Concept Guide

ManualsBrandsDell ManualsAccess PlatformsW-Series 277 Access Points

381

382

383

384

385

386

387

388

389

390

Table Of Contents

About this Guide
- Intended Audience
- Related Documents
- Conventions
- Contacting Dell
About Instant
- Instant Overview
- What is New in this Release
  - Support for New W-IAP Devices
  - No Support for W-IAP92/93
Setting up a W-IAP
- Setting up Instant Network
- Logging in to the Instant UI
  - Regulatory Domains
  - Specifying Country Code
- Accessing the Instant CLI
Automatic Retrieval of Configuration
- Managed Mode Operations
- Pre-requisites
- Configuring Managed Mode Parameters
  - Example
- Verifying the Configuration
Instant User Interface
- Login Screen
- Main Window
Initial Configuration Tasks
- Basic Configuration Tasks
- Additional Configuration Tasks
Customizing W-IAP Settings
- Modifying the W-IAP Hostname
  - In the Instant UI
  - In the CLI
- Configuring Zone Settings on a W-IAP
  - In the Instant UI
  - In the CLI
- Specifying a Method for Obtaining IP Address
  - In the Instant UI
  - In the CLI
- Configuring External Antenna
  - EIRP and Antenna Gain
  - Configuring Antenna Gain
    - In the Instant UI
    - In the CLI
- Configuring Radio Profiles for a W-IAP
- Configuring Uplink VLAN for a W-IAP
  - In the Instant UI
  - In the CLI
- Changing USB Port Status
  - In the Instant UI
  - In the CLI
- Master Election and Virtual Controller
  - Master Election Protocol
  - Manual Provisioning of Master W-IAP
    - Provisioning a W-IAP as a Master W-IAP
      - In the Instant UI
      - In the CLI
- Adding a W-IAP to the Network
- Removing a W-IAP from the Network
VLAN Configuration
- VLAN Pooling
- Uplink VLAN Monitoring and Detection on Upstream Devices
Wireless Network Profiles
- Configuring Wireless Network Profiles
- Configuring Fast Roaming for Wireless Clients
- Editing Status of a WLAN SSID Profile
  - In the Instant UI
  - In the CLI
- Editing a WLAN SSID Profile
- Deleting a WLAN SSID Profile
Wired Profiles
- Configuring a Wired Profile
- Assigning a Profile to Ethernet Ports
  - In the Instant UI
  - In the CLI
- Editing a Wired Profile
- Deleting a Wired Profile
- Link Aggregation Control Protocol
- Understanding Hierarchical Deployment
Captive Portal for Guest Access
- Understanding Captive Portal
  - Types of Captive Portal
  - Walled Garden
- Configuring a WLAN SSID for Guest Access
  - In the Instant UI
  - In the CLI
- Configuring Wired Profile for Guest Access
  - In the Instant UI
  - In the CLI
- Configuring Internal Captive Portal for Guest Network
  - In the Instant UI
  - In the CLI
- wConfiguring External Captive Portal for a Guest Network
- Configuring Facebook Login
- Configuring Guest Logon Role and Access Rules for Guest Users
  - In the Instant UI
  - In the CLI
    - Example
- Configuring Captive Portal Roles for an SSID
  - In the Instant UI
  - In the CLI
- Configuring Walled Garden Access
Authentication and User Management
- Managing W-IAP Users
- Supported Authentication Methods
- Supported EAP Authentication Frameworks
  - Authentication Termination on W-IAP
- Configuring Authentication Servers
- Understanding Encryption Types
  - WPA and WPA2
  - Recommended Authentication and Encryption Combinations
- Configuring Authentication Survivability
  - Enabling Authentication Survivability
    - In the Instant UI
      - Important Points to Remember
    - In the CLI
- Configuring 802.1X Authentication for a Network Profile
  - Configuring 802.1X Authentication for a Wireless Network Profile
    - In the Instant UI
    - In the CLI
  - Configuring 802.1X Authentication for Wired Profiles
    - In the Instant UI
    - In the CLI
- Configuring MAC Authentication for a Network Profile
  - Configuring MAC Authentication for Wireless Network Profiles
    - In the Instant UI
    - In the CLI
  - Configuring MAC Authentication for Wired Profiles
    - In the Instant UI
    - In the CLI
- FConfiguring MAC Authentication with 802.1X Authentication
  - Configuring MAC and 802.1X Authentication for a Wireless Network Profile
    - In the Instant UI
    - In the CLI
  - Configuring MAC and 802.1X Authentication for Wired Profiles
    - In the Instant UI
    - In the CLI
- hConfiguring MAC Authentication with Captive Portal Authentication
  - In the Instant UI
  - In the CLI
- Configuring WISPr Authentication
  - In the Instant UI
  - In the CLI
- Blacklisting Clients
  - Blacklisting Clients Manually
  - Blacklisting Users Dynamically
- Uploading Certificates
Roles and Policies
- Firewall Policies
- Content Filtering
- Configuring User Roles
- Configuring Derivation Rules
- Using Advanced Expressions in Role and VLAN Derivation Rules
  - Configuring a User Role for VLAN Derivation
    - Creating a User VLAN Role
      - In the Instant UI
      - In the CLI
    - Assigning User VLAN Roles to a Network Profile
      - In the Instant UI
      - In the CLI
DHCP Configuration
- Configuring DHCP Scopes
- Configuring the Default DHCP Scope for Client IP Assignment
  - In the Instant UI
  - In the CLI
VPN Configuration
- Understanding VPN Features
  - Supported VPN Protocols
- Configuring a Tunnel from a W-IAP to Dell Networking W-Series Mobility Contro...
- Configuring Routing Profiles
  - In the Instant UI
  - In the CLI
IAP-VPN Deployment
- Understanding IAP-VPN Architecture
  - IAP-VPN Scalability Limits
  - IAP-VPN Forwarding Modes
- Configuring W-IAP and Controller for IAP-VPN Operations
  - Configuring a W-IAP network for IAP-VPN operations
  - Configuring a Controller for IAP-VPN Operations
Adaptive Radio Management
- ARM Overview
- Configuring ARM Features on a W-IAP
- Configuring Radio Settings
  - In the Instant UI
    - In the CLI
Deep Packet Inspection and Application Visibility
- Deep Packet Inspection
- Enabling Application Visibility
  - In the Instant UI
  - In the CLI
- Application Visibility
- Configuring ACL Rules for Application and Application Categories
  - In the Instant UI
  - In the CLI
    - Example
- Configuring Web Policy Enforcement Service
  - In the Instant UI
  - In the CLI
    - Example
Voice and Video
- Wi-Fi Multimedia Traffic Management
  - Configuring WMM for Wireless Clients
    - In the Instant UI
    - In the CLI
  - Configuring WMM-DSCP Mapping
    - In the Instant UI
    - In the CLI
- QoS for Microsoft Office Lync
  - Microsoft Office Lync
Services
- AirGroup Configuration
- Configuring a W-IAP for RTLS Support
  - In the Instant UI
  - In the CLI
- Configuring a W-IAP for Analytics and Location Engine Support
  - ALE with Instant
  - Enabling ALE Support on a W-IAP
- Configuring OpenDNS Credentials
  - In the Instant UI
  - In the CLI
- Integrating a W-IAP with Palo Alto Networks Firewall
  - Integration with Instant
  - Configuring a W-IAP for PAN integration
    - In the Instant UI
    - In the CLI
- Integrating a W-IAP with an XML API interface
  - Integration with Instant
  - Configuring a W-IAP for XML API integration
    - In the Instant UI
    - In the CLI
- CALEA Integration and Lawful Intercept Compliance
W-IAP Management and Monitoring
- Managing a W-IAP from W-AirWave
Uplink Configuration
- Uplink Interfaces
- Uplink Preferences and Switching
Intrusion Detection
- Detecting and Classifying Rogue APs
- OS Fingerprinting
- Configuring Wireless Intrusion Protection and Detection Levels
  - Containment Methods
- Configuring IDS Using CLI
Mesh W-IAP Configuration
- Mesh Network Overview
  - Mesh W-IAPs
    - Mesh Portals
    - Mesh Points
- Setting up Instant Mesh Network
- Configuring Wired Bridging on Ethernet 0 for Mesh Point
  - In the Instant UI
  - In the CLI
Mobility and Client Management
- Layer-3 Mobility Overview
- Configuring L3-Mobility
  - Home Agent Load Balancing
  - Configuring a Mobility Domain for Instant
    - In the Instant UI
    - In the CLI
Spectrum Monitor
- Understanding Spectrum Data
- Configuring Spectrum Monitors and Hybrid W-IAPs
  - Converting a W-IAP to a Hybrid W-IAP
    - In the Instant UI
    - In the CLI
  - Converting a W-IAP to a Spectrum Monitor
    - In the Instant UI
    - In the CLI
W-IAP Maintenance
- Upgrading a W-IAP
- Backing up and Restoring W-IAP Configuration Data
- Converting a W-IAP to a Remote AP and Campus AP
- Resetting a Remote AP or Campus AP to a W-IAP
- Rebooting the W-IAP
Monitoring Devices and Logs
- Configuring SNMP
- Configuring a Syslog Server
- Running Debug Commands from the UI
Hotspot Profiles
- Understanding Hotspot Profiles
- Configuring Hotspot Profiles
- Sample Configuration
ClearPass Guest Setup
- Testing
- Troubleshooting
IAP-VPN Deployment Scenarios
- Scenario 1—IPSec: Single Datacenter Deployment with No Redundancy
- Scenario 2—IPSec: Single Datacenter with Multiple Controllers for Redundancy
- Scenario 3—IPSec: Multiple Datacenter Deployment with Primary and Backup Cont...
- Scenario 4—GRE: Single Datacenter Deployment with No Redundancy
Terminology
- Acronyms and Abbreviations
- Glossary

l 10.40.0.0/16 subnet is reserved for L3 mode –used by Contractor SSID.

l 172.16.20.0/24 subnet is used for NAT mode – used for wired network.

l Client count in each branch is 200.

l Contractors are only permitted to reach 10.16.0.0/16 network.

AP Configuration

This section provides information on configuration steps performed through the CLI or the UI.

Configuration Steps CLI Commands UI Procedure

1. Configure the primary IP

address. This IP address

is the Public IP address of

the controller. Fast

failover is enabled for

fast convergence.

(ap)(config)# vpn primary <public IP of primary

controller>

(ap)(config)# vpn backup <public IP of backup

controllers>

(ap)(config)# vpn preemption

(ap)(config)# vpn fast-failover

See

Configuring an

IPSec Tunnel

2. Configure routing

profiles to tunnel traffic

through IPSec.

(ap)(config)# routing-profile

(ap)(routing-profile)# route 0.0.0.0 0.0.0.0 <public

IP of primary controller>

(ap)(routing-profile)# route 10.0.0.0 255.0.0.0

See

Configuring

Routing

Profiles

3. Configure Enterprise

DNS for split DNS. The

example in the next

column uses a specific

enterprise domain to

tunnel all DNS queries

matching that domain to

corporate.

(ap)(config)# internal-domains

(ap)(domains)# domain-name corpdomain.com

See

Configuring

Enterprise

Domains

4. Configure distributed L3

DHCP profiles with VLAN

30 and 40.

Distributed L3 profile with VLAN30

(ap)(config)# ip dhcp l3-dhcp

(ap)(DHCP profile "l3-dhcp")# server-type

Distributed,L3

(ap)(DHCP profile "l3-dhcp")# server-vlan 30

(ap)(DHCP profile "l3-dhcp")# ip-range 10.30.0.0

10.30.255.255

(ap)(DHCP profile "l3-dhcp")# dns-server

10.1.1.50,10.1.1.30

(ap)(DHCP profile "l3-dhcp")# domain-name

corpdomain.com

(ap)(DHCP profile "l3-dhcp")# client-count 200

Distributed L3 profile with VLAN40

(ap)(config)# ip dhcp l3-dhcp

(ap)(DHCP profile "l3-dhcp")# server-type

Distributed,L3

(ap)(DHCP profile "l3-dhcp")# server-vlan 40

(ap)(DHCP profile "l3-dhcp")# ip-range 10.40.0.0

10.40.255.255

(ap)(DHCP profile "l3-dhcp")# dns-server

10.1.1.50,10.1.1.30

(ap)(DHCP profile "l3-dhcp")# domain-name

corpdomain.com

See

Configuring

Distributed

DHCP Scopes

and

Configuring

Local DHCP

Scopes

Table 77: W-IAP Configuration for Scenario 3—IPSec: Multiple Datacenter Deployment

Dell Networking W-Series Instant 6.4.3.1-4.2.0.0 | User Guide IAP-VPN Deployment Scenarios | 390