Concept Guide

ManualsBrandsDell ManualsAccess PlatformsW-Series 277 Access Points

391

392

393

394

395

396

397

398

399

400

Table Of Contents

About this Guide
- Intended Audience
- Related Documents
- Conventions
- Contacting Dell
About Instant
- Instant Overview
- What is New in this Release
  - Support for New W-IAP Devices
  - No Support for W-IAP92/93
Setting up a W-IAP
- Setting up Instant Network
- Logging in to the Instant UI
  - Regulatory Domains
  - Specifying Country Code
- Accessing the Instant CLI
Automatic Retrieval of Configuration
- Managed Mode Operations
- Pre-requisites
- Configuring Managed Mode Parameters
  - Example
- Verifying the Configuration
Instant User Interface
- Login Screen
- Main Window
Initial Configuration Tasks
- Basic Configuration Tasks
- Additional Configuration Tasks
Customizing W-IAP Settings
- Modifying the W-IAP Hostname
  - In the Instant UI
  - In the CLI
- Configuring Zone Settings on a W-IAP
  - In the Instant UI
  - In the CLI
- Specifying a Method for Obtaining IP Address
  - In the Instant UI
  - In the CLI
- Configuring External Antenna
  - EIRP and Antenna Gain
  - Configuring Antenna Gain
    - In the Instant UI
    - In the CLI
- Configuring Radio Profiles for a W-IAP
- Configuring Uplink VLAN for a W-IAP
  - In the Instant UI
  - In the CLI
- Changing USB Port Status
  - In the Instant UI
  - In the CLI
- Master Election and Virtual Controller
  - Master Election Protocol
  - Manual Provisioning of Master W-IAP
    - Provisioning a W-IAP as a Master W-IAP
      - In the Instant UI
      - In the CLI
- Adding a W-IAP to the Network
- Removing a W-IAP from the Network
VLAN Configuration
- VLAN Pooling
- Uplink VLAN Monitoring and Detection on Upstream Devices
Wireless Network Profiles
- Configuring Wireless Network Profiles
- Configuring Fast Roaming for Wireless Clients
- Editing Status of a WLAN SSID Profile
  - In the Instant UI
  - In the CLI
- Editing a WLAN SSID Profile
- Deleting a WLAN SSID Profile
Wired Profiles
- Configuring a Wired Profile
- Assigning a Profile to Ethernet Ports
  - In the Instant UI
  - In the CLI
- Editing a Wired Profile
- Deleting a Wired Profile
- Link Aggregation Control Protocol
- Understanding Hierarchical Deployment
Captive Portal for Guest Access
- Understanding Captive Portal
  - Types of Captive Portal
  - Walled Garden
- Configuring a WLAN SSID for Guest Access
  - In the Instant UI
  - In the CLI
- Configuring Wired Profile for Guest Access
  - In the Instant UI
  - In the CLI
- Configuring Internal Captive Portal for Guest Network
  - In the Instant UI
  - In the CLI
- wConfiguring External Captive Portal for a Guest Network
- Configuring Facebook Login
- Configuring Guest Logon Role and Access Rules for Guest Users
  - In the Instant UI
  - In the CLI
    - Example
- Configuring Captive Portal Roles for an SSID
  - In the Instant UI
  - In the CLI
- Configuring Walled Garden Access
Authentication and User Management
- Managing W-IAP Users
- Supported Authentication Methods
- Supported EAP Authentication Frameworks
  - Authentication Termination on W-IAP
- Configuring Authentication Servers
- Understanding Encryption Types
  - WPA and WPA2
  - Recommended Authentication and Encryption Combinations
- Configuring Authentication Survivability
  - Enabling Authentication Survivability
    - In the Instant UI
      - Important Points to Remember
    - In the CLI
- Configuring 802.1X Authentication for a Network Profile
  - Configuring 802.1X Authentication for a Wireless Network Profile
    - In the Instant UI
    - In the CLI
  - Configuring 802.1X Authentication for Wired Profiles
    - In the Instant UI
    - In the CLI
- Configuring MAC Authentication for a Network Profile
  - Configuring MAC Authentication for Wireless Network Profiles
    - In the Instant UI
    - In the CLI
  - Configuring MAC Authentication for Wired Profiles
    - In the Instant UI
    - In the CLI
- FConfiguring MAC Authentication with 802.1X Authentication
  - Configuring MAC and 802.1X Authentication for a Wireless Network Profile
    - In the Instant UI
    - In the CLI
  - Configuring MAC and 802.1X Authentication for Wired Profiles
    - In the Instant UI
    - In the CLI
- hConfiguring MAC Authentication with Captive Portal Authentication
  - In the Instant UI
  - In the CLI
- Configuring WISPr Authentication
  - In the Instant UI
  - In the CLI
- Blacklisting Clients
  - Blacklisting Clients Manually
  - Blacklisting Users Dynamically
- Uploading Certificates
Roles and Policies
- Firewall Policies
- Content Filtering
- Configuring User Roles
- Configuring Derivation Rules
- Using Advanced Expressions in Role and VLAN Derivation Rules
  - Configuring a User Role for VLAN Derivation
    - Creating a User VLAN Role
      - In the Instant UI
      - In the CLI
    - Assigning User VLAN Roles to a Network Profile
      - In the Instant UI
      - In the CLI
DHCP Configuration
- Configuring DHCP Scopes
- Configuring the Default DHCP Scope for Client IP Assignment
  - In the Instant UI
  - In the CLI
VPN Configuration
- Understanding VPN Features
  - Supported VPN Protocols
- Configuring a Tunnel from a W-IAP to Dell Networking W-Series Mobility Contro...
- Configuring Routing Profiles
  - In the Instant UI
  - In the CLI
IAP-VPN Deployment
- Understanding IAP-VPN Architecture
  - IAP-VPN Scalability Limits
  - IAP-VPN Forwarding Modes
- Configuring W-IAP and Controller for IAP-VPN Operations
  - Configuring a W-IAP network for IAP-VPN operations
  - Configuring a Controller for IAP-VPN Operations
Adaptive Radio Management
- ARM Overview
- Configuring ARM Features on a W-IAP
- Configuring Radio Settings
  - In the Instant UI
    - In the CLI
Deep Packet Inspection and Application Visibility
- Deep Packet Inspection
- Enabling Application Visibility
  - In the Instant UI
  - In the CLI
- Application Visibility
- Configuring ACL Rules for Application and Application Categories
  - In the Instant UI
  - In the CLI
    - Example
- Configuring Web Policy Enforcement Service
  - In the Instant UI
  - In the CLI
    - Example
Voice and Video
- Wi-Fi Multimedia Traffic Management
  - Configuring WMM for Wireless Clients
    - In the Instant UI
    - In the CLI
  - Configuring WMM-DSCP Mapping
    - In the Instant UI
    - In the CLI
- QoS for Microsoft Office Lync
  - Microsoft Office Lync
Services
- AirGroup Configuration
- Configuring a W-IAP for RTLS Support
  - In the Instant UI
  - In the CLI
- Configuring a W-IAP for Analytics and Location Engine Support
  - ALE with Instant
  - Enabling ALE Support on a W-IAP
- Configuring OpenDNS Credentials
  - In the Instant UI
  - In the CLI
- Integrating a W-IAP with Palo Alto Networks Firewall
  - Integration with Instant
  - Configuring a W-IAP for PAN integration
    - In the Instant UI
    - In the CLI
- Integrating a W-IAP with an XML API interface
  - Integration with Instant
  - Configuring a W-IAP for XML API integration
    - In the Instant UI
    - In the CLI
- CALEA Integration and Lawful Intercept Compliance
W-IAP Management and Monitoring
- Managing a W-IAP from W-AirWave
Uplink Configuration
- Uplink Interfaces
- Uplink Preferences and Switching
Intrusion Detection
- Detecting and Classifying Rogue APs
- OS Fingerprinting
- Configuring Wireless Intrusion Protection and Detection Levels
  - Containment Methods
- Configuring IDS Using CLI
Mesh W-IAP Configuration
- Mesh Network Overview
  - Mesh W-IAPs
    - Mesh Portals
    - Mesh Points
- Setting up Instant Mesh Network
- Configuring Wired Bridging on Ethernet 0 for Mesh Point
  - In the Instant UI
  - In the CLI
Mobility and Client Management
- Layer-3 Mobility Overview
- Configuring L3-Mobility
  - Home Agent Load Balancing
  - Configuring a Mobility Domain for Instant
    - In the Instant UI
    - In the CLI
Spectrum Monitor
- Understanding Spectrum Data
- Configuring Spectrum Monitors and Hybrid W-IAPs
  - Converting a W-IAP to a Hybrid W-IAP
    - In the Instant UI
    - In the CLI
  - Converting a W-IAP to a Spectrum Monitor
    - In the Instant UI
    - In the CLI
W-IAP Maintenance
- Upgrading a W-IAP
- Backing up and Restoring W-IAP Configuration Data
- Converting a W-IAP to a Remote AP and Campus AP
- Resetting a Remote AP or Campus AP to a W-IAP
- Rebooting the W-IAP
Monitoring Devices and Logs
- Configuring SNMP
- Configuring a Syslog Server
- Running Debug Commands from the UI
Hotspot Profiles
- Understanding Hotspot Profiles
- Configuring Hotspot Profiles
- Sample Configuration
ClearPass Guest Setup
- Testing
- Troubleshooting
IAP-VPN Deployment Scenarios
- Scenario 1—IPSec: Single Datacenter Deployment with No Redundancy
- Scenario 2—IPSec: Single Datacenter with Multiple Controllers for Redundancy
- Scenario 3—IPSec: Multiple Datacenter Deployment with Primary and Backup Cont...
- Scenario 4—GRE: Single Datacenter Deployment with No Redundancy
Terminology
- Acronyms and Abbreviations
- Glossary

Configuration Steps CLI Commands UI Procedure

Configure a wireless SSID to operate in L3 mode for employee

and associate distributed L3 mode VLAN 30 to the WLAN SSID

profile.

(ap)(config) # wlan ssid-profile wireless-ssid

(ap)(SSID Profile "wireless-ssid")# enable

(ap)(SSID Profile "wireless-ssid")# type employee

(ap)(SSID Profile "wireless-ssid")# essid wireless-

ssid

(ap)(SSID Profile "wireless-ssid")# opmode wpa2-aes

(ap)(SSID Profile "wireless-ssid")# vlan 30

(ap)(SSID Profile "wireless-ssid")# auth-server

server1

(ap)(SSID Profile "wireless-ssid")# auth-server

server2

(ap)(SSID Profile "wireless-ssid")# auth-

survivability

Configure a wireless SSID is configured to operate in L3 mode for

contractor and associate distributed L3 mode VLAN 40 to the

WLAN SSID profile.

(ap)(config) # wlan ssid-profile wireless-ssid-

contractor

(ap)(SSID Profile "wireless-ssid-contractor")#

enable

(ap)(SSID Profile "wireless-ssid-contractor")# type

employee

(ap)(SSID Profile "wireless-ssid-contractor")# essid

wireless-ssid-contractor

(ap)(SSID Profile "wireless-ssid-contractor")#

opmode wpa2-aes

(ap)(SSID Profile "wireless-ssid-contractor")# vlan

(ap)(SSID Profile "wireless-ssid-contractor")# auth-

server server1

(ap)(SSID Profile "wireless-ssid-contractor")# auth-

server server2

(ap)(SSID Profile "wireless-ssid-contractor")# auth-

survivability

7. Create access rule for

wired and wireless

authentication. In this

example, the rule

permits all traffic. For

contractor SSID role, the

rule allows only

10.16.0.0/16 network and

all other traffic address is

translated at the source

and the global routing

profile definition is

bypassed.

For wired profile:

(ap)(config)# wlan access-rule wired-port

(ap)(Access Rule "wired-port")# rule any any match

any any any

permit

For WLAN SSID employee roles:

(ap)(config)# wlan access-rule wireless-ssid

(ap)(Access Rule "wireless-ssid")# rule any any

match any any any permit

For WLAN SSID contractor roles:

(ap)(config)# wlan access-rule wireless-ssid-

contractor

See

Configuring

ACL Rules for

Network

Services

Table 77: W-IAP Configuration for Scenario 3—IPSec: Multiple Datacenter Deployment

Dell Networking W-Series Instant 6.4.3.1-4.2.0.0 | User Guide IAP-VPN Deployment Scenarios | 392