User Guide

ManualsBrandsNortel Networks ManualsOther2300

Table Of Contents

Nortel WLAN Security Switch 2300 Series Configuration Guide
Contents
How to get Help
Introducing the Nortel WLAN 2300 System
- Nortel WLAN 2300 System
- Documentation
  - Safety and Advisory Notices
  - Text and Syntax Conventions
Using the Command-Line Interface
- CLI Conventions
- Command-Line Editing
- Using CLI Help
- Understanding Command Descriptions
Configuring AAA for Administrative and Local Access
- Overview of AAA for Administrative and Local Access
- Before You Start
- About Administrative Access
  - Access Modes
  - Types of Administrative Access
- First-Time Configuration using the Console
- Configuring Accounting for Administrative Users
- Displaying the AAA Configuration
- Saving the Configuration
- Administrative AAA Configuration Scenarios
Configuring and Managing Ports and VLANs
- Configuring and Managing Ports
- Configuring and Managing VLANs
- Managing the Layer 2 Forwarding Database
- Port and VLAN Configuration Scenario
Configuring and Managing IP Interfaces and Services
- MTU Support
- Configuring and Managing IP Interfaces
- Configuring the System IP Address
- Configuring and Managing IP Routes
- Managing the Management Services
- Configuring and Managing DNS
- Configuring and Managing Aliases
- Configuring and Managing Time Parameters
- Managing the ARP Table
- Pinging Another Device
- Logging In to a Remote Device
- Tracing a Route
- IP Interfaces and Services Configuration Scenario
Configuring SNMP
- Overview
- Configuring SNMP
- Displaying SNMP Information
Configuring and Managing Mobility Domain Roaming
- About the Mobility Domain Feature
- Configuring a Mobility Domain
- Monitoring the VLANs and Tunnels in a Mobility Domain
- Understanding the Sessions of Roaming Users
- Mobility Domain Scenario
Configuring User Encryption
- Configuring WPA
- Configuring RSN (802.11i)
- Configuring WEP
  - Setting Static WEP Key Values
  - Assigning Static WEP Keys
- Encryption Configuration Scenarios
Configuring AP access points
- AP Overview
- Configuring AP access points
- Disabling or Reenabling Radios
- Displaying AP Information
Configuring RF Auto-Tuning
- RF Auto-Tuning Overview
- Changing RF Auto-Tuning Settings
- Displaying RF Auto-Tuning Information
Wi-Fi Multimedia
- How WMM Works in WSS Software
  - QoS on the WSS Switch
  - QoS on an AP
- Disabling or Reenabling WMM
- Displaying WMM Information
Configuring and Managing Spanning Tree Protocol
- Enabling the Spanning Tree Protocol
- Changing Standard Spanning Tree Parameters
- Configuring and Managing STP Fast Convergence Features
- Displaying Spanning Tree Information
- Spanning Tree Configuration Scenario
Configuring and Managing IGMP Snooping
- Disabling or Reenabling IGMP Snooping
- Disabling or Reenabling Proxy Reporting
- Enabling the Pseudo-Querier
- Changing IGMP Timers
- Enabling Router Solicitation
  - Changing the Router Solicitation Interval
- Configuring Static Multicast Ports
  - Adding or Removing a Static Multicast Router Port
  - Adding or Removing a Static Multicast Receiver Port
- Displaying Multicast Information
Configuring and Managing Security ACLs
- About Security Access Control Lists
  - Overview of Security ACL Commands
  - Security ACL Filters
- Creating and Committing a Security ACL
- Mapping Security ACLs
  - Mapping User-Based Security ACLs
  - Mapping Security ACLs to Ports, VLANs, Virtual Ports, or Distributed APs
    - Displaying ACL Maps to Ports, VLANs, and Virtual Ports
    - Clearing a Security ACL Map
- Modifying a Security ACL
- Using ACLs to Change CoS
  - Filtering Based on DSCP Values
- Enabling Prioritization for Legacy Voice over IP
  - Enabling SVP Optimization for SpectraLink Phones
- Security ACL Configuration Scenario
Managing Keys and Certificates
- Why Use Keys and Certificates?
  - Wireless Security through TLS
  - PEAP-MS-CHAP-V2 Security
- About Keys and Certificates
- Creating Keys and Certificates
- Displaying Certificate and Key Information
- Key and Certificate Configuration Scenarios
Configuring AAA for Network Users
- About AAA for Network Users
- AAA Tools for Network Users
- Configuring 802.1X Authentication
- Configuring Authentication and Authorization by MAC Address
- Configuring Web-based AAA
- Configuring Last-Resort Access
- Configuring AAA for Users of Third-Party APs
- Assigning Authorization Attributes
- Overriding or Adding Attributes Locally with a Location Policy
- Configuring Accounting for Wireless Network Users
  - Viewing Local Accounting Records
  - Viewing Roaming Accounting Records
- Displaying the AAA Configuration
- Avoiding AAA Problems in Configuration Order
  - Using the Wildcard “Any” as the SSID Name in Authentication Rules
  - Using Authentication and Accounting Rules Together
    - Configuration Producing an Incorrect Processing Order
    - Configuration for a Correct Processing Order
- Configuring a Mobility Profile
- Network User Configuration Scenarios
Configuring Communication with RADIUS
- RADIUS Overview
- Before You Begin
- Configuring RADIUS Servers
- Configuring RADIUS Server Groups
  - Creating Server Groups
  - Deleting a Server Group
- RADIUS and Server Group Configuration Scenario
Managing 802.1X on the WSS Switch
- Managing 802.1X on Wired Authentication Ports
  - Enabling and Disabling 802.1X Globally
  - Setting 802.1X Port Control
- Managing 802.1X Encryption Keys
- Setting EAP Retransmission Attempts
- Managing 802.1X Client Reauthentication
- Managing Other Timers
- Displaying 802.1X Information
Managing Sessions
- About the Session Manager
- Displaying and Clearing Administrative Sessions
- Displaying and Clearing Network Sessions
Managing System Files
- About System Files
  - Displaying Software Version Information
  - Displaying Boot Information
- Working with Files
- Managing Configuration Files
- Backing Up and Restoring the System
  - Managing Configuration Changes
  - Backup and Restore Examples
- Upgrading the System Image
Rogue Detection and Countermeasures
- About Rogues and RF Detection
- Summary of Rogue Detection Features
- Configuring Rogue Detection Lists
- Enabling Countermeasures
- Disabling or Reenabling Active Scan
- Enabling AP Signatures
- Disabling or Reenabling Logging of Rogues
- Enabling Rogue and Countermeasures Notifications
- IDS and DoS Alerts
- Displaying RF Detection Information
Appendix A: Troubleshooting a WS Switch
- Fixing Common WSS Setup Problems
- Recovering the System Password
  - WSS-2350
  - WSS-2370, WSS-2380, or WSS-2360
- Configuring and Managing the System Log
- Running Traces
- Using Show Commands
- Remotely Monitoring Traffic
- Capturing System Information for Technical Support
  - Displaying Technical Support Information
  - Sending Information to NETS
Appendix B: Supported RADIUS Attributes
- Supported Standard and Extended Attributes
- Nortel Vendor-Specific Attributes
Appendix C: Mobility Domain Traffic Ports
Appendix D: DHCP Server
- How the WSS Software DHCP Server Works
- Configuring the DHCP Server
- Displaying DHCP Server Information
Glossary
Index
Command Index

Contents 17

Nortel WLAN Security Switch 2300 Series Configuration Guide

Configuring and Managing Mobility Domain Roaming 175

About the Mobility Domain Feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

Configuring a Mobility Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

Configuring the Seed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

Configuring Member WSSs on the Seed . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

Configuring a Member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Displaying Mobility Domain Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Displaying the Mobility Domain Configuration . . . . . . . . . . . . . . . . . . . . . . . . 181

Clearing a Mobility Domain from a WSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

Clearing a Mobility Domain Member from a Seed . . . . . . . . . . . . . . . . . . . . 183

Monitoring the VLANs and Tunnels in a Mobility Domain . . . . . . . . . . . . . . . . . . 183

Displaying Roaming Stations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

Displaying Roaming VLANs and Their Affinities . . . . . . . . . . . . . . . . . . . . . . 185

Displaying Tunnel Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Understanding the Sessions of Roaming Users . . . . . . . . . . . . . . . . . . . . . . . . . 186

Requirements for Roaming to Succeed . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Effects of Timers on Roaming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Monitoring Roaming Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Mobility Domain Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Configuring User Encryption 191

Configuring WPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

WPA Cipher Suites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

TKIP Countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

WPA Authentication Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

WPA Information Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

Client Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Configuring WPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Configuring RSN (802.11i) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

Configuring WEP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

Setting Static WEP Key Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

Assigning Static WEP Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Encryption Configuration Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Enabling WPA with TKIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Enabling Dynamic WEP in a WPA Network . . . . . . . . . . . . . . . . . . . . . . . . . 215