Users Guide

b. Enter the mobility domain ID value (1-65535) in the 802.11r Mobility Domain ID field. The default
value is 1.
c. Enter the R1 Key timeout value in seconds (60-86400) for decrypt-tunnel or bridge mode in the 802.11r
R1 Key Duration field. The default value is 3600.
6. Click Apply to save your settings.
In the CLI
Create an 802.11r profile using the following command:
(host) (config) #wlan dot11r-profile <profile> dot11r
Troubleshooting Fast BSS Transition
ArubaOS provides various troubleshooting options to verify the Fast BSS Transition functionalities.
In decrypt-tunnel mode and bridge mode, each r0 key generates up to four r1 keys and the controller pushes
each r1 key to the corresponding AP. The following commands help verifying the pushing functionality:
Execute the following command to view all the r1 keys that are stored in an AP:
(host)(config) #show ap debug dot11r state
You can use the following command to remove an r1 key from an AP when the AP does not have a cached r1
key during Fast BSS Transition roaming.
(host) #ap debug dot11r remove-key
Execute the following command to view the hit/miss rate of r1 keys cached on an AP before a Fast BSS
Transition roaming. This counter helps to verify if enough r1 keys are pushed to the neighboring APs.
(host)(config) #show ap debug dot11r efficiency <client-mac>
SSIDProfiles
A Service Set Identifier (SSID) is the network or WLAN that any client sees. A SSID profile defines the name of
the network, authentication type for the network, basic rates, transmit rates, SSID cloaking, and certain WMM
settings for the network.
SSID Profile Overview
ArubaOS supports different types of the Advanced Encryption Standard (AES), Temporal Key Integrity Protocol
(TKIP), and wired equivalent privacy (WEP) encryption. AES is the most secure and recommended encryption
method. Most modern devices are AES capable and AES should be the default encryption method. Use TKIP
only when the network includes devices that do not support AES. In these situations, use a separate SSID for
devices that are only capable of TKIP.
Suite-B Cryptography
The Suite-B (bSec) protocol is a pre-standard protocol that has been proposed to the IEEE 802.11 committee as
an alternative to 802.11i. The main difference between bSec and standard 802.11i is that bSec implements
Suite-B algorithms wherever possible. Notably, AES-CCM is replaced by AES-GCM, and the Key Derivation
Function (KDF) of 802.11i is upgraded to support SHA-256 and SHA-384. In order to provide interoperability
with standard Wi-Fi software drivers, bSec is implemented as a shim layer between standard 802.11 Wi-Fi and a
Layer 3 protocol such as IP. A controller configured to advertise a bSec SSID will advertise an open network,
however only bSec frames will be permitted on the network.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Virtual APs |
428