Concept Guide
Table Of Contents
- About this Guide
- About Instant
- Setting up a W-IAP
- Automatic Retrieval of Configuration
- Instant User Interface
- Initial Configuration Tasks
- Customizing W-IAP Settings
- Modifying the W-IAP Host Name
- Configuring Zone Settings on a W-IAP
- Specifying a Method for Obtaining IP Address
- Configuring External Antenna
- Configuring Radio Profiles for a W-IAP
- Configuring Uplink VLAN for a W-IAP
- Changing the W-IAP Installation Mode
- Changing USB Port Status
- Master Election and Virtual Controller
- Adding a W-IAP to the Network
- Removing a W-IAP from the Network
- VLAN Configuration
- IPv6 Support
- Wireless Network Profiles
- Configuring Wireless Network Profiles
- Configuring Fast Roaming for Wireless Clients
- Configuring Modulation Rates on a WLAN SSID
- Multi-User-MIMO
- Management Frame Protection
- Disabling Short Preamble for Wireless Client
- Editing Status of a WLAN SSID Profile
- Editing a WLAN SSID Profile
- Deleting a WLAN SSID Profile
- Wired Profiles
- Captive Portal for Guest Access
- Understanding Captive Portal
- Configuring a WLAN SSID for Guest Access
- Configuring Wired Profile for Guest Access
- Configuring Internal Captive Portal for Guest Network
- Configuring External Captive Portal for a Guest Network
- Configuring Facebook Login
- Configuring Guest Logon Role and Access Rules for Guest Users
- Configuring Captive Portal Roles for an SSID
- Configuring Walled Garden Access
- Authentication and User Management
- Managing W-IAP Users
- Supported Authentication Methods
- Supported EAP Authentication Frameworks
- Configuring Authentication Servers
- Understanding Encryption Types
- Configuring Authentication Survivability
- Configuring 802.1X Authentication for a Network Profile
- Enabling 802.1X Supplicant Support
- Configuring MAC Authentication for a Network Profile
- Configuring MAC Authentication with 802.1X Authentication
- Configuring MAC Authentication with Captive Portal Authentication
- Configuring WISPr Authentication
- Blacklisting Clients
- Uploading Certificates
- Roles and Policies
- DHCP Configuration
- Configuring Time-Based Services
- Dynamic DNS Registration
- VPN Configuration
- IAP-VPN Deployment
- Adaptive Radio Management
- Deep Packet Inspection and Application Visibility
- Voice and Video
- Services
- Configuring AirGroup
- Configuring a W-IAP for RTLS Support
- Configuring a W-IAP for Analytics and Location Engine Support
- Managing BLE Beacons
- Clarity Live
- Configuring OpenDNS Credentials
- Integrating a W-IAP with Palo Alto Networks Firewall
- Integrating a W-IAP with an XML API Interface
- CALEA Integration and Lawful Intercept Compliance
- Cluster Security
- W-IAP Management and Monitoring
- Uplink Configuration
- Intrusion Detection
- Mesh W-IAP Configuration
- Mobility and Client Management
- Spectrum Monitor
- W-IAP Maintenance
- Monitoring Devices and Logs
- Hotspot Profiles
- ClearPass Guest Setup
- IAP-VPN Deployment Scenarios
- Acronyms and Abbreviations
Parameter Description
RFC 3576 Select Enabled to allow the W-IAPs to process RFC 3576-compliant Change of Authorization (CoA)
and disconnect messages from the RADIUS server. Disconnect messages cause a user session to
be terminated immediately, whereas the CoA messages modify session authorization attributes
such as data filters.
RFC5997 This helps to detect the server status of the RADIUSserver. Every time there is an authentication or
accounting request timeout, the W-IAP will send a status request enquiry to get the actual status of
the RADIUS server before confirming the status of the server to be DOWN.
l Authentication—Select this checkbox to ensure the W-IAP sends a status-server request to
determine the actual state of the authentication server before marking the server as
unavailable.
l Accounting—Select this checkbox to ensure the W-IAP sends a status-server request to
determine the actual state of the accounting server before marking the server as unavailable.
NOTE: You can choose to select either the Authentication or Accounting checkboxes or select both
checkboxes to support RFC5997.
NAS IP
address
Allows you to configure an arbitrary IP address to be used as RADIUS attribute 4, NAS IP Address,
without changing source IP Address in the IP header of the RADIUS packet.
NOTE: If you do not enter the IP address, the VC IP address is used by default when Dynamic
RADIUS Proxy is enabled.
NAS
Identifier
Allows you to configure strings for RADIUS attribute 32, NAS Identifier, to be sent with RADIUS
requests to the RADIUS server.
Dead Time Specify a dead time for authentication server in minutes.
When two or more authentication servers are configured on the W-IAP and a server is unavailable,
the dead time configuration determines the duration for which the authentication server would be
available if the server is marked as unavailable.
Dynamic
RADIUS
proxy
parameters
Specify the following dynamic RADIUS proxy (DRP) parameters:
l DRP IP—IP address to be used as source IP for RADIUS packets.
l DRP Mask—Subnet mask of the DRP IP address.
l DRP VLAN—VLAN in which the RADIUS packets are sent.
l DRP Gateway—Gateway IP address of the DRP VLAN.
For more information on dynamic RADIUS proxy parameters and configuration procedure, see
Configuring Dynamic RADIUSProxy Parameters on page 158.
Table 33: RADIUSServer Configuration Parameters
To assign the RADIUSauthentication server to a network profile, select the newly added server when
configuring security settings for a wireless or wired network profile.
You can also add an external RADIUSserver by selecting the New option when configuring a WLAN or wired
profile. For more information, see Configuring Security Settings for a WLAN SSID Profile on page 86 and
Configuring Security Settings for a Wired Profile on page 106.
l LDAP—To configure an LDAP server, select the LDAP option and configure the attributes described in the
following table:
Dell Networking W-Series Instant 6.5.1.0-4.3.1.0 | User Guide Authentication and User Management | 153