

Disable Telnet access

Generate a new pair of SSH keys

Note: This command may take up to 2 minutes to complete.After issuing this

command, you must reboot the AP for the new keys to take effect.

Any change that you make to the access point configuration through the command line interface

remains in effect for the current session. To save your changes across sessions, use the save-running

command

SSH2 Connection to the Access Point

If you already have your network deployed and know the IP address of your access point, you can use a

remote SSH2 connection to the access point to view the system console over the network.

The Professional Access Point supports SSH version 2 only.

The default Static IP address is 192.168.1.10. If there is no DHCP server on the network, the

access point retains this static IP address at first-time startup. You can use the Detection Utility to

find the IP address of the access point. (For more about IP addressing, see “Understanding

Dynamic and Static IP Addressing on the Professional Access Point” on page 20.)

Using an SSH2 connection to the access point is similar to Telnet in that it gives you remote access to the

system console and CLI. SSH2 has the added advantage of being a secure connection traffic encrypted.

To use an SSH2 connection, you need to have SSH software installed on your PC (such as PuTTY, which

is available at http://www.chiark.greenend.org.uk/~sgtatham/putty/).

Class Structure, Commands, and Examples - 182

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

1. Start your SSH application. (This example uses PuTTY.)

2. Enter the IP address of the access point and click Open.

(If your Domain Name Server is configured to map domain names to IP addresses via DHCP, you can

enter the domain name of the access point instead of an IP address.)

This brings up the SSH command window and establishes a connection to the access point. The login

prompt is displayed.

3. Enter the default Administrator username and password for the Professional Access Point (admin

admin), and press "Enter" after each. (The password is masked, so it will not be displayed on the

screen.)

admin@10.10.100.110's password:

Enter 'help' for help.

When the user name and password is accepted, the screen displays the Professional Access Point

help command prompt.

USR5453-AP#

You are now ready to enter CLI commands at the command line prompt. In addition to commands that

affect the behavior or the access point, the CLI supports the following commands that pertain to Telnet

Class Structure, Commands, and Examples - 183

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

status:

SSH Function

SSH Command

Get the current SSH status

Enable SSH acess

Disable SSH access

get ssh status

set ssh status up

set ssh status down

Any change that you make to the access point configuration through the command line interface

remains in effect for the current session. To save your changes across sessions, use the save-running

command

Quick View of Commands and How to Get Help

•

Commands and Syntax

•

Getting Help on Commands at the CLI

Ready to Get Started?

•

Settings updated from the CLI (with get, set, add, remove commands) will not be saved to the startup

configuration unless you explicitly save them via the save-running command. For a description of con-

figurations maintained on the access point and details on how to save your updates, see ““Saving Con-

figuration Changes” on page 191.

Commands and Syntax

The CLI for the Professional Access Point provides the following commands for manipulating objects.

•

named_classis a class of an object from the configuration whose instances are individually

named.

•

instanceis a name of an instance of class.

field values cannot contain spaces unless the value is in quotes

For a detailed class and field reference, see “Class and Field Reference” on page 253.

Class Structure, Commands, and Examples - 184

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Command

get

Description

The "get" command allows you to get the field values of existing instances of a class.

Classes can be "named" or "unnamed". The command syntax is:

get unnamed-class [ field ... | detail ]

get named-class [ instance | all [ field ... | name | detail ] ]

The rest of the command line is optional. If provided, it is either a list of one or more

fields, or the keyword detail.

An example of using the "get" command on an unnamed class with a single instance is:

get log

(There is only one log on the access point. This command returns information on the log

file.)

An example of using the "get" command on an unnamed class with multiple instances is:

get log-entry

(There are multiple log entries but they are not named. This command returns all log

entries.)

An example of using the "get" command on a named class with multiple instances is:

get bss wlan0bssInternal

(There are multiple bss’s and they are named. This command returns information on the

BSS named "wlan0bssInternal".)

An example of using the "get" command on a named class to get all instances:

get radius-user all name

get radius-user all

Note: "wlan0bssInternal" is the name of the basic service set (BSS) on the internal

network (wlan0interface). For information on interfaces, see “Understanding Interfaces

as Presented in the CLI” on page 190.

Class Structure, Commands, and Examples - 185

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Command

set

Description

The "set" command allows you to set the field values of existing instances of a class.

set unnamed-class [ with qualifier-field qualifier-value ... to ] field value . . .

The first argument is an unnamed class in the configuration.

After this is an optional qualifier that restricts the set to only some instances. For single-

ton classes (with only one instance) no qualifier is needed. If there is a qualifier, it starts

with the keyword with, then has a sequence of one or more qualifier-field qualifier-

value pairs, and ends with the keyword to. If these are included, then only instances

whose present value of qualifier-field is qualifier-value will be set. The qualifier-value

arguments cannot contain spaces. Therefore, you cannot select instances whose

desired qualifier-value has a space in it.

The rest of the command line contains field-value pairs.

set named-class instance | all [ with qualifier-field qualifier-value ... to ] field value . . .

The first argument is either a named class in the configuration.

The next argument is the name of the instance to set, or the keyword all, which indi-

cates that all instances should be set. Classes with multiple instances can be set con-

secutively in the same command line as shown in Example 4 below. The qualifier-value

arguments cannot contain spaces.

Here are some examples. (Bold text indicates class names, field names, or keywords;

text that is not bold indicates values to which the fields are being set.)

1. set interface wlan0 ssid "Vicky's AP"

2. set radio all beacon-interval 200

3. set tx-queue wlan0 with queue data0 to aifs 3

4. set tx-queue wlan0 with queue data0 to aifs

burst

5. set bridge-port br0 with interface eth0 to path-cost 200

cwmin 15 cwmax 1024

Note: For information on interfaces used in this example (such as wlan0 br0, or eth0)

see “Understanding Interfaces as Presented in the CLI” on page 190.

add

The "add" command allows you to add a new instance of a class.

add named-class instance [ field value ... ]

add anonymous-class [ field value ... ]

For example:

add radius-userwally

Class Structure, Commands, and Examples - 186

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Command

remove

Description

The "remove" command allows you to remove an existing instance of a class.

remove unnamed-class [ field value . . . ]

remove named-class instance | all [ field value . . .]

For example:

remove radius-user wally

The CLI also includes the following commands for maintenance tasks:

save-running

The save-running command saves the running configuration as the startup configuration.

For more information, see ““Saving Configuration Changes” on page 191.

reboot

The reboot command restarts the access point (a soft reboot).

For more information, see ““Reboot the Access Point” on page 247.

factory-reset

The factory-reset command resets the access point to factory defaults and reboots.

For more information, see ““Reset the Access Point to Factory Defaults” on page 247.

Getting Help on Commands at the CLI

Help on commands can be requested at the command line interface (CLI) by using the TAB key. This is a

quick way to see all valid completions for a class.

Hitting TAB once will attempt to complete the current command.

If multiple completions exist, a beep will sound and no results will be displayed. Enter TAB again to display

all available completions.

•

Example 1: At a blank command line, hit TAB twice to get a list of all commands.

USR5453-AP#

add

Add an instance to the running configuration

factory-reset Reset the system to factory defaults

get

Get field values of the running configuration

Reboot the system

Remove instances in the running configuration

Save the running configuration

reboot

remove

save-running

set

Set field values of the running configuration

•

Example 2: Type "get " TAB TAB (including a space after get) to see a list of all field options for the get

command.

USR5453-AP# get

association

basic-rate

bridge-port

bss

Associated station

Basic rate of the radio

Bridge ports of bridge interfaces

Basic Service Set of the radio

Class Structure, Commands, and Examples - 187

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

cluster

Clustering-based configuration settings

cluster-member Member of a cluster of like-configured access points

config

Configuration settings

Detected access point

DHCP client settings

IEEE 802.11

detected-ap

dhcp-client

dot11

host

Internet host settings

Network interface

IP route entry

Kernel log entry

Log settings

interface

ip-route

klog-entry

log

log-entry

mac-acl

ntp

portal

radio

Log entry

MAC address access list item

Network Time Protocol client

Guest captive portal

Radio

radius-user

ssh

RADIUS user

SSH access to the command line interface

supported-rate Supported rate of the radio

system

System settings

telnet

tx-queue

wme-queue

Telnet access to the command line interface

Transmission queue parameters

Transmission queue parameters for stations

•

Example 3: Type "get system v" TAB. This will result in completion with the only matching field, "get sys-

tem version". Hit ENTER to display the output results of the command.

For detailed examples on getting help, see “Tab Completion and Help” on page 248.

Ready to Get Started?

If you know the four basic commands shown above (get, set, remove, and add) and how to get help at the

CLI using tab completion, you are ready to get started.

The best way to get up-to-speed quickly is to bring up the CLI on your access point and follow along with

some or all of the examples in the next topic “Command Usage and Configuration Examples” on page 188.

Command Usage and Configuration Examples

“Understanding Interfaces as Presented in the CLI” on page 190

“Saving Configuration Changes” on page 191

“Basic Settings” on page 192

“Access Point and Cluster Settings” on page 196

“User Accounts” on page 196

“Status” on page 199

Class Structure, Commands, and Examples - 188

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

“Ethernet (Wired) Interface” on page 207

“Wireless Interface” on page 213

“Security” on page 213

“Enable/Configure Guest Login Welcome Page” on page 228

“Configuring Multiple BSSIDs on Virtual Wireless Networks” on page 229

“Radio Settings” on page 230

“MAC Filtering” on page 235

“Load Balancing” on page 238

“Quality of Service” on page 238

“Wireless Distribution System” on page 245

“Time Protocol” on page 246

“Reboot the Access Point” on page 247

“Reset the Access Point to Factory Defaults” on page 247

“Keyboard Shortcuts” on page 248

Class Structure, Commands, and Examples - 189

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Understanding Interfaces as Presented in the CLI

The following summary of interface names is provided to help clarify the related CLI commands and output

results. These names are not exposed on the Web User Interface, but are used throughout the CLI. You

get and set many configuration values on the access point by referring to interfaces. In order to configure

the access point through the CLI, you need to understand which interfaces are available on the access

point, what role they play (corresponding setting on the Web User Interface), and how to refer to them.

Interface

Description

Local loopback for data meant for the access point itself.

The wired (Ethernet) interface for the Internal network.

eth0

br0

The Internal bridge represents the Internal interface for the access point. To telnet

or ssh into the access point, use the IP address for this interface.

br0 consists:

• eth0 (or vlanSomeNumberif you have VLANs configured)

• wlan0

The IP address of the access point is provided in the output detail for br0. So, a

useful command is get interface. This gives you common information on all inter-

faces. From the output results, you can find the IP address for br0. Use this IP

address to connect to the access point.

brguest

brvwn1

The Guest bridge, which consists of eth1 and wlan0guest.

The bridge interface for Virtual Wireless Network (VWN) 1.

The bridge interface for VWN1 consists of:

• wlan0vwn1

•

vlanVLANIDwhere VLANIDis a four-digit VLAN ID that you provided. (For

example, if you provided a VLAN ID of 1234, the VLAN interface would be

"vlan1234"

brvwn2

This is for the second Virtual Wireless Network (VWN) 2.

The bridge interface for VWN2 consists of:

• wlan0vwn1

•

vlanVLANIDwhere VLANIDis a four-digit VLAN ID that you provided. (For

example, if you provided a VLAN ID of 1234, the VLAN interface would be

vlan1234.)

wlan0

The wireless (radio) interface for the Internal network.

The wireless (radio) interface for the Guest network.

The wireless interface for Virtual Wireless Network (VWN) 1.

The wireless interface for Virtual Wireless Network (VWN) 2.

wlan0guest

wlan0vwn1

wlan0vwn2

Class Structure, Commands, and Examples - 190

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Interface

Description

A wireless distribution system (WDS) interface where "x" indicates the number of

wlan0wdsx

the WDS link. (For example, wlan0wds1.)

vlanxxxx

A VLAN interface for VLAN ID xxxx. To find out what this VLAN interface is

(Internal, Guest, VWN1 or VWN2), use the following command to look at the "role

field:

get interface vlanVLANID role

For example:

get interface vlan1234 role

Saving Configuration Changes

The Professional Access Point maintains three different configurations.

•

Factory Default Configuration - This configuration consists of the default settings shipped with the

access point (as specified in “Default Settings for the Professional Access Point” on page 16).

You can always return the access point to the factory defaults by using the factory-reset command, as

described in “Reset the Access Point to Factory Defaults” on page 247.

•

Startup Configuration - The startup configuration contains the settings that the access point will use

the next time it starts up (for example, upon reboot).

To save configuration updates made from the CLI to the startup configuration, you must execute the

save-running or "set config startup running" command from the CLI after making changes.

Running Configuration - The running configuration contains the settings with which the access point

is currently running.

When you view or update configuration settings through the command line interface (CLI) using get,

set, add, and remove commands, you are viewing and changing values on the running configuration

only. If you do not save the configuration (by executing the save-running or "set config startup running"

command at the CLI), you will lose any changes you submitted via the CLI upon reboot.

The save-running command saves the running configuration as the startup configuration. (The save-running

command is a shortcut command for "set config startup running", which accomplishes the same thing)

Settings updated from the CLI (with get, set, add, remove commands) will not be saved to the startup

configuration unless you explicitly save them via the save-running command. This gives you the option of

maintaining the startup configuration and trying out values on the running configuration that you can

discard (by not saving).

By contrast, configuration changes made from the Web User Interface are automatically saved to both the

running and startup configurations. If you make changes from the Web User Interface that you do not want

to keep, your only option is to reset to factory defaults. The previous startup configuration will be lost.

Class Structure, Commands, and Examples - 191

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Basic Settings

Before configuring this feature, make sure you are familiar with the names of the interfaces as

described in “Understanding Interfaces as Presented in the CLI” on page 190. The interface name you

reference in a command determines whether a setting applies to a wired or wireless interface, or to the

Internal or Guest network.

The following CLI command examples correspond to tasks you can accomplish on the Basic Settings tab

of the Web User Interface for access points with clustering capabilities. In some cases, the CLI get

command provides additional details not available through the Web User Interface.

This table shows a quick view of Basic Settings commands and provides links to detailed examples.

Basic Setting

Example

Get the IP Address for the Internal Inter-

face on an Access Point

get interface br0 ip

get interface

get interface is a catch-all command that shows common information

on all interfaces for the access point such as IP addresses, MAC

addresses, and so on. The IP address for the Internal interface (and

the one used to access the access point) is that shown for br0. (See

“Understanding Interfaces as Presented in the CLI” on page 190)

Get the MAC Address for an Access Point

get interface br0 mac

Get Both the IP Address and MAC

Address

get interface br0 mac ip

Get Common Information on All Interfaces

for an Access Point

get interface

Get the Firmware Version for the Access

Point

get system version

Get the Location of the Access Point

Set the Location for an Access Point

get cluster location

set system location NewLocation

For example:

set system location hallway

set system location"Vicky’s Office"

Get the Current Password

Set the Password

get system encrypted-password

set system password NewPassword

For example:

set system password admin

Get the Wireless Network Name (SSID))

get interface wlan0 ssid

Class Structure, Commands, and Examples - 192

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Basic Setting

Example

Set the Wireless Network Name (SSID)

set interface wlan0 ssid NewSSiD

For example:

set interface wlan0 ssid Vicky

set interface wlan0 ssid "Vicky’s AP"

Get the IP Address for the Internal Interface on an Access Point

In the following example, the IP address for the access point is: 10.10.55.216. Use the get command as

shown to obtain the IP address for the Internal network.

USR5453-AP# get interface br0 ip

10.10.55.216

Get the MAC Address for an Access Point

In the following example, the MAC address for the access point is: 00:a0:c9:8c:c4:7e. Use the get

command as shown to obtain the MAC address.

USR5453-AP# get interface br0 mac

00:a0:c9:8c:c4:7e

Get Both the IP Address and MAC Address

The following command returns both the IP address and the MAC address for an access point:

USR5453-AP# get interface br0 mac ip

Field Value

---------------------

10.10.55.216

mac

00:a0:c9:8c:c4:7e

Get Common Information on All Interfaces for an Access Point

The following example shows common information (including IP addresses) for all interfaces.

USR5453-AP# get interface

name

type

status mac

mask

---------------------------------------------------------------------------

-----

down

00:00:00:00:00:00 127.0.0.1

00:02:B3:01:01:01

00:02:B3:02:02:02

255.0.0.0

eth0

eth1

br0

bridge

00:02:B3:01:01:01 10.10.100.110

255.255.255.0

brguest

wlan0

bridge

service-set up

down

00:00:00:00:00:00

00:0C:41:16:DF:A6

wlan0guest service-set up

wlan0wds0 wds down

Class Structure, Commands, and Examples - 193

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

wlan0wds1 wds

wlan0wds2 wds

wlan0wds3 wds

USR5453-AP#

down

Class Structure, Commands, and Examples - 194

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Get the Firmware Version for the Access Point

In the following example, the access point is running Firmware Version: 1.0.0.9. Use the get command as

shown to obtain the Firmware Version.

USR5453-AP# get system version

1.0.0.9

Get the Location of the Access Point

In the following example, the location of the access point has not been set. Use the get command as

shown to obtain the location of the access point.

USR5453-AP# get cluster location

not set

Set the Location for an Access Point

To set the location for an access point, use the set command as follows:

USR5453-AP# set system location hallway

USR5453-AP# set system location "Vicky's Office"

To check to make sure that the location was set properly, use the get command again to find out the

location

USR5453-AP# get system location

Vicky’s Office

Get the Current Password

USR5453-AP# get system encrypted-password

2yn.4fvaTgedM

Set the Password

USR5453-AP# set system password admin

USR5453-AP# get system encrypted-password

/rYSvxS4Okptc

Get the Wireless Network Name (SSID)

USR5453-AP# get interface wlan0 ssid

Internal Instant802 Network

Set the Wireless Network Name (SSID)

USR5453-AP# set interface wlan0 ssid "Vicky’s AP"

USR5453-AP# get interface wlan0 ssid

Vicky’s AP

Class Structure, Commands, and Examples - 195

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Access Point and Cluster Settings

The command examples in this section show how to get the configuration for a cluster of access points.

These settings generally correspond to those on the Cluster menu’s Access Points tab in the Web User

Interface.

You cannot use the CLI to add or remove an access point from a cluster or set the configuration policy.

If you want to configure clustering, please use the Web User Interface as described in “Access Points”

on page 43

This table provides a quick view of Access Point Cluster commands and provides links to detailed

examples.

Cluster Command

Example

Determine whether the Access Point is a Cluster Member or is in

Stand-alone Mode

get cluster detail

Get MAC Addresses for all Access Points in the Cluster

get clustered-ap all name

Determine whether the Access Point is a Cluster Member or is in Stand-alone Mode

This command shows whether the access point is clustered or not. If the command returns 0, the access

point is in stand-alone mode (not clustered). If the command returns 1, the access point is a member of a

cluster. In the following example, the access point is in stand-alone mode.

USR5453-AP# get cluster detail

Field

--------------------

clustered

Value

clusterable 0

kickstarted 0

location

not set

formation

Get MAC Addresses for all Access Points in the Cluster

USR5453-AP# get cluster-member all

name

mac

location removed

---------------------------------------------------------------------

00:e0:b8:76:23:b4 00:e0:b8:76:23:b4 10.10.10.248 not set 0

00:e0:b8:76:16:88 00:e0:b8:76:16:88 10.10.10.230 not set 0

User Accounts

The following command examples show configuration tasks related to user accounts. These tasks

correspond to the Cluster menu’s User Management tab in the Web User Interface.

Class Structure, Commands, and Examples - 196

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

This table shows a quick view of User Management commands and provides links to detailed examples.

User Account Command

Example

Get All User Accounts

To view all usernames:

get radius-user all name

To view all user accounts:

get radius-user all

Add Users

add radius-user UserNameusername UserName

For example:

add radius-user samantha username samantha

To set the user’s real name:

set radius-user UserNamerealname RealName

For example:

set radius-user samantha realname "Elizabeth Montgomery"

(or set radius-user samantha realname Elizabeth

)

To set user’s password:

Enable a user account

Disable a user account

Remove a User Account

set radius-user UserNamepassword Password

For example:

set radius-user samantha password westport

set radius-user UserNamedisabled 0

For example:

set radius-user samantha disabled 0

set radius-user UserNamedisabled 1

For example:

set radius-user samantha disabled 1

remove radius-user UserName

The user account requires a value for the disabled parameter. If a single user is missing a value for dis-

abled, the user account table in the Web User Interface will not display any users.

Get All User Accounts

To view all user names:

USR5453-AP# get radius-user all name

name

--------

larry

To view all user accounts:

USR5453-AP# get radius-user all

Class Structure, Commands, and Examples - 197

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

name

------------------------------------------------------------

larry larry David White

username disabled password realname

(At the start, "larry" is the only user configured.)

Add Users

In this example, you will add four new users: (1) samantha, (2) endora, (3) darren, and (4) wally. You will

set up user names, real names, and passwords for each.

1. Add username "samantha":

USR5453-AP# add radius-user samantha username samantha

2. Provide a real name (Elizabeth Montgomery) for this user:

USR5453-AP# set radius-user samantha realname "Elizabeth Montgomery"

3. Set the user password for samantha to "westport":

USR5453-AP# set radius-user samantha password westport

4. Enable user "samantha":

USR5453-AP# set radius-user samantha disabled 0

5. Repeat this process to add some other users (endora, darren, and wally):

USR5453-AP# add radius-user endora username endora

USR5453-AP# set radius-user endora realname "Agnes Moorhead"

USR5453-AP# set radius-user endora password scotch

USR5453-AP# set radius-user endora disabled 0

USR5453-AP# add radius-user darren username darren

USR5453-AP# set radius-user darren realname "Dick York"

USR5453-AP# set radius-user darren password martini

USR5453-AP# set radius-user darren disabled 0

USR5453-AP# add radius-user wally username wally

USR5453-AP# set radius-user wally realname "Tony Dow"

USR5453-AP# set radius-user wally password sodapop

USR5453-AP# set radius-user wally disabled 0

6. After configuring these new accounts, use the "get" command to view all users. (Passwords are always

hidden.)

USR5453-AP# get radius-user all

name

username disabled password realname

------------------------------------------------------------

larry

David White

samantha samanatha 0

Elizabeth Montgomery

Agnes Moorhead

Dick York

endora

darren

wally

endora

darren

wally

Tony Dow

Class Structure, Commands, and Examples - 198

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Remove a User Account

To remove a user account, type the following

USR5453-AP# remove radius-user wally

Use the "get" command to view all user names. (You can see "wally" has been removed.)

USR5453-AP# get radius-user all name

name

--------

larry

samantha

endora

darren

Status

The command tasks and examples in this section show status information on access points. These

settings correspond to what is shown on the Status tabs in the Web User Interface. (“Status” on page 77)

This table provides a quick view of all Status commands and links to detailed examples.

Make sure you are familiar with the names of the interfaces as described in “Understanding Interfaces

as Presented in the CLI” on page 190. The interface name you reference in a get command deter-

mines whether the command output shows a wired or wireless interface or the Internal or Guest net-

work.

This table shows a quick view of Status commands and provides links to detailed examples

Status Command

Example

Understanding Interfaces as Presented in

the CLI

Reference of interface names and purposes as described in “Under-

standing Interfaces as Presented in the CLI” on page 190.

Global command to get all detail on a

Basic Service Set (BSS).

get bss all detail

This is a useful command to use to get a

comprehensive understanding of how the

access point is currently configured.

Get Common Information on the Internal

Interface for the Access Point

get interface br0

Get All Wired Settings for the Wired Inter-

nal Interface

Get Current Settings for the Ethernet

(Wired) Guest Interface

get interface brguest

get interface brguest mac

get interface brguest ssid

Get the MAC Address for the Wired Inter-

nal Interface

get interface wlan0 mac

Class Structure, Commands, and Examples - 199

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Status Command

Example

Get the Network Name (SSID) for the

Wired Internal Interface

get interface wlan0 ssid

Get the Current IEEE 802.11 Radio Mode

get radio wlan0 mode

Get the Channel the Access Point is Cur-

rently Using

get radio wlan0 channel

Get Basic Radio Settings for the Internal

Interface

get radio wlan0

get radio wlan0 detail

Get Status on Events

get log-entry

Enable Remote Logging and Specify the

Log Relay Host for the Kernel Log

As a prerequisite to remote logging, the Log Relay Host must be con-

figured first as described in Setting Up the Log Relay Host.

See complete explanation of CLI commands at Enable Remote Log-

ging and Specify the Log Relay Host for the Kernel Log. Here are a

few:

set log relay-enabled 1enables remote logging

set log relay-enabled 1disables remote logging

get log

set log TAB TAB shows values you can set on the log

Get Transmit / Receive Statistics

get interface all ip mac ssid tx-packets tx-bytes

tx-errors rx-packets rx-bytes rx-errors

Get Client Associations

get association

get clustered-ap

Get neighbouring Access Points

Get Common Information on the Internal Interface for the Access Point

The following command obtains all information on the internal interface for an access point:

USR5453-AP# get interface br0

Field

Value

--------------------

type

status

hello

mac

mask

bridge

00:a0:c9:8c:c4:7e

192.168.1.1

255.255.255.0

Get Current Settings for the Ethernet (Wired) Internal Interface

The following example shows how to use the CLI to get the Ethernet (Wired) settings for the Internal

interface for an access point. You can see by the output results of the command that the MAC address is

00:a0:c9:8c:c4:7e, the IP address is 192.168.1.1, and the subnet mask is 255.255.255.0.

Get All Wired Settings for the Wired Internal Interface

USR5453-AP# get interface br0

Class Structure, Commands, and Examples - 200

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field

Value

--------------------

mac

00:a0:c9:8c:c4:7e

192.168.1.1

mask

255.255.255.0

Get the MAC Address for the Wired Internal Interface

USR5453-AP# get interface wlan0 mac

02:0C:41:00:02:00

Get the Network Name (SSID) for the Wired Internal Interface

USR5453-AP# get interface wlan0 ssid

elliot_AP

Get Current Settings for the Ethernet (Wired) Guest Interface

The following example shows how to use the CLI to get the Ethernet (Wired) settings for the Guest

interface for an access point. You can see by the output results of the command that the MAC address is

00:50:04:6f:6f:90, the IP address is 10.10.56.248, and the subnet mask is 255.255.255.0.

USR5453-AP# get interface brguest

Field

Value

--------------------

type

status

mac

mask

bridge

00:50:04:6f:6f:90

10.10.56.248

255.255.255.0

You can get specifics on the Guest interface by using the same types of commands as for the

Internal interface but substituting brguestfor wlan0. For example, to get the MAC address for the

guest interface: get interface wlan0 ssid

Get Current Wireless (Radio) Settings

The following examples show how to use the CLI to get wireless radio settings on an access point, such as

mode, channel, and so on. You can see by the results of the commands that the access point mode is set

to IEEE 802.11g, the channel is set to 6, the beacon interval is 100, and so forth.

For information on how to configure Radio settings through the CLI, see “Radio Settings” on page 230.

(Radio settings are fully described in “Configuring Radio Settings” on page 130.)

Get the Current IEEE 802.11 Radio Mode

USR5453-AP# get radio wlan0 mode

Get the Channel the Access Point is Currently Using

USR5453-AP# get radio wlan0 channel

Get Basic Radio Settings for the Internal Interface

USR5453-AP# get radio wlan0

Field

Value

Class Structure, Commands, and Examples - 201

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

------------------------------

status

max-bsses

channel-policy

channel

static-channel

mode

best

fragmentation-threshold 2346

rts-threshold

ap-detection

2347

beacon-interval

100

Get All Radio Settings on the Internal Interface

USR5453-AP# get radio wlan0 detail

Field

Value

----------------------------------------------------

status

description

mac

IEEE 802.11

max-bss

channel-policy

mode

best

static-channel

channel

tx-power

100

2347

2346

tx-rx-status

beacon-interval

rts-threshold

fragmentation-threshold

load-balance-disassociation-utilization 0

load-balance-disassociation-stations

load-balance-no-association-utilization 0

ap-detection

station-isolation

frequency

off

2417

wme

Get Status on Events

USR5453-AP# get log-entry

Number Time

Priority Daemon

Message

------------------------------------------------------

Apr 20 21:39:55

Sending renew...

Apr 20 21:39:55

debug

udhcpc

info

udhcpc

Lease of 10.10.55.216 obtained, lease time 300

Apr 20 21:37:25

Sending renew...

Apr 20 21:37:25

debug

udhcpc

info

udhcpc

Lease of 10.10.55.216 obtained, lease time 300

Apr 20 21:34:55

Sending renew...

Apr 20 21:34:55

debug

udhcpc

info

udhcpc

Class Structure, Commands, and Examples - 202

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Lease of 10.10.55.216 obtained, lease time 300

Enable Remote Logging and Specify the Log Relay Host for the Kernel Log

The Kernel Log is a comprehensive list of system even its and kernel messages such as error conditions

like dropping frames. To capture Access Point Kernel Log messages you need access to a remote syslog

server on the network. The following sections describe how to set up remote logging for the access point.

1. Prerequisites for Remote Logging

2. View Log Settings

3. Enable / Disable Log Relay Host

4. Specify the Relay Host

5. Specify the Relay Port

6. Review Log Settings After Configuring Log Relay Host

Prerequisites for Remote Logging

To capture Kernel Log messages from the access point system, you must first set up a remote server

running a syslog process and acting as a syslog "log relay host" on your network. (For information on how

to set up the remote server, see “Setting Up the Log Relay Host” on page 80.)

Then, you can use the CLI to configure the Professional Access Point to send its syslog messages to the

remote server.

View Log Settings

To view the current log settings:

USR5453-AP# get log

Field

Value

--------------------------

depth

relay-enabled 0

relay-host

relay-port

514

When you start a new access point, the Log Relay Host is disabled. From the above output for the "get

log" command, you can identify the following about the Log Relay Host (syslog server):

•

The syslog server is disabled (because "relay-enabled" is set to "0")

No IP address or Host Name is specified for the syslog server.

The access point is listening for syslog messages on the default port 514

Enable / Disable Log Relay Host

To enable the Log Relay Host:

USR5453-AP# set log relay-enabled 1

To disable the Log Relay Host:

Class Structure, Commands, and Examples - 203

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

USR5453-AP# set log relay-enabled 0

Specify the Relay Host

To specify the Relay Host, provide either the IP Address or a DNS name for the Log Relay Host as

parameters to the "set log relay-host" command as shown below.

If you are using Instant802 Conductor, the Repository Server should receive the syslog messages

from all access points. In this case, use the IP address of the Conductor Repository Server as the

Relay Host.

•

To specify an IP address for the syslog server:

set log relay-host IP_Address_Of_LogRelayHost

Where IP_Address_Of_LogRelayHostis the IP Address of the Log Relay Host.

For example:

USR5453-AP# set log relay-host 10.10.5.220

•

To specify a Host Name for the syslog server:

set log relay-host Host_Name_Of_LogRelayHost

Where Host_Name_Of_LogRelayHostis the a DNS name for the Log Relay Host.

For example:

USR5453-AP# set log relay-host myserver

Specify the Relay Port

To specify the Relay Port for the syslog server:

set log relay-port Number_Of_LogRelayPort

Where Number_Of_LogRelayPortis the port number for the Log Relay Host.

For example:

USR5453-AP# set log relay-port 514

Review Log Settings After Configuring Log Relay Host

To view the current log settings:

USR5453-AP# get log

Field

--------------------------

depth 15

relay-enabled 1

Value

relay-host

relay-port

10.10.5.220

514

Class Structure, Commands, and Examples - 204

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

From the above output for the "get log" command, you can identify the following about the Log Relay

Host (syslog server):

•

The syslog server is enabled (because "relay-enabled" is set to "1")

The syslog server is at the IP address 10.10.5.220

The access point is listening for syslog messages on the default port 514

Get Transmit / Receive Statistics

USR5453-AP# get interface all ip mac ssid tx-packets tx-bytes tx-errors rx-packets

rx-bytes rx-errors

Name

Tx-bytes Tx-errors Rx-packets Rx-bytes Rx-errors

---------------------------------------------------------------------------

Mac

Ssid

Tx-packets

127.0.0.1

151772 0

00:00:00:00:00:00

1319

00:A0:C9:8C:C4:7E

11323

00:50:04:6F:6F:90

6632

1319

4699

152

151772 0

1259824 0

664298 0

885264 0

293550 0

eth0

eth1

br0

3025566 0

0.0.0.0

49400 0

10.10.55.216 00:A0:C9:8C:C4:7E

3025566 0 10467

10.10.56.248 00:50:04:6F:6F:90

48032 0 5909

0.0.0.0

710681 0

wlan0guest 0.0.0.0

471228 0

4699

152

brguest

wlan0

02:0C:41:00:02:00 AAP1000 (Trusted) 6483

0 0

02:0C:41:00:02:01 AAP1000 (Guest)

0 0

5963

wlan0wds0

wlan0wds1

wlan0wds2

wlan0wds3

Get Client Associations

USR5453-AP# get association

Interf Station

Authen Associ Rx-pac Tx-pac Rx-byt Tx-byt Tx-rat

wlan0 00:0c:41:8f:a7:72 Yes

wlan0 00:09:5b:2f:a5:2f Yes

USR5453-AP# get association detail

Yes

126

382

9222 3055 540

16620 10065 110

Inter Station

Authe Assoc Rx-pa Tx-pa Rx-byt Tx-byt Tx-ra Liste

wlan0 00:0c:41:8f:a7:72 Yes Yes 126 29

wlan0 00:09:5b:2f:a5:2f Yes Yes 382 97

9222 3055 540 1

16620 10065 110 1

Get neighbouring Access Points

The Neighboring access point view shows wireless networks within range of the access point. These

commands provide a detailed view of neighboring access points including identifying information (SSIDs

and MAC addresses) for each, and statistical information such as the channel each access point is

broadcasting on, signal strength, and so forth.

Class Structure, Commands, and Examples - 205

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

To see the kinds of information about access point neighbours you can search on, type get detected-ap

TAB TAB.

USR5453-AP# get detected-ap

[Enter]

band

* Get common fields *

Frequency band

beacon-interval Beacon interval in kus (1.024 ms)

capability

channel

detail

IEEE 802.11 capability value

Channel

* Get all fields *

ERP

erp

last-beacon

mac

Time of last beacon

MAC address

num_beacons

phy-type

privacy

rate

Number of beacons received

PHY mode detected with

WEP or WPA enabled

Rate

signal

Signal strength

ssid

Service Set IDentifier (a.k.a., Network Name)

supported-rates Supported rates list

type

wpa

Type (AP, Ad hoc, or Other)

WPA security enabled

To get the neighbouring access points, type get detected-ap

USR5453-AP# get detected-ap

Field

Value

-----------------------------------------

mac

type

00:e0:b8:76:28:e0

privacy On

ssid

Purina

channel 6

signal 2

Field

Value

-----------------------------------------

mac

type

00:0e:81:01:01:62

privacy Off

ssid

Internal Instant802 Network

channel 6

signal 1

Field

Value

-----------------------------------------

mac

type

00:e0:b8:76:1a:f6

privacy Off

ssid

domani

channel 6

signal 3

Field

Value

Class Structure, Commands, and Examples - 206

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

-----------------------------------------

mac

type

00:e0:b8:76:28:c0

privacy Off

ssid

domani

channel 6

signal 4

Ethernet (Wired) Interface

Before configuring this feature, make sure you are familiar with the names of the interfaces as

described in “Understanding Interfaces as Presented in the CLI” on page 190. The interface name you

reference in a command determines whether a setting applies to a wired or wireless interface or to the

Internal or Guest network.

This table shows a quick view of commands for getting and setting values for the Wired interface and

provides links to detailed examples.

Wired Interface Command

Get Summary View of Internal and Guest Interfaces

Get the DNS Name

Example

get bss

get host id

set host id HostName

Set the DNS Name

For example:

set host id vicky-ap

Get Current Settings for the Ethernet (Wired) Internal Interface

Get Current Settings for the Ethernet (Wired) Guest Interface

Set Up Guest Access

get interface br0

get interface brguest

Setting up Guest Access consists of configur-

ing Internal and Guest Wired interfaces on

VLANs.

For detailed examples, see “Set Up Guest

Access” on page 208.

Find out if Guest Access is enabled and configured.

Get/Change the Connection Type (DHCP or Static IP)

get interface brguest status

(will be "up" or "down")

See detailed example in “Get/Change the Con-

nection Type (DHCP or Static IP)” on

page 211.

Re-Configure Static IP Addressing Values

For detailed examples see:

“Set the Static IP Address” on page 212

“Set the Static Subnet Mask Address” on

page 212

“Set the Static Subnet Mask Address” on

page 212

Class Structure, Commands, and Examples - 207

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Wired Interface Command

Example

Set DNS Nameservers to Use Static IP Addresses (Dynamic to

Manual Mode)

See example below.

Set DNS Nameservers to Use DHCP IP Addressing (Manual to

Dynamic Mode)

See example below.

Get Summary View of Internal and Guest Interfaces

USR5453-AP# get bss

name

status radio beacon-interface mac

--------------------------------------------------------------------

wlan0bssInternal up

wlan0 wlan0

00:0C:41:16:DF:A6

wlan0bssGuest

down

wlan0 wlan0guest

Get the DNS Name

USR5453-AP# get host id

USR5453-AP

Set the DNS Name

USR5453-AP# set host id vicky-ap

bob# get host id

vicky-ap

Get Wired Internal Interface Settings

See “Get Current Settings for the Ethernet (Wired) Internal Interface” on page 200 under Status.

Get Wired Guest Interface Settings

See “Get Current Settings for the Ethernet (Wired) Guest Interface” on page 201 under Status.

Set Up Guest Access

Before configuring this feature, make sure you are familiar with the names of the interfaces as

described in “Understanding Interfaces as Presented in the CLI” on page 190. The interface name you

reference in a command determines whether a setting applies to a wired or wireless interface or to the

Internal or Guest network.

Configuring a Guest interface from the CLI is a complex task. Unless this is your area of expertise, you

may find it easier to use the Web User Interface to set up Guest Access. For information on how to set up

Guest Access from the Web User Interface, see “Ethernet (Wired) Settings” on page 89 and “Guest Login”

on page 121.

Before configuring guest or internal interface settings, make sure you are familiar the names of the

Class Structure, Commands, and Examples - 208

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

interfaces as described in “Understanding Interfaces as Presented in the CLI” on page 190.

After you configure the Guest Network (as described in the sections below), you can enable a "captive

portal" Welcome page for guest clients who are using the Web over your Guest network. You can mod-

ify the Welcome page text that is displayed to guests when they log on to the Web. For more informa-

tion, see “Enable/Configure Guest Login Welcome Page” on page 228.

The following Guest Access configuration examples are provided:

•

Enable / Configure Guest Access on VLANs

Disable Guest Access on VLANs

Change VLAN IDs (VLANs Must Be Enabled Already)

Enable / Configure Guest Access on VLANs

•

You cannot use an ssh or telnet connection to configure VLANs, because you will lose network

connectivity to the access point when you remove the bridge-port. Therefore, you cannot configure

VLANs through the CLI.

•

Be sure to verify that the switch and DHCP server you are using can support VLANs per the

802.1Q standard. After configuring the VLAN on the Advanced menu’s Ethernet (Wired) Settings

page, physically reconnect the Ethernet cable on the switch to the tagged packet (VLAN) port.

Then, re-connect via the Web User Interface to the new IP address. (If necessary, check with the

infrastructure support administrator regarding the VLAN and DHCP configurations.)

This example assumes you start with Guest Access "disabled" and provides commands to enable it on

VLANs.

1. Get the current status of Guest Access (it is "down" or disabled initially):

USR5453-AP# get interface brguest status

down

2. Enable Guest and remove bridge-port:

USR5453-AP# set bss wlan0bssGuest status up

USR5453-AP# set bss wlan1bssGuest status up

USR5453-AP# set interface brguest status up

USR5453-AP# set portal status up

USR5453-AP# remove bridge-port br0 interface eth0

3. Enable VLANs:

USR5453-AP# add interface vlan1111 type vlan status up vlan-id 1111 vlan-interface

eth0

USR5453-AP# add bridge-port br0 interface vlan1111

USR5453-AP# add interface vlan2222 type vlan status up vlan-id 2222 vlan-interface

eth0

USR5453-AP# add bridge-port brguest interface vlan2222

4. Check the current settings:

USR5453-AP# get bss

Class Structure, Commands, and Examples - 209

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

name

status radio beacon-interface mac

--------------------------------------------------------------------

wlan0bssInternal up

wlan0bssGuest up

wlan0 wlan0

wlan0 wlan0guest

00:01:02:03:04:01

00:01:02:03:04:02

USR5453-AP# get interface brguest

Field Value

-------------------------

type

bridge

status up

mac

mask

00:01:02:03:04:02

10.10.56.248

255.255.255.0

Disable Guest Access on VLANs

This example assumes you start with Guest Access "enabled" on VLANs and provides commands to

disable it.

1. Get the current status of Guest Access (it is "up" or enabled initially):

USR5453-AP# get interface brguest status

The output for the following commands show that VLANs are configured for the Internal and Guest

interfaces (because both interfaces are VLANs: "brguest" is vlan2222and "br0" is vlan1111):

USR5453-AP# get bridge-port brguest

Name

Interface

-------------------

brguest wlan0

brguest vlan2222

USR5453-AP# get bridge-port br0

Name Interface

---------------

br0 wlan0guest

br0 vlan1111

2. The following series of commands reconfigures the Internal interface to use an Ethernet port (by

setting br0to eth0), disables Guest Access, and removes the two VLANs.

USR5453-AP# add bridge-port br0 interface eth0

USR5453-AP# set bss wlan0bssGuest status down

USR5453-AP# set bss wlan1bssGuest status down

USR5453-AP# remove bridge-port br0 interface vlan1111

USR5453-AP# remove interface vlan1111

USR5453-AP# remove bridge-port brguest interface vlan2222

USR5453-AP# remove interface vlan2222

USR5453-AP# set interface brguest status down

USR5453-AP# set portal status down

Class Structure, Commands, and Examples - 210

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Change VLAN IDs (VLANs Must Be Enabled Already)

1. Check the current configuration of Wired interfaces.

The output of the following command shows that the Guest interface is already configured on VLANs:

USR5453-AP# get bridge-port br0

Name Interface

---------------

br0 wlan0guest

br0 vlan1111

2. Set up a new VLAN and remove the old one:

USR5453-AP# set interface vlan1111 vlan-id 1112

Error: vlan-id cannot be changed after insert.

USR5453-AP# remove bridge-port br0 interface vlan111

USR5453-AP# remove interface vlan1111

USR5453-AP# add interface vlan1113 type vlan status up vlan-id 1113 vlan-interface

eth0

Get/Change the Connection Type (DHCP or Static IP)

For more information on DHCP and Static IP connection types, see the topic ““Understanding Dynamic

and Static IP Addressing on the Professional Access Point” on page 20.

To get the connection type:

USR5453-AP# get dhcp-client status

You cannot use the CLI to reset the connection type from DHCP to Static IP because you will lose

connectivity during the process of assigning a new static IP address. To make such a change, use the Web

User Interface on a computer connected to the access point with an Ethernet cable.

To reset the connection type from Static IP to DHCP:

USR5453-AP# set dhcp-client status up

To view the new settings:

USR5453-AP# get interface br0 detail

Field

Value

-----------------------------------

type

bridge

status

description

mac

mask

static-ip

static-mask

nat

Bridge - Internal

00:E0:B8:76:23:B4

10.10.12.221

255.255.255.0

10.10.12.221

255.255.255.0

Class Structure, Commands, and Examples - 211

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Re-Configure Static IP Addressing Values

This section assumes you have already set the access point to use Static IP Addressing and set some

initial values as described in “Get/Change the Connection Type (DHCP or Static IP)” on page 211.

If you are using static IP addressing on the access point (instead of DHCP), you may want to reconfigure

the static IP address, subnet mask, default gateway, or DNS name servers.

The following examples show how to change these values from the CLI. With the exception of DNS name

servers, these values can only be reconfigured if you are using Static IP Addressing mode.

You do have the option of manually configuring DNS name servers for either a DHCP or Static IP

connection type, so that task is covered in a separate section following this one.

Set the Static IP Address

1. Check to see what the current static IP address is. (In this example, the current static IP address is the

factory default.)

USR5453-AP# get interface br0 static-ip

10.10.12.221

2. Re-set to a new static IP address:

USR5453-AP# set interface br0 static-ip 10.10.12.81

Set the Static Subnet Mask Address

1. Check to see the current Subnet Mask. (In this example, the current subnet mask is the factory

default.)

USR5453-AP# get interface br0 static-mask

255.255.255.0

2. Re-set to a new static Subnet Mask:

USR5453-AP# set interface br0 static-mask 255.255.255.128

Set the IP Address for the Default Gateway

This example sets the Default Gateway to 10.10.12.126:

USR5453-AP# set ip-route with gateway 10.10.12.126 in-use yes

Set DNS Nameservers to Use Static IP Addresses (Dynamic to Manual Mode)

This example shows how to reconfigure DNS Nameservers from Dynamic mode (where name server IP

addresses are assigned through DHCP) to Manual mode, and specify static IP addresses for them.

1. Check to see which mode the DNS Name Service is running in. (In this example, DNS naming is

running in DHCP mode initially because the following command returns upfor the mode.)

USR5453-AP# get host dns-via-dhcp

Class Structure, Commands, and Examples - 212

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

2. Turn off Dynamic DNS Nameservers and re-check the settings:

USR5453-AP# set host dns-via-dhcp down

USR5453-AP# get host dns-via-dhcp

down

3. Get the current IP addresses for the DNS Nameservers:

USR5453-AP# get host static-dns-1

10.10.3.9

USR5453-AP# get host static-dns-2

10.10.3.11

4. Re-set the IP addresses for the DNS Nameservers as desired:

USR5453-AP# set host static-dns-1 10.10.3.10

USR5453-AP# get host static-dns-1

10.10.3.10

USR5453-AP# set host static-dns-2 10.10.3.12

USR5453-AP# get host static-dns-2

10.10.3.12

Set DNS Nameservers to Use DHCP IP Addressing (Manual to Dynamic Mode)

To switch DNS Nameservers from Manual (static IP addresses) to Dynamic mode (nameserver addresses

assigned by DHCP), use the reverse command and check to see the new configuration:

USR5453-AP# set host dns-via-dhcp up

USR5453-AP# get host dns-via-dhcp

Wireless Interface

To set up a wireless (radio) interface, configure the following on each interface (Internal or Guest) as

described in other sections of this CLI document.

•

Configure the Radio Mode and Radio Channel as described in “Configure Radio Settings” on

page 232.

Configure the Network Name as described in “Set the Wireless Network Name (SSID)” on page 195.

Security

Before configuring this feature, make sure you are familiar with the names of the interfaces as

described in “Understanding Interfaces as Presented in the CLI” on page 190. The interface name you

reference in a command determines whether a setting applies to a wired or wireless interface or to the

Internal or Guest network.

The following sections show examples of how to use the CLI to view and configure security settings on the

Class Structure, Commands, and Examples - 213

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

access point. These settings correspond to those available in the Web User Interface on the Advanced

menu’s Security tab. For a detailed discussion of concepts and configuration options, see“Security” on

page 101.

This section focuses on configuring security on the Internal network. (Security on the Guest network

defaults to None. See “When to Use No Security” on page 102.)

This table shows a quick view of Security commands and links to detailed examples.

Security Command

Example

Get the Current Security Mode

get interface wlan0 security

get bss wlan0bssInternal detail

Get Detailed Description of Current Secu-

rity Settings

get interface wlan0 detail

Set the Broadcast SSID (Allow or Prohibit)

set bss wlan0bssInternal ignore-broadcast-ssid on

set bss wlan0bssInternal ignore-broadcast-ssid off

Enable / Disable Station Isolation

Set Security to None

set interface wlan0 security plain-text

Set Security to Static WEP

Set Security to IEEE 802.1x

See detailed example in “Set Security to Static WEP” on page 216.

See detailed example in“Set Security to IEEE 802.1x” on page 219.

Set Security to WPA/WPA2 Personal

(PSK)

See detailed example in “Set Security to WPA/WPA2 Personal (PSK)”

on page 221.

Set Security to WPA/WPA2 Enterprise

(RADIUS)

See detailed example in “Set Security to WPA/WPA2 Enterprise

(RADIUS)” on page 223.

Get the Current Security Mode

USR5453-AP# get interface wlan0 security

none

Get Detailed Description of Current Security Settings

USR5453-AP# get bss wlan0bssInternal detail

Field

Value

---------------------------------------------

status

description

radio

Internal

wlan0

beacon-interface

mac

wlan0

00:0C:41:16:DF:A6

dtim-period

max-stations

ignore-broadcast-ssid

mac-acl-mode

mac-acl-name

radius-accounting

off

deny-list

wlan0bssInternal

Class Structure, Commands, and Examples - 214

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

radius-ip

radius-key

127.0.0.1

secret

open-system-authentication

shared-key-authentication

wpa-cipher-tkip

wpa-cipher-ccmp

wpa-allowed

off

wpa2-allowed

rsn-preauthentication

Set the Broadcast SSID (Allow or Prohibit)

To set the Broadcast SSID to on (allow):

USR5453-AP# set bss wlan0bssInternal ignore-broadcast-ssid on

To set the Broadcast SSID to off (prohibit):

USR5453-AP# set bss wlan0bssInternal ignore-broadcast-ssid off

Enable / Disable Station Isolation

USR5453-AP# get radio wlan0 station-isolation

off

USR5453-AP# set radio wlan0 station-isolation off

USR5453-AP# get radio wlan0 detail

Field

Value

---------------------------------------------------------------

status

description

Radio 1 - IEEE 802.11g

mac

max-bss

channel-policy

mode

static

static-channel

channel

tx-power

tx-rx-status

100

beacon-interval

rts-threshold

fragmentation-threshold

load-balance-disassociation-utilization 0

100

2347

2346

load-balance-disassociation-stations

load-balance-no-association-utilization 0

ap-detection

station-isolation

frequency

off

2437

wme

Class Structure, Commands, and Examples - 215

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Set Security to None

USR5453-AP# set interface wlan0 security none

Set Security to Static WEP

2. Set the Transfer Key Index

3. Set the Key Length

4. Set the Key Type

5. Set the WEP Keys

6. Set the Authentication Algorithm

7. Get Current Security Settings After Re-Configuring to Static WEP Security Mode

1. Set the Security Mode

USR5453-AP# set interface wlan0 security static-wep

2. Set the Transfer Key Index

The following commands set the Transfer Key Index to 4.

USR5453-AP# set interface wlan0 wep-default-key 1

USR5453-AP# set interface wlan0 wep-default-key 2

USR5453-AP# set interface wlan0 wep-default-key 3

USR5453-AP# set interface wlan0 wep-default-key 4

3. Set the Key Length

For the CLI, valid values for Key Length are 40 bits or 104 bits.

The Key Length values used by the CLI do not include the initialisation vector in the length. On the

Web User Interface, longer Key Length values may be shown which include the 24-bit initialisation

vector. A Key Length of 40 bits (not including initialisation vector) is equivalent to a Key Length of 64

bits (with initialisation vector). A Key Length of 104 bits (not including initialisation vector) is equivalent

to a Key Length of 128 bits (which includes the initialisation vector).

To set the WEP Key Length, type one of the following commands:

To set the WEP Key Length to 40 bits:

To set the WEP Key Length to 104 bits:

set interface wlan0 wep-key-length 40

set interface wlan0 wep-key-length 104

In this example, you will set the WEP Key Length to 40.

USR5453-AP# set interface wlan0 wep-key-length 40

4. Set the Key Type

Valid values for Key Type are ASCII or Hex. The following commands set the Key Type.

To set the Key Type to ASCII:

To set the Key Type to Hex:

set interface wlan0 wep-key-ascii yes

set interface wlan0 wep-key-ascii no

Class Structure, Commands, and Examples - 216

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

In this example, you will set the Key Type to ASCII:

USR5453-AP# set interface wlan0 wep-key-ascii yes

5. Set the WEP Keys

The number of characters required for each WEP key depends on how you set Key Length and Key

Type:

•

If Key Length is 40 bits and the Key Type is "ASCII", then each WEP key be 5 characters long.

If Key Length is 40 bits and Key Type is "Hex", then each WEP key must be 10 characters long.

If Key Length is 104 bits and Key Type is "ASCII", then each WEP Key must be 13 characters

long.

•

If Key Length is 104 bits and Key Type is "Hex", then each WEP Key must be 26 characters long.

Although the CLI will allow you to enter WEP keys of any number of characters, you must use the cor-

rect number of characters for each key to ensure a valid security configuration.

USR5453-AP# set interface wlan0 wep-key-1 abcde

USR5453-AP# set interface wlan0 wep-key-2 fghi

USR5453-AP# set interface wlan0 wep-key-3 klmno

USR5453-AP# set interface wlan0 wep-key-4

6. Set the Authentication Algorithm

The options for the authentication algorithm are Open System, Shared Key or Both:

To set Authentication Algorithm

to Open System:

set bss wlan0bssInternal open-system-authentication on

set bss wlan0bssInternal shared-key-authentication off

set bss wlan0bssInternal open-system-authentication off

To set Authentication Algorithm

to Shared Key:

set bss wlan0bssInternal shared-key-authentication on

set bss wlan0bssInternal open-system-authentication on

To set Authentication Algorithm

to Both:

set bss wlan0bssInternal shared-key-authentication on

In this example, you will set the authentication algorithm to Shared Key:

USR5453-AP# set bss wlan0bssInternal shared-key-authentication on

USR5453-AP# set bss wlan0bssInternal open-system-authentication off

7. Get Current Security Settings After Re-Configuring to Static WEP Security Mode

Now you can use the "get" command again to view the updated security configuration and see the results

of your new settings.

The following command gets the security mode in use on the Internal network:

USR5453-AP# get interface wlan0 security

static-wep

The following command gets details on how the internal network is configured, including details on

Class Structure, Commands, and Examples - 217

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Security.

USR5453-AP# get bss wlan0bssInternal detail

Field Value

---------------------------------------------

status

description

radio

Internal

wlan0

beacon-interface

mac

wlan0

00:0C:41:16:DF:A6

dtim-period

max-stations

ignore-broadcast-ssid

mac-acl-mode

mac-acl-name

radius-accounting

radius-ip

2007

off

deny-list

wlan0bssInternal

off

127.0.0.1

secret

radius-key

open-system-authentication off

shared-key-authentication on

wpa-cipher-tkip

wpa-cipher-ccmp

wpa-allowed

wpa2-allowed

rsn-preauthentication

off

The following command gets details on the interface and shows the WEP Key settings, specifically.

USR5453-AP# get interface wlan0 detail

Field

Value

-------------------------------------------

type

status

service-set

description

mac

Wireless - Internal

00:0C:41:16:DF:A6

0.0.0.0

static-ip

static-mask

nat

0.0.0.0

rx-bytes

rx-packets

rx-errors

rx-drop

rx-fifo

rx-frame

rx-compressed

rx-multicast

tx-bytes

tx-packets

tx-errors

tx-drop

259662

722

tx-fifo

tx-colls

tx-carrier

Class Structure, Commands, and Examples - 218

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

tx-compressed

ssid

bss

Vicky’s AP

wlan0bssInternal

static-wep

security

wpa-personal-key

wep-key-ascii

wep-key-length

yes

104

wep-default-key 4

wep-key-1

wep-key-2

wep-key-3

wep-key-4

vlan-interface

vlan-id

abcde

fghij

klmno

radio

remote-mac

wep-key

Set Security to IEEE 802.1x

2. Set the Authentication Server

3. Set the RADIUS Key (For External RADIUS Server Only)

4. Enable RADIUS Accounting (External RADIUS Server Only)

5. Get Current Security Settings After Re-Configuring to IEEE 802.1x Security Mode

1. Set the Security Mode

USR5453-AP# set interface wlan0 security dot1x

2. Set the Authentication Server

You can use the built-in authentication server on the access point or an external RADIUS server.

To use the built-in authentication server, set the RADIUS IP address to that used by the built-in server

(127.0.0.1) and turn RADIUS accounting off (because it is not supported by the built-in server)

RADIUS Option

Example

To set the AP to use the Built-in

Authentication Server:

set bss wlan0bssInternal radius-ip 127.0.0.1

To set the AP to use an External

RADIUS Server:

set bss wlan0bssInternal radius-ip RADIUS_IP_Address

where RADIUS_IP_Addressis the IP address of an external RADIUS server.

In this example, you will set it to use the built-in server:

USR5453-AP# set bss wlan0bssInternal radius-ip 127.0.0.1

3. Set the RADIUS Key (For External RADIUS Server Only)

If you use an external RADIUS server, you must provide the RADIUS key. (If you use the built-in

Class Structure, Commands, and Examples - 219

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

authentication server the RADIUS key is automatically provided.)

This command sets the RADIUS key to secretfor an external RADIUS server.

USR5453-AP# set bss wlan0bssInternal radius-key secret

4. Enable RADIUS Accounting (External RADIUS Server Only)

You can enable RADIUS Accounting if you want to track and measure the resources a particular user has

consumed such system time, amount of data transmitted and received, and so on.

RADIUS accounting is not supported by the built-in server, so if you are using the built-in server make

sure that RADIUS accounting is off.

To enable RADIUS accounting:

To disable RADIUS accounting:

set bss wlan0bssInternal radius-accounting on

set bss wlan0bssInternal radius-accounting off

In this example, you will disable RADIUS accounting since you are using the built-in server:

USR5453-AP# set bss wlan0bssInternal radius-accounting off

5. Get Current Security Settings After Re-Configuring to IEEE 802.1x Security Mode

Now you can use the "get" command again to view the updated security configuration and see the results

of your new settings.

The following command gets the security mode in use on the Internal network:

USR5453-AP# get interface wlan0 security

dot1x

The following command gets details on how the internal BSS is configured, including details on Security.

USR5453-AP# get bss wlan0bssInternal detail

Field

Value

---------------------------------------------

status

description

radio

Internal

wlan0

beacon-interface

mac

wlan0

00:0C:41:16:DF:A6

dtim-period

max-stations

ignore-broadcast-ssid

mac-acl-mode

mac-acl-name

radius-accounting

radius-ip

2007

off

deny-list

wlan0bssInternal

off

127.0.0.1

secret

radius-key

open-system-authentication off

shared-key-authentication on

Class Structure, Commands, and Examples - 220

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

wpa-cipher-tkip

wpa-cipher-ccmp

wpa-allowed

wpa2-allowed

rsn-preauthentication

off

Set Security to WPA/WPA2 Personal (PSK)

4. Set the Pre-shared Key

2. Set the WPA Versions

3. Set the Cipher Suites

5. Get Current Security Settings After Re-Configuring to WPA/WPA2 Personal (PSK)

1. Set the Security Mode

USR5453-AP# set interface wlan0 security wpa-personal

2. Set the WPA Versions

Select the WPA version based on what types of client stations you want to support.

WPA Option

Example

WPA: If all client stations on the

network support the original

WPA but none support the

newer WPA2, then use WPA.

set bss wlan0bssInternal wpa-allowed on

set bss wlan0bssInternal wpa2-allowed off

To support WPA clients:

WPA2: If all client stations on the

network support WPA2, we

suggest using WPA2 which

provides the best security per

the IEEE 802.11i standard.

set bss wlan0bssInternal wpa-allowed off

set bss wlan0bssInternal wpa2-allowed on

To support WPA2 clients:

Both: If you have a mix of

clients, some of which support

WPA2 and others which

set bss wlan0bssInternal wpa-allowed on

set bss wlan0bssInternal wpa2-allowed on

support only the original WPA,

select "Both". This lets both

WPA and WPA2 client stations

assoicate and authenticate, but

uses the more robust WPA2 for

clients who support it. This

WPA configuration allows more

interoperability, at the expense

of some security.

To support both WPA and

WPA2 clients:

In this example, you will set the access point to support Both WPA and WPA2 client stations:

Class Structure, Commands, and Examples - 221

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

USR5453-AP# set bss wlan0bssInternal wpa-allowed on

USR5453-AP# set bss wlan0bssInternal wpa2-allowed on

3. Set the Cipher Suites

Set the cipher suite you want to use. The options are:

Cipher Suite Option

Example

TKIP: Temporal Key Integrity

Protocol (TKIP), which is the

default.

set bss wlan0bssInternal wpa-cipher-tkip on

set bss wlan0bssInternal wpa-cipher-ccmp off

To set the cipher suite to TKIP

only:

CCMP (AES) - Counter mode/

CBC-MAC Protocol (CCMP) is

an encryption method for IEEE

802.11i that uses the Advanced

Encryption Algorithm (AES).

set bss wlan0bssInternal wpa-cipher-tkip off

set bss wlan0bssInternal wpa-cipher-ccmp on

To set the cipher suite to CCMP

(AES) only:

Both - When the authentication

algorithm is set to "Both", both

TKIP and AES clients can asso-

ciate with the access point.

WPA clients must have either a

valid TKIP key or a valid CCMP

(AES) key to be able to associ-

ate with the AP.

set bss wlan0bssInternal wpa-cipher-tkip on

set bss wlan0bssInternal wpa-cipher-ccmp on

To set the cipher suite to Both:

In this example, you will set the cipher suite to Both:

USR5453-AP# set bss wlan0bssInternal wpa-cipher-tkip on

USR5453-AP# set bss wlan0bssInternal wpa-cipher-ccmp on

4. Set the Pre-shared Key

The Pre-shared Key is the shared secret key for WPA-PSK. Enter a string of at least 8 characters to a

maximum of 63 characters. Following are two examples; the first sets the key to "SeCret !", the second

sets the key to "KeepSecret".

Ex 1. USR5453-AP# set interface wlan0 wpa-personal-key "SeCret !"

Ex 2. USR5453-AP# set interface wlan0 wpa-personal-key KeepSecret

Class Structure, Commands, and Examples - 222

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Shared secret keys can include spaces and special characters if the key is placed inside quotation

marks as in the first example above. If the key is a string of characters with no spaces or special char-

acters in it, the quotation marks are not necessary as in the second example above..

5. Get Current Security Settings After Re-Configuring to WPA/WPA2 Personal (PSK)

Now you can use the "get" command again to view the updated security configuration and see the results

of your new settings.

The following command gets the security mode in use on the Internal network:

USR5453-AP# get interface wlan0 security

wpa-personal

The following command gets details on how the internal network is configured, including details on

Security.

USR5453-AP# get bss wlan0bssInternal detail

Field

Value

---------------------------------------------

status

description

radio

Internal

wlan0

beacon-interface

mac

wlan0

00:0C:41:16:DF:A6

dtim-period

max-stations

ignore-broadcast-ssid

mac-acl-mode

mac-acl-name

off

deny-list

wlan0bssInternal

radius-accounting

radius-ip

radius-key

127.0.0.1

secret

open-system-authentication

shared-key-authentication

wpa-cipher-tkip

wpa-cipher-ccmp

wpa-allowed

wpa2-allowed

rsn-preauthentication

Set Security to WPA/WPA2 Enterprise (RADIUS)

3. Enable Pre-Authentication

2. Set the WPA Versions

4. Set the Cipher Suites

5. Set the Authentication Server

6. Set the RADIUS Key (For External RADIUS Server Only)

7. Enable RADIUS Accounting (External RADIUS Server Only))

8. Get Current Security Settings After Re-Configuring to WPA/WPA2 Enterprise (RADIUS)

Class Structure, Commands, and Examples - 223

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

8. Get Current Security Settings After Re-Configuring to WPA/WPA2 Enterprise (RADIUS)

1. Set the Security Mode

USR5453-AP# set interface wlan0 security wpa-enterprise

2. Set the WPA Versions

Select the WPA version based on what types of client stations you want to support.

WPA Option

Example

WPA: If all client stations on the

network support the original

WPA but none support the

newer WPA2, then use WPA.

set bss wlan0bssInternal wpa-allowed on

set bss wlan0bssInternal wpa2-allowed off

To support WPA clients:

WPA2: If all client stations on the

network support WPA2, we

suggest using WPA2 which

provides the best security per

the IEEE 802.11i standard.

set bss wlan0bssInternal wpa-allowed off

set bss wlan0bssInternal wpa2-allowed on

To support WPA2 clients:

Both: If you have a mix of

clients, some of which support

WPA2 and others which

set bss wlan0bssInternal wpa-allowed on

set bss wlan0bssInternal wpa2-allowed on

support only the original WPA,

select "Both". This lets both

WPA and WPA2 client stations

assoicate and authenticate, but

uses the more robust WPA2 for

clients who support it. This

WPA configuration allows more

interoperability, at the expense

of some security.

To support both WPA and

WPA2 clients:

In this example, you will set the access point to support WPA client stations only:

USR5453-AP# set bss wlan0bssInternal wpa-allowed on

USR5453-AP# set bss wlan0bssInternal wpa2-allowed off

Class Structure, Commands, and Examples - 224

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

3. Enable Pre-Authentication

If you set WPA versions to "WPA2" or "Both", you can enable pre-authentication for WPA2 clients.

Enable pre-authentication if you want

WPA2 wireless clients to send pre-authen-

tication packet. The pre-authentication

information will be relayed from the

access point the client is currently using to

the target access point. Enabling this fea-

ture can help speed up authentication for

roaming clients who connect to multiple

access points.

set bss wlan0bssInternal rsn-preauthentication on

To enable pre-authentication for WPA2 cli-

ents:

To disable pre-authentication for WPA2 cli- set bss wlan0bssInternal rsn-preauthentication on

ents:

This option does not apply if you set the WPA Version to support "WPA" clients only because the original

WPA does not support this pre-authentication

In this example, you will disable pre-authentication.

USR5453-AP# set bss wlan0bssInternal rsn-preauthentication off

4. Set the Cipher Suites

Set the cipher suite you want to use. The options are:

Cipher Suite Option

Example

TKIP: Temporal Key Integrity

Protocol (TKIP), which is the

default.

set bss wlan0bssInternal wpa-cipher-tkip on

set bss wlan0bssInternal wpa-cipher-ccmp off

To set the cipher suite to TKIP

only:

CCMP (AES) - Counter mode/

CBC-MAC Protocol (CCMP) is

an encryption method for IEEE

802.11i that uses the Advanced

Encryption Algorithm (AES).

set bss wlan0bssInternal wpa-cipher-tkip off

set bss wlan0bssInternal wpa-cipher-ccmp on

To set the cipher suite to CCMP

(AES) only:

Class Structure, Commands, and Examples - 225

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Cipher Suite Option

Example

Both - When the authentication

algorithm is set to "Both", both

TKIP and AES clients can asso-

ciate with the access point.

WPA clients must have either a

valid TKIP key or a valid CCMP

(AES) key to be able to associ-

ate with the AP.

set bss wlan0bssInternal wpa-cipher-tkip on

set bss wlan0bssInternal wpa-cipher-ccmp on

To set the cipher suite to Both:

In this example, you will set the cipher suite to TKIP Only:

USR5453-AP# set bss wlan0bssInternal wpa-cipher-tkip on

USR5453-AP# set bss wlan0bssInternal wpa-cipher-ccmp off

5. Set the Authentication Server

You can use the built-in authentication server on the access point or an external RADIUS server.

To use the built-in authentication server, set the RADIUS IP address to that used by the built-in server

(127.0.0.1) and turn RADIUS accounting off (because it is not supported by the built-in server)

RADIUS Option

Example

To set the AP to use the Built-in

Authentication Server:

set bss wlan0bssInternal radius-ip 127.0.0.1

To set the AP to use an External

RADIUS Server:

set bss wlan0bssInternal radius-ip RADIUS_IP_Address

where RADIUS_IP_Addressis the IP address of an external RADIUS server.

In this example, you will use an external RADIUS server with an IP address of 142.77.1.1:

USR5453-AP# set bss wlan0bssInternal radius-ip 142.77.1.1

6. Set the RADIUS Key (For External RADIUS Server Only)

If you use an external RADIUS server, you must provide the RADIUS key. (If you use the built-in

authentication server the RADIUS key is automatically provided.)

This command sets the RADIUS key to KeepSecretfor an external RADIUS server.

USR5453-AP# set bss wlan0bssInternal radius-key KeepSecret

7. Enable RADIUS Accounting (External RADIUS Server Only)

You can enable RADIUS Accounting if you want to track and measure the resources a particular user has

Class Structure, Commands, and Examples - 226

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

consumed such system time, amount of data transmitted and received, and so on.

RADIUS accounting is not supported by the built-in server, so if you are using the built-in server make

sure that RADIUS accounting is off.

To enable RADIUS accounting:

To disable RADIUS accounting:

set bss wlan0bssInternal radius-accounting on

set bss wlan0bssInternal radius-accounting off

For this example, you will enable RADIUS accounting for your external RADIUS server:

USR5453-AP# set bss wlan0bssInternal radius-accounting on

8. Get Current Security Settings After Re-Configuring to WPA/WPA2 Enterprise (RADIUS)

Now you can use the "get" command again to view the updated security configuration and see the results

of your new settings.

The following command gets the security mode in use on the Internal network:

USR5453-AP# get interface wlan0 security

wpa-enterprise

The following command gets details on how the internal network is configured, including details on

Security.

USR5453-AP# get bss wlan0bssInternal detail

Field

Value

---------------------------------------------

status

description

radio

Internal

wlan0

beacon-interface

mac

wlan0

00:0C:41:16:DF:A6

dtim-period

max-stations

ignore-broadcast-ssid

mac-acl-mode

mac-acl-name

radius-accounting

radius-ip

2007

off

deny-list

wlan0bssInternal

142.77.1.1

KeepSecret

radius-key

open-system-authentication on

shared-key-authentication off

wpa-cipher-tkip

wpa-cipher-ccmp

wpa-allowed

off

wpa2-allowed

rsn-preauthentication

off

Class Structure, Commands, and Examples - 227

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Enable/Configure Guest Login Welcome Page

Guest Welcome Option

Example

View Guest Login Settings:

get portal

Enable/Disable the Guest

Welcome Page

set portal status

Set Guest Welcome Page

Textl:

set portal welcome-screen-text "Welcome Screen Text"

Where "Welcome Screen Text" is the content of the Welcome message you

want displayed on the Guest Welcome Web Page. The Welcome message must

be in quotes if it contains spaces, punctuation, and special characters."

Guest Login settings are only relevant if you have first configured a Guest Network. For information

about configuring a Guest Network, see “Set Up Guest Access” on page 208.

You can set up a "captive portal" that Guest clients will see when they log on to the Guest network. or

modify the Welcome screen guest clients see when they open a Web browser or try to browse the Web.

View Guest Login Settings

To view the current settings for Guest Login:

USR5453-AP# get portal

Field

Value

---------------------------------------------------------------------------

status

welcome-screen

down

welcome-screen-text Thank you for using wireless Guest Access as provided

by this U.S. Robotics Corporation wireless AP. Upon clicking "Accept", you

will gain access to our wireless guest network. This network allows complete

access to the Internet but is external to the corporate network. Please note

that this network is not configured to provide any level of wireless

security.

Enable/Disable the Guest Welcome Page

To enable the Guest welcome page:

USR5453-AP# set portal status up

To disable the Guest welcome page:

USR5453-AP# set portal status down

Set Guest Welcome Page Text

To specify the text for the Guest welcome page:

USR5453-AP# set portal welcome-screen-text "Welcome to the Stephens Network"

Class Structure, Commands, and Examples - 228

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Review Guest Login Settings

The following example shows the results of the "set portal" command after specifying some new

settings:

USR5453-AP# get portal

Field

Value

-----------------------------------------------------

status

welcome-screen

welcome-screen-text Welcome to the Stephens Network

Configuring Multiple BSSIDs on Virtual Wireless Networks

Before configuring this feature, make sure you are familiar with the names of the interfaces as

described in “Understanding Interfaces as Presented in the CLI” on page 190. The interface name you

reference in a command determines whether a setting applies to a wired or wireless interface or to the

Internal or Guest network,.

Configuring Virtual Wireless Network "One" on Radio One

1. Configure these settings from the Web User Interface first:

•

On Advanced menu’s Ethernet (Wired) Settings tab on the Web User Interface, enable Virtual

Wireless Networks as described in “Enabling and Disabling Virtual Wireless Networks on the

Access Point” on page 92.

On Advanced menu’s Virtual Wireless Networks tab on the Web User Interface, provide a VLAN ID

as described in “Configuring VLANs” on page 126.

2. Use the CLI to configure Security on the interface.

The following example shows commands for configuring WPA/WPA2 Enterprise (RADIUS) security

mode, allowing "Both" WPA and WPA2 clients to authenticate and using a TKIP cipher suite:

USR5453-AP# set bss wlan0bssvwn1 open-system-authentication on

USR5453-AP# set bss wlan0bssvwn1 shared-key-authentication on

USR5453-AP# set bss wlan0bssvwn1 wpa-allowed on

USR5453-AP# set bss wlan0bssvwn1 wpa2-allowed on

USR5453-AP# set bss wlan0bssvwn1 wpa-cipher-tkip on

USR5453-AP# set bss wlan0bssvwn1 wpa-cipher-ccmp off

USR5453-AP# set bss wlan0bssvwn1 radius-ip 127.0.0.1

USR5453-AP# set bss wlan0bssvwn1 radius-key secret

USR5453-AP# set bss wlan0bssvwn1 status up

USR5453-AP# set interface wlan0vwn1 security wpa-enterprise

3. Use the CLI to set the Network Name (SSID) for the new Virtual Wireless Network:

USR5453-AP# set interface wlan0vwn1 ssid my-vwn-one

Class Structure, Commands, and Examples - 229

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Creating VWN 'Two' on Radio One with WPA security

To configure the second Virtual Wireless Network, repeat steps 1-3 as described above (in Configuring

Virtual Wireless Network "One" on Radio One) with the following differences:

•

Create a second VLAN ID from the Web User Interface with a new SSID

In the CLI commands, replace wlan0bssvwn1with wlan0bssvwn2

Radio Settings

Before configuring this feature, make sure you are familiar with the names of the interfaces as

described in “Understanding Interfaces as Presented in the CLI” on page 190. The interface name you

reference in a command determines whether a setting applies to a wired or wireless interface or to the

Internal or Guest network.

This table shows a quick view of Radio Settings commands and provides links to detailed examples.

Radio Setting Command

Example

Get Radio Settings

get radio

get radio wlan0

get radio wlan0 detail

Get IEEE 802.11 Radio Mode

Get Radio Channel

get radio wlan0 mode

get radio wlan0 channel

get radio wlan0

Get Basic Radio Settings

Get All Radio Settings

Get Supported Rate Set

Get Basic Rate Set

get radio wlan0 detail

get supported-rate

get basic-rate

Configure Radio Settings

See detailed examples in:

“1. Turn the Radio On or Off” on page 233

“2. Set the Radio Mode” on page 233

“3. Enable or Disable Super G” on page 233

“4. Set the Beacon Interval” on page 233

“5. Set the DTIM Period” on page 233

“6. Set the Fragmentation Threshold” on page 233

“7. Set the RTS Threshold” on page 234

“8. Configure Basic and Supported Rate Sets” on page 234

Get IEEE 802.11 Radio Mode

To get the current setting for radio Mode:

USR5453-AP# get radio wlan0 mode

Class Structure, Commands, and Examples - 230

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

(The radio in this example is using IEEE 802.11g mode.)

Get Radio Channel

To get the current setting for radio Channel:

USR5453-AP# get radio wlan0 channel

(The radio in this example is on Channel 6.)

Get Basic Radio Settings

To get basic current Radio settings:

USR5453-AP# get radio wlan0

Field

Value

----------------------

status

mac

channel-policy static

mode

static-channel 6

channel

tx-rx-status

Get All Radio Settings

To get all current Radio settings: get radio wlan0 detail

USR5453-AP# get radio wlan0 detail

Field

Value

----------------------------------------------------

status

description

mac

IEEE 802.11

max-bss

channel-policy

mode

static

static-channel

channel

tx-power

100

2347

2346

tx-rx-status

beacon-interval

rts-threshold

fragmentation-threshold

load-balance-disassociation-utilization 0

load-balance-disassociation-stations

load-balance-no-association-utilization 0

ap-detection

station-isolation

frequency

off

2437

Class Structure, Commands, and Examples - 231

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

wme

Get Supported Rate Set

The Supported Rate Set is what the access point supports. The access point will automatically choose the

most efficient rate based on factors like error rates and distance of client stations from the access point.

USR5453-AP# get supported-rate

name rate

-----------

wlan0 54

wlan0 48

wlan0 36

wlan0 24

wlan0 18

wlan0 12

wlan0 11

wlan0 9

wlan0 6

wlan0 5.5

wlan0 2

wlan0 1

Get Basic Rate Set

The Basic Rate Set is what the access point will advertise to the network for the purposes of setting up

communication with other APs and client stations on the network. It is generally more efficient to have an

access point broadcast a subset of its supported rate sets.

USR5453-AP# get basic-rate

name rate

-----------

wlan0 11

wlan0 5.5

wlan0 2

wlan0 1

Configure Radio Settings

To get a list of all fields you can set on the access point radio, type the following at the CLI prompt: set

radio wlan0 [SpaceKey] [TAB] [TAB]

1. Turn the Radio On or Off

2. Set the Radio Mode

3. Enable or Disable Super G

4. Set the Beacon Interval

5. Set the DTIM Period

6. Set the Fragmentation Threshold

7. Set the RTS Threshold

8. Configure Basic and Supported Rate Sets

Class Structure, Commands, and Examples - 232

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

1. Turn the Radio On or Off

To turn the radio on:

set radio wlan0 status up

set radio wlan0 status down

To turn the radio off:

2. Set the Radio Mode

Valid values depend on the capabilities of the radio. Possible values and how you would use the CLI to set

each one are shown below.

IEEE 802.11b

IEEE 802.11g

set radio wlan0 mode

The following command sets the Wireless Mode to IEEE 802.11g:

USR5453-AP# set radio wlan0 mode g

3. Enable or Disable Super G

You cannot enable/disable Super G from the CLI. You must set this from the Web User Interface. For

information on how to set this option, please see the field description for this option in “Configuring Radio

Settings” on page 130.

4. Set the Beacon Interval

The following command sets the beacon interval to 80.

USR5453-AP# set radio wlan0 beacon-interval 80

5. Set the DTIM Period

The Delivery Traffic Information Map (DTIM) period indicates how often wireless clients should check to

see if they have buffered data on the access point awaiting pickup. The measurement is in beacons.

Specify a DTIM period within a range of 1 - 255 beacons. For example, if you set this to "1" clients will

check for buffered data on the access point at every beacon. If you set this to "2", clients will check on

every other beacon.

The following command sets the DTIM interval to 3.

USR5453-AP# set bss wlan0bssInternal dtim-period 3

To get the updated value for DTIM interval after you have changed it:

USR5453-AP# get bss wlan0bssInternal dtim-period

6. Set the Fragmentation Threshold

You can specify a fragmentation threshold as a number between 256 and 2,346 to set the frame size

threshold in bytes. The fragmentation threshold is a way of limiting the size of packets (frames) transmitted

over the network. If a packet exceeds the fragmentation threshold set here, the fragmentation function will

be activated and the packet will be sent as multiple 802.11 frames. If the packet being transmitted is equal

to or less than the threshold, fragmentation will not be used. Setting the threshold to the largest value

Class Structure, Commands, and Examples - 233

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

(2,346 bytes) effectively disables fragmentation.

The following command sets the fragmentation threshold to 2000.

USR5453-AP# set radio wlan0 fragmentation-threshold 2000

7. Set the RTS Threshold

You can specify an RTS Threshold value between 0 and 2347. The RTS threshold specifies the packet

size of a request to send (RTS) transmission. This helps control traffic flow through the access point,

especially one with a lot of clients.

The following command sets the RTS threshold at

USR5453-AP# set radio wlan0 rts-threshold 2346

8. Configure Basic and Supported Rate Sets

Add a basic rate set

add basic-rate WirelessInterface rate SomeRate

For example:

add basic-rate wlan0 rate 48

Get current basic rates

Add supported rate

get basic-rate

add supported-rate WirelessInterfaceName rate SomeRate

For example:

add supported-rate wlan0 rate 9

Get current supported rates

get supported-rate wlan0

The following command adds "48" as a basic rate to wlan0(the internal, wireless interface):

USR5453-AP# add basic-rate wlan0 rate 48

To get the basic rates currently configured for this access point:

USR5453-AP# get basic-rate

name rate

-----------

wlan0 11

wlan0 5.5

wlan0 2

wlan0 1

wlan1 24

wlan1 12

wlan1 6

wlan0 48

The following command adds "9" as a supported rate to wlan0(the internal, wireless interface):

USR5453-AP# add supported-rate wlan0 rate 9

To get the supported rates currently configured for this access point (using "wlan0" as the interface for this

example):

Class Structure, Commands, and Examples - 234

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

USR5453-AP# get supported-rate wlan0

rate

----

5.5

You can use the "get" command to view current rate sets from the CLI as described in “Get Supported

Rate Set” on page 232 and “Get Basic Rate Set” on page 232. However, cannot reconfigure Sup-

ported Rate Sets or Basic Rate Sets from the CLI. You must use the Advanced menu’s Radio page on

the Web User Interface to configure this feature.

MAC Filtering

Before configuring this feature, make sure you are familiar with the names of the interfaces as

described in “Understanding Interfaces as Presented in the CLI” on page 190. The interface name you

reference in a command determines whether a setting applies to a wired or wireless interface or to the

Internal or Guest network.

You can control access to Professional Access Point based on Media Access Control (MAC) addresses.

Based on how you set the filter, you can allow access by only client stations with a listed MAC address or

deny access by the stations listed.

The Professional Access Point maintains up to five MAC address lists to use as filters. One is the default

list, which is used by the Web User Interface. The other four are specific to the access point’s wireless

network interfaces.

•

Default MAC Address List

The default MAC address list is named "default". MAC filtering in the Web User Interface maintains

addresses in the default list.

•

Interface-Specific MAC Address Lists

Through the CLI, you can maintain a MAC address list for each of the Professional Access Point’s

wireless interfaces. Unless you initiate an interface’s list with the "set" command, the interface uses the

list named "default".

Specify an Accept or Deny List

Add MAC Addresses of Client Stations to the Filtering List

Remove MAC Address of a Client Station from the Filtering List

Get Current MAC Filtering Settings

Class Structure, Commands, and Examples - 235

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Specify an Accept or Deny List

To set up MAC filtering, you first need to specify which type of list you want to configure, and assign a

name to the list.

To set up an Accept list:

set bss interface mac-acl-mode accept-list

set bss interface mac-acl-name list_name

With this type of list, client stations whose

MAC addresses are listed will be allowed

access to the access point.

Where interface is the wireless network interface for which you want

to define a MAC filtering list, and list_name is a name that you choose

for the list. Valid values for interface are as follows:

• wlan0bssInternal

• wlan0bssGuest

• wlan0bssVWN1

• wlan0bssVWN2

Example:

set bss wlan0bssGuest mac-acl-mode accept-list

set bss wlan0bssGuest mac-acl-name Guest

To set up a Deny list:

set bss interface mac-acl-mode deny-list

set bss interface mac-acl-name list_name

With this type of list, client stations whose

MAC addresses are listed will be denied

access to the access point.

Where interface is the wireless network interface for which you want

to define a MAC filtering list, and list_name is a name that you choose

for the list. Valid values for interface are as follows:

• wlan0bssInternal

• wlan0bssGuest

• wlan0bssVWN1

• wlan0bssVWN2

Example:

set bss wlan0bssInternal mac-acl-mode deny-list

set bss wlan0bssInternal mac-acl-name Internal

Add MAC Addresses of Client Stations to the Filtering List

To add a MAC address to the list:

add mac-acl list_name mac MAC_Address_Of_Client

Where list_name is the name of a MAC filtering list and MAC_Address_Of_Clientis the MAC address of

the wireless client that you want to add to the MAC filtering list.

For example, to add 4 new clients to the list named Internal:

Class Structure, Commands, and Examples - 236

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

USR5453-AP# add mac-acl Internal mac 00:01:02:03:04:05

USR5453-AP# add mac-acl Internal mac 00:01:02:03:04:06

USR5453-AP# add mac-acl Internal mac 00:01:02:03:04:07

USR5453-AP# add mac-acl Internal mac 00:01:02:03:04:08

Remove MAC Address of a Client Station from the Filtering List

To remove a MAC address from the list:

remove mac-acl list_name mac MAC_Address_Of_Client

Where list_name is the name of a MAC filtering list and MAC_Address_Of_Clientis the MAC address of

a wireless client that you want to remove from the MAC filtering list.

For example:

USR5453-AP# remove mac-acl Guest mac 00:01:02:03:04:04

Get Current MAC Filtering Settings

Mode (Accept or Deny)

The following command shows which type of MAC filtering list is currently configured:

get bss interface mac-acl-mode

Where interface is the wireless network interface for which you want to see the MAC filtering list type.

For example:

USR5453-AP# get bss wlan0bssGuest mac-acl-mode

accept-list

Client List

The following command shows the clients on the MAC filtering list:

USR5453-AP# get mac-acl

name

mac

-----------------------------------

wlan0bssInternal 00:01:02:03:04:05

wlan0bssInternal 00:01:02:03:04:06

wlan0bssInternal 00:01:02:03:04:07

wlan0bssInternal 00:01:02:03:04:08

Class Structure, Commands, and Examples - 237

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Load Balancing

Before configuring this feature, make sure you are familiar with the names of the interfaces as

described in “Understanding Interfaces as Presented in the CLI” on page 190. The interface name you

reference in a command determines whether a setting applies to a wired or wireless interface or to the

Internal or Guest network.

Load balancing parameters affect the distribution of wireless client connections across multiple access

points. Using load balancing, you can prevent scenarios where a single access point in your network

shows performance degradation because it is handling a disproportionate share of the wireless traffic. (For

an overview of Load Balancing, see “Load Balancing” on page 139.)

The access point provides default settings for load balancing.

The following command examples reconfigure some load balancing settings and get details on the

configuration:

USR5453-AP# set radio wlan0 load-balance-disassociation-stations 2

USR5453-AP# get radio wlan0 load-balance-disassociation-stations

USR5453-AP# set radio wlan0 load-balance-disassociation-utilization 25

USR5453-AP#

USR5453-AP# get radio wlan0 load-balance-disassociation-utilization

USR5453-AP# set radio wlan0 load-balance-no-association-utilization 50

USR5453-AP#

USR5453-AP# get radio wlan0 load-balance-no-association-utilization

Quality of Service

Before configuring this feature from the CLI, make sure you are familiar with the names of the inter-

faces as described in “Understanding Interfaces as Presented in the CLI” on page 190 The interface

name referenced in a command determines if a setting applies to a wired or wireless interface or to the

Internal or Guest network.

Quality of Service (QoS) provides you with the ability to specify parameters on multiple queues for

increased throughput and better performance of differentiated wireless traffic like Voice-over-IP (VoIP),

other types of audio, video, and streaming media as well as traditional IP data over the Professional

Access Point.

For a complete conceptual overview of QoS, see“Quality of Service” on page 143.

This table shows a quick view of QOS commands and provides links to detailed examples.

QoS Command

Example

Enable/Disable Wi-Fi Multimedia

set radio wlan0 wme off

set radio wlan0 wme on

get radio wlan0 wme

Class Structure, Commands, and Examples - 238

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

QoS Command

Example

About Access Point and Station EDCA

Parameters

See “About Access Point and Station EDCA Parameters” on

page 240.

Understanding the Queues for Access

Point and Station

See “Understanding the Queues for Access Point and Station” on

page 240.

Distinguishing between Access Point and

Station Settings in QoS Commands

See ““Distinguishing between Access Point and Station Settings in

QoS Commands” on page 240.

Get QoS Settings on the Access Point

Get QoS Settings on the Client Station

Set Arbirtation Interframe Spaces (AIFS)

get tx-queue

get wme-queue

On the access point:

set wme-queue wlan0 with queue Queue_Name to

aifs AIFS_Value

On a client station:

set wme-queue wlan0 with queue Queue_Name to

aifs AIFS_Value

See examples in “Set Arbirtation Interframe Spaces (AIFS)” on

page 241

Setting Minimum and Maximum Conten-

tion Windows (cwmin, cwmax)

On the access point:

set tx-queue wlan0 with queue Queue_Name to

cwmin cwmin_Value cwmax cwmax_Value

On a client station:

set wme-queue wlan0 with queue Queue_Name to

cwmin cwmin_Value cwmax cwmax_Value

See examples in “Setting Minimum and Maximum Contention Win-

dows (cwmin, cwmax)” on page 242.

Set the Maximum Burst Length (burst) on

the Access Point

set tx-queue wlan0 with queue Queue_Name to

burst burst_Value

See examples in “Set the Maximum Burst Length (burst) on the

Access Point” on page 243.

Set Transmission Opportunity Limit (txop-

limit) for WMM client stations

set wme-queue wlan0 with queue Queue_Name to

txop-limit txop-limit_Value

See examples in “Set Transmission Opportunity Limit (txop-limit) for

WMM client stations” on page 244.

Enable/Disable Wi-Fi Multimedia

By default, Wi-Fi MultiMedia (WMM) is enabled on the access point. With WMM enabled, QoS settings on

the Professional Access Point control both downstream traffic flowing from the access point to client

station (access point EDCA parameters) and upstream traffic flowing from the station to the access point

(station EDCA parameters). Enabling WMM essentially activates station-to-access-point QoS control.

Disabling WMM will deactivates QoS control of "station EDCA parameters" on upstream traffic flowing from

Class Structure, Commands, and Examples - 239

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

the station to the access point. With WMM disabled, you can still set downstream access-point-to-station

QoS parameters but no station-to-access-point QoS parameters.

•

To disable WMM:

USR5453-AP# set radio wlan0 wme off

USR5453-AP# get radio wlan0 wme

off

•

To enable WMM:

USR5453-AP# set radio wlan0 wme on

USR5453-AP# get radio wlan0 wme

About Access Point and Station EDCA Parameters

AP Enhanced Distributed Channel Access (EDCA) Parameters affect traffic flowing from the access point

to the client station (access-point-to-station).

Station Enhanced Distributed Channel Access (EDCA) Parameters affect traffic flowing from the client

station to the access point (station-to-access-point). Keep in mind that station-to-access-point parameters

apply only when WMM is enabled as described in “Enable/Disable Wi-Fi Multimedia” on page 239.

Understanding the Queues for Access Point and Station

The same types of queues are defined for different kinds of data transmitted from access-point-to-station

and station-to-access-point but they are referenced by differently depending on whether you are

configuring access point or station parameters.

Data

Access Point

Station

Voice - Highest priority queue, minimum delay. Time-sensitive data

such as VoIP and streaming media are automatically sent to this

queue.

data0

Video - High priority queue, minimum delay. Time-sensitive video

data is automatically sent to this queue.

data1

data2

data3

Best Effort - Medium priority queue, medium throughput and delay.

Most traditional IP data is sent to this queue.

Background - Lowest priority queue, high throughput. Bulk data that

requires maximum throughput and is not time-sensitive is sent to this

queue (FTP data, for example).

Distinguishing between Access Point and Station Settings in QoS Commands

Access Point - To get and set QoS settings on the access point, use "tx-queue" class name in the

command.

Station - To get and set QoS settings on the client station, use the "wme-queue" class name in the

command.

Class Structure, Commands, and Examples - 240

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Get QoS Settings on the Access Point

To view the current QoS settings and queue names for access-point-to-station parameters:

USR5453-AP# get tx-queue

name queue aifs cwmin cwmax burst

---------------------------------------

wlan0 data0 1

wlan0 data1 1

wlan0 data2 3

wlan0 data3 7

1.5

3.0

1023 0

Get QoS Settings on the Client Station

To view the current QoS settings queue names for station-to-access-point parameters:

USR5453-AP# get wme-queue

name queue aifs cwmin cwmax txop-limit

--------------------------------------------

wlan0 vo

wlan0 vi

wlan0 be

wlan0 bk

1023 0

Set Arbirtation Interframe Spaces (AIFS)

Arbitration Inter-Frame Spacing (AIFS) specifies a wait time (in milliseconds) for data frames.

Valid values for AIFS are 1-255.

Set AIFS on the Access Point

To set AIFS on access-point-to-station traffic:

set tx-queue wlan0 with queue Queue_Name to aifs AIFS_Value

Where Queue_Nameis the queue on the access point to which you want the setting to apply and

AIFS_Valueis the wait time value you want to specify for AIFS.

For example, this command sets the AIFS wait time on the access point Voice queue (data0) to 13

milliseconds.

USR5453-AP# set tx-queue wlan0 with queue data0 to aifs 13

View the results of this configuration update (bold in the command output highlights the modified value):

USR5453-AP# get tx-queue

name queue aifs cwmin cwmax burst

---------------------------------------

wlan0 data0 13

wlan0 data1 1

wlan0 data2 3

wlan0 data3 7

1.5

3.0

1023 0

Class Structure, Commands, and Examples - 241

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Set AIFS on the Client Station

To set the AIFS on station-to-access-point traffic:

set wme-queue wlan0 with queue Queue_Name to aifs AIFS_Value

Where Queue_Nameis the queue on the station to which you want the setting to apply and AIFS_Valueis

the wait time value you want to specify for AIFS.

For example, this command sets the AIFS wait time on the station Voice queue (vo) to 14 milliseconds.

USR5453-AP# set wme-queue wlan0 with queue vo to aifs 14

View the results of this configuration update (bold in the command output highlights the modified value):

USR5453-AP# get wme-queue

name queue aifs cwmin cwmax txop-limit

--------------------------------------------

wlan0 vo

wlan0 vi

wlan0 be

wlan0 bk

1023 0

Setting Minimum and Maximum Contention Windows (cwmin, cwmax)

The Minimum Contention Window (cwmin) sets the upper limit (in milliseconds) of the range from which the

initial random backoff wait time is determined. For more details, see “Random Backoff and Minimum /

Maximum Contention Windows” on page 146.)

Valid values for the "cwmin" are 1, 3, 7, 15, 31, 63, 127, 255, 511, or 1023. The value for "cwmin" must be

lower than the value for "cwmax".

The Maximum Contention Window (cwmax) sets the upper limit (in milliseconds) for the doubling of the

random backoff value. This doubling continues until either the data frame is sent or the Maximum

Contention Window size is reached. For more details, see “Random Backoff and Minimum / Maximum

Contention Windows” on page 146.)

Valid values for the "cwmax" are 1, 3, 7, 15, 31, 63, 127, 255, 511, or 1023. The value for "cwmax" must be

higher than the value for "cwmin".

Set cwmin and cwmax on the Access Point

To set the Minimum and Maximum Contention Windows (cwmin, cwmax) on access-point-to-station traffic:

set tx-queue wlan0 with queue Queue_Name to cwmin cwmin_Value cwmax cwmax_Value

Where Queue_Nameis the queue on the access point to which you want the setting to apply and

cwmin_Valueand cwmax_Valueare the values (in milliseconds) you want to specify for contention back-off

windows.

For example, this command sets the access point Video queue (data1) cwminvalue to 15 and cwmaxvalue

to 31.

Class Structure, Commands, and Examples - 242

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

USR5453-AP# set tx-queue wlan0 with queue data1 cwmin 15 cwmax 31

View the results of this configuration update (bold in the command output highlights the modified values):

USR5453-AP# get tx-queue

name queue aifs cwmin cwmax burst

---------------------------------------

wlan0 data0 13

wlan0 data1 1

wlan0 data2 3

wlan0 data3 7

1.5

3.0

1023 0

Set cwmin and cwmax on the Station

To set the Minimum and Maximum Contention Windows (cwmin, cwmax) on station-to-access-point traffic:

set wme-queue wlan0 with queue Queue_Name to cwmin cwmin_Value cwmax

cwmax_Value

Where Queue_Nameis the queue on the station to which you want the setting to apply and cwmin_Value

and cwmax_Valueare the values (in milliseconds) you want to specify for contention back-off windows.

For example, this command sets the client station Video queue (vi) cwminvalue to 15 and cwmaxvalue to

31.

USR5453-AP# set wme-queue wlan0 with queue vi cwmin 7 cwmax 15

View the results of this configuration update (bold in the command output highlights the modified values):

USR5453-AP# get wme-queue

name queue aifs cwmin cwmax txop-limit

--------------------------------------------

wlan0 vo

wlan0 vi

wlan0 be

wlan0 bk

1023 0

Set the Maximum Burst Length (burst) on the Access Point

The Maximum Burst Length (burst) specifies (in milliseconds) the Maximum Burst Length allowed for

packet bursts on the wireless network. A packet burst is a collection of multiple frames transmitted without

header information. The burstapplies only to the access point (access-point-to-station traffic).

Valid values for maximum burst length are 0.0 through 999.9.

To set the maximum burst length on access-point-to-station traffic:

set tx-queue wlan0 with queue Queue_Name to burst burst_Value

Where Queue_Nameis the queue on the access point to which you want the setting to apply and

burst_Valueis the wait time value you want to specify for maximum burst length.

For example, this command sets the maximum packet burst length on the access point Best Effort queue

(data2) to 0.5.

Class Structure, Commands, and Examples - 243

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

USR5453-AP# set tx-queue wlan0 with queue data2 to burst 0.5

View the results of this configuration update (bold in the command output highlights the modified value):

USR5453-AP# get tx-queue

name queue aifs cwmin cwmax burst

---------------------------------------

wlan0 data0 13

wlan0 data1 1

wlan0 data2 3

wlan0 data3 7

1.5

3.0

0.5

1023 0

Set Transmission Opportunity Limit (txop-limit) for WMM client stations

The Transmission Opportunity Limit (txop-limit) specifies an interval of time (in milliseconds) when a

WMM client station has the right to initiate transmissions on the wireless network. The txop-limitapplies

only to the client stations (station-to-access-point traffic).

To set the txop-limiton station-to-access-point traffic:

set wme-queue wlan0 with queue Queue_Name to txop-limit txop-limit_Value

Where Queue_Nameis the queue on the station to which you want the setting to apply and txop-

limit_Valueis the value you want to specify for the txop-limit

For example, this command sets the txop-limiton the station Voice queue (vo) to 49.

USR5453-AP# set wme-queue wlan0 with queue vo to txop-limit 49

View the results of this configuration update (bold in the command output highlights the modified value):

USR5453-AP# get wme-queue

name queue aifs cwmin cwmax txop-limit

--------------------------------------------

wlan0 vo

wlan0 vi

wlan0 be

wlan0 bk

1023 0

Class Structure, Commands, and Examples - 244

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Wireless Distribution System

Before configuring this feature, make sure you are familiar with the names of the interfaces as

described in “Understanding Interfaces as Presented in the CLI” on page 190. The interface name you

reference in a command determines whether a setting applies to a wired or wireless interface or to the

Internal or Guest network.

This table shows a quick view of WDS commands and links to detailed examples.

WDS Command

Example

Configuring a WDS Link

See detailed command example below.

get interface wlan0wds0 detail

Configuring a WDS Link

To set up a Wireless Distribution System (WDS) link between two wireless networks:

1. Enable the WDS interface (wlan0wds0) on the current access point:

USR5453-AP# set interface wlan0wds0 status up

USR5453-AP# set interface wlan0wds0 radio wlan0

2. Provide the MAC address of the remote access point to which you want to link:

USR5453-AP# set interface wlan0wds0 remote-mac MAC_Address_Of_Remote_AP

For example:

USR5453-AP# set interface wlan0wds0 remote-mac 00:E0:B8:76:1B:14

Getting Details on a WDS Configuration

Verify the configuration of the WDS link you just configured by getting details on the WDS interface:

USR5453-AP# get interface wlan0wds0 detail

Field

Value

-------------------------------------------------------

type

wds

status

description

mac

Wireless Distribution System - Link 1

00:E0:B8:76:26:08

mask

static-ip

static-mask

rx-bytes

rx-packets

rx-errors

rx-drop

rx-fifo

Class Structure, Commands, and Examples - 245

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

rx-frame

rx-compressed

rx-multicast

tx-bytes

tx-packets

tx-errors

tx-drop

tx-fifo

tx-colls

tx-carrier

tx-compressed

ssid

bss

security

wpa-personal-key

wep-key-ascii

wep-key-length

wep-default-key

wep-key-1

wep-key-2

wep-key-3

wep-key-4

vlan-interface

vlan-id

104

radio

wlan0

remote-mac

wep-key

00:E0:B8:76:1B:14

Time Protocol

The Network Time Protocol (NTP) is an Internet standard protocol that synchronizes computer clock times

on your network. NTP servers transmit Coordinated Universal Time (UTC, also known as Greenwich Mean

Time) to their client systems. NTP sends periodic time requests to servers, using the returned time stamp

to adjust its clock. The timestamp will be used to indicate the date and time of each event in log messages.

See http://www.ntp.org for more general information on NTP.

To enable the Network Time Protocol (NTP) server on the access point do the following:

1. Enable the NTP Server

set ntp status up

2. Provide the Host Name or Address of an NTP Server

set ntp server NTP_Server

Where NTP_Serveris the host name or IP address of the NTP server you want to use. (USRobotics recom-

mends using the host name rather than the IP address, since IP addresses these change more frequently.)

For example, this command sets the NTP server by host name to "ntp.instant802.com

set ntp server ntp.instant802.com

3. Get Current Time Protocol Settings

USR5453-AP# get ntp detail

Class Structure, Commands, and Examples - 246

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Value

--------------------------

status up

server ntp.instant802.com

Reboot the Access Point

To reboot the access point, simply type "reboot" at the command line:

USR5453-AP# reboot

Reset the Access Point to Factory Defaults

If you are experiencing extreme problems with the Professional Access Point and have tried all other

troubleshooting measures, you can reset the access point. This will restore factory defaults and clear all

settings, including settings such as a new password or wireless settings.

The following command resets the access point from the CLI:

USR5453-AP# factory-reset

Keep in mind that the factory-resetcommand resets only the access point you are currently admin-

istering; not other access points in the cluster.

For information on the factory default settings, see “Default Settings for the Professional Access Point”

on page 16.

Keyboard Shortcuts and Tab Completion Help

The CLI provides keyboard shortcuts to help you navigate the command line and build valid commands,

along with "tab completion" hints on available commands that match what you have typed so far. Using the

CLI will be easier if you use the tab completion help and learn the keyboard shortcuts.

•

Keyboard Shortcuts

Tab Completion and Help

Class Structure, Commands, and Examples - 247

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Keyboard Shortcuts

Action on CLI

Keyboard Shortcut

Move cursor to the beginning of the current line

Ctrl-a

Home

Move cursor to the end of the current line

Ctrl-e

End

Move cursor back on the current line, one character at a time

Move the cursor forward on the current line, one character at a time

Ctrl-b

Left Arrow key

Ctrl-f

Right Arrow Key

Start over at a blank command prompt (abandons the input on the current line)

Remove one character on the current line.

Ctrl-c

Ctrl-h

Ctrl-W

Remove the last word in the current command.

(Clears one word at a time from the current command line, always starting with the

last word on the line.)

Remove characters starting from cursor location to end of the current line.

Ctrl-k

Ctrl-U

Ctrl-l

(Clears the current line from the cursor forward.)

Remove all characters before the cursor.

(Clears the current line from the cursor back to the CLI prompt.)

Clear screen but keep current CLI prompt and input in place.

Display previous command in history.

Ctrl-p

Up Arrow key

(Ctrl-p and Ctrl-n let you cycle through a history of all executed commands like Up

and Down arrow keys typically do. Up/Down arrow keys also work for this.)

Display next command in history.

Ctrl-n

Down Arrow key

(Ctrl-p and Ctrl-n let you cycle through a history of all executed commands like Up

and Down arrow keys typically do. Up/Down arrow keys also work for this.)

Exit the CLI. (At a blank command prompt, typing Ctrl-d closes the CLI.)

Ctrl-d

(Typing Ctrl-d within command text also removes characters, one at a time, at cur-

sor location like Ctrl-h.)

Tab Completion and Help

Help on commands can be requested at the command line interface (CLI) by using the TAB key. (See also

“Basic Settings” on page 192.)

Hitting TAB once will attempt to complete the current command.

If multiple completions exist, a beep will sound and no results will be displayed. Enter TAB again to display

all available completions.

Class Structure, Commands, and Examples - 248

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

•

Example 1: At a blank command line, hit TAB twice to get a list of all commands.

USR5453-AP#

add

Add an instance to the running configuration

factory-reset Reset the system to factory defaults

get

Get field values of the running configuration

Reboot the system

Remove instances in the running configuration

Save the running configuration

reboot

remove

save-running

set

Set field values of the running configuration

•

Example 2: Type "get " TAB TAB (including a space after get) to see a list of all field options for the get

command.

USR5453-AP# get

association

basic-rate

bridge-port

bss

Associated station

Basic rate of the radio

Bridge ports of bridge interfaces

Basic Service Set of the radio

Clustering-based configuration settings

cluster

cluster-member Member of a cluster of like-configured access points

config

Configuration settings

Detected access point

DHCP client settings

IEEE 802.11

detected-ap

dhcp-client

dot11

host

Internet host settings

Network interface

IP route entry

Kernel log entry

Log settings

interface

ip-route

klog-entry

log

log-entry

mac-acl

ntp

portal

radio

Log entry

MAC address access list item

Network Time Protocol client

Guest captive portal

Radio

radius-user

ssh

RADIUS user

SSH access to the command line interface

supported-rate Supported rates of the radio

system

System settings

telnet

tx-queue

wme-queue

Telnet access to the command line interface

Transmission queue parameters

Transmission queue parameters for stations

•

Example 3: Type "get system v" TAB. This will result in completion with the only matching field, "get sys-

tem version". (Hit ENTER to get the output results of the command.)

USR5453-AP# get system v

USR5453-AP# get system version

Example 4: Type "set" TAB TAB (including a space after set) to get a list of all field options for the set

command.

USR5453-AP# set

bss

Basic Service Set of the radio

cluster

Clustering-based configuration settings

cluster-member Member of a cluster of like-configured access po

config Configuration settings

Class Structure, Commands, and Examples - 249

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

dhcp-client

dot11

DHCP client settings

IEEE 802.11

host

Internet host settings

Network interface

IP route entry

interface

ip-route

log

Log settings

mac-acl

ntp

portal

radio

MAC address access list item

Network Time Protocol client

Guest captive portal

Radio

radius-user

ssh

system

telnet

tx-queue

wme-queue

RADIUS user

SSH access to the command line interface

System settings

Telnet access to the command line interface

Transmission queue parameters

Transmission queue parameters for stations

•

Example 5: Type "set mac" TAB, and the command will complete with the only matching option:

USR5453-AP# set mac-acl

Example 6: Type "set cluster" TAB TAB, and the two matching options are displayed:

USR5453-AP# set cluster

cluster

Clustering-based configuration settings

cluster-member Member of a cluster of like-configured access points

Example 7: Type "add" TAB TAB (including a space after add) to get a list of all field options for the add

command.

•

USR5453-AP# add

basic-rate

bridge-port

bss

interface

mac-acl

Basic rate of the radio

Bridge ports of bridge interfaces

Basic Service Set of the radio

Network interface

MAC address access list item

RADIUS user

radius-user

supported-rate Supported rate of the radio

Example 8: Type "remove" TAB TAB (including a space after remove) to get a list of all field options for

the remove command

•

USR5453-AP# remove

basic-rate

bridge-port

bss

interface

ip-route

mac-acl

Basic rate of the radio

Bridge ports of bridge interfaces

Basic Service Set of the radio

Network interface

IP route entry

MAC address access list item

RADIUS user

radius-user

supported-rate Supported rates of the radio

CLI Class and Field Overview

The following is an introduction to the CLI classes and fields. For a complete reference guide, see “Class

Class Structure, Commands, and Examples - 250

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

and Field Reference” on page 25–253.

Configuration information for the Professional Access Point is represented as a set of classes and objects.

Different kinds of information uses different classes. For example, information about a network interface is

represented by the "interface" class, while information about an NTP client is represented by the "ntp"

class.

Depending on the type of class, there can be multiple instances of a class. For example, there is one

instance of the "interface" class for each network interface that the access point has (Ethernet, radio, and

so on), while there is just a singleton instance of the "ntp" class, since an access point needs only a single

NTP client. Some classes require their instances to have names to differentiate between them; these are

called named classes. For example, one interface might have a name of eth0to indicate that it is an

Ethernet interface, while another interface could have a name of wlan0to indicate it is a wireless LAN

(WLAN) interface. Instances of singleton classes do not have names, since they only have a single

instance. Classes that can have multiple instances but do not have a name are called anonymous classes.

Together, singleton and anonymous classes are called unnamed classes. Some classes require their

instances to have names, but the multiple instances can have the same name to indicate that they are part

of the same group. These are called group classes.

has name? \ # of instances?

one

multiple

singleton

n/a

anonymous

unique named

group named

yes - unique

yes - non-unique

n/a

Each class defines a set of fields, that describe the actual information associated with a class. Each

instance of a class will have a value for each field that contains the information. For example, the interface

class has fields such as "ip" and "mask". For one instance, the ipfield might have a value of 192.168.1.1

while the maskfield has a value of 255.255.0.0; another instance might have an ipfield with a value of

10.0.0.1 and maskfield with a value of 255.0.0.0.

Class Structure, Commands, and Examples - 251

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Figure 10. CLI Class Relationships

Class Structure, Commands, and Examples - 252

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Class and Field Reference

Class Index

Class

Description

An associated station.

A radio rate.

A port that is a member of a bridge.

A BSS of a radio.

cluster

Stores arbitrary data.

cluster-member

config

Stores arbitrary data.

Config settings.

detected-ap

dhcp-client

dot11

A detected access point.

The handler for the DHCP client class.

802.11 settings (all radios).

IP host settings.

A network interface.

An IP route.

Java Virtual Machine.

kickstartd

log

The handler for the kickstartd class

Access point log settings.

An entry in the log.

log-entry

mac-acl

ntp

A MAC access list entry.

Network Time Protocol client settings.

Guest captive portal settings.

A physical radio.

A local authentication server user.

The handler for the serial class.

SNMP server.

snmp

ssh

The handler for the ssh class.

A radio rate.

supported-rate

system

telnet

System-wide settings.

The handler for the telnet class.

An SNMP trap destination host.

A transmission queue.

Web user interface settings.

A WME station queue.

association

Class and Field Reference - 253

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Persistent: No.

Purpose: An associated station.

Field Index

Field

Description

interface

station

The interface with which the station is associated.

The MAC address of the station.

Whether the station is authenticated.

Whether the station is associated.

The number of packets received from the station.

The number of packets transmitted by the station.

The number of bytes received from the station.

The number of bytes transmitted by the station.

The transmission rate.

tx-bytes

tx-rate

listen-interval

The listen interval.

interface

Purpose

The interface with which the station is associated.

Valid values Linux network interface name.

station

Purpose

The MAC address of the station.

Valid values Six colon-separated octets in hexadecimal.

authenticated

Purpose

Whether the station is authenticated.

Valid values "Yes" or "-".

associated

Purpose

Whether the station is associated.

Valid values "Yes" or "-".

rx-packets

Purpose

The number of packets received from the station.

Valid values Positive integer.

tx-packets

Purpose

The number of packets transmitted by the station.

Valid values Positive integer.

Class and Field Reference - 254

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

rx-bytes

Purpose

The number of bytes received from the station.

Valid values Positive integer.

tx-bytes

Purpose

The number of bytes transmitted by the station.

Valid values Positive integer.

tx-rate

Purpose

The transmission rate.

Valid values A rate, in 100 kbps.

listen-interval

Purpose

The listen interval.

Valid values A time, in ms.

basic-rate

Persistent: Yes.

Purpose: A radio rate.

Description: Used to set the rate sets of radios.

Field Index

Field

Description

rate

A radio rate in MBps.

rate

Purpose

A radio rate in MBps. Note that you cannot change an existing rate field; you can only insert

or delete the entire instance.

Valid values Positive integer, or 5.5.

bridge-port

Persistent: Yes.

Purpose: A port that is a member of a bridge.

Class and Field Reference - 255

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Index

Field

Description

The path cost.

The port priority.

path-cost

priority

path-cost

Purpose

The path cost. Used only when STP is on.

Valid values 1-65535.

priority

Purpose

The port priority. Used only when STP is on.

Valid values 0-255.

bss

Persistent: Yes.

Purpose: A BSS of a radio.

Description: Represents a basic service set.

Class and Field Reference - 256

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Index

Field

Description

Controls whether this is on or off.

A human-readable description of the interface.

The radio this is part of.

The service-set interface to send beacons for.

The MAC address of the interface.

Delivery Traffic Information Map period.

Maximum number of stations.

dtim-period

max-stations

ignore-broadcast-ssid

Do not send SSID in beacons and ignore probe

requests.

MAC address Access Control List mode.

The name of the mac access control list to use.

Whether RADIUS accounting is enabled.

The RADIUS server IP address.

radius-key

The RADIUS server shared secret.

open-system-authentica- Whether Open System authentication is permitted.

tion

shared-key-authentica-

tion

Whether Shared Key authentication is permitted.

wpa-cipher-tkip

Whether TKIP is permitted as a WPA cipher.

Whether CCMP is permitted as a WPA cipher.

wpa-cipher-ccmp

status

Purpose

Controls whether this is on or off.

Valid values "up" or "down".

description

Purpose

A human-readable description of the interface.

Valid values an ASCII string.

radio

Purpose

The radio this is part of.

Valid values The name of an existing radio instance.

beacon-interface

Purpose

The service-set interface to send beacons for.

Valid values The name of an existing interface instance with type of service-set.

Class and Field Reference - 257

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

mac

Purpose

The MAC address of the interface. Read-only; value is determined by the starting MAC of

the radio.

Valid values 6 colon-separated hexadecimal digit pairs.

dtim-period

Purpose

Delivery Traffic Information Map period.

Valid values 1-225.

max-stations

Purpose

Maximum number of stations.

Valid values 0-2007.

ignore-broadcast-ssid

Purpose

Do not send SSID in beacons and ignore probe requests.

Valid values "on" or "off".

mac-acl-mode

Purpose

MAC address Access Control List mode.

Valid values "deny-list": deny only stations in list. "accept-list": accept only stations in list. */

mac-acl-name

Purpose

The name of the mac access control list to use.

Valid values the name of existing mac-acl instances.

radius-accounting

Purpose

Whether RADIUS accounting is enabled. If unset defaults to "off".

Valid values "on" or "off".

radius-ip

Purpose

The RADIUS server IP address.

Valid values An IP address.

radius-key

Purpose

The RADIUS server shared secret.

Valid values A string.

Class and Field Reference - 258

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

open-system-authentication

Purpose

Whether Open System authentication is permitted.

Valid values "on" or "off".

shared-key-authentication

Purpose

Whether Shared Key authentication is permitted.

Valid values "on" or "off".

wpa-cipher-tkip

Purpose

Whether TKIP is permitted as a WPA cipher.

Valid values "on" or "off".

wpa-cipher-ccmp

Purpose

Whether CCMP is permitted as a WPA cipher.

Valid values "on" or "off".

channel-planner

Persistent: Yes.

Purpose: Stores arbitrary data.

Field Index

This class has the same fields as class cluster-member.

cluster

Persistent: Yes.

Purpose: Stores arbitrary data.

Field Index

This class has the same fields as class cluster-member.

cluster-member

Persistent: Yes.

Class and Field Reference - 259

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Purpose:

Stores arbitrary data.

Description: No services are restarted.

config

Persistent: Yes.

Purpose:

Configuration settings.

Description: Used for configuration fields.

Field Index

Field

Description

startup

Configuration at boot time.

Configuration after factory reset.

Prevent external configuration updates

default

no-external-updates

startup

Purpose

Configuration at boot time.

Write-only.

Valid values "default": Reset to factory defaults.

"rescue": Reset to rescue.

"running": Save running configuration.

default

Purpose

Configuration after factory reset.

Write-only.

Valid values "rescue": Reset to rescue.

"running": Save running configuration.

no-external-updates

Purpose

Prevent external configuration updates.

Valid values "up" or "down".

debug

Persistent: Yes.

Purpose:

Access point debug settings.

Description: The debugging parameters of the access point.

Class and Field Reference - 260

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Index

Field

Description

level

Level of debugging information.

timestamp

klevel

Add a timestamp to debugging information.

Level of kernel debugging information.

Level of Orchestrator debugging information.

Host for Orchestrator to send syslogs to.

olevel

ologhost

level

Purpose

Level of debugging information.

Valid values 0-5.

timestamp

Purpose

Add a timestamp to debugging information.

Valid values "on" or "off".

klevel

Purpose

Level of kernel debugging information.

Valid values 1-8.

olevel

Purpose

Level of Orchestrator debugging information.

Valid values 0-7.

ologhost

Purpose

Host for Orchestrator to send syslogs to.

Valid values IP address.

detected-ap

Persistent: No.

Purpose:

A detected access point.

Description: Represents an access point that has been detected by passive scanning.

Class and Field Reference - 261

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Index

Field

Description

The MAC address of the AP.

The radio that detected the AP.

The beacon interval of the AP in kus (1.

The capabilities of the AP.

The type of device detected.

Whether privacy (WEP or WPA) is enabled.

The SSID of the AP.

privacy

ssid

wpa

Whether WPA security is enabled.

phy-type

The mode our radio was in when the AP was

detected.

band

The RF band the AP was detected in.

The channel of the AP.

The rate of the AP.

The signal of the AP.

The ERP of the AP.

beacons

The number of beacons received from this

AP.

last-beacon

The time of the last beacon received from

this AP.

supported-rates

The supported rates of the AP.

mac

Purpose

The MAC address of the AP.

Valid values Six colon-separated octets in hexadecimal.

radio

Purpose

The radio that detected the AP.

Valid values Linux network interface name.

beacon-interval

Purpose

The beacon interval of the AP in kus (1.024 ms).

Valid values Positive integer.

capability

Purpose

The capabilities of the AP.

Valid values C-formatted hexadecmial bitflag.

Class and Field Reference - 262

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

type

Purpose

The type of device detected.

Valid values "AP", "Ad hoc", or "Other".

privacy

Purpose

Whether privacy (WEP or WPA) is enabled.

Valid values "On" or "Off".

ssid

Purpose

The SSID of the AP.

Valid values String of up to 32 octets.

wpa

Purpose

Whether WPA security is enabled.

Valid values "On" or "Off".

phy-type

Purpose

The mode your radio was in when the AP was detected.

Valid values 4: IEEE 802.11b.

7: IEEE 802.11g.

band

Purpose

The RF band the AP was detected in.

Valid values "2.4" or "5".

channel

Purpose

The channel of the AP.

Valid values Positive integer.

rate

Purpose

The rate of the AP.

Valid values Positive integer.

signal

Purpose

The signal of the AP.

Valid values Positive integer.

Class and Field Reference - 263

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

erp

Purpose

The ERP of the AP.

Valid values C-formatted

hexadecimal number.

beacons

Purpose

The number of beacons received from this AP.

Valid values Positive integer.

last-beacon

Purpose

The time of the last beacon received from this AP.

Valid values Date and time, in Unix time format.

supported-rates

Purpose

The supported rates of the AP.

Valid values Bracketed list of hexadecimal rate codes.

dhcp-client

Persistent: Yes.

Purpose:

The handler for the DHCP client class.

Description: Represents a DHCP client.

Field Index

Field

Description

Controls whether this is on or off.

The interface to perform DHCP on.

interface

status

Purpose

Controls whether this is on or off.

Valid values "up" or "down".

interface

Purpose

The interface to perform DHCP on.

Valid values The name of an existing interface instance. */

Class and Field Reference - 264

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

dot11

Persistent: Yes.

Purpose:

802.11 settings (all radios).

Description: Represents the wireless functions of the access point.

Field Index

Field

debug

dot11d

Description

Controls whether 802.

The debugging level for 802.

Whether AP should enable 802.

status

Purpose

Controls whether 802.11 is in use.

Valid values "up" or "down".

debug

Purpose

The debugging level for 802.11.

Valid values 0-3.

dot11d

Purpose

Whether AP should enable 802.11d

Valid values "up" or "down".

host

Persistent: Yes.

Purpose:

IP host settings.

Description: Used for IP host fields.

Class and Field Reference - 265

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Index

Field

Description

dns-[12]

domain

Domain name servers in use.

Domain name in use.

The host name.

static-dns-[12]

Domain name servers to use when not

obtained through DHCP.

static-domain

dns-via-dhcp

Domain name to use when not obtained

through DHCP.

Whether DNS parameters are obtained

through DHCP.

dns-[12]

Purpose

Domain name servers in use.

Valid values IP address.

domain

Purpose

Domain name in use.

Valid values DNS domain name.

purpose

The host name.

Valid values DNS domain name.

static-dns-[12]

Purpose

Domain name servers to use when not obtained through DHCP.

Valid values IP address.

static-domain

Purpose

Domain name to use when not obtained through DHCP.

Valid values DNS domain name.

dns-via-dhcp

Purpose

Whether DNS parameters are obtained through DHCP.

Valid values "up" or "down".

Class and Field Reference - 266

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

interface

Persistent: Yes.

Purpose:

A network interface.

Description: Used for per-interface fields.

Field Index

Field

Description

The actual IP address of this interface.

The actual netmask of this interface.

Controls whether this is on or off.

The type of the interface.

A human-readable description of the inter-

face.

The MAC address of the interface.

The static IP address of this interface.

The static netamsk of this interface.

Received bytes.

Received packets.

Received packets with errors.

Received packets that were dropped.

Received packets with FIFO overflows.

Received packets with frame errors.

Received packets with compression.

Received packets that were multicast.

Transmitted bytes.

Transmitted packets.

Transmitted packets with errors.

Transmitted packets that were dropped.

Transmitted packets with FIFO overflows.

Transmitted packets will collisions.

Transmitted packets with carrier errors.

Transmitted packets with compression.

Purpose

The actual IP address of this interface. Read-only.

Valid values IP address.

mask

Purpose

The actual netmask of this interface.

Read-only.

Class and Field Reference - 267

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Valid values Netmask in dotted-decimal notation.

status

Purpose

Controls whether this is on or off.

Valid values "up" or "down".

type

Purpose

The type of the interface. Used to determine what additional fields are available. Read-only.

Valid values "service-set", "bridge", "vlan", "wds", "pptp", "pppoe".

description

Purpose

A human-readable description of the interface.

Valid values an ASCII string.

mac

Purpose

The MAC address of the interface.

Valid values 6 colon-separated hexadecimal digit pairs.

static-ip

Purpose

The static IP address of this interface. Used when DHCP is not in use.

Valid values IP address.

static-mask

Purpose

The static netamsk of this interface. Used when DHCP is not in use.

Valid values Netmask in dotted-decimal notation.

rx-bytes

Purpose

Received bytes.

Valid values Integer.

rx-packets

Purpose

Received packets.

Valid values Integer.

rx-errors

Purpose

Received packets with errors.

Valid values Integer.

Class and Field Reference - 268

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

rx-drop

Purpose

Received packets that were dropped

Valid values Integer.

rx-fifo

Purpose

Received packets with FIFO overflows.

Valid values Integer.

rx-frame

Purpose

Received packets with frame errors.

Valid values Integer.

rx-compressed

Purpose

Received packets with compression.

Valid values Integer.

rx-multicast

Purpose

Received packets that were multicast.

Valid values Integer.

tx-bytes

Purpose

Transmitted bytes.

Valid values Integer.

tx-packets

Purpose

Transmitted packets.

Valid values Integer.

tx-errors

Purpose

Transmitted packets with errors.

Valid values Integer.

tx-drop

Purpose

Transmitted packets that were dropped.

Valid values Integer.

tx-fifo

Purpose

Transmitted packets with FIFO overflows.

Class and Field Reference - 269

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Valid values Integer.

tx-colls

Purpose

Transmitted packets will collisions.

Valid values Integer.

tx-carrier

Purpose

Transmitted packets with carrier errors.

Valid values Integer.

tx-compressed

Purpose

Transmitted packets with compression.

Valid values Integer.

ip-route

Persistent: Yes.

Purpose:

An IP route.

Description: An IP route.

Field Index

Field

Description

in-use

Whether the route is currently in use.

The destination network prefix.

The mask of the destination network prefix.

destination

mask

gateway

The router by which the destination is reach-

able.

in-use

Purpose

Whether the route is currently in use. Read-only.

Valid values "up" or "down".

destination

Purpose

The destination network prefix.

Valid values IP address prefix.

mask

Purpose

The mask of the destination network prefix.

Class and Field Reference - 270

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Valid values Netmask.

gateway

Purpose

The router by which the destination is reachable.

Valid values IP address.

jvm

Persistent: No.

Purpose:

Java Virtual Machine.

Description: Represents a JVM.

Field Index

Field

Description

Controls whether this is on or off.

Purpose

Controls whether this is on or off.

Valid values "up" or "down".

kickstartd

Persistent: No.

Purpose:

The handler for the kickstartd class.

Description: Represents a kickstartd process.

log

Persistent: Yes.

Purpose:

Access point log settings.

Description: Access point log messages.

Class and Field Reference - 271

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Index

Field

Description

depth

The number of log entries to keep

depth

Purpose

The number of log entries to keep.

Valid values Positive integer.

log-entry

Persistent: No.

Purpose:

An entry in the log.

Description: An entry in the log.

Field Index

Field

Description

number

priority

time

The entry number.

The priority of the log entry.

The time of the message.

The daemon the message is associated with.

The message.

daemon

message

number

Purpose

The entry number.

Valid values A non-zero integer.

priority

Purpose

The priority of the log entry.

Valid values A non-zero integer.

time

Purpose

The time of the message.

Valid values A Unix-format time.

daemon

Purpose

The daemon the message is associated with.

Valid values String.

Class and Field Reference - 272

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

message

Purpose

The message.

Valid values String.

mac-acl

Persistent: Yes.

Purpose:

A MAC access list entry.

Description: Each instance represents a single MAC address. All instances with the same name form a

list. This list can be used by BSSes.

Field Index

Field

Description

A MAC address.

mac

Purpose

A MAC address.

Valid values 6 colon-separated hexadecimal digit pairs. */

ntp

Persistent: Yes.

Purpose:

Network Time Protocol client settings.

Field Index

Field

server

Description

Controls whether this is on or off.

The NTP server IP address.

status

Purpose

Controls whether this is on or off.

Valid values "up" or "down".

server

Purpose

The NTP server IP address.

Valid values An IP address.

Class and Field Reference - 273

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

portal

Persistent: Yes.

Purpose:

Guest captive portal settings.

Description: Represents a portal. When a portal is run on an interface, traffic entering that interface does

not have unconditional access to the AP - they must satisfy some portal requirements, such

as clicking through a welcome screen, before access is given.

Field Index

Field

Description

Controls whether this is on or off.

welcome-screen

Whether the welcome screen is shown to

guest users.

welcome-screen-text

Text to display on the welcome screen.

status

Purpose

Controls whether this is on or off.

Valid values "up" or "down".

welcome-screen

Purpose

Whether the welcome screen is shown to guest users.

Valid values "on" or "off".

welcome-screen-text

Purpose

Text to display on the welcome screen.

Valid values HTML.

radio

Persistent: Yes.

Purpose:

A physical radio.

Description: Represents a physical radio.

Class and Field Reference - 274

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Index

Field

Description

Controls whether the radio is on or off.

description

A human-readable description of the inter-

face.

The MAC address of the radio.

max-bss

The maximum number of BSSes permitted

on this radio.

channel-policy

mode

The channel policy of this radio.

The wireless mode of this radio.

Whether Super G is enabled.

The static channel of this radio.

The transmit power of this radio.

Whether the radio transmits and receives

data.

beacon-interval

rts-threshold

The beacon interval for this radio in kus (1.

The size of frames at which RTS/CTS will be

used.

fragmentation-threshold

The size of frames at which they will be frag-

mented.

load-balance-disassociation-utili- The load that must be exceeded in order for a

zation station to be disassociated.

load-balance-disassociation-sta- The number of associated stations that must

tions

be exceeded for a station to be disassoci-

ated.

load-balance-no-association-utili- The load that must be exceeded in order for

zation

new stations to be prohibited from associat-

ing.

ap-detection

station-isolation

wme

Whether AP detection is performed.

Whether stations are isolated.

Whether WME is enabled.

wme_wifi_noack_test

Mode for Wi-Fi noack test.

status

Purpose

Controls whether the radio is on or off

Valid values "up" or "down".

description

Purpose

A human-readable description of the interface.

Valid values an ASCII string.

mac

Purpose

The MAC address of the radio. If blank, obtains the MAC address of the radio from hard-

Class and Field Reference - 275

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

ware. This will be used as the starting MAC address for the BSSes.

Valid values 6 colon-separated hexadecimal digit pairs.

max-bss

Purpose

The maximum number of BSSes permitted on this radio. This limits the number of bss

instances whose radio field can be this radio's name.

Valid values Positive integers.

channel-policy

Purpose

The channel policy of this radio.

Valid values static: Use static-channel.

best: Select the best channel.

mode

Purpose

The wireless mode of this radio.

Valid values The Valid values depend on the capabilities of the radio:

b: IEEE 802.11b.

g: IEEE 802.11g.

super-g

Purpose

Whether Super G is enabled. If unset defaults to "no".

Valid values "yes" or "no".

static-channel

Purpose

The static channel of this radio. Used when channel policy is static.

Valid values Depends on regulatory-domain and mode. All channels are positive integers.

tx-power

Purpose

The transmit power of this radio.

Valid values A percentage.

tx-rx-status

Purpose

Whether the radio transmits and receives data.

Valid values "up" or "down".

beacon-interval

Purpose

The beacon interval for this radio in kus (1.024 ms).

Valid values 20-2000.

Class and Field Reference - 276

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

rts-threshold

Purpose

The size of frames at which RTS/CTS will be used.

Valid values 0-2347.

fragmentation-threshold

Purpose

The size of frames at which they will be fragmented.

Valid values 256-2346.

load-balance-disassociation-utilization

Purpose

The load that must be exceeded in order for a station to be disassociated. The condition for

load-balance-disassociation-stations must also be satisfied, if it is non-zero.

Valid values A non-zero percentage, or 0 to disable.

load-balance-disassociation-stations

Purpose

The number of associated stations that must be exceeded for a station to be disassociated.

The condition for load-balance-disassociation-utilization must also be satisfied, if it is non-

zero.

Valid values 1-2007, or 0 to disable.

load-balance-no-association-utilization

Purpose

The load that must be exceeded in order for new stations to be prohibited from associating.

Valid values A non-zero percentage, or 0 to disable.

ap-detection

Purpose

Whether AP detection is performed. If on, the detected APs will be represented by instances

of the detected-ap class.

Valid values "on" or "off".

station-isolation

Purpose

Whether stations are isolated. If on, then stations on this radio cannot exchange data with

other stations on this radio.

Valid values "on" or "off".

wme

Purpose

Whether WME is enabled. Determines whether wme-queue values will be sent to clients.

Valid values "on" or "off".

wme_wifi_noack_test

Purpose

Mode for Wi-Fi noack test.

Class and Field Reference - 277

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Valid values "on" or "off".

radius-user

Persistent: Yes.

Purpose:

A local authentication server user.

Description: Handles username/password and generates password hash

serial

Persistent: Yes.

Purpose:

The handler for the serial class.

Description: Represents the serial access to the CLI.

snmp

Persistent: Yes.

Purpose:

SNMP server.

Description: Represents a SNMP server.

Field Index

Field

Description

Controls whether this is on or off.

The read-only community name.

The read-write community name.

The IP address of the interface to listen on.

The engine identifier.

ro-community

rw-community

engine-id

status

Purpose

Controls whether this is on or off.

Valid values "up" or "down".

ro-community

Purpose

The read-only community name.

Valid values String.

Class and Field Reference - 278

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

rw-community

Purpose

The read-write community name.

Valid values String.

Purpose

The IP address of the interface to listen on.

Valid values IP address.

engine-id

Purpose

The engine identifier.

Valid values A string.

ssh

Persistent: Yes.

Purpose:

The handler for the ssh class.

Description: Represents the SSH.

supported-rate

Persistent: Yes.

Purpose:

A radio rate.

Field Index

This class has the same fields as class basic-rate.

system

Persistent: Yes.

Purpose:

System-wide settings.

Description: Used for system-wide fields.

Class and Field Reference - 279

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Index

Field

Description

password

The login password.

The login password, crypted.

encrypted-password

password-initialized

Whether the password has been initialized since first

boot.

reboot

Reboot the system.

password

Purpose

The login password.

Write-only.

Valid values String.

encrypted-password

Purpose

The login password, crypted.

Valid values String.

password-initialized

Purpose

Whether the password has been initialized since first boot.

Valid values 1, or blank.

reboot

Purpose

Reboot the system.

Write-only.

Valid values "yes" to reboot.

telnet

Persistent: Yes.

Purpose:

The handler for the telnet class.

Description: Represents Telnet access to the CLI.

traphost

Persistent: Yes.

Purpose:

An SNMP trap destination host.

Description: Represents a trapsink, trap2sink and informsink commands in SNMPD configuration file.

Class and Field Reference - 280

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

Field Index

Field

host

Description

The host to send traps to.

The community to send the traps with.

The type of traps to send.

community

type

host

Purpose

The host to send traps to.

Valid values IP address.

community

Purpose

The community to send the traps with.

Valid values A string.

type

Purpose

The type of traps to send.

Valid values "trapsink", "trap2sink", or "informsink".

tx-queue

Persistent: Yes.

Purpose:

A transmission queue.

Description: Represents transmission queue parameters of a radio. The name of the instance must be

the same as the name of the radio it represents.

Field Index

Field

queue

aifs

Description

The queue.

Adaptive Inter-Frame Space.

Minimum contention window.

Maximum contention window.

Maximum burst length.

cwmin

cwmax

burst

queue

Purpose

The queue.

Valid values "data0", "data1", "data2", "data3", "mgmt", "after_beacon", or "beacon".

Class and Field Reference - 281

Download from Www.Somanuals.com. All Manuals Search And Download.

Professional Access Point

Administrator Guide

aifs

Purpose

Adaptive Inter-Frame Space.

Valid values 1-255.

cwmin

Purpose

Minimum contention window.

Valid values 1, 3, 7, 15, 31, 63, 127, 255, 511, or 1024.

cwmax

Purpose

Maximum contention window.

Valid values 1, 3, 7, 15, 31, 63, 127, 255, 511, or 1024.

burst

Purpose

Maximum burst length.

Valid values 0.0-999.9.

web-ui

Persistent: No.

Purpose:

Web user interface settings.

Description: Represents the web user interface of the AP.

Field Index

Field

Description