User manual

ManualsBrandsNortel Networks ManualsSoftwareSwitch 2300

Part No. NN47250-500 (320657-F)

October 2007

4655 Great America Parkway

Santa Clara, CA 95054

*320657-F*

Nortel WLAN—Security

Switch 2300 Series

Configuration Guide

Summary of content (758 pages)

PAGE 1
Part No.
PAGE 2
Copyright © 2007 Nortel Networks. All rights reserved. The information in this document is subject to change without notice. The statements, configurations, technical data, and recommendations in this document are believed to be accurate and reliable, but are presented without express or implied warranty. Users must take full responsibility for their applications of any products specified in this document. The information in this document is proprietary to Nortel Networks.
PAGE 3
In addition, the program and information contained herein are licensed only pursuant to a license agreement that contains restrictions on use and disclosure (that may incorporate by reference certain limitations and notices imposed by third parties).
PAGE 4
Nortel according to the then-current RMA procedures. The End Customer or their designated reseller is responsible to ensure that the shipments are insured, with the transportation charges prepaid and that the RMA number is clearly marked on the outside of the package. Nortel will not accept collect shipments or those returned without an RMA number clearly visible on the outside of the package.
PAGE 5
Nortel Networks software license agreement This Software License Agreement (“License Agreement”) is between you, the end-user (“Customer”) and Nortel Corporation and its subsidiaries and affiliates (“Nortel Networks”). PLEASE READ THE FOLLOWING CAREFULLY. YOU MUST ACCEPT THESE LICENSE TERMS IN ORDER TO DOWNLOAD AND/OR USE THE SOFTWARE. USE OF THE SOFTWARE CONSTITUTES YOUR ACCEPTANCE OF THIS LICENSE AGREEMENT.
PAGE 6
software documentation are governed by Nortel standard commercial license in accordance with U.S. Federal Regulations at 48 C.F.R. Sections 12.212 (for non-DoD entities) and 48 C.F.R. 227.7202 (for DoD entities). b)Customer may terminate the license at any time. Nortel may terminate the license if Customer fails to comply with the terms and conditions of this license. In either event, upon termination, Customer must either return the Software to Nortel or certify its destruction.
PAGE 7
OpenSSL Project License Statements Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
PAGE 8
NN47250-500 (320657-F Version 02.
PAGE 9
Contents 9 Contents Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 How to get help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Introducing the Nortel WLAN 2300 system . . . . . . . . . . . . . . . . . . . . . . . . . 39 Nortel WLAN 2300 system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Documentation . . . . . . . . . . . . . . . . . . . . .
PAGE 10
Contents WSS setup methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Quick starts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 WLAN Management Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 CLI . . . . . . . . . . . . . . . . . . . . . .
PAGE 11
Contents 11 Local authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Local authentication for console users and RADIUS authentication for Telnet users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Local override and backup local authentication . . . . . . . . . . . . . . . . . . . . . . . 81 Authentication when RADIUS servers do not respond . . . . . . . . . . . . . . . . . .
PAGE 12
Contents Displaying port information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Displaying port configuration and status . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Displaying PoE state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Displaying port statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Clearing statistics counters . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 13
Contents 13 Adding an entry to the forwarding database . . . . . . . . . . . . . . . . . . . . . . . . . 113 Removing entries from the forwarding database . . . . . . . . . . . . . . . . . . . . . 113 Configuring the aging timeout period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Displaying the aging timeout period . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Changing the aging timeout period . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 14
Contents Changing the Telnet service port number . . . . . . . . . . . . . . . . . . . . . . . . 133 Resetting the Telnet service port number to its default . . . . . . . . . . . . . . 133 Managing Telnet server sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Managing HTTPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Enabling HTTPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 15
Contents 15 Displaying NTP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 Managing the ARP table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Displaying ARP table entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Adding an ARP entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Changing the aging timeout . . . . . . . . . . . . . . . . . .
PAGE 16
Contents Configuring member WSSs on the seed . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Configuring a member . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Configuring mobility domain seed redundancy . . . . . . . . . . . . . . . . . . . . . . . 167 Displaying Mobility Domain status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 Displaying the Mobility Domain configuration . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 17
Contents 17 Disabling or re-enabling RF load balancing . . . . . . . . . . . . . . . . . . . . . . . . . 196 Assigning radios to load balancing groups . . . . . . . . . . . . . . . . . . . . . . . . . . 196 Specifying band preference for RF load balancing . . . . . . . . . . . . . . . . . . . . 196 Setting strictness for RF load balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 Exempting an SSID from RF load balancing . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 18
Contents Configuring AP port parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 Setting the port type for a directly connected AP . . . . . . . . . . . . . . . . . . 236 Configuring an indirectly connected AP . . . . . . . . . . . . . . . . . . . . . . . . . 237 Configuring static IP addresses on distributed APs . . . . . . . . . . . . . . . . 237 Clearing an AP from the configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 239 Changing AP names . . . . . . . .
PAGE 19
Contents 19 Configuring radio-specific parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 Configuring the channel and transmit power . . . . . . . . . . . . . . . . . . . . . 255 Configuring the external antenna model . . . . . . . . . . . . . . . . . . . . . . . . . 256 External antenna selector guides for the AP-2330, AP-2330A, AP-2330B and Series 2332 APs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 Antenna selection decision trees . . . . . . . . . . . . .
PAGE 20
Contents Configuring user encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291 Configuring WPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 WPA cipher suites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295 TKIP countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 WPA authentication methods . . . . . . . . . . . . . . . .
PAGE 21
Contents 21 Channel and power tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Power tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Channel tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Tuning the transmit data rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323 Auto-RF parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 22
Contents Configuring quality of service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343 About QoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343 Summary of QoS features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343 End-to-End QoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 QoS Mapping . . . . . . . . . . . . . . . . . . . . . . .
PAGE 23
Contents 23 Changing standard spanning tree parameters . . . . . . . . . . . . . . . . . . . . . . . . . . 369 Changing the bridge priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371 Changing STP port parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372 Changing the STP port cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372 Resetting the STP port cost to the default value . . . . . . . . . . . . . . . . . .
PAGE 24
Contents Enabling router solicitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397 Changing the router solicitation interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398 Configuring static multicast ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398 Adding or removing a static multicast router port . . . . . . . . . . . . . . . . . . . . . 399 Adding or removing a static multicast receiver port . . . . . . . . . . .
PAGE 25
Contents 25 Mapping security ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422 Mapping user-based security ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423 Mapping security ACLs to ports, VLANs, virtual ports, or distributed APs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425 Displaying ACL maps to ports, VLANs, and virtual ports . . . . . . . . . . . . 425 Clearing a security ACL map . . .
PAGE 26
Contents Public key infrastructures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447 Public and private keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448 Digital certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449 PKCS #7, PKCS #10, and PKCS #12 object files . . . . . . . . . . . . . . . . . . . . . 450 Certificates automatically generated by WSS software . . . . . . . . . . .
PAGE 27
Contents 27 Wildcard “Any” for SSID matching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476 AAA methods for IEEE 802.1X and Web network access . . . . . . . . . . . . . . 477 AAA rollover process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477 Local override exception . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477 Remote authentication with local backup . . . . . . . . . . . . . . . . . . . . . . . . 478 IEEE 802.
PAGE 28
Contents Displaying session information for Web portal Web-based AAA users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 Using a custom login page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505 Copying and modifying the Web login page . . . . . . . . . . . . . . . . . . . . . . 506 Custom login page scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 Using dynamic fields in Web-based AAA redirect URLs . . . .
PAGE 29
Contents 29 How the location policy differs from a security ACL . . . . . . . . . . . . . . . . . . . 539 Setting the location policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 Applying security ACLs in a location policy rule . . . . . . . . . . . . . . . . . . . 540 Displaying and positioning location policy rules . . . . . . . . . . . . . . . . . . . 541 Clearing location policy rules and disabling the location policy . . . . . . . . . . .
PAGE 30
Contents Configuring load balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 568 Adding members to a server group . . . . . . . . . . . . . . . . . . . . . . . . . . . . 569 Deleting a server group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 571 RADIUS and server group configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . 571 Managing 802.1X on the WSS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 31
Contents 31 Creating the SODA agent with SODA manager . . . . . . . . . . . . . . . . . . . . . . 597 Copying the SODA agent to the WSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 Installing the SODA agent files on the WSS . . . . . . . . . . . . . . . . . . . . . . . . . 599 Enabling SODA functionality for the service profile . . . . . . . . . . . . . . . . . . . . 600 Disabling enforcement of SODA agent checks . . . . . . . . . . . . . . . . . . . . . . .
PAGE 32
Contents Dynamic Frequency Selection (DFS) . . . . . . . . . . . . . . . . . . . . . . . . . . . 629 Countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629 Mobility Domain requirement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630 Summary of rogue detection features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630 Configuring rogue detection lists . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 33
Contents 33 About system files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651 Displaying software version information . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 Displaying boot information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653 Working with files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653 Displaying a list of files . . . . . . . . . . . . .
PAGE 34
Contents Logging to the console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676 Logging messages to a syslog server . . . . . . . . . . . . . . . . . . . . . . . . . . 676 Setting Telnet session defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 Changing the current Telnet session defaults . . . . . . . . . . . . . . . . . . . . . 677 Logging to the trace buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 35
Contents 35 Configuring a snoop filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686 Displaying configured snoop filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 Editing a snoop filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 Deleting a snoop filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 Mapping a snoop filter to a radio . . . . . . . . . . . . . . . . . . . . . . .
PAGE 36
Contents Command Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 751 NN47250-500 (320657-F Version 02.
PAGE 37
How to get help 37 How to get help This section explains how to get help for Nortel products and services. Getting help from the Nortel web site The best way to get technical support for Nortel products is from the Nortel Technical Support Web site: http://www.nortel.com/support This site provides quick access to software, documentation, bulletins, and tools to address issues with Nortel products.
PAGE 38
How to get help Getting help from a specialist by using an Express Routing Code To access some Nortel Technical Solutions Centers, you can use an Express Routing Code (ERC) to quickly route your call to a specialist in your Nortel product or service. To locate the ERC for your product or service, go to: http://www.nortel.
PAGE 39
Introducing the Nortel WLAN 2300 system Nortel WLAN 2300 system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 This guide explains how to configure and manage a Nortel WLAN 2300 system wireless LAN (WLAN) using the WLAN Security Switch 2300 Series command line interface (CLI) commands that you enter on a WLAN—Security Switch (WSS).
PAGE 40
Introducing the Nortel WLAN 2300 system Documentation Consult the following documents to plan, install, configure, and manage a Nortel WLAN 2300 system. Planning, Configuration, and Deployment • Nortel WLAN Management Software 2300 Series User Guide. Instructions for planning, configuring, deploying, and managing the entire WLAN with the WLAN Management Software tool suite.
PAGE 41
Introducing the Nortel WLAN 2300 system 41 Safety and advisory notices The following kinds of safety and advisory notices appear in this manual. Text and syntax conventions Caution! This situation or condition can lead to data loss or damage to the product or other property. Note. This information is of special interest. Nortel manuals use the following text and syntax conventions: Convention Use Monospace text Sets off command syntax or sample commands and system responses.
PAGE 42
Introducing the Nortel WLAN 2300 system NN47250-500 (320657-F Version 02.
PAGE 43
Using the command-line interface CLI conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Command-line editing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Using CLI help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Understanding command descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 44
Using the command-line interface Command prompts By default, the WSS Software CLI provides the following prompt for restricted users. The mmmm portion shows the WSS model number (for example, 2360) and the nnnnnn portion shows the last 6 digits of the switch’s media access control (MAC) address.
PAGE 45
Using the command-line interface 45 Syntax notation The WSS Software CLI uses standard syntax notation: • Bold monospace font identifies the command and keywords you must type. For example: set enablepass • Italic monospace font indicates a placeholder for a value. For example, you replace vlan-id in the following command with a virtual LAN (VLAN) ID: clear interface vlan-id ip • Curly brackets ({ }) indicate a mandatory parameter, and square brackets ([ ]) indicate an optional parameter.
PAGE 46
Using the command-line interface Text entry conventions and allowed characters Unless otherwise indicated, the WSS Software CLI accepts standard ASCII alphanumeric characters, except for tabs and spaces, and is case-insensitive. The CLI has specific notation requirements for MAC addresses, IP addresses, and masks, and allows you to group usernames, MAC addresses, virtual LAN (VLAN) names, and ports in a single command.
PAGE 47
Using the command-line interface 47 User wildcards, MAC address wildcards, and VLAN wildcards Name “wildcarding” is a way of using a wildcard pattern to expand a single element into a list of elements that match the pattern. WSS Software accepts user wildcards, MAC address wildcards, and VLAN wildcards.
PAGE 48
Using the command-line interface 00:01:02:* 00:01:02:03:* 00:01:02:03:04:* For example, the MAC address wildcard 02:06:8c* represents all MAC addresses starting with 02:06:8c. Specifying only the first 3 bytes of a MAC address allows you to apply commands to MAC addresses based on an organizationally unique identity (OUI). VLAN wildcards A VLAN wildcard is a method for matching one of a set of local rules on a WSS, known as the location policy, to one or more users.
PAGE 49
Using the command-line interface 49 Port lists The physical Ethernet ports on a WSS can be set for connection to APs, authenticated wired users, or the network backbone. You can include a single port or multiple ports in one WSS Software CLI command by using the appropriate list format. The ports on a WSS are numbered 1 through 22. No port 0 exists on the switch. You can include a single port or multiple ports in a command that includes port port-list.
PAGE 50
Using the command-line interface Virtual LAN identification The names of virtual LANs (VLANs), which are used in Mobility Domain™ communications, are set by you and can be changed. In contrast, VLAN ID numbers, which the WSS uses locally, are determined when the VLAN is first configured and cannot be changed. Unless otherwise indicated, you can refer to a VLAN by either its VLAN name or its VLAN number. CLI set and show commands use a VLAN’s name or number to uniquely identify the VLAN within the WSS.
PAGE 51
Using the command-line interface 51 Command-line editing WSS Software editing functions are similar to those of many other network operating systems. Keyboard shortcuts The following keyboard shortcuts are available for entering and editing CLI commands: Keyboard Shortcut(s) Function Ctrl+A Jumps to the first character of the command line. Ctrl+B or Left Arrow key Moves the cursor back one character. Ctrl+C Escapes and terminates prompts and tasks. Ctrl+D Deletes the character at the cursor.
PAGE 52
Using the command-line interface igmp Show igmp information interface Show interfaces ip Show ip information Single-asterisk (*) wildcard character You can use the single-asterisk (*) wildcard character in wildcards. (For details, see “User wildcards, MAC address wildcards, and VLAN wildcards” (page 47).) Double-asterisk (**) wildcard characters The double-asterisk (**) wildcard character matches all usernames. For details, see “User wildcards” (page 47). Using CLI help The CLI provides online help.
PAGE 53
Using the command-line interface 53 To see a subset of the online help, type the command for which you want more information. For example, the following command displays all the commands that begin with the letter i: WSS# show i? ifm Show interfaces maintained by the interface manager igmp Show igmp information interface Show interfaces ip Show ip information To see all the variations, type one of the commands followed by a question mark (?).
PAGE 54
Using the command-line interface You can fully operate the WLE2340 only if the following commands are set: To set static ip address for AP at WSS: #set ap boot-configuration switch mode enable #set ap boot-configuration switch switch #set ap boot-configuration ip netmask gateway mode enable To set snoop mapping (recommend snap-length is 100): #set snoop observer
PAGE 55
WSS setup methods Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 How a WSS gets its configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Web Quick Start (2350 and 2360/2361) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 CLI quickstart command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 56
WSS setup methods Overview WSS Software provides the following quick-start methods for new (unconfigured) switches: • Web Quick Start (2350 and 2360/2361 only) • CLI quickstart command You can use either quick-start method to configure a switch to provide wireless service.
PAGE 57
WSS setup methods 57 CLI You can configure a switch using the CLI by attaching a PC to the switch’s Console port. After you configure the switch for SSH or Telnet access, you also can use these protocols to access the CLI. Web View You can use a switch’s web management interface, Web View, to configure the switch. For access information, see “Enabling and logging onto Web View” (page 695). Note. Web View is different from the Web Quick Start application.
PAGE 58
WSS setup methods How a WSS gets its configuration Figure 1 shows how a WSS gets a configuration when you power it on. Figure 1. WSS Startup Algorithm Switch is powered on. Does switch have a configuration? Yes Switch boots using its configuration file. Is auto-config enabled? Yes No Model 2350? Yes Was factory reset pressed during power on? No No Model 2360/2361? Yes Web Quick Start is enabled. No Boots with no configuration. You must use the CLI to start configuring the switch.
PAGE 59
WSS setup methods 59 Web Quick Start (2350 and 2360/2361) You can use the Web Quick Start to configure the switch to provide wireless access to up to ten network users. To access the Web Quick Start, attach a PC directly to port 1 or port 2 on the switch and use a web browser on the PC to access IP address 192.168.100.1. (For more detailed instructions, see “Accessing the Web Quick Start” (page 60).) Note. The Web Quick Start application is different from Web View.
PAGE 60
WSS setup methods • Category 5 (Cat 5) or higher Ethernet cable If the PC is connected to the network, power down the PC or disable its network interface card (NIC), then unplug the PC from the network. Note. You can use a Layer 2 device between the switch and the PC. However, do not attach the switch to your network yet. The switch requires the PC you attach to it for configuration to be in the 192.168.100.x subnet, and uses the WSS Software DHCP server to assign the PC an address from this subnet.
PAGE 61
WSS setup methods 61 6 Click Next to begin. The wizard screens guide you through the configuration steps. Caution! Use the wizard’s Next and Back buttons to navigate among the wizard pages. Using the browser’s navigation buttons, such as Back and Forward, can result in loss of information. Do not click the browser’s Refresh or Reload button at any time while using the wizard. If you do click Refresh or Reload, all the information you have entered in the wizard will be cleared.
PAGE 62
WSS setup methods 7 After guiding you through the configuration, the wizard displays a summary of the configuration values you selected. Here is an example: 8 Review the configuration settings, then click Finish to save the changes or click Back to change settings. If you want to quit for now and start over later, click Cancel. If you click Finish, the wizard saves the configuration settings into the switch’s configuration file.
PAGE 63
WSS setup methods 63 • Default route • 802.1Q tagging for ports in the default VLAN • Administrative users and passwords • Enable password • System time, date, and timezone • Unencrypted (clear) SSID names • Usernames and passwords for guest access using Web-based AAA • Encrypted (crypto) SSID names and dynamic WEP encryption for encrypted SSIDs’ wireless traffic • Usernames and passwords for secure access using 802.
PAGE 64
WSS setup methods One of the questions the script asks is the country code. For a list of valid country codes, see “Specifying the country of operation” (page 229). Note. For Series 2332 access points, be sure the system country code is supported for the selected access point model. The Series 2332 access point has been region-locked to meet geographic regulatory restrictions. Each model is associated to a specific regulatory domain and subsequent country of operation.
PAGE 65
WSS setup methods 65 The IP addresses, usernames, and passwords in this document are examples. Use values that are appropriate for your organization. If you configure time and date parameters, you will be required to enter a name for the timezone, and then enter the value of the timezone (the offset from UTC) separately. You can use a string of up to 32 alphabetic characters as the timezone name. Figure 2 shows an example. Users bob and alice can access encrypted SSID corporate on either of the APs.
PAGE 66
WSS setup methods Enable password [optional]: enable Do you wish to set the time? [y]: y Enter the date (dd/mm/yy) []: 31/03/06 Is daylight saving time (DST) in effect [n]: n Enter the time (hh:mm:ss) []: 04:36:20 Enter the timezone []: PST Enter the offset (without DST) from GMT for 'PST' in hh:mm [0:0]: -8:0 Do you wish to configure wireless? [y]: y Enter a clear SSID to use: public Do you want Web Portal authentication? [y]: y Enter a username to be used with Web Portal, to exit: user1 Enter a pa
PAGE 67
WSS setup methods 67 • Drop ship—WMS Services running in the corporate network can configure a 2350 switch shipped directly to a remote office. This option does not require any preconfiguration of the switch. • Staged—You can stage any model of switch by preconfiguring IP connectivity and enabling auto-config, then sending the switch to the remote office. The switch contacts WMS Services in the corporate network to complete its configuration. The drop ship option is supported only for the 2350.
PAGE 68
WSS setup methods NN47250-500 (320657-F Version 02.
PAGE 69
Configuring Web-based AAA for administrative and local access Overview of Web-based AAA for administrative and local access . . . . . . . . . . . . . . . 69 Before you start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 About Administrative Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 First-time configuration via the console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 70
Configuring Web-based AAA for administrative and local access 4 Enabled mode. To enter the enabled mode of operation, you type the enable command at the command prompt. In enabled mode, you can use all CLI commands. Although WSS Software does not require an enable password, Nortel highly recommends that you set one. 5 Customized authentication. You can require authentication for all users or for only a subset of users.
PAGE 71
Configuring Web-based AAA for administrative and local access 71 Figure 1. Typical Nortel WLAN 2300 system Building 1 AP Floor 3 AP Layer 2 switches WSSs Floor 2 AP AP WSSs AP WSS AP Core router 840-9502-0071 Floor 1 Data center Layer 2 or Layer 3 switches RADIUS or AAA Servers Before you start Before reading more of this chapter, use the Nortel WLAN Security Switch 2300 Series Quick Start Guide to set up a WSS and the attached APs for basic service.
PAGE 72
Configuring Web-based AAA for administrative and local access • Network access mode—Allows network users to connect through the WSS. For information about configuring network users, see “Configuring AAA for network users” (page 467). Types of Administrative Access WSS Software allows you access to the WSS with the following types of administrative access: • Console—Access via only the console port. For more information, see “First-time configuration via the console” (page 72).
PAGE 73
Configuring Web-based AAA for administrative and local access 73 4 Press Enter to display an enabled-mode command prompt: WSS# Once you see this prompt after you have typed the enable command, you have administrative privileges, which allow you to further configure the WSS. Setting the WSS enable password There is one enable password for the entire WSS. You can optionally change the enable password from the default.
PAGE 74
Configuring Web-based AAA for administrative and local access WMS enable password If you use WLAN Management Software to continue configuring the switch, you will need to enter the switch’s enable password when you upload the switch’s configuration into WLAN Management Software. (For WMS information, see the Nortel WLAN Management Software Reference Manual.) NN47250-500 (320657-F Version 02.
PAGE 75
Configuring Web-based AAA for administrative and local access 75 Authenticating at the console You can configure the console so that authentication is required, or so that no authentication is required. Nortel recommends that you enforce authentication on the console port. To enforce console authentication, take the following steps: 1 Add a user in the local database by typing the following command with a username and password: WSS# set user username password password success: change accepted.
PAGE 76
Configuring Web-based AAA for administrative and local access Customizing Web-based AAA with “wildcards” and groups “Wildcarding” lets you classify users by username or media access control (MAC) address for different Web-based AAA treatments. A user wildcard is a string, possibly containing wildcards, for matching Web-based AAA and IEEE 802.1X authentication methods to a user or set of users.
PAGE 77
Configuring Web-based AAA for administrative and local access 77 Setting user passwords Like usernames, passwords are not case-sensitive. To make passwords secure, make sure they contain uppercase and lowercase letters and numbers. Nortel recommends that all users create passwords that are memorable to themselves, difficult for others to guess, and not subject to a dictionary attack. User passwords are automatically encrypted when entered in the local database. However, the encryption is not strong.
PAGE 78
Configuring Web-based AAA for administrative and local access To configure accounting for administrative logins over the network at EXAMPLE, enter the following command: set accounting admin EXAMPLE\* start-stop | stop-only aaa-method You can select either start-stop or stop-only accounting modes. The stop-only mode sends only stop records, whereas start-stop sends both start and stop records, effectively doubling the number of accounting records.
PAGE 79
Configuring Web-based AAA for administrative and local access 79 user Geetha Password = 1214253d1d19 (encrypted) (For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.) Saving the configuration You must save the configuration for all commands that you enter and want to use for future sessions.
PAGE 80
Configuring Web-based AAA for administrative and local access Local authentication The first time you access a WSS, it requires no authentication. (For more information, see “First-time configuration via the console” (page 72).) In this scenario, after the initial configuration of the WSS, Natasha is connected through the console and has enabled access. To enable local authentication for a console user, you must configure a local username.
PAGE 81
Configuring Web-based AAA for administrative and local access 81 Local override and backup local authentication This scenario illustrates how to enable local override authentication for console users. Local override means that WSS Software attempts authentication first via the local database. If it finds no match for the user in the local database, WSS Software then tries a RADIUS server—in this case, server r1 in server group sg1.
PAGE 82
Configuring Web-based AAA for administrative and local access Authentication when RADIUS servers do not respond This scenario illustrates how to enable RADIUS authentication for both console and administrative users, but to unconditionally allow access for administrative and console users if the RADIUS server (in this case, server r1 in server group sg1) does not respond. To configure unconditional authentication, Natasha sets the authentication method to none.
PAGE 83
Managing User Passwords 83 Managing User Passwords Passwords Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Configuring Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Displaying Password Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 84
Managing User Passwords Configuring Passwords To configure passwords, you can perform the following tasks: • Set a password for a user in the local database. • Enable restrictions on password usage. • Set the maximum number of failed login attempts • Specify the minimum password length allowed. • Set the time duration, before password expiration. • Restore access to a user, that is locked out of the system.
PAGE 85
Managing User Passwords 85 For example, to enable password restrictions on the WSS, type the following command: WSS# set authentication password-restrict enable warning: the following users have passwords that do not have atleast 2 each of upper-case letters, lower-case letters, numbers and special characters administrator admin user1 user2 admin2 jsmith success: change accepted.
PAGE 86
Managing User Passwords administrator admin user2 admin2 success: change accepted. Configuring password expiration time To specify how long a user password is valid before it must be reset, use the following command: set user username expire-password-in time To specify how long the passwords are valid for users in a user group, use the following command: set usergroup group-name expire-password-in time By default, user passwords do not expire.
PAGE 87
Managing User Passwords 87 The following command restores access to user Nin, who is locked out of the system: WSS# clear user Nin lockout success: change accepted. Displaying Password Information User password information appears with the show web-based aaa command.
PAGE 88
Managing User Passwords NN47250-500 (320657-F Version 02.
PAGE 89
Configuring and managing ports and VLANs Configuring and managing ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Configuring and managing VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Managing the layer 2 forwarding database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Port and VLAN configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 90
Configuring and managing ports and VLANs applies default settings appropriate for the port type. Table 1 lists the default settings applied for each port type. For example, the AP column lists default settings that WSS Software applies when you change a port type to ap (access point). Table 1: Port Defaults set by port type change Port type Parameter AP Access Wired Authentication Network Removed from all VLANs. You cannot assign an AP access port to a VLAN.
PAGE 91
Configuring and managing ports and VLANs 91 Setting a port for a directly connected AP Note. Before configuring a port as an AP access port, you must use the set system countrycode command to set the IEEE 802.11 country-specific regulations on the WSS. (See “Specifying the country of operation” (page 229).
PAGE 92
Configuring and managing ports and VLANs Configuring for a AP To configure a connection for a AP (referred to as a AP in the CLI), use the following command: set ap ap-num serial-id serial-ID model {2330 | 2330A | 2330B | 2332-A1 | 2332-A2 | 2332-A3 | 2332-A4 | 2332-A5 | 2332-A6 | 2332-E1 | 2332-E2 | 2332-E3 | 2332-E4 | 2332-E5 |2332-E6 | 2332-E7 | 2332-E8 | 2332-E9 | 2332-J1} [radiotype {11a | 11b| 11g}] The ap-num parameter identifies the AP connection for the AP.
PAGE 93
Configuring and managing ports and VLANs 93 To set port 17 as a wired authentication port, type the following command: WSS# set port type wired-auth 17 success: change accepted This command configures port 17 as a wired authentication port supporting one interface and one simultaneous user session. For 802.
PAGE 94
Configuring and managing ports and VLANs To clear a port, use the following command: clear port type port-list For example, to clear the port-related settings from port 5 and reset the port as a network port, type the following command: WSS# clear port type 5 This may disrupt currently authenticated users. Are you sure? (y/n) [n]y success: change accepted. Clearing a AP Caution! When you clear a AP, WSS Software ends user sessions that are using the AP.
PAGE 95
Configuring and managing ports and VLANs 95 Removing a port name To remove a port name, use the following command: clear port port-list name Configuring media type on a dual-interface gigabit ethernet port (2380 only) The gigabit Ethernet ports on a 2380 switch have two physical interfaces: a 1000BASE-TX copper interface and a 1000BASE-SX or 1000BASE-LX fiber interface. The copper interface is provided by a built-in RJ-45 connector.
PAGE 96
Configuring and managing ports and VLANs Configuring port operating parameters Autonegotiation is enabled by default on a WSS’s 10/100 Ethernet ports and gigabit Ethernet ports. Note. All ports on the 2380 switches support full-duplex operating mode only. They do not support half-duplex operation. The 10/100 ports on the 2360/2361 or 2382 switches support half-duplex and full-duplex operation. Note.
PAGE 97
Configuring and managing ports and VLANs 97 To set the port speed on ports 1 and 5 to 10 Mbps, type the following command: WSS# set port speed 1, 5 10 Gigabit Ports—autonegotiation and flow control WSS gigabit ports use autonegotiation by default to determine capabilities for 802.3z flow control parameters. The gigabit ports can respond to IEEE 802.3z flow control packets. Some devices use this capability to prevent packet loss by temporarily pausing data transmission.
PAGE 98
Configuring and managing ports and VLANs Resetting a port You can reset a port by toggling its link state and PoE state. WSS Software disables the port’s link and PoE (if applicable) for at least one second, then reenables them. This feature is useful for forcing an AP that is connected to two WSS switches to reboot using the port connected to the other switch.
PAGE 99
Configuring and managing ports and VLANs 99 Displaying PoE state To display the PoE state of a port, use the following command: show port poe [port-list] To display PoE information for ports 2 and 4, type the following command: WSS# show port poe 2,4 Port Name Link Status Port Type PoE config PoE Draw 22 down AP disabled off 44 up AP enabled 1.44 In this example, PoE is disabled on port 2 and enabled on port 4. The AP connected to port 4 is drawing 1.44 W of power from the WSS.
PAGE 100
Configuring and managing ports and VLANs Monitoring port statistics You can display port statistics in a format that continually updates the counters. When you enable monitoring of port statistics, WSS Software clears the CLI session window and displays the statistics at the top of the window. WSS Software refreshes the statistics every 5 seconds. This interval cannot be configured.
PAGE 101
Configuring and managing ports and VLANs 101 To cycle the display to the next set of statistics, press the Spacebar. In this example, packet statistics are displayed next: Port Status Rx Unicast Rx NonUnicast Tx Unicast Tx NonUnicast 1 Up 54620 62144 68318 62556 (For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.
PAGE 102
Configuring and managing ports and VLANs To configure a port group named server1 containing ports 1 through 5 and enable the link, type the following command: WSS# set port-group name server1 1-5 mode on success: change accepted. After you configure a port group, you can use the port group name with commands that change Layer 2 configuration parameters to apply configuration changes to all ports in the port group.
PAGE 103
Configuring and managing ports and VLANs 103 Interoperating with Cisco Systems EtherChannel Load-sharing port groups are interoperable with Cisco Systems EtherChannel capabilities. To configure a Cisco Catalyst switch to interoperate with a Nortel WSS, use the following command on the Catalyst switch: set port channel port-list mode on Configuring and managing VLANs Note. The CLI commands in this chapter configure VLANs on WSS network ports.
PAGE 104
Configuring and managing ports and VLANs VLANs, IP subnets, and IP addressing Generally, VLANs are equivalent to IP subnets. If a WSS is connected to the network by only one IP subnet, the switch must have at least one VLAN configured. Optionally, each VLAN can have its own IP address. However, no two IP addresses on the switch can belong to the same IP subnet.
PAGE 105
Configuring and managing ports and VLANs 105 member of the VLAN. The traffic can be of any protocol type. (For more information about Mobility Domains, see “Configuring and managing Mobility Domain roaming” (page 165).) Note. Because the default VLAN (VLAN 1) might not be in the same subnet on each switch, Nortel recommends that you do not rename the default VLAN or use it for user traffic. Instead, configure other VLANs for user traffic.
PAGE 106
Configuring and managing ports and VLANs Configuring a VLAN You can configure the following VLAN parameters: • VLAN number • VLAN name • Port list (the ports in the VLAN) • Per-port tag value (an 802.
PAGE 107
Configuring and managing ports and VLANs 107 You can specify a tag value from 1 through 4093. Note. WSS Software does not remove a port from other VLANs when you add the port to a new VLAN. If a new VLAN causes a configuration conflict with an older VLAN, remove the port from the older VLAN before adding the port to the new VLAN. For example, to add ports 2 through 4 and port 8 to VLAN red, type the following command: WSS# set vlan red port 2-4,8 success: change accepted.
PAGE 108
Configuring and managing ports and VLANs To completely remove VLAN ecru, type the following command: WSS# clear vlan ecru This may disrupt user connectivity. Do you wish to continue? (y/n) [n]y success: change accepted. Note. You cannot remove the default VLAN (VLAN 1). However, you can add and remove ports. You can also rename the default VLAN, but Nortel recommends against it.
PAGE 109
Configuring and managing ports and VLANs 109 Note. There can be a slight delay before functions such as pinging between clients become available again after Layer 2 restrictions are lifted. Even though packets are passed immediately once Layer 2 restrictions are gone, it can take 10 seconds or more for upper-layer protocols to update their ARP caches and regain their functionality.
PAGE 110
Configuring and managing ports and VLANs WSS# show vlan config burgundy VLAN Name 2 Admin VLAN Status Tunl State burgundy Up Up Affin Port Port Tag State 2 none Up 3 none Up 4 none Up 6 none Up 5 Note. The display can include AP access ports and wired authentication ports, because WSS Software dynamically adds these ports to a VLAN when handling user traffic for the VLAN.
PAGE 111
Configuring and managing ports and VLANs 111 Managing the layer 2 forwarding database A WSS uses a Layer 2 forwarding database (FDB) to forward traffic within a VLAN. The entries in the forwarding database map MAC addresses to the physical or virtual ports connected to those MAC addresses within a particular VLAN.
PAGE 112
Configuring and managing ports and VLANs For example, to display the number of dynamic entries that the forwarding database contains, type the following command: WSS# show fdb count dynamic Total Matching Entries = 2 Displaying forwarding database entries To display the entries in the forwarding database, use either of the following commands: show fdb [mac-addr-wildcard [vlan vlan-id]] show fdb {perm | static | dynamic | system | all} [port port-list | vlan vlan-id] The mac-addr-wildcard parameter c
PAGE 113
Configuring and managing ports and VLANs 113 (For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.
PAGE 114
Configuring and managing ports and VLANs For example, to display the aging timeout period for all configured VLANs, type the following command: WSS# show fdb agingtime VLAN 2 aging time = 300 sec VLAN 1 aging time = 300 sec Changing the aging timeout period To change the aging timeout period, use the following command: set fdb agingtime vlan-id age seconds For example, to set the aging timeout period for VLAN 2 to 600 seconds, type the following command: WSS# set fdb agingtime 2 age 600 success: ch
PAGE 115
Configuring and managing ports and VLANs 115 WSS# set port 19-20 name mobility success: change accepted. WSS# set port 21,22 name backbone success: change accepted.
PAGE 116
Configuring and managing ports and VLANs WSS# show system ============================================================================== = Product Name: WSS System Name: WSS System Countrycode: US System Location: System Contact: System IP: 0.0.0.
PAGE 117
Configuring and managing ports and VLANs 117 WSS# show port status Port Name Admin Oper Config Actual Type Media 1 wss_mgmt up up auto 100/full network 10/100BaseTx 2 finance up up auto 100/full ap 10/100BaseTx 3 accounting up up auto 100/full ap 10/100BaseTx 4 shipping up up auto 100/full ap 10/100BaseTx 5 lobby up up auto 100/full ap 10/100BaseTx 6 conf_room1 up up auto 100/full ap 10/100BaseTx 7 conf_room2 up up auto 100/full ap 10/100BaseTx 8 manufacturi
PAGE 118
Configuring and managing ports and VLANs Link Port Port Name PoE Status PoE Type config Draw(Watts) 5 lobby up AP enabled 7.04 6 conf_room1 up AP enabled 7.04 7 conf_room2 up AP enabled 7.04 8 manufacturing up AP enabled 7.04 up AP enabled 7.04 9 manufacturing 10 manufacturing up AP enabled 7.04 11 manufacturing up AP enabled 7.04 12 manufacturing up AP enabled 7.04 13 manufacturing up AP enabled 7.04 14 rsrch_dev up AP enabled 7.
PAGE 119
Configuring and managing ports and VLANs 119 WSS# show port status Port Name Admin Oper Config Actual Type Media 1 wss_mgmt up up auto 100/full network 10/100BaseTx 2 finance up up auto 100/full ap 10/100BaseTx 3 accounting up up auto 100/full ap 10/100BaseTx 4 shipping up up auto 100/full ap 10/100BaseTx 5 lobby up up auto 100/full ap 10/100BaseTx 6 conf_room1 up up auto 100/full ap 10/100BaseTx 7 conf_room2 up up auto 100/full ap 10/100BaseTx 8 manufacturi
PAGE 120
Configuring and managing ports and VLANs success: change accepted. WSS# set vlan 2 name roaming port 19-20 success: change accepted. WSS# show vlan config VLAN Name Admin VLAN Status Tunl State Affin Port Port Tag State 1 default Up Up 5 none Up 19 none Up 20 none Up 1 2 roaming 7 Up Up 5 Save the configuration. Type the following command: WSS# save config success: configuration saved. NN47250-500 (320657-F Version 02.
PAGE 121
Configuring and managing IP interfaces and services MTU support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Configuring and managing IP interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Configuring the system IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Configuring and managing IP routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 122
Configuring and managing IP interfaces and services MTU support WLAN Security Switch 2300 Series (WSS Software) supports standard maximum transmission units (MTUs) of 1514 bytes for standard Ethernet packets and 1518 bytes for Ethernet packets with an 802.1Q tag. WSS Software does not support changing of the MTU through software configuration, and WSS Software does not do path MTU discovery.
PAGE 123
Configuring and managing IP interfaces and services 123 Configuring and managing IP interfaces Many features, including the following, require an IP interface on the WSS: • Management access through Telnet • Access by WLAN Management Software • Exchanging information and user data with other WSS switches in a Mobility Domain IP interfaces are associated with VLANs. At least one VLAN on a WSS must have an IP interface to provide management access.
PAGE 124
Configuring and managing IP interfaces and services How WSS software resolves conflicts with statically configured IP parameters WSS Software compares the IP parameter values already configured on the switch with the values received from the DHCP server, and resolves any conflicts as follows: • IP address—If the VLAN also has a statically configured IP address, WSS Software uses an address from the DHCP server instead of the statically configured address.
PAGE 125
Configuring and managing IP interfaces and services 125 The IP interface table flags the address assigned by a DHCP server with an asterisk ( * ). In the following example, VLAN corpvlan received IP address 10.3.1.110 from a DHCP server. WSS# show interface * = From DHCP VLAN Name Address Mask Enabled State RIB ---- --------------- --------------- --------------- ------- ----- -------4 corpvlan *10.3.1.110 255.255.255.
PAGE 126
Configuring and managing IP interfaces and services Configuring the system IP address You can designate one of the IP addresses configured on a WSS to be the system IP address of the switch.
PAGE 127
Configuring and managing IP interfaces and services 127 • Default route—Forwarding path for traffic to a destination without an explicit route in the route table A destination can be a subnet or network. If two static routes specify a destination, the more specific route is always chosen (longest prefix match). For example, if you have a static route with a destination of 10.10.1.0/24, and another static route with a destination of 10.10.0.0/16, the first static route is chosen to reach 10.10.1.
PAGE 128
Configuring and managing IP interfaces and services 10.0.2.1/32 IP 0 Local vlan:2:ip:10.0.1.1/24 10.0.2.255/32 IP 0 Local vlan:2:ip:10.0.1.1/24 224.0.0.0/ 4 IP 0 Local MULTICAST This example shows dynamic routes added by WSS Software for two VLAN interfaces, 10.0.1.1/24 on VLAN 1 and 10.0.2.1/24 on VLAN 2. This example also shows two static routes, which have a next-hop type (NH-Type) value of Router. Static routes have a default router, listed in the Gateway field. The 0.0.0.
PAGE 129
Configuring and managing IP interfaces and services 129 The metric (cost) can be any number between 0 and 2,147,483,647. Lower-cost routes are preferred over higher-cost routes. When you add multiple routes to the same destination, WSS Software groups the routes together and orders them from lowest cost at the top of the group to highest cost at the bottom of the group.
PAGE 130
Configuring and managing IP interfaces and services Managing the management services WSS Software provides the following services for managing a WSS over the network: Secure Shell (SSH) SSH provides a secure connection to the CLI through TCP port 22. Telnet Telnet provides a nonsecure connection to the CLI through TCP port 23. HTTPS HTTPS provides a secure connection to the Web management application through TCP port 443. SSH is enabled by default. Telnet and HTTPS are disabled by default.
PAGE 131
Configuring and managing IP interfaces and services 131 If a key has already been generated, the command replaces the old key with a new one. The new key takes affect for all new SSH sessions. You can verify the key using the following command: show crypto key ssh For example: WSS# show crypto key ssh ec:6f:56:7f:d1:fd:c0:28:93:ae:a4:f9:7c:f5:13:04 This command displays the checksum (also called a fingerprint) of the public key.
PAGE 132
Configuring and managing IP interfaces and services Managing SSH server sessions Use the following commands to manage SSH server sessions: show sessions admin clear sessions admin ssh [session-id] These commands display and clear SSH server sessions. Note. If you type the clear sessions admin ssh command from within an SSH session, the session ends as soon as you press Enter.
PAGE 133
Configuring and managing IP interfaces and services 133 Adding a Telnet user To log in with Telnet, a user must supply a valid username and password. To add a username and password to the local database, use the following command: set user username password password Optionally, you also can configure WSS Software either to locally authenticate the user or to use a RADIUS server to authenticate the user.
PAGE 134
Configuring and managing IP interfaces and services Managing Telnet server sessions Use the following commands to manage Telnet server sessions: show sessions admin clear sessions admin telnet [session-id] These commands display and clear management sessions from a remote client to the WSS’s Telnet server. Note. If you type the clear sessions admin telnet command from within a Telnet session, the session ends as soon as you press Enter.
PAGE 135
Configuring and managing IP interfaces and services 135 Displaying HTTPS information To display HTTPS service information, use the following command: show ip https To display information for a WSS’s HTTPS server, type the following command: WSS> show ip https HTTPS is enabled HTTPS is set to use port 443 Last 10 Connections: IP Address Last Connected Time Ago (s) ------------ ----------------------- -----------10.10.10.
PAGE 136
Configuring and managing IP interfaces and services Configuring and managing DNS You can configure a WSS to use a Domain Name Service (DNS) server to resolve hostnames into their IP addresses. This capability is useful in cases where you specify a hostname instead of an IP address in a command. For example, as an alternative to the command ping 192.168.9.1, you can enter the command ping chris.example.com. When you enter ping chris.example.
PAGE 137
Configuring and managing IP interfaces and services 137 To override the default domain name when entering a hostname in a CLI command, enter a period at the end of the hostname. For example, if the default domain name is example.com, enter chris. if the hostname is chris and not chris.example.com. Aliases take precedence over DNS. When you enter a hostname, WSS Software checks for an alias with that name first, before using DNS to resolve the name.
PAGE 138
Configuring and managing IP interfaces and services Aliases take precedence over DNS. When you enter a hostname, WSS Software checks for an alias with that name first, before using DNS to resolve the name. Adding an alias To add an alias, use the following command: set ip alias name ip-addr Specify an alias of up to 32 alphanumeric characters. To add an alias HR1 for IP address 192.168.1.2, type the following command: WSS# set ip alias HR1 192.168.1.2 success: change accepted.
PAGE 139
Configuring and managing IP interfaces and services 139 Configuring and managing time parameters You can configure the system time and date statically or by using Network Time Protocol (NTP) servers. In each case, you can specify the offset from Coordinated Universal Time (UTC) by setting the time zone. You also can configure WSS Software to offset the time by an additional hour for daylight savings time or similar summertime period. Note.
PAGE 140
Configuring and managing IP interfaces and services To set the time zone, use the following command: set timezone zone-name {-hours [minutes]} The zone name can be up to 32 alphanumeric characters long, with no spaces. The hours parameter specifies the number of hours to add to or subtract from UTC. Use a minus sign (-) in front of the hour value to subtract the hours from UTC.
PAGE 141
Configuring and managing IP interfaces and services 141 To set the summertime period to PDT (Pacific Daylight Time) and use the default start and end dates and times, type the following command: WSS# set summertime PDT success: change accepted. Displaying the summertime period To display the summertime period, use the following command: show summertime For example, to display the summertime period, type the following command: WSS# show summertime Summertime is enabled, and set to 'PDT'.
PAGE 142
Configuring and managing IP interfaces and services Displaying the time and date To display the time and date, use the following command: show timedate WSS# show timedate Sun Feb 29 2004, 23:58:02 PST Configuring and managing NTP The Network Time Protocol (NTP) allows a networking device to synchronize its system time and date with the time and date on an NTP server. When used on multiple devices, NTP ensures that the time and date are consistent among those devices.
PAGE 143
Configuring and managing IP interfaces and services 143 Removing an NTP server To remove an NTP server, use the following command: clear ntp server {ip-addr | all} If you use the all option, WSS Software clears all NTP servers configured on the switch. Changing the NTP update interval The default update interval is 64 seconds. To change the update interval, use the following command: set ntp update-interval seconds You can specify an interval from 16 through 1024 seconds.
PAGE 144
Configuring and managing IP interfaces and services The Timezone and Summertime fields are displayed only if you change the timezone or enable summertime. (For more information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.) Managing the ARP table The Address Resolution Protocol (ARP) table maps IP addresses to MAC addresses. An ARP entry enters the table in one of the following ways: • Added automatically by the WSS.
PAGE 145
Configuring and managing IP interfaces and services 145 To add an ARP entry, use the following command: set arp {permanent | static | dynamic} ip-addr mac-addr To add a static ARP entry that maps IP address 10.10.10.1 to MAC address 00:bb:cc:dd:ee:ff, type the following command: WSS# set arp static 10.10.10.1 00:bb:cc:dd:ee:ff success: added arp 10.10.10.
PAGE 146
Configuring and managing IP interfaces and services In this example, the ping is successful, indicating that the WSS has IP connectivity with the other device. Note. A WSS cannot ping itself. WSS Software does not support this. (For information about the command options, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.
PAGE 147
Configuring and managing IP interfaces and services 147 To clear Telnet client session 0, type the following command: WSS# clear sessions telnet client 0 You also can clear a Telnet client session by typing exit from within the client session. Tracing a route You can trace the router hops necessary to reach an IP host. The traceroute facility uses the TTL (Time to Live) field in the IP header to cause routers and servers to generate specific return messages.
PAGE 148
Configuring and managing IP interfaces and services IP interfaces and services configuration scenario This scenario configures IP interfaces, assigns one of the interfaces to be the system IP address, and configures a default route, DNS parameters, and time and date parameters. 1 Configure IP interfaces on the wss_mgmt and roaming VLANs, and verify the configuration changes. Type the following commands: WSS# set interface wss_mgmt ip 10.10.10.10/24 success: change accepted.
PAGE 149
Configuring and managing IP interfaces and services 149 WSS# set ip route default 10.20.10.1 1 success: change accepted. WSS# show ip route Router table for IPv4 Destination/ Mask Proto Metric NH-Type Gateway Static 1 Router 10.20.10.17 10.10.10.10/24 IP 0 Direct vlan:1:ip 10.10.10.10/32 IP 0 Local vlan:1:ip:10.10.10.10/24 10.20.10.10/24 IP 0 Direct vlan:1:ip 10.20.10.10/32 IP 0 Local vlan:1:ip:10.20.10.10/24 224.0.0.0/ 4 IP 0 Local MULTICAST 0.0.0.
PAGE 150
Configuring and managing IP interfaces and services WSS# show summertime Summertime is enabled, and set to 'PDT'. Start : Sun Apr 04 2004, 02:00:00 End : Sun Oct 31 2004, 02:00:00 Offset : 60 minutes Recurring : yes, starting at 2:00 am of first Sunday of April and ending at 2:00 am on last Sunday of October. WSS# set ntp server 192.168.1.
PAGE 151
Configuring SNMP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Configuring SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Displaying SNMP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 WSS Software supports Simple Network Management Protocol (SNMP) versions 1, 2c, and 3.
PAGE 152
Configuring SNMP Setting the system location and contact strings To set the location and contact strings for a switch, use the following commands: set system location string set system contact string Each string can be up to 256 characters long and blank spaces are accepted. The following commands set a WSS’s location to 3rd_floor_closet and set the contact to sysadmin1: WSS# set system location 3rd_floor_closet success: change accepted. WSS# set system contact sysadmin1 success: change accepted.
PAGE 153
Configuring SNMP 153 Enabling SNMP versions To enable an SNMP protocol, use the following command: set snmp protocol {v1 | v2c | usm | all} {enable | disable} The usm option enables SNMPv3. The all option enables all three versions of SNMP. The following command enables all SNMP versions: WSS# set snmp protocol all enable success: change accepted.
PAGE 154
Configuring SNMP Configuring community strings (SNMPv1 and SNMPv2c only) To configure a community string for SNMPv1 or SNMPv2c, use the following command: set snmp community name comm-string access {read-only | read-notify | notify-only | read-write | notify-read-write} The comm-string can be up to 32 alphanumeric characters long, with no spaces. You can configure up to 10 community strings.
PAGE 155
Configuring SNMP 155 Creating a USM user for SNMPv3 To create a USM user for SNMPv3, use the following command: set snmp usm usm-username snmp-engine-id {ip ip-addr | local | hex hex-string} access {read-only | read-notify | notify-only | read-write | notify-read-write} auth-type {none | md5 | sha} {auth-pass-phrase string | auth-key hex-string} encrypt-type {none | des | 3des | aes} {encrypt-pass-phrase string | encrypt-key hex-string} To clear a USM user, use the following command: clear snmp usm usm-u
PAGE 156
Configuring SNMP • To specify a passphrase, use the encrypt-pass-phrase string option. The string can be from 8 to 32 alphanumeric characters long, with no spaces. Type a string at least 8 characters long for DES or 3DES, or at least 12 characters long for AES. • To specify a key, use the encrypt-key hex-string option. Type a 16-byte hexadecimal string. Command examples The following command creates USM user snmpmgr1, associated with the local SNMP engine ID.
PAGE 157
Configuring SNMP 157 Setting SNMP security By default, WSS Software allows nonsecure SNMP message exchanges. You can configure WSS Software to require secure SNMP exchanges instead. Depending on the level of security you want WSS Software to enforce, you can require authentication of message exchanges only, or of message exchanges and notifications. You also can require encryption in addition to authentication. SNMPv1 and SNMPv2c do not support authentication or encryption.
PAGE 158
Configuring SNMP Configuring a notification profile A notification profile is a named list of all the notification types that can be generated by a switch, and for each notification type, the action to take (drop or send) when an event occurs. A default notification profile (named default) is already configured in WSS Software. All notifications in the default profile are dropped by default. You can configure up to 10 notification profiles.
PAGE 159
Configuring SNMP 159 • MichaelMICFailureTraps—Generated when two Michael message integrity code (MIC) failures occur within 60 seconds, triggering Wi-Fi Protected Access (WPA) countermeasures. • MobilityDomainJoinTraps—Generated when the WSS is initially able to contact a mobility domain seed member, or can contact the seed member after a timeout. • MobilityDomainTimeoutTraps—Generated when a timeout occurs after a WSS has unsuccessfully tried to communicate with a seed member.
PAGE 160
Configuring SNMP WSS# set snmp notify profile snmpprof_rfdetect send RFDetectClientViaRogueWiredAPTraps success: change accepted. WSS# set snmp notify profile snmpprof_rfdetect send RFDetectDoSTraps success: change accepted. WSS# set snmp notify profile snmpprof_rfdetect send RFDetectAdhocUserTraps success: change accepted. WSS# set snmp notify profile snmpprof_rfdetect send RFDetectInterferingRogueAPTraps success: change accepted.
PAGE 161
Configuring SNMP 161 Configuring a notification target A notification target is a remote device to which WSS Software sends SNMP notifications. You can configure the WSS Software SNMP engine to send confirmed notifications (informs) or unconfirmed notifications (traps). Some of the command options differ depending on the SNMP version and the type of notification you specify. You can configure up to 10 notification targets.
PAGE 162
Configuring SNMP The inform or trap option specifies whether the WSS Software SNMP engine expects the target to acknowledge notifications sent to the target by the WSS. Use inform if you want acknowledgements. Use trap if you do not want acknowledgements. The inform option is applicable to SNMP version v2c or usm only. The username is a USM username, and is applicable only when the SNMP version is usm.
PAGE 163
Configuring SNMP 163 Enabling the SNMP service To enable the WSS Software SNMP service, use the following command: set ip snmp server {enable | disable} The following command enables the SNMP service: WSS# set ip snmp server enable success: change accepted.
PAGE 164
Configuring SNMP The command lists settings separately for each notification profile. The use count indicates how many notification targets use the profile. For each notification type, the command lists whether WSS Software sends notifications of that type to the targets that use the notification profile.
PAGE 165
Configuring and managing Mobility Domain roaming About the Mobility Domain feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 Configuring a Mobility Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Configuring secure WSS to WSS communications . . . . . . . . . . . . . . . . . . . . . . . . . . 170 Monitoring the VLANs and tunnels in a Mobility Domain . . . . . . . . . . . . . . . . . . . .
PAGE 166
Configuring and managing Mobility Domain roaming When users access a WSS in a Mobility Domain, they become members of the VLAN designated through their authorized identity. If a user’s native VLAN is not present on the WSS that he or she accesses, the accessed WSS forms a tunnel to a WSS in the Mobility Domain that includes the native VLAN. In a Mobility Domain, one WSS acts as a seed device, which distributes information to the WSSs defined in the Mobility Domain.
PAGE 167
Configuring and managing Mobility Domain roaming 167 For example, the following commands add two members with IP addresses 192.168.12.7 and 192.168.15.5 to a Mobility Domain whose seed is the current WSS: WSS# set mobility-domain member 192.168.12.7 success: change accepted. WSS# set mobility-domain member 192.168.15.5 success: change accepted. Each command adds a member identified by its IP address to the list of Mobility Domain members.
PAGE 168
Configuring and managing Mobility Domain roaming When the primary seed is restored, it resumes its role as the primary seed switch in the Mobility Domain. The secondary seed returns to the role of a regular Mobility Domain member. NN47250-500 (320657-F Version 02.
PAGE 169
Configuring and managing Mobility Domain roaming 169 Use the following commands to configure a Mobility Domain consisting of a primary seed, secondary seed, and one or more member switches: On the primary seed: set mobility-domain mode seed domain-name mob-domain-name set mobility-domain member ip-addr (for each member switch) On the secondary seed: set mobility-domain mode secondary-seed domain-name mob-domain-name seed-ip primary-seed-ip-addr set mobility-domain member ip-addr (for each member switch) O
PAGE 170
Configuring and managing Mobility Domain roaming Displaying the Mobility Domain configuration To view the configuration of the Mobility Domain, use the show mobility-domain config command on either the seed or a nonseed member. • To view Mobility Domain configuration on the seed: WSS# show mobility-domain config This WSS is the seed for domain Santa Clara. 192.168.12.7 is a member 192.168.15.
PAGE 171
Configuring and managing Mobility Domain roaming 171 • On the Mobility Domain seed switch, when you specify the IP addresses and public keys for each member switch, the member switches’ public keys need to be obtained from each member switch by issuing the show crypto domain key command on each member switch.
PAGE 172
Configuring and managing Mobility Domain roaming • On the Mobility Domain seed switch, set the Mobility Domain mode and domain-name. Seed Switch Example: WSS-1# set mobility-domain mode seed domain-name NORTEL • On the Mobility Domain seed switch, specify the IP addresses and public keys for each member switch. The unique public key for each member switch is obtained from the show crypto domain key command. Note.
PAGE 173
Configuring and managing Mobility Domain roaming 173 Member State Status --------------- ------------- -------------192.168.110.15 STATE_UP SEED 192.168.110.16 STATE_UP MEMBER 192.168.110.17 STATE_UP MEMBER Monitoring the VLANs and tunnels in a Mobility Domain Tunnels connect WSSs. Tunnels are formed automatically in a Mobility Domain to extend a VLAN to the WSS that a roaming station is associated with. A single tunnel can carry traffic for many users and many VLANs.
PAGE 174
Configuring and managing Mobility Domain roaming Displaying roaming VLANs and their affinities The command show roaming vlan displays all VLANs in the Mobility Domain, the WSSs servicing the VLANs, and their tunnel affinity values configured on each switch for the VLANs. The member WSS that offers the requested VLAN reports the affinity number.
PAGE 175
Configuring and managing Mobility Domain roaming 175 Roaming requires certain conditions and can be affected by some of the WSS switch’s timers. You can monitor a wireless client’s roaming sessions with the show sessions network verbose command.
PAGE 176
Configuring and managing Mobility Domain roaming The output shows that the client SHUTTLE\2\exmpl roamed from the AP connected to port 3 to the AP connected to port 6 on the same WSS, and then roamed back to the AP connected to port 3. WSS> show sessions network verbose UserName Sess ID IP or MAC Address VLAN Name Port/Radio SHUTTLE 2\exmpl 6* 10.3.8.55 default 3/1 Client MAC: 00:06:25:13:08:33 GID: SESS-4-000404-98441-c807c14b State: ACTIVE (prev AUTHORIZED) now on: WSS 10.3.8.
PAGE 177
Configuring and managing Mobility Domain roaming 177 5 To display the Mobility Domain configuration, type the following command: WSS# show mobility-domain config This WSS is the seed for domain sunflower. 192.168.253.11 is a member 192.168.111.112 is a member 6 To display the WSSs that are hosting VLANs for roaming, type the following command: WSS# show roaming vlan VLAN WSS Affinity ---------------- --------------- -------vlan-eng 192.168.12.7 5 vlan-fin 192.168.15.5 5 vlan-pm 192.168.15.
PAGE 178
Configuring and managing Mobility Domain roaming NN47250-500 (320657-F Version 02.
PAGE 179
Configuring network domains About the network domain feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 Configuring a network domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 Network domain scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 A Network Domain is a group of geographically dispersed Mobility Domains that share information over a WAN link.
PAGE 180
Configuring network domains Figure 1. Network domain Corporate Office ND Seed Peer Layer 2-3 ND Seed Peer ND Seed Peer Layer 2-3 Layer 2-3 WAN Link Branch Office 1 ND Seed Peer Branch Office 2 ND Seed Peer Sales Office A ND Seed Peer Sales Office B Sales Office C In a Network Domain, one or more WSSs acts as a seed device. A Network Domain seed stores information about all of the VLANs on the Network Domain members.
PAGE 181
Configuring network domains 181 Figure 2.
PAGE 182
Configuring network domains Network domain seed affinity When there are multiple Network Domain seeds in an installation, a Network Domain member connects to the seed with which it has the highest configured affinity. If that seed is unavailable, the Network Domain member connects to the seed with which it has the next-highest affinity. Figure 3 illustrates how a WSS connects to a Network Domain seed based on its configured affinity for the seed. Figure 3.
PAGE 183
Configuring network domains 183 Configuring a network domain To configure a Network Domain: 1 Designate one or more Network Domain seed WSSs. (See “Configuring network domain seeds” (page 184).) 2 Specify seed peers in the Network Domain. (See “Specifying network domain seed peers” (page 185).) 3 Configure WSSs to be part of the Network Domain. (See “Configuring network domain members” (page 186).
PAGE 184
Configuring network domains Configuring network domain seeds In a Network Domain, a member WSS consults a seed WSS to determine a user’s VLAN membership in a remote Mobility Domain.
PAGE 185
Configuring network domains 185 Specifying network domain seed peers When multiple WSSs are configured as seed devices in a Network Domain, they establish a peer relationship to share information about the VLANs configured on the member devices, so that all of the Network Domain seed peers have the same database of VLAN information. Sharing information in this way provides redundancy in case one of the seed peers becomes unavailable.
PAGE 186
Configuring network domains Configuring network domain members In a Network Domain, at least one seed device must be aware of each member device. The seed maintains an active TCP connection with the member. To configure a WSS as a member of a Network Domain, you specify one or more Network Domain seeds for it to use. If you specify multiple Network Domain seeds, you can also specify the affinity the WSS has for each seed.
PAGE 187
Configuring network domains 187 Displaying network domain information To view the status of Network Domains configured on the WSS, use the show network-domain command. The output of the command differs based on whether the WSS is a member of a Network Domain or a Network Domain seed.
PAGE 188
Configuring network domains Clearing network domain configuration from a WSS You can clear all Network Domain configuration from a WSS, regardless of whether the WSS is a seed or a member of a Network Domain. You may want to do this in order to change a WSS from one Network Domain to another, or to remove a WSS entirely from a Network Domain.
PAGE 189
Configuring network domains 189 Clearing a network domain seed from a WSS You can remove individual Network Domain seeds from a WSS’s configuration. To remove a specific Network Domain seed, type the following command: clear network-domain seed-ip ip-addr When you enter this command, the Network Domain TCP connections between the WSS and the specified Network Domain seed are closed.
PAGE 190
Configuring network domains Clearing a network domain peer from a network domain seed On a WSS configured as a Network Domain seed, you can clear the configuration of individual Network Domain peers. To remove a specific Network Domain peer from a Network Domain seed, type the following command: clear network-domain peer ip-addr This command has no effect if the WSS is not configured as a Network Domain seed. NN47250-500 (320657-F Version 02.
PAGE 191
Configuring network domains 191 Clearing network domain seed or member configuration from a WSS You can remove the Network Domain seed or member configuration from the WSS. To do this, enter the following command: clear network-domain mode {seed | member} Use the seed parameter to clear Network Domain seed configuration from the WSS. Use the member parameter to clear Network Domain member configuration from the WSS.
PAGE 192
Configuring network domains about the VLANs in the three Mobility Domains. The Network Domain seed at Site 1 is also the seed for Mobility Domain A. The Network Domain seed at Site 2 is used by both Mobility Domains B and C. At least one Network Domain seed is aware of each WSS in the installation and maintains an active TCP connection with it. The following is the Network Domain configuration for this scenario: 1 Make the WSS with IP address 10.10.10.
PAGE 193
Configuring network domains 193 Member Network Domain name: globaldom Member State Mode -------------------------------10.10.10.1 UP SEED 10.10.10.2 UP MEMBER 10.10.10.3 UP MEMBER 20.20.20.1 UP SEED 20.20.20.2 UP MEMBER 20.20.20.3 UP MEMBER 30.30.30.1 UP MEMBER 30.30.30.
PAGE 194
Configuring network domains NN47250-500 (320657-F Version 02.
PAGE 195
Configuring RF load balancing for APs 195 Configuring RF load balancing for APs RF load balancing overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 Configuring RF load balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 Displaying RF load balancing information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 196
Configuring RF load balancing for APs • Assigning radios to load balancing groups • Specifying band preference for RF load balancing • Setting strictness for RF load balancing • Exempting an SSID from RF load balancing Disabling or re-enabling RF load balancing RF load balancing is enabled by default globally on the WSS switch and for individual radios.
PAGE 197
Configuring RF load balancing for APs 197 Setting strictness for RF load balancing To perform RF load balancing, AP radios with heavy client loads are less visible to new clients, and causes the new client to associate with AP radios with a lighter load. You can specify how strictly WSS attempts to load balanced across the AP radios in the load-balancing group.
PAGE 198
Configuring RF load balancing for APs WSS IP address Port Radio Overlap ------------------ ---- ----- ------WSS# show load-balancing group all Load-balancing group: G1 IP address AP Radio Clients ------------------ ---- ----- ------10.1.0.188 30 1 0 --------------------------------------WSS# show configuration area load-balancing all # Configuration nvgen'd at 2007-6-27 03:17:38 # Image 6.0.3.2.
PAGE 199
Configuring APs AP overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Configuring global AP parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 Disabling or reenabling radios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 Displaying AP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 200
Configuring APs Figure 1. Example Nortel network serial-id 0322199997 2330 serial-id 0322199996 2330 WSS2 System IP address 10.10.40.4 serial-id 0322199999 2330 external antenna model 5303 RADIUS servers Port 2 Port 1 WSS1 System IP address 10.10.10.4 10.10.40.19/24 Port 5 Layer 2 10.10.20.19/24 10.10.70.20 Router 10.10.30.19/24 10.10.60.19/24 10.10.70.40 Port 4 Port 3 Layer 2 2330 serial-id 0322199998 10.10.10.
PAGE 201
Configuring APs 201 Note. Intentional radiators, such as the Nortel WLAN 2330/2330A/2330B and Series 2332 access points, are not intended to be operated with any antenna(s) other than those furnished by Nortel. An intentional radiator may only be operated with the antenna(s) with which it is authorized. For a complete listing of antennas for use with this product, visit http://www.nortel.com/support. • Configure SSID and encryption settings in a service profile.
PAGE 202
Configuring APs through any network port. (A network port is any port connecting the switch to other networking devices, such as switches and routers, and it can also be configured for 802.1Q VLAN tagging.) The WSS contains a configuration for a Distributed AP based on the AP’s serial number. Similar to ports configured for directly connected APs, Distributed AP configurations are numbered and can reference a particular AP. These numbered configurations do not, however, reference any physical port.
PAGE 203
Configuring APs 203 As part of the boot process, an AP disables and reenables the link on the port over which the AP is attempting to boot. If STP is enabled on the device that is directly connected to the port, the link state change can cause the port on the other device to leave the forwarding state and stop forwarding traffic. The port remains unable to forward traffic for the duration of the STP forwarding delay.
PAGE 204
Configuring APs AP parameters Table 1 summarizes parameters that apply to individual APs, including dual-homing parameters. (For information about parameters for individual radios, see “Configuring a radio profile” (page 250) and “Configuring radio-specific parameters” (page 255).) Table 1: Global AP parameters Parameter Default Value Description name Based on the port or Distributed AP connection number. For example: • AP01 AP name.
PAGE 205
Configuring APs 205 • WSS redundancy—You can provide redundancy of WSS services by dual-homing the AP to two directly connected WSSs; or by configuring a Distributed AP configuration either on two or more indirectly connected WSSs, or on a combination of a directly connected WSS and one or more indirectly connected WSSs. To provide WSS redundancy on an AP model that has only one AP port, configure a Distributed AP connection on two or more indirectly connected WSSs.
PAGE 206
Configuring APs Figure 3. Dual-homed direct connections to two WSS Switches WSS 840-9502-0052 Network backbone WSS AP Dual-homed direct and distributed connections to WSSs Figure 4 shows an example of a dual-homed configuration in which one AP connection is direct and the other is distributed over the network. Figure 4. Dual-homed direct and distributed connections to WSSs WSS WSS WSS Network backbone WSS AP port 2 AP port 1 In this example, the AP’s port 1 is directly connected to a WSS.
PAGE 207
Configuring APs 207 Dual-homed distributed connections to WSSs on both AP ports Figure 5 shows an example of a dual-homed configuration in which both AP connections are distributed over the network. Figure 5. Dual-homed distributed connections to WSSs on both AP ports WSS WSS Network backbone Network backbone WSS AP port 2 AP port 1 In this configuration, the AP first attempts to boot on its port 1.
PAGE 208
Configuring APs Dual-homed distributed connections to WSSs on one AP port Figure 6 shows an example of an AP with a single physical link to a network containing three WSSs. Figure 6. Single-homed connection to multiple WSSs on one AP port WSS WSS WSS Network backbone In this configuration, the AP sends a boot request on its connected port. WSSs that are in the same subnet respond to the AP.
PAGE 209
Configuring APs 209 Establishing connectivity on the network When an AP is first powered on, its bootloader obtains an IP address for the AP. The IP address is either obtained through DHCP (the default) or can be statically configured on the AP. How a distributed AP obtains an IP address through DHCP By default, a distributed AP obtains its IP address through DHCP. The AP brings up the link on the AP’s port 1 and attempts the boot process outlined below.
PAGE 210
Configuring APs ● If the DHCP Offer message contained one or more IP addresses in the Option 43 field, the AP sends a unicast Find WSS message to each address. The process skips to step 6. ● If the DHCP Offer message contained one or more hostnames in the Option 43 field, the AP sends DNS Requests to the DNS server for the IP addresses of the hosts, then sends a unicast Find WSS message to each address. The process skips to step 6. Note.
PAGE 211
Configuring APs 211 5 The AP sends Find WSS requests to the WSS IP addresses given by the DNS reply. If a WSS receives the Find WSS Request, the process continues with step 6. However, if no WSSs reply, the AP repeatedly retries this method: ● If still no WSSs reply, the AP begins the process again, starting with the procedure under “How a distributed AP contacts a WSS (DHCP-obtained address)” (page 209), on the other AP port.
PAGE 212
Configuring APs 3 4 ● If the AP receives a response to the broadcast Find WSS message, then the process continues using the procedure described under “How a distributed AP contacts a WSS (DHCP-obtained address)”, starting with step 6 on page 211. ● If there is no response to the broadcast Find WSS message, the WSS continues broadcasting the Find WSS message for a period of time. If still no response is received, then the process skips to step 4 on page 212.
PAGE 213
Configuring APs 213 After the AP receives the configuration information from the WSS, it is then operational on the network as a wireless access point. AP boot examples The following figures show AP boot examples: • Figure 7 on page 214 shows an example of the boot process for an AP connected through a Layer 2 network. • Figure 8 on page 216 shows an example of the boot process for an AP connected through a Layer 3 network.
PAGE 214
Configuring APs Example AP boot over layer 2 network Figure 7 shows an example of the boot process for an AP connected through a Layer 2 network. MX1, MX2, and MX3 each have a Distributed AP configuration for the AP. Figure 7. AP booting over layer 2 network WSS2 System IP address 10.10.40.4 active APs = 34 4 DAP 1 serial_id 0322199999 model 2330bias = low WSS1 System IP address 10.10.10.
PAGE 215
Configuring APs 215 the DNS server address, and the domain name. AP then sends a DHCP Request message to the server and receives an Ack from the server. 3 The AP sends a broadcast Find WSS message to IP subnet broadcast address. 4 WSS1 and WSS3 have high priority for the AP and reply immediately. 5 The AP contacts WSS1 and determines whether it should use a locally stored operational image or download it from the WSS. WSS1 is contacted because it has fewer active AP connections than WSS3.
PAGE 216
Configuring APs Example AP Boot over Layer 3 Network Figure 8 shows an example of the boot process for an AP connected through a Layer 3 network. Figure 8. AP booting over layer 3 network WSS2 System IP address 10.10.40.4 active APs = 34 DAP 1 serial_id 0322199998 model 2330 bias = low WSS1 System IP address 10.10.10.
PAGE 217
Configuring APs 217 1 The AP sends DHCP Discover message from the AP’s port 1. 2 The DHCP server replies with a DHCP Offer message containing an IP address for the AP, the default router IP address for the AP’s IP subnet, the DNS server address, and the domain name. AP then sends a DHCP Request message to the server and receives an Ack from the server. 3 The AP sends a broadcast Find WSS message to the IP subnet broadcast address.
PAGE 218
Configuring APs using the directly connected WSS regardless of the bias set on any of the WSSs configured for the AP. Only in the event of a physical port failure would the AP attempt to boot from its port 2. Figure 9. Dual-homed AP booting WSS2 System IP address 10.10.40.4 active APs = 34 DAP 1 serial_id 0322199999 model 2330 WSS1 System IP address 10.10.10.
PAGE 219
Configuring APs 219 Example boot of AP with static IP configuration Figure 10 shows an example of the boot process for an AP configured with static IP information. In the example, the AP has been configured to use the following: • Static IP address: 172.16.0.42, netmask: 255.255.255.0, default router 172.16.0.20 • Boot WSS: 2350, DNS server: 172.16.0.1 Figure 10. AP booting with a static IP address DAP 1 static IP: 172.16.0.42 DNS Server 172.16.0.
PAGE 220
Configuring APs Session load balancing You can assign APs to a load-balancing group. A load-balancing group helps reduce congestion by distributing client sessions among the APs in the group. For example, if an 802.11b/g radio operating on channel 1 is supporting more sessions than a neighboring 802.11b/g radio operating on channel 6, the load-balancing feature can reject association requests to the radio on channel 1.
PAGE 221
Configuring APs 221 Table 2: Defaults for service profile parameters (continued) Radio Behavior When Parameter Set To Default Value Parameter Default Value beacon enable Sends beacons to advertise the SSID managed by the service profile. cac-mode none Does not limit the number of active user sessions based on Call Admission Control (CAC). cac-session 14 If session-based CAC is enabled (cac-mode is set to session), limits the number of active user sessions on a radio to 14.
PAGE 222
Configuring APs Table 2: Defaults for service profile parameters (continued) Radio Behavior When Parameter Set To Default Value Parameter Default Value no-broadcast disable Does not reduce wireless broadcast traffic by sending unicasts to clients for ARP requests and DHCP Offers and Acks instead of forwarding them as multicasts. proxy-arp disable Does not reply on behalf of wireless clients to ARP requests for client IP addresses.
PAGE 223
Configuring APs 223 Table 2: Defaults for service profile parameters (continued) Radio Behavior When Parameter Set To Default Value Parameter Default Value transmit-rates 802.11a: • mandatory: 6.0,12.0,24.0 • beacon-rate: 6.0 • multicast-rate: auto • disabled: none 802.11b: • mandatory: 1.0,2.0 • beacon-rate: 2.0 • multicast-rate: auto • disabled: none 802.11g: • mandatory: 1.0,2.0,5.5,11.0 • beacon-rate: 2.
PAGE 224
Configuring APs Table 2: Defaults for service profile parameters (continued) Parameter Default Value Radio Behavior When Parameter Set To Default Value wep key-index No keys defined Uses dynamic WEP rather than static WEP. Note: If you configure a WEP key for static WEP, WSS Software continues to also support dynamic WEP. wep active-multicast-index 1 Uses WEP key 1 for static WEP encryption of multicast traffic if WEP encryption is enabled and keys are defined.
PAGE 225
Configuring APs 225 Table 3: MAC address allocations on APs • • Radios and SSIDs 2330/2330A/2330B and Series 2332 • • The 802.11b/g radio equals the AP base MAC address. The BSSIDs for the SSIDs configured on the 802.11b/g radio end in even numbers. The first BSSID is equal to the AP’s base MAC address. The next BSSID is equal to the AP’s base MAC address + 2, and so on. The 802.11a radio equals the AP base MAC address + 1. The BSSIDs for the SSIDs configured on the 802.11a radio end in odd numbers.
PAGE 226
Configuring APs Table 4: Defaults for radio profile parameters Radio Behavior When Parameter Set To Default Value Parameter Default Value active-scan enable Sends probe any requests (probe requests with a null SSID name) to solicit probe responses from other access points. (See “Rogue detection and counter measures” (page 625).) beacon-interval 100 Waits 100 ms between beacons. countermeasures Not configured Does not issue countermeasures against any device.
PAGE 227
Configuring APs 227 Table 4: Defaults for radio profile parameters (continued) Radio Behavior When Parameter Set To Default Value Parameter Default Value rts-threshold 2346 Transmits frames longer than 2346 bytes by means of the Request-to-Send/ Clear-to-Send (RTS/CTS) method. service-profile No service profiles defined You must configure a service profile. The service profile sets the SSID name and other parameters.
PAGE 228
Configuring APs Table 5: Radio-specific parameters Parameter Default Value Description antennalocation indoor/outdoor Location of the radio’s antenna. Note: This parameter applies only to APs that support external antennas. antennatype For most AP models, the default is internal. Nortel external antenna model Note: This parameter is configurable only on APs that support external antennas.
PAGE 229
Configuring APs 229 • Configure a service profile to set SSID and encryption parameters. (See “Configuring a service profile” (page 244).) • Configure a radio profile. (See “Configuring a radio profile” (page 250).) • If required, configure the channel, transmit power, and external antenna type on each radio. (See “Configuring radio-specific parameters” (page 255).) • Map the radio profile to a service profile. (See “Mapping the radio profile to service profiles” (page 270).
PAGE 230
Configuring APs WSS# set system countrycode US success: change accepted. WSS# show system ============================================================================== = Product Name: WSS System Name: WSS System Countrycode: US System Location: System Contact: System IP: 30.30.30.
PAGE 231
Configuring APs 231 profile with a high bias setting. If more than one WSS has an Auto-AP profile with a high bias setting, the switch that has the greatest capacity to add new unconfigured APs is selected.
PAGE 232
Configuring APs Configuring an auto-AP profile The Auto-AP profile for Distributed AP configuration is like an individual AP configuration, except the configuration has the name auto instead of a Distributed AP number. To create an Auto-AP profile for automatic Distributed AP configuration, type the following command: WSS# set ap auto success: change accepted.
PAGE 233
Configuring APs 233 Table 7: Configurable profile parameters for distributed APs (continued) Parameter Default Value radio num auto-tune max-power default radio num mode enabled radio num radio-profile default radiotype 11g (or 11b for country codes where 802.11g is not allowed) APs that receive their configurations from the Auto-AP profile also receive the radio settings from the radio profile used by the Auto-AP profile.
PAGE 234
Configuring APs Enabling the auto-AP profile To enable the Auto-AP profile for automatic Distributed AP configuration, type the following command: WSS# set ap auto mode enable success: change accepted. Specifying the radio profile used by the auto-AP profile The Auto-AP profile uses radio profile default by default.
PAGE 235
Configuring APs 235 Converting an AP configured by the auto-AP profile into a permanent AP You can convert a temporary AP configuration created by the Auto-AP profile into a persistent AP configuration on the WSS. To do so, use the following command: set ap auto persistent {ap-num | all} This command creates a persistent Distributed AP configuration based on the settings in the Auto-AP profile. The Distributed AP name and number assigned by the Auto-AP profile are used for the persistent entry.
PAGE 236
Configuring APs Table 8: Maximum APs supported per switch (continued) WSS Model Maximum That Can Be Configured Maximum That Can Be Booted 2360/2361 30 12 2350 8 3 Setting the port type for a directly connected AP You must set the port type on WSS ports that are directly connected to APs. When you change port type, WSS Software applies default settings appropriate for the port type. Table 9 on page 236 lists the default settings that WSS Software applies when you set a port’s type to ap.
PAGE 237
Configuring APs 237 To set the port type for AP access ports, use the following command: set port type ap port-list model {2330 | 2330A | 2330B | 2332-A1 | 2332-A2 | 2332-A3 | 2332-A4 | 2332-A5 | 2332-A6 | 2332-E1 | 2332-E2 | 2332-E3 | 2332-E4 | 2332-E5 |2332-E6 | 2332-E7 | 2332-E8 | 2332-E9 | 2332-J1} poe {enable | disable} [radiotype {11a | 11b| 11g}] You must specify the AP model and the PoE state. (For syntax information, see “Setting a port for a directly connected AP” (page 91).
PAGE 238
Configuring APs When you configure static IP information for a Distributed AP, it uses the boot procedure described in “How a distributed AP contacts a WSS (statically configured address)” (page 211) instead of the default boot procedure.
PAGE 239
Configuring APs 239 success: change accepted. Specifying VLAN information To specify 802.1Q VLAN tagging information for a Distributed AP, use the following command: set ap ap-num boot-vlan vlan-tag tag-value [mode {enable | disable}] When this command is configured, all Ethernet frames emitted from the Distributed AP are formatted with an 802.1Q tag with a specified VLAN number. Frames sent to the Distributed AP that are not tagged with this value are ignored.
PAGE 240
Configuring APs Changing bias The CLI commands described in this section enable you to change the bias for an AP. To change the bias of an AP, use the following command: set {ap port-list | ap ap-num} bias {high | low} The default bias is high. To change the bias for a Distributed AP to low, type the following command: WSS# set ap 1 bias low success: change accepted. Configuring a load-balancing group A load-balancing group is a named set of APs.
PAGE 241
Configuring APs 241 Even when forced image download is disabled (the default), the AP still checks with the WSS to verify that the AP has the latest image, and to verify that the WSS is running WSS Software Version 5.0 or later. The AP loads its local image only if the WSS is running WSS Software Version 5.0 or later and does not have a newer AP image than the one in the AP’s local storage. If the switch is not running WSS Software Version 5.
PAGE 242
Configuring APs RSA aaaa:aaaa:aaaa:aaaa: aaaa:aaaa:aaaa:aaaa If the AP is already installed, you can display the fingerprint in WSS Software. (See “Finding the fingerprint” (page 243).) Encryption options By default, a WSS can configure and manage a Distributed AP regardless of whether the AP has an encryption key, and regardless of whether you have confirmed the fingerprint by setting it in WSS Software. You can configure a WSS to require Distributed APs to have an encryption key.
PAGE 243
Configuring APs 243 Finding the fingerprint An AP’s fingerprint is listed on a label on the back of the AP. (See “Encryption key fingerprint” (page 241).) If the AP is already installed and operating, use the show ap status command to display the fingerprint. The following example shows information for Distributed AP 8, including its fingerprint: WSS# show ap status 8 ap: 8, IP-addr: 10.2.26.
PAGE 244
Configuring APs Setting the AP security requirement on a WSS You can configure the WSS to require all Distributed APs to have encryption keys. In this case, the WSS does not establish a management session with a Distributed AP unless the AP has a key, and you have confirmed the key’s fingerprint in WSS Software. Note. A change to AP security support does not affect management sessions that are already established. To apply the new setting to an AP, restart the AP.
PAGE 245
Configuring APs 245 Creating a service profile To create a service profile and assign an SSID to it, use the following command: set service-profile name ssid-name ssid-name An SSID can be up to 32 alphanumeric characters long. You can include blank spaces in the name, if you delimit the name with single or double quotation marks. You must use the same type of quotation mark (either single or double) on both ends of the string.
PAGE 246
Configuring APs An AP radio responds to an 802.11 probe any request only for a beaconed SSID. A client that sends a probe any request receives a separate response for each of the beaconed SSIDs supported by a radio. For a nonbeaconed SSID, radios respond only to directed 802.11 probe requests that match the nonbeaconed SSID’s SSID string. When you disable beaconing for an SSID, the radio still sends beacon frames, but the SSID name in the frames is blank.
PAGE 247
Configuring APs 247 Table 11: Transmit rates Parameter Default Value Description mandatory • • • Set of data transmission rates that clients are required to support in order to associate with an SSID on an AP radio. A client must support at least one of the mandatory rates. These rates are advertised in the basic rate set of 802.11 beacons, probe responses, and reassociation response frames sent by AP radios. Data frames and management frames sent by AP radios use one of the specified mandatory rates.
PAGE 248
Configuring APs Table 11: Transmit rates (continued) Parameter Default Value Description multicast-rate auto for all radio types Data rate of multicast frames sent by AP radios. • rate—Sets the multicast rate to a specific rate. The valid rates depend on the radio type and are the same as the valid rates for mandatory. However, you cannot set the multicast rate to a disabled rate. • auto—Sets the multicast rate to the highest rate that can reach all clients connected to the AP radio.
PAGE 249
Configuring APs 249 The following command sets a 802.11g mandatory rate for service profile sp1 to 54 Mbps and disables rates 1.0 Mbps and 2.0 Mbps: WSS# set service-profile sp1 transmit-rates 11g mandatory 54.0 disabled 1.0,2.0 The following command maps radio profile rp1 to service profile sp1. WSS# set radio-profile rp1 service-profile sp1 After these commands are entered, if a client transmitting with a data rate of 1.0 Mbps or 2.
PAGE 250
Configuring APs Changing the short retry threshold The short retry threshold specifies the number of times a radio can send a short unicast frame for an SSID without receiving an acknowledgment for the frame. A short unicast frame is a frame that is shorter than the RTS threshold. To change the short retry threshold, use the following command: set service-profile name short-retry threshold The threshold can be a value from 1 through 15. The default is 5.
PAGE 251
Configuring APs 251 Creating a new profile To create a radio profile, use the following command: set radio-profile name [mode {enable | disable}] Specify a name of up to 16 alphanumeric characters. Do not include the mode enable or mode disable option. After you create the radio profile, you can use the enable and disable options to enable or disable all radios that use the profile.
PAGE 252
Configuring APs The DTIM interval does not apply to unicast frames. An AP also stores unicast frames in buffer memory, but the AP includes information about the buffered unicast frames in each beacon frame. When a user station receives a beacon frame that advertises unicast frames destined for the station, the station sends a request for the frames and the AP transmits the requested frames to the user station.
PAGE 253
Configuring APs 253 Changing the maximum receive threshold The maximum receive threshold specifies the number of milliseconds a frame received by a radio can remain in buffer memory. To change the maximum receive lifetime, use the following command: set radio-profile name max-rx-lifetime time The time can be from 500 ms (0.5 second) through 250,000 ms (250 seconds). The default is 2000 ms (2 seconds).
PAGE 254
Configuring APs To change the preamble length advertised by 802.11b/g radios, use the following command: set radio-profile name preamble-length {long | short} To configure 802.11b/g radios that use the radio profile rp_long to advertise support for long preambles instead of short preambles, type the following command: WSS# set radio-profile rp_long preamble-length long success: change accepted.
PAGE 255
Configuring APs 255 To disable the radios that are using radio profile rptest and remove the profile, type the following commands: WSS# set radio-profile rptest mode disable WSS# clear radio-profile rptest success: change accepted. Configuring radio-specific parameters This section shows how to configure the channel and transmit power on individual radios, and how to configure for external antennas. (For information about the parameters you can set on individual radios, see Table 5.
PAGE 256
Configuring APs Configuring the external antenna model This section introduces the external antenna portfolio available for the WLAN 2300 system AP-2330/2330A/ 2330B and Series 2332 Access Points. • The portfolio includes 802.11b/g (2.4GHz), 802.11a (5GHz) and 802.11a/b/g (2.4/5GHz) models.
PAGE 257
Configuring APs 257 • Nortel has tested and measured each product. The antenna gains expressed in dBi measurements are the Nortel tested values and may differ slightly from those published by Cushcraft for similar products. Warning! Intentional radiators, such as the Nortel WLAN 2330/ 2330A/2330B and Series 2332 access points, are not intended to be operated with any antenna(s) other than those furnished by Nortel.
PAGE 258
Configuring APs External antenna selector guides for the AP-2330, AP-2330A, AP-2330B and Series 2332 APs Table 12: External Antenna Selector Guide for the AP-2330/AP-2330A/ AP-2330B and Series 2332 APs for indoor operation WSS Model String Cushcraft Nortel Model Number S2403BHN36RSM DR4000072E6 24453 (Discontinued) S2403BPXN36RSM DR4000088E6 24493 (Replaces DR4000072E6) S2406PN36RSM DR4000075E6 24553 SL2402PN36RSM DR4000074E6 24203 SQ2405DDN36RSM DR4000073E6 24403 S2409PN36RSM DR400007
PAGE 259
Configuring APs 259 Table 12: External Antenna Selector Guide for the AP-2330/AP-2330A/ AP-2330B and Series 2332 APs for indoor operation (continued) S241290PN36RSM DR4000086E6 24123 Cushcraft Nortel Model Number WSS Model String WLAN Directional Patch Panel Array Antenna with an average gain of 12 dBi, 3-foot cable with a Reverse SMA connector and either a tilt, wall or pole mounting capability.
PAGE 260
Configuring APs Table 12: External Antenna Selector Guide for the AP-2330/AP-2330A/ AP-2330B and Series 2332 APs for indoor operation (continued) 2.4/5.0 GHz Dual Antennas S24493DSN36RSM DR4000078E6 Mixed WLAN Dual-Band, Tri-Mode 802.11 a/b/g Spatial Diversity Monopole Antenna. It operates over the 2.4 - 2.5 GHz and 4.90 - 5.875 GHz bands. It has an average gain of 3.0 dBi from 2.4 - 2.5 GHz, 4.0 dBi from 4.90 - 5.15 GHz, 3.9 dBi from 5.15 - 5.25 GHz, 3.2 dBi from 5.25 - 5.35 GHz, 2.9 dBi from 5.
PAGE 261
Configuring APs 261 24493To be used with the outdoor NEMA enclosure only. Output NEMA-10 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 10-foot outdoor rated extension cable. 24493To be used with the outdoor NEMA enclosure only. Output NEMA-25 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 25-foot outdoor rated extension cable.
PAGE 262
Configuring APs 24883To be used with the outdoor NEMA enclosure only. Output NEMA-10 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 10-foot outdoor rated extension cable. 24883To be used with the outdoor NEMA enclosure only. Output NEMA-25 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 25-foot outdoor rated extension cable.
PAGE 263
Configuring APs 263 24143To be used with the outdoor NEMA enclosure only. Output NEMA-10 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 10-foot outdoor rated extension cable. 24143To be used with the outdoor NEMA enclosure only. Output NEMA-25 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 25-foot outdoor rated extension cable.
PAGE 264
Configuring APs 24123To be used with the outdoor NEMA enclosure only. Output NEMA-10 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 10-foot outdoor rated extension cable. 24123To be used with the outdoor NEMA enclosure only. Output NEMA-25 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 25-foot outdoor rated extension cable.
PAGE 265
Configuring APs 265 24113To be used with the outdoor NEMA enclosure only. Output NEMA-10 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 10-foot outdoor rated extension cable. 24113To be used with the outdoor NEMA enclosure only. Output NEMA-25 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 25-foot outdoor rated extension cable.
PAGE 266
Configuring APs 5643NEMA To be used with the outdoor NEMA enclosure only. Output power is compensated for the addition of the 10-foot plenum rated cable and the lightning protection circuitry. 5643To be used with the outdoor NEMA enclosure only. Output NEMA-10 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 10-foot outdoor rated extension cable. 5643To be used with the outdoor NEMA enclosure only.
PAGE 267
Configuring APs 267 5133NEMA To be used with the outdoor NEMA enclosure only. Output power is compensated for the addition of the 10-foot plenum rated cable and the lightning protection circuitry. 5133To be used with the outdoor NEMA enclosure only. Output NEMA-10 power is compensated for the addition of the 10-foot plenum rated cable, the lightning protection circuitry and the 10-foot outdoor rated extension cable. 5133To be used with the outdoor NEMA enclosure only.
PAGE 268
Configuring APs Antenna selection decision trees The following decision trees are intended to quickly guide users to the appropriate model(s) based on basic criteria. • The distinction between office and industrial types refers solely to the aesthetic suitability of an antenna for each environment. Any antenna identified as suitable for office deployments can be deployed in industrial environments and vice versa.
PAGE 269
Configuring APs 269 Figure 11. 5 GHz Antennas 2.
PAGE 270
Configuring APs Specifying the external antenna model To specify the 2.
PAGE 271
Configuring APs 271 Assigning a radio profile and enabling radios To assign a radio profile to radios, use the following command: set {ap port-list | ap ap-num} radio {1 | 2} radio-profile name mode {enable | disable} To assign radio profile rp1 to radio 1 on ports 5-8, 11-14, and 16 and enable the radios, type the following command: WSS# set ap 5-8,11-14,16 radio 1 radio-profile rp1 mode enable success: change accepted.
PAGE 272
Configuring APs The following command enables all radios that use radio profile rp1: WSS# set radio-profile rp1 mode enable success: change accepted. The following commands disable all radios that use radio profile rp1, change the beacon interval, then reenable the radios: WSS# set radio-profile rp1 mode disable success: change accepted. WSS# set radio-profile rp1 beacon-interval 200 success: change accepted. WSS# set radio-profile rp1 mode enable success: change accepted.
PAGE 273
Configuring APs 273 Displaying AP information You can display the following AP information: • AP and radio-specific configuration settings • Connection information for Distributed APs configured on a WSS • List of Distributed APs that are not configured on a WSS • Connection information for Distributed APs • Service profile information • Radio profile information • Status information • Information about static IP addresses on Distributed APs • Statistics counters Displaying AP configurati
PAGE 274
Configuring APs (For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.) Displaying connection information for APs To display connection information for APs configured on a WSS, use the following command: show ap global [ap-num | serial-id serial-ID] This command lists the System IP addresses of all the WSS switches on which each AP is configured, and lists the bias for the AP on each switch.
PAGE 275
Configuring APs 275 WSS# show ap unconfigured Total number of entries: 2 Serial Id Model IP Address Port Vlan ----------- ------ --------------- ---- -------0333001287 2330 10.3.8.54 5 default 0333001285 2330 10.3.8.57 7 vlan-eng Displaying active connection information for APs A AP can have only one active data connection.
PAGE 276
Configuring APs vlan-name = session-timeout = service-type = 11a beacon rate: 11a mandatory rate: 11b beacon rate: 11b mandatory rate: 11g beacon rate: 11g mandatory rate: orange 300 2 6.0 6.0,12.0,24.0 2.0 1.0,2.0 2.0 1.0,2.0,5.5,11.0 multicast rate: AUTO standard rates: 9.0,18.0,36.0,48.0,54.0 multicast rate: AUTO standard rates: 5.5,11.0 multicast rate: AUTO standard rates: 6.0,9.0,12.0,18.0,24.0, 36.0,48.0,54.
PAGE 277
Configuring APs 277 The terse option displays a brief line of essential status information for each directly connected AP. The all option displays information for all directly attached APs configured on the switch. The following command displays the status of a AP: WSS# show ap status 1 ap: 1, IP-addr: 10.2.30.
PAGE 278
Configuring APs WSS IP: WSS name: 172.16.0.21 DNS: 2350 172.16.0.1 (For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.
PAGE 279
Configuring APs 279 TxUniPkt TxUni Byte RxPkt UndcrptPkt TxMulti TxMultiByte RxByte Pkt Undcrp PhyErr tByte 18.0 0 0 0 0 0 0 0 0 38 24.0 0 0 0 0 0 0 0 0 47 36.0 0 0 0 0 0 0 0 0 1 48.0 0 0 0 0 1 68 0 0 29 54.0 0 0 0 0 0 0 0 0 5 55683 832715 8697520 41 11513 0 0 12948 TOTAL 6660 (For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.
PAGE 280
Configuring APs NN47250-500 (320657-F Version 02.
PAGE 281
Configuring WLAN mesh services 281 Configuring WLAN mesh services WLAN mesh services overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 Configuring WLAN mesh services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 Configuring Wireless Bridging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 Displaying WLAN Mesh Services Information . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 282
Configuring WLAN mesh services Figure 1. WLAN Mesh Services In the Figure 1, a client is associated with a Mesh AP and an AP without a wired interface to the network. The Mesh AP is configured to communicate with a Mesh Portal AP and an AP with wired connectivity to an WSS. Communication between the Mesh AP and the Mesh Portal AP takes place through a secure radio link (a Mesh Link).
PAGE 283
Configuring WLAN mesh services 283 Configuring WLAN mesh services The basic configuration procedure for WLAN mesh services consists of the following tasks: • Attach the Mesh AP to the network and configure mesh services. • Configure a service profile for mesh services. • Set the security parameters to allow the Mesh AP to authenticate the network. • Optional—configure the Mesh Portal AP to emit link calibration packets and aid with positioning the Mesh AP.
PAGE 284
Configuring WLAN mesh services Configuring the Mesh AP Note. Before a Mesh AP can be installed in a location untethered from the network, it must be preconfigured for mesh services, including the mesh services SSID, and the pre-shared key for establishing the connection between the Mesh AP and the Mesh Portal AP. 1 Attach the AP to your network, apply power, and allow the AP to boot as a regular AP. 2 Once the AP has booted, use the following command to enable mesh services on the AP.
PAGE 285
Configuring WLAN mesh services 285 Configuring the Service Profile for Mesh Services Configure the Mesh Portal AP to beacon the mesh services SSID. To do this, create a service profile and enable mesh services using the following commands: set service-profile mesh-service-profile ssid-name mesh-ssid set service-profile mesh-service-profile mesh mode {enable | disable} Then, service profile can be mapped to a radio profile, that manages a radio on the Mesh Portal AP. Note.
PAGE 286
Configuring WLAN mesh services Configuring Security The secure connection between the Mesh AP and the Mesh Portal AP is established in a two-step process: 1 Creation of an encrypted point-to-point link between the Mesh AP and the Mesh Portal AP 2 Authentication of the Mesh AP. When the Mesh AP is booted, it searches for a beacon containing the configured mesh SSID. Once the Mesh AP locates a Mesh Portal AP with the mesh SSID, it associates with the Mesh Portal AP as a client device.
PAGE 287
Configuring WLAN mesh services 287 Enabling Link Calibration Packets on the Mesh Portal AP A Mesh Portal AP can be configured to emit link calibration packets to assist with positioning the Mesh AP. A link calibration packet is an unencrypted 802.11 management packet of type Action. When enabled on an AP, link calibration packets are sent at the rate of 5 per second.
PAGE 288
Configuring WLAN mesh services Deploying the Mesh AP After you have configured the Mesh AP with mesh services settings, detach the AP from the wired network and place it in the desired location. The Mesh Portal AP must be within radio range of the Mesh AP. Configuring Wireless Bridging You can use WLAN mesh services in a wireless bridge configuration and implement APs as bridge endpoints in a transparent Layer 2 bridge.
PAGE 289
Configuring WLAN mesh services 289 When wireless bridging is enabled for a service profile, the APs with the applied service profile are bridge peers. When a Mesh AP associates with a Mesh Portal AP through this service profile, the Mesh Portal AP automatically configures the Mesh AP to operate in bridge mode. The show service-profile command indicates if bridging is enabled for the service profile.
PAGE 290
Configuring WLAN mesh services BSSID: 00:0b:0e:17:bb:3f (54 Mbps) packets bytes TX: 307 44279 RX: 315 215046 Use the show ap boot-configuration command to display information about a Mesh AP: WSS# show ap boot-configuration 7 Static Boot Configuration AP: 7 IP Address: Disabled VLAN Tag: Disabled Switch: Disabled Mesh: Disabled IP Address: Netmask: Gateway: VLAN Tag: Switch IP: Switch Name: DNS IP: Mesh SSID: Mesh PSK: For information about the fields in the output, see the Nortel WLAN Security Switc
PAGE 291
Configuring user encryption Configuring WPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 Configuring WEP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309 Encryption configuration scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 292
Configuring user encryption Table 1: Wireless encryption defaults Encryption Type Client Support Default State Configuration Required in WSS Software RSN RSN clients Non-RSN clients Disabled • • WPA WPA clients Non-WPA clients Disabled • • Enable the RSN information element (IE). Specify the supported cipher suites (CCMP, TKIP, 40-bit WEP, 104-bit WEP). TKIP is enabled by default when the RSN IE is enabled. Enable the WPA information element (IE).
PAGE 293
Configuring user encryption 293 Figure 1. Default encryption WLAN Security Switch User A Dynamic WEP Non-WPA User B Dynamic 40-bit WEP WPA User C Static WEP Non-WPA User D TKIP WPA 840-9502-0030 Encryption settings: -WPA disabled -Dynamic WEP enabled -Static WEP disabled This rest of this chapter describes the encryption types and how to configure them, and provides configuration scenarios.
PAGE 294
Configuring user encryption Configuring WPA Wi-Fi Protected Access (WPA) is a security enhancement to the IEEE 802.11 wireless standard. WPA provides enhanced encryption with new cipher suites and provides per-packet message integrity checks. WPA is based on the 802.11i standard. You can use WPA with 802.1X authentication. If the client does not support 802.1X, you can use a preshared key on the AP and the client for authentication. NN47250-500 (320657-F Version 02.
PAGE 295
Configuring user encryption 295 WPA cipher suites WPA supports the following cipher suites for packet encryption, listed from most secure to least secure: • Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)—CCMP provides Advanced Encryption Standard (AES) data encryption. To provide message integrity, CCMP uses the Cipher Block Chaining Message Authentication Code (CBC-MAC).
PAGE 296
Configuring user encryption Figure 2 shows the client support when WPA encryption for TKIP only is enabled. A radio using WPA with TKIP encrypts traffic only for WPA TKIP clients but not for CCMP or WEP clients. The radio disassociates from these other clients. Figure 2. WPA encryption with TKIP only WLAN Security Switch User A Dynamic WEP Non-WPA User B Dynamic 40-bit WEP WPA NN47250-500 (320657-F Version 02.
PAGE 297
Configuring user encryption 297 Figure 3 shows the client support when both WEP encryption and TKIP are enabled. A radio using WPA with TKIP and WEP encrypts traffic for WPA TKIP clients, WPA WEP clients, and non-WPA dynamic WEP clients, but not for CCMP or static WEP clients. The radio disassociates from these other clients. Figure 3.
PAGE 298
Configuring user encryption TKIP countermeasures WPA access points and clients verify the integrity of a wireless frame received on the network by generating a keyed message integrity check (MIC). The Michael MIC used with TKIP provides a holddown mechanism to protect the network against tampering. • If the recalculated MIC matches the MIC received with the frame, the frame passes the integrity check and the access point or client processes the frame normally.
PAGE 299
Configuring user encryption 299 WPA authentication methods You can configure an SSID to support one or both of the following authentication methods for WPA clients: • 802.1X—The AP and client use an Extensible Authentication Protocol (EAP) method to authenticate one another, then use the resulting key in a handshake to derive a unique key for the session. The 802.1X authentication method requires user information to be configured on AAA servers or in the WSS’s local database.
PAGE 300
Configuring user encryption WPA information element A WPA information element (IE) is a set of extra fields in a wireless frame that contain WPA information for the access point or client. To enable WPA support in a service profile, you must enable the WPA IE. The following types of wireless frames can contain a WPA IE: • Beacon (sent by an AP)—The WPA IE in a beacon frame advertises the cipher suites and authentication methods that an AP radio supports for the encrypted SSID.
PAGE 301
Configuring user encryption 301 Client support To use the TKIP or CCMP cipher suite for encryption, a client must support WPA. However, an AP radio configured for WPA can support non-WPA clients who use dynamic WEP or static WEP.
PAGE 302
Configuring user encryption Table 2 lists the encryption support for WPA and non-WPA clients. Table 2: Encryption support for WPA and non-WPA clients Client Encryption Type WSS Software Encryption Type WPA—CCMP WPA—TKIP WPA— CCMP WPA— TKIP WPA— WEP40 WPA— WEP104 Dynamic WEP Static WEP Supported Supported WPA—WEP40 WPA—WEP104 Dynamic WEP Static WEP NN47250-500 (320657-F Version 02.
PAGE 303
Configuring user encryption 303 Configuring WPA To configure AP radios to support WPA: 1 Create a service profile for each SSID that will support WPA clients. 2 Enable the WPA IE in the service profile. 3 Enable the cipher suites you want to support in the service profile. (TKIP is enabled by default.) Optionally, you also can change the countermeasures timer value for TKIP. 4 Map the service profile to the radio profile that will control IEEE settings for the radios.
PAGE 304
Configuring user encryption To enable or disable cipher suites, use the following commands: set service-profile name cipher-ccmp {enable | disable} set service-profile name cipher-tkip {enable | disable} set service-profile name cipher-wep104 {enable | disable} set service-profile name cipher-wep40 {enable | disable} To enable the 40-bit WEP cipher suite in service profile wpa, type the following command: WSS# set service-profile wpa cipher-wep40 enable success: change accepted.
PAGE 305
Configuring user encryption 305 Configuring a global PSK passphrase or raw key for all clients To configure a global passphrase for all WPA clients, use the following command: set service-profile name psk-phrase passphrase The passphrase must be from 8 to 63 characters long, including blanks. If you use blanks, you must enclose the string in quotation marks.
PAGE 306
Configuring user encryption To display the WPA settings in effect in service profile wpa, type the following command: WSS# show service-profile sp1 ssid-name: private ssid-type: crypto Beacon: yes Proxy ARP: no DHCP restrict: no No broadcast: no Short retry limit: 5 Long retry limit: 5 Auth fallthru: none Sygate On-Demand (SODA): no Enforce SODA checks: yes SODA remediation ACL: Custom success web-page: Custom failure web-page: Custom logout web-page: Custom agent-directory: Static COS: no COS: 0 CAC m
PAGE 307
Configuring user encryption 307 To assign radio profile bldg1 to radio 1 on ports 5-8, 11-14, and 16 and enable the radios, type the following command: WSS# set ap 5-8,11-14,16 radio 1 radio-profile bldg1 mode enable success: change accepted. To assign radio profile bldg1 to radio 2 on ports 11-14 and port 16 and enable the radios, type the following command: WSS# set ap 11-14,16 radio 2 radio-profile bldg1 mode enable success: change accepted. Configuring RSN (802.
PAGE 308
Configuring user encryption To enable RSN in service profile wpa, type the following command: WSS# set service-profile rsn rsn-ie enable success: change accepted. Specifying the RSN cipher suites To use RSN, at least one cipher suite must be enabled. You can enable one or more of the following cipher suites: • CCMP • TKIP • 40-bit WEP • 104-bit WEP By default, TKIP is enabled and the other cipher suites are disabled.
PAGE 309
Configuring user encryption 309 Displaying RSN settings To display the RSN settings in a service profile, use the following command: show service-profile {name | ?} The RSN settings appear at the bottom of the output. Note. The RSN-related fields appear in the show service-profile output only when RSN is enabled.
PAGE 310
Configuring user encryption Static WEP encryption is disabled by default. To enable static WEP encryption, configure the static WEP keys and assign them to unicast and multicast traffic. Make sure you configure the same static keys on the clients. To support dynamic WEP in a WPA environment, enable WPA and enable the WEP-40 or WEP-104 cipher suite. (See “Configuring WPA” (page 303).) This section describes how to configure and assign static WEP keys.
PAGE 311
Configuring user encryption 311 Setting static WEP key values WSS Software supports dynamic WEP automatically. To enable static WEP, configure WEP keys and assign them to unicast and multicast traffic. You can set the values of the four static WEP keys, then specify which of the keys to use for encrypting multicast frames and unicast frames. If you do this, WSS Software continues to support dynamic WEP in addition to static WEP.
PAGE 312
Configuring user encryption Assigning static WEP keys When static WEP is enabled, static WEP key 1 is assigned to unicast and multicast traffic by default. To assign another key to unicast or multicast traffic, use the following commands: set service-profile name wep active-multicast-index num set service-profile name wep active-unicast-index num The num parameter specifies the key and the value can be from 1 to 4.
PAGE 313
Configuring user encryption 313 Enabling WPA with TKIP The following example shows how to configure WSS Software to provide authentication and TKIP encryption for 801.X WPA clients. This example assumes that pass-through authentication is used for all users. A RADIUS server group performs all authentication and authorization for the users. 1 Create an authentication rule that sends all 802.1X users of SSID mycorp in the EXAMPLE domain to the server group shorebirds for authentication.
PAGE 314
Configuring user encryption success: change accepted. 7 Apply radio profile rp1 to radio 1 on port 5 and to radios 1 and 2 on port 11, enable the radios, and verify the configuration changes. Type the following commands: WSS# set ap 5,11 radio 1 radio-profile rp1 mode enable success: change accepted. WSS# set ap 11 radio 2 radio-profile rp1 mode enable success: change accepted.
PAGE 315
Configuring user encryption 315 Enabling dynamic WEP in a WPA network The following example shows how to configure WSS Software to provide authentication and encryption for 801.X dynamic WEP clients, and for 801.X WPA clients using TKIP. This example assumes that pass-through authentication is used for all users. The commands are the same as those in “Enabling WPA with TKIP” (page 313), with the addition of a command to enable a WEP cipher suite.
PAGE 316
Configuring user encryption WPA enabled: ciphers: cipher-tkip, cipher-wep40 authentication: 802.1X TKIP countermeasures time: 60000ms ... 7 Map service profile wpa-wep to radio profile rp2. Type the following commands: WSS# set radio-profile rp2 service-profile wpa-wep success: change accepted. 8 Apply radio profile rp2 to radio 1 on port 5 and to radios 1 and 2 on port 11, enable the radios, and verify the configuration changes.
PAGE 317
Configuring user encryption 317 Configuring encryption for MAC clients The following example shows how to configure WSS Software to provide PSK authentication and TKIP or 40-bit WEP encryption for MAC clients: 1 Create an authentication rule that sends all MAC users of SSID voice to the local database for authentication and authorization. Type the following command: WSS# set authentication mac ssid voice * local success: configuration saved.
PAGE 318
Configuring user encryption 5 Create a service profile named wpa-wep-for-mac for SSID voice. Type the following command: WSS# set service-profile wpa-wep-for-mac success: change accepted. 6 Set the SSID in the service profile to voice. Type the following command: WSS# set service-profile wpa-wep-for-mac ssid-name voice success: change accepted. 7 Enable WPA in service profile wpa-wep-for-mac.
PAGE 319
Configuring user encryption 319 12 Map service profile wpa-wep-for-mac to radio profile rp3. Type the following commands: WSS# set radio-profile rp3 service-profile wpa-wep-for-mac success: change accepted. 13 Apply radio profile rp3 to radio 1 on port 4 and to radios 1 and 2 on port 6 and enable the radios, and verify the configuration changes. Type the following commands: WSS# set ap 4,6 radio 1 radio-profile rp3 mode enable success: change accepted.
PAGE 320
Configuring user encryption NN47250-500 (320657-F Version 02.
PAGE 321
Configuring Auto-RF Auto-RF overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 Changing Auto-RF settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325 Locking down tuned settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 Displaying Auto-RF information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 322
Configuring Auto-RF ● Initial power assignment—The AP sets a radio’s initial power level to the maximum value allowed for the country code (regulatory domain). In a deployment with few APs, the radio remains at maximum power. Otherwise, the radio reduces power until the power is just enough to reach the AP’s nearest neighbor that is on the same channel.
PAGE 323
Configuring Auto-RF 323 • Amount of noise on the channel • Packet retransmission count, which is the rate at which the radio receives retransmitted packets. • Utilization, calculated based on the number of multicast packets per second that a radio can send on a channel while continuously sending fixed-size frames over a period of time. • Phy error count, which is the number of frames received by the AP radio that have physical layer errors.
PAGE 324
Configuring Auto-RF Table 1: Defaults for Auto-RF parameters Parameter Default Value Radio Behavior When Parameter Set To Default Value Radio profile parameters channel-config enable When the radio is first enabled, Auto-RF sets the channel based on the channels in use on neighboring access points. channel-interval 3600 Every 3600 seconds, WSS Software examines the RF information gathered from the network and determines whether the channel needs to be changed to compensate for RF changes.
PAGE 325
Configuring Auto-RF 325 Changing Auto-RF settings Changing channel tuning settings Disabling or reenabling channel tuning Auto-RF for channels is enabled by default. To disable or reenable the feature for all radios in a radio profile, use the following command: set radio-profile name auto-tune channel-config {enable | disable} [no-client] The no-client option allows WSS Software to change the channel on a radio even if the radio has active client sessions.
PAGE 326
Configuring Auto-RF Changing power tuning settings Enabling power tuning Auto-RF for power is disabled by default. To enable or disable the feature for all radios in a radio profile, use the following command: set radio-profile name auto-tune power-config {enable | disable} To enable power tuning for radios in the rp2 radio profile, type the following command: WSS# set radio-profile rp2 auto-tune power-config enable success: change accepted.
PAGE 327
Configuring Auto-RF 327 success: change accepted. Locking down tuned settings You can convert dynamically assigned channels and power settings into statically configured settings, by locking them down. When you lock down channel or power settings, WSS Software converts the latest values set by Auto-RF into static settings. You can lock down channel or power settings on a radio-profile basis.
PAGE 328
Configuring Auto-RF Tune Power: Tune Power Interval: Channel Holddown: Active-Scan: WMM Powersave: no Tune Channel Interval: 3600 600 Power ramp interval: 60 300 Countermeasures: none yes RFID enabled: no no QoS Mode: wmm No service profiles configured.
PAGE 329
Configuring Auto-RF 329 WSS# show auto-tune neighbors ap 2 radio 1 Total number of entries for port 2 radio 1: 5 Channel Neighbor BSS/MAC RSSI ------- ----------------- --------------1 00:0b:85:06:e3:60 -46 1 00:0b:0e:00:0a:80 -78 1 00:0b:0e:00:d2:c0 -74 1 00:0b:85:06:dd:00 -50 1 00:0b:0e:00:05:c1 -72 Displaying RF attributes To display the current values of the RF attributes Auto-RF uses to decide whether to change channel or power settings, use the following commands: show auto-tune attributes [ap ap-nu
PAGE 330
Configuring Auto-RF NN47250-500 (320657-F Version 02.
PAGE 331
Configuring APs to be AeroScout listeners Configuring AP radios to listen for AeroScout RFID tags . . . . . . . . . . . . . . . . . . . . 331 Locating an RFID tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332 AeroScout RFID tags are wireless transmitters that you can place on assets such as office equipment to track the equipment’s location. Each tag regularly transmits its unique ID.
PAGE 332
Configuring APs to be AeroScout listeners • Set the channel on each radio to the channel on which the RFID tags transmit. You can use the same channel on all the RFID tags. • Map the AP radios to the radio profile and enable the radios. Note. An AP always forwards RFID tag information to its WSS, even of RFID mode is disabled. The following example shows the commands to configure three Distributed APs to be AeroScout listeners.
PAGE 333
Configuring APs to be AeroScout listeners 333 Using an AeroScout engine 1 Load the site map in AeroScout System Manager. 2 Mark the origin point (0,0), if not already done. 3 Calibrate distance, if not already done. 4 Add each AP configured as a listener to the map, and enter its IP address. Note. To look up a AP’s IP address, use the show ap status command. 5 Enable RSSI location calculation. 6 Enable tag positioning. 7 Enable the map to use the APs.
PAGE 334
Configuring APs to be AeroScout listeners Using WMS If your network is modeled in a WLAN Management Software network plan, you can use WLAN Management Software to locate devices that have AeroScout asset tags. This capability has the following requirements: • Three or more listeners are required for optimal location results. WLAN Management Software will attempt to display a tag’s location even if there are fewer than three listeners, but the location might not be accurate.
PAGE 335
AirDefense integration with the Nortel WLAN 2300 system About AirDefense integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 Converting an AP into an AirDefense sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336 This chapter describes how the AirDefense security system integrates with the Nortel WLAN 2300 system, and how a Nortel Access Point can be converted into an AirDefense sensor.
PAGE 336
AirDefense integration with the Nortel WLAN 2300 system Figure 1. AirDefense integration with the Nortel WLAN 2300 system Distributed AP WMS Client AirDefense Sensor (Converted AP) WMS User can access AirDefense UI from WMS SNM P Tr aps WMS Server SNMP WSS AirDefense Server In the example above, a Distributed AP converted to operate as an AirDefense sensor monitors the network and sends information to the AirDefense server, via a WSS.
PAGE 337
AirDefense integration with the Nortel WLAN 2300 system 337 • “Converting an AirDefense sensor back to an AP” (page 341) • “Clearing the AirDefense sensor software from the AP’s configuration” (page 341) Nortel WLAN—Security Switch 2300 Series Configuration Guide
PAGE 338
AirDefense integration with the Nortel WLAN 2300 system Copying the AirDefense sensor software to the WSS The AirDefense sensor software is contained in a file called adconvert.bin, which can be obtained from Nortel. After obtaining the AirDefense sensor software, you copy the file to the WSS that manages the AP to be converted to an AirDefense sensor. For example, the following command copies the adconvert.bin file from a TFTP server to the WSS: WSS# copy tftp://172.16.0.1/adconvert.bin adconvert.
PAGE 339
AirDefense integration with the Nortel WLAN 2300 system 339 Loading the AirDefense sensor software on the AP After the AirDefense sensor software is copied to the WSS, you can configure an AP to load the software. When you do this, the software is transferred to the AP, which then reboots and comes up as an AirDefense sensor.
PAGE 340
AirDefense integration with the Nortel WLAN 2300 system Specifying the AirDefense server To specify the AirDefense server the converted AP sends information to, do the following: 1 Open a Web browser and establish a secure (https) connection to the converted AP. 2 Using the converted AP’s Web interface, specify the IP address, subnet mask, and default gateway of the AirDefense server.
PAGE 341
AirDefense integration with the Nortel WLAN 2300 system 341 Converting an AirDefense sensor back to an AP Once an AP is converted to an AirDefense sensor, you can convert the AP back to a Nortel Access Point by doing the following: 1 Open a Web browser and establish a secure (https) connection to the converted AP. 2 Click the Revert button in the converted AP’s Web interface. When you do this, the AP reboots and comes up as a Nortel Access Point.
PAGE 342
AirDefense integration with the Nortel WLAN 2300 system NN47250-500 (320657-F Version 02.
PAGE 343
Configuring quality of service About QoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343 Changing QoS settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358 Displaying QoS information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 344
Configuring quality of service Table 1.QoS parameters QoS Feature Description Configuration Command QoS parameters configured in the radio profile QoS mode Method used to set contention window parameters of forwarding queues on APs. One of the following modes can be enabled: • SpectraLink Voice Priority • Wi-Fi Multimedia set radio-profile qos-mode See the following: • “End-to-End QoS” (page 346) • “Changing the QoS mode” (page 359) WMM must be configured in order to accept WMM clients.
PAGE 345
Configuring quality of service 345 Table 1.QoS parameters (continued) QoS Feature Description Configuration Command Transmit rates Data transmission rates supported by each radio type. The following categories are specified: • Beacon • Multicast • Mandatory (a client must support at least one of these rates to associate) • Disabled • Standard (valid rates that are not disabled and are not mandatory) Defaults: • Mandatory: • 802.11a—6.0, 12.0, 24.0 • 802.11b—5.5, 11.0 • 802.11g—1.0, 2.0, 5.5, 11.
PAGE 346
Configuring quality of service Table 1.QoS parameters (continued) QoS Feature Description Configuration Command Session timers Keepalives and timeouts for clients sessions.
PAGE 347
Configuring quality of service 347 Mapping from 802.1p, WMM user priority to CoS is static. Also, mapping from CoS to access category (AC) on the APs is static. Table 4 shows how WMM priority information is mapped across the network. Table 2: WMM Priority Mappings CoS WMM User Priority 802.
PAGE 348
Configuring quality of service Session-based Call Admission Control (CAC) is also supported. You can use CAC with either QoS mode to ensure bandwidth availability by limiting the number of active sessions a radio can have. The static CoS option enables you to easily set CoS for all traffic on an SSID by marking all the SSID’s traffic with the same CoS value. You can use ACLs to override CoS markings or set CoS for non-WMM traffic. The following sections describe each of these options.
PAGE 349
Configuring quality of service 349 Figure 1. QoS on WSSs—Classification of Ingress Packets WSS receives packet. Set packet CoS based on 802.1p: 802.1p value that is not 0? 1 -> 1 2 -> 2 3 -> 3 4 -> 4 5 -> 5 6 -> 6 7 -> 7 Yes No (802.
PAGE 350
Configuring quality of service Figure 2. QoS on WSSs—marking of egress packets WSS has classified ingress packet. Mark 802.1p with CoS value: Egress interface has 802.1Q VLAN tag? Yes No VLAN tag 1 -> 1 2 -> 2 3 -> 3 4 -> 4 5 -> 5 6 -> 6 7 -> 7 Look up CoS and mark packet’s DSCP value: Egress interface is IP tunnel? Yes No Do not mark DSCP. NN47250-500 (320657-F Version 02.01) 1 -> 8 2 -> 16 3 -> 24 4 -> 32 5 -> 40 6 -> 48 7 -> 56 Transmit packet.
PAGE 351
Configuring quality of service 351 Figure 3. QoS on APs —classification and marking of packets from clients to WSSs AP receives packet from client. Static CoS enabled? Yes Set packet CoS with static CoS value. No Set packet CoS based on 802.11 Service Type: 1 -> 1 2 -> 2 3 -> 3 4 -> 4 5 -> 5 6 -> 6 7 -> 7 Set tunnel’s IP ToS to 802.1p value. Look up CoS and mark packet’s DSCP value: 1 -> 8 2 -> 16 3 -> 24 4 -> 32 5 -> 40 6 -> 48 7 -> 56 Set tunnel IP ToS to static CoS value.
PAGE 352
Configuring quality of service Figure 4. QoS on APs —classification and marking of packets from WSSs to clients AP receives packet from WSS. Static CoS enabled? Yes Set packet CoS with static CoS value. No Look up CoS for DSCP value and set packet CoS: 0 - 7 -> 0 8 - 15 -> 1 16 - 23 -> 2 24 - 31 -> 3 32 - 39 -> 4 40 - 47 -> 5 48 - 55 -> 6 56 - 63 -> 7 Map CoS value to AP forwarding queue: 0 or 3 -> Background 1 or 2 -> Best Effort 4 or 5 -> Video 6 or 7 -> Voice Mark 802.
PAGE 353
Configuring quality of service 353 WMM QoS on the WSS WSS Software performs classification on ingress to determine a packet’s CoS value. This CoS value is used to mark the packet at the egress interface. The classification and marking performed by the switch depend on whether the ingress interface has an 802.1p or DSCP value other than 0, and whether the egress interface is tagged or is an IP tunnel. The mappings between DSCP and CoS values are configurable. (See “Changing CoS mappings” (page 360).) 802.
PAGE 354
Configuring quality of service An AP uses the DSCP-to-CoS and CoS-to-DSCP mappings of the WSS that is managing it. If you change mappings on a WSS, the change also applies to the AP. Likewise, if an AP changes to another WSS (for example, after an AP restart), the AP uses the mappings in effect on the new WSS. Table 5 lists the default mappings between an AP’s internal CoS values and its forwarding queues. Table 5.
PAGE 355
Configuring quality of service 355 Figure 5. WMM QoS in a Nortel network Layer 3 3 802.1p = 7 IP ToS = 0xe0 802.1p = 7 Voice Data. . . IP ToS = 0xe0 Voice Data. . . Tnl Hdr IP ToS = 0xe0 Voice Data. . . 4 WSS B WSS A 5 Layer 3 2 Tnl Hdr IP ToS = 0xe0 Voice Data. . . AP A 1 AP B Srvc Type = 7 Voice Data . . .
PAGE 356
Configuring quality of service Figure 5 on page 355 shows the following process: 1 A user sends voice traffic from a WMM VoIP phone. The phone marks the CoS field of the packet with service type 7, indicating that the packet is for high priority (voice) traffic. 2 AP A receives the voice packet and classifies the packet by mapping the service type in the 802.11 header to an internal CoS value. In this example, the service type is 7 and maps to internal CoS 7.
PAGE 357
Configuring quality of service 357 Normally, an AP radio waits an additional number of microseconds following the fixed wait time, before forwarding a queued packet or frame. Each forwarding queue has a different range of possible random wait times. The Voice queue has the narrowest range, whereas the Background and Best Effort queues have the widest range. The random wait times ensure that the Voice queue gets statistically more access to the air than the other queues.
PAGE 358
Configuring quality of service Broadcast control You also can enhance bandwidth availability on an SSID by enabling the following broadcast control features: • Proxy ARP—WSS responds on behalf of wireless clients to ARP requests for their IP addresses. • DHCP Restrict—WSS captures and does not forward any traffic except DHCP traffic for a wireless client who is still being authenticated and authorized.
PAGE 359
Configuring quality of service 359 • Broadcast control • Static CoS state and CoS value • DSCP-CoS mappings The QoS mode is configurable on a radio-profile basis. CAC and static CoS are configurable on a service-profile basis. DSCP-CoS mapping is configurable on a global switch basis. Changing the QoS mode The default QoS mode is WMM.
PAGE 360
Configuring quality of service Changing the maximum number of active sessions When CAC is enabled, the maximum number of active sessions a radio can have is 14 by default. To change the maximum number of sessions, use the following command: set service-profile name cac-session max-sessions The max-sessions can be a value from 0 to 100.
PAGE 361
Configuring quality of service 361 WSS# set qos cos-to-dscp-map 6 dscp 55 success: change accepted.
PAGE 362
Configuring quality of service WSS# show radio-profile rp1 Beacon Interval: Max Tx Lifetime: RTS Threshold: Long Preamble: Tune Power: Tune Power Interval: Channel Holddown: Active-Scan: WMM Powersave: 100 DTIM Interval: 2000 Max Rx Lifetime: 2346 Frag Threshold: no Tune Channel: no Tune Channel Interval: 600 Power ramp interval: 300 Countermeasures: yes RFID enabled: no QoS Mode: 1 2000 2346 yes 3600 60 none no wmm Service profiles: sp1 In this example, the QoS mode is WMM and U-APSD support (WMM po
PAGE 363
Configuring quality of service 363 Note. Configuration information for some settings appears in other chapters. To configure transmit rates, or the long or short retry, see “Configuring a service profile” (page 244). To configure the user-idle timeout and idle-client probing, see “Displaying and changing network session timers” (page 620). (For more information about this command’s output, see the “AP Commands” chapter in the Nortel WLAN Security Switch 2300 Series Command Line Reference.
PAGE 364
Configuring quality of service Displaying a CoS-to-DSCP mapping To display the DSCP value to which a specific CoS value is mapped during marking, use the following command: show qos cos-to-dscp-map cos-value The following command displays the DSCP value to which CoS value 6 is mapped: WSS# show qos cos-to-dscp-map 6 cos 6 is marked with dscp 48 (tos 0xC0) Displaying the DSCP table To display the standard mappings of DSCP, ToS, and precedence values, use the following command: WSS# show qos dscp-tab
PAGE 365
Configuring quality of service 365 0,3 4,5 6,7 BestEffort Video Voice 15327 0 1714881 278 0 0 0 0 0 0 0 0 0 0 AP: 4 radio: 2 1,2 0,3 4,5 6,7 Background BestEffort Video Voice Nortel WLAN—Security Switch 2300 Series Configuration Guide
PAGE 366
Configuring quality of service NN47250-500 (320657-F Version 02.
PAGE 367
Configuring and managing spanning tree protocol Enabling the spanning tree protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368 Changing standard spanning tree parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369 Configuring and managing STP fast convergence features . . . . . . . . . . . . . . . . . . . . 375 Displaying spanning tree information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 368
Configuring and managing spanning tree protocol Enabling the spanning tree protocol STP is disabled by default. You can enable STP globally or on individual VLANs. To enable STP, use the following command: set spantree {enable | disable} [{all | vlan vlan-id | port port-list vlan-id}] To enable STP on all VLANs configured on a WSS, type the following command: WSS# set spantree enable success: change accepted.
PAGE 369
Configuring and managing spanning tree protocol 369 Changing standard spanning tree parameters You can change the following standard STP parameters: • Bridge priority • Port cost • Port priority Bridge priority The bridge priority determines the WSS’s eligibility to become the root bridge. You can set this parameter globally or on individual VLANs. The root bridge is elected based on the bridge priority of each device in the spanning tree.
PAGE 370
Configuring and managing spanning tree protocol Port priority Port priority is the eligibility of the port to be the designated port to the root bridge, and thus part of the path to the root bridge. When the WSS has more than one link to the root bridge, STP uses the link with the lowest priority value. You can set this parameter on an individual port basis, for all VLANs the port is in, or for specific VLANs. Specify a priority from 0 (highest priority) through 255 (lowest priority).
PAGE 371
Configuring and managing spanning tree protocol 371 Changing the bridge priority To change the bridge priority, use the following command: set spantree priority value {all | vlan vlan-id} Specify a bridge priority from 0 through 65,535. The default is 32,768. The all option applies the change globally to all VLANs. Alternatively, specify an individual VLAN. To change the bridge priority of VLAN pink to 69, type the following command: WSS# set spantree priority 69 vlan pink success: change accepted.
PAGE 372
Configuring and managing spanning tree protocol Changing STP port parameters You can change the STP cost and priority of an individual port, on a global basis or an individual VLAN basis. Changing the STP port cost To change the cost of a port, use one of the following commands. set spantree portcost port-list cost cost set spantree portvlancost port-list cost cost {all | vlan vlan-id} The set spantree portcost command changes the cost for ports in the default VLAN (VLAN 1) only.
PAGE 373
Configuring and managing spanning tree protocol 373 Changing the STP port priority To change the priority of a port, use one of the following commands: set spantree portpri port-list priority value set spantree portvlanpri port-list priority value {all | vlan vlan-id} The set spantree portpri command changes the priority for ports in the default VLAN (VLAN 1) only. The set spantree portvlanpri command changes the priority for ports in a specific other VLAN or in all VLANs.
PAGE 374
Configuring and managing spanning tree protocol Changing spanning tree timers You can change the following STP timers: • Hello interval—The interval between configuration messages sent by a WSS when the switch is acting as the root bridge. You can specify an interval from 1 through 10 seconds. The default is 2 seconds. • Forwarding delay—The period of time a bridge other than the root bridge waits after receiving a topology change notification to begin forwarding data packets.
PAGE 375
Configuring and managing spanning tree protocol 375 To change the maximum acceptable age for root bridge hello packets on all VLANs to 15 seconds, type the following command: WSS# set spantree maxage 15 all success: change accepted. Configuring and managing STP fast convergence features The standard STP timers delay traffic forwarding briefly after a topology change.
PAGE 376
Configuring and managing spanning tree protocol Uplink fast convergence Uplink fast convergence enables a WSS that has redundant links to the network core to immediately change the state of a backup link to forwarding if the primary link to the root fails. Uplink fast convergence bypasses the listening and learning states to immediately enter the forwarding state. Note.
PAGE 377
Configuring and managing spanning tree protocol 377 Configuring port fast convergence To enable or disable port fast convergence, use the following command: set spantree portfast port port-list {enable | disable} To enable port fast convergence on ports 9, 11, and 13, type the following command: WSS# set spantree portfast port 9,11,13 enable success: change accepted.
PAGE 378
Configuring and managing spanning tree protocol Displaying port fast convergence information To display port fast convergence information, use the following command: show spantree portfast [port-list] To display port fast convergence information for all ports, type the following command: WSS# show spantree portfast Port Vlan Portfast ------------- ----------1 1 disable 2 1 disable 3 1 disable 4 1 enable 5 1 disable 6 1 disable 7 1 disable 8 1 disable 10 1 disable 15 1 disable 16 1 disable 17 1 disabl
PAGE 379
Configuring and managing spanning tree protocol 379 Configuring backbone fast convergence To enable or disable backbone fast convergence, use the following command: set spantree backbonefast {enable | disable} To enable backbone fast convergence on all VLANs, type the following command: WSS# set spantree backbonefast enable success: change accepted.
PAGE 380
Configuring and managing spanning tree protocol Displaying the backbone fast convergence state To display the state of the backbone fast convergence feature, use the following command: show spantree backbonefast Here is an example: WSS# show spantree backbonefast Backbonefast is enabled In this example, backbone fast convergence is enabled. NN47250-500 (320657-F Version 02.
PAGE 381
Configuring and managing spanning tree protocol 381 Configuring uplink fast convergence To enable or disable uplink fast convergence, use the following command: set spantree uplinkfast {enable | disable} Nortel WLAN—Security Switch 2300 Series Configuration Guide
PAGE 382
Configuring and managing spanning tree protocol Displaying uplink fast convergence information To display uplink fast convergence information, use the following command: show spantree uplinkfast [vlan vlan-id] The following command displays uplink fast convergence information for all VLANs: WSS# show spantree uplinkfast VLAN port list --------------------1 1(fwd),2,3 In this example, ports 1, 2, and 3 provide redundant links to the network core. Port 1 is forwarding traffic.
PAGE 383
Configuring and managing spanning tree protocol 383 Displaying STP bridge and port information To display STP bridge and port information, use the following command: show spantree [port port-list | vlan vlan-id] [active] By default, STP information for all ports and all VLANs is displayed. To display STP information for specific ports or a specific VLAN only, enter a port list or a VLAN name or number. For each VLAN, only the ports contained in the VLAN are listed in the command output.
PAGE 384
Configuring and managing spanning tree protocol Displaying the STP port cost on a VLAN basis To display a brief list of the STP port cost for a port in each of its VLANs, use the following command: show spantree portvlancost port-list This command displays the same information as the show spantree command’s Cost field in a concise format for all VLANs. The show spantree command lists all the STP information separately for each VLAN.
PAGE 385
Configuring and managing spanning tree protocol 385 Displaying blocked STP ports To display information about ports that are in the STP blocking state, use the following command: show spantree blockedports [vlan vlan-id] To display information about blocked ports on a WSS for the default VLAN (VLAN 1), type the following command: WSS# show spantree blockedports vlan default Port Vlan Port-State Cost Prio Portfast -----------------------------------------------------------------------22 190 Blocking 4 128
PAGE 386
Configuring and managing spanning tree protocol Displaying spanning tree statistics To display STP statistics, use the following command: show spantree statistics [port-list [vlan vlan-id]] To display STP statistics for port 1, type the following command: WSS# show spantree statistics 1 BPDU related parameters Port 1 VLAN 1 spanning tree enabled for VLAN = 1 port spanning tree enabled state Forwarding port_id 0x8015 port_number 0x15 path cost 0x4 message age (port/VLAN) 0(20) designated_root 00-0b-0e
PAGE 387
Configuring and managing spanning tree protocol 387 topology change timer INACTIVE topology change timer value 0 hold timer INACTIVE hold timer value 0 delay root port timer INACTIVE delay root port timer value 0 delay root port timer restarted is FALSE VLAN based information & statistics spanning tree type ieee spanning tree multicast address 01-00-0c-cc-cc-cd bridge priority 32768 bridge MAC address 00-0b-0e-12-34-56 bridge hello time 2 bridge forward delay 15 topology change initiator: 0 last topology ch
PAGE 388
Configuring and managing spanning tree protocol Clearing STP statistics To clear the STP statistics counters, use the following command. clear spantree statistics port-list [vlan vlan-id] As soon as you enter the command, WSS Software resets the STP counters for the specified ports or VLANs to 0. The software then begins incrementing the counters again.
PAGE 389
Configuring and managing spanning tree protocol 389 ---- --------------- ------ ----- ----- --------------- ----- ----1 default Up Up 5 1 none Up 10 backbone Up Down 5 21 none Down 22 none Down 3 Enable STP on the backbone VLAN and verify the change. Type the following commands: WSS# set spantree enable vlan backbone success: change accepted.
PAGE 390
Configuring and managing spanning tree protocol 13 14 15 16 17 18 19 20 21 22 up up up up up up up up up up 5 down auto network down auto network down auto network down auto network down auto network down auto network down auto network down auto network up auto 1000/full network up auto 1000/full network 10/100BaseTx 10/100BaseTx 10/100BaseTx 10/100BaseTx 10/100BaseTx 10/100BaseTx 10/100BaseTx 10/100BaseTx Wait for STP to complete the listening and learning stages and converge, then verify that STP
PAGE 391
Configuring and managing IGMP snooping Disabling or reenabling IGMP snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391 Disabling or reenabling proxy reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391 Enabling the pseudo-querier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392 Changing IGMP timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 392
Configuring and managing IGMP snooping To disable or reenable proxy reporting, use the following command: set igmp proxy-report {enable | disable} [vlan vlan-id] Enabling the pseudo-querier The IGMP pseudo-querier enables IGMP snooping to operate in a VLAN that does not have a multicast router to send IGMP general queries to clients. Note. Nortel recommends that you use the pseudo-querier only when the VLAN contains local multicast traffic sources and no multicast router is servicing the subnet.
PAGE 393
Configuring and managing IGMP snooping 393 Changing the query interval To change the IGMP query interval timer, use the following command: set igmp qi seconds [vlan vlan-id] For seconds, you can specify a value from 1 through 65,535. The default is 125 seconds.
PAGE 394
Configuring and managing IGMP snooping Changing the other-querier-present interval To change the other-querier-present interval, use the following command: set igmp oqi seconds [vlan vlan-id] For seconds, you can specify a value from 1 through 65,535. The default is 255 seconds. NN47250-500 (320657-F Version 02.
PAGE 395
Configuring and managing IGMP snooping 395 Changing the query response interval To set the query response interval, use the following command: set igmp qri tenth-seconds [vlan vlan-id] You can specify a value from 1 through 65,535 tenths of a second. The default is 100 tenths of a second (10 seconds).
PAGE 396
Configuring and managing IGMP snooping Changing the last member query interval To set the last member query interval, use the following command: set igmp lmqi tenth-seconds [vlan vlan-id] You can specify a value from 1 through 65,535 tenths of a second. The default is 10 tenths of a second (1 second). NN47250-500 (320657-F Version 02.
PAGE 397
Configuring and managing IGMP snooping 397 Changing robustness Robustness adjusts the IGMP timers to the amount of traffic loss that occurs on the network. Set the robustness value higher to adjust for more traffic loss. To change the robustness value, use the following command: set igmp rv num [vlan vlan-id] You can specify a value from 2 through 255. The default is 2. Enabling router solicitation A WSS can search for multicast routers by sending multicast router solicitation messages.
PAGE 398
Configuring and managing IGMP snooping Changing the router solicitation interval The default multicast router solicitation interval is 30 seconds. To change the interval, use the following command: set igmp mrsol mrsi seconds [vlan vlan-id] You can specify 1 through 65,535 seconds. The default is 30 seconds. Configuring static multicast ports A WSS learns about multicast routers and receivers from multicast traffic it receives from those devices.
PAGE 399
Configuring and managing IGMP snooping 399 Adding or removing a static multicast router port To add or remove a static multicast router port, use the following command: set igmp mrouter port port-list enable | disable Nortel WLAN—Security Switch 2300 Series Configuration Guide
PAGE 400
Configuring and managing IGMP snooping Adding or removing a static multicast receiver port To add a static multicast receiver port, use the following command: set igmp receiver port port-list enable | disable Displaying multicast information You can use the CLI to display the following IGMP snooping information: • Multicast configuration information and statistics • Multicast queriers • Multicast routers • Multicast receivers NN47250-500 (320657-F Version 02.
PAGE 401
Configuring and managing IGMP snooping 401 Displaying multicast configuration information and statistics To display multicast configuration information and statistics, use the following command: show igmp [vlan vlan-id] The show igmp command displays the IGMP snooping state, the settings of all multicast parameters you can configure, and multicast statistics.
PAGE 402
Configuring and managing IGMP snooping Mrouter-Adv Mrouter-Term Mrouter-Sol DVMRP PIM V1 PIM V2 0 0 50 4 0 0 0 0 101 4 0 0 0 0 0 0 0 0 Topology notifications: 0 Packets with unknown IGMP type: 0 Packets with bad length: 0 Packets with bad checksum: 0 Packets dropped: 4 (For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.
PAGE 403
Configuring and managing IGMP snooping 403 Displaying multicast queriers To display information about the multicast querier only without also displaying all the other multicast information, use the following command: show igmp querier [vlan vlan-id] To display querier information for VLAN orange, type the following command: WSS# show igmp querier vlan orange Querier for vlan orange Port Querier-IP Querier-MAC TTL ---- --------------- ----------------- ----1 193.122.135.
PAGE 404
Configuring and managing IGMP snooping Displaying multicast routers To display information about the multicast routers only without also displaying all the other multicast information, use the following command: show igmp mrouter [vlan vlan-id] To display the multicast routers in VLAN orange, type the following command: WSS# show igmp mrouter vlan orange Multicast routers for vlan orange Port Mrouter-IPaddr Mrouter-MAC Type TTL ---- --------------- ----------------- ----- ----10 192.28.7.
PAGE 405
Configuring and managing IGMP snooping 405 Displaying multicast receivers To display information about the multicast receivers only without also displaying all the other multicast information, use the following command: show igmp receiver-table [vlan vlan-id] [group group-ip-addr/mask-length] Use the group parameter to display receivers for a specific group or set of groups. For example, to display receivers for multicast groups 237.255.255.1 through 237.255.255.
PAGE 406
Configuring and managing IGMP snooping NN47250-500 (320657-F Version 02.
PAGE 407
Configuring and managing security ACLs About security access control lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407 Creating and committing a security ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410 Mapping security ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422 Modifying a security ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 408
Configuring and managing security ACLs Overview of security ACL commands Figure 1 provides a visual overview of the way you use WSS Software commands to set a security ACL, commit the ACL so it is stored in the configuration, and map the ACL to a user session, VLAN, port, virtual port, or Distributed AP. Setting security ACLs ACLs in edit buffer null Commited ACLs null ACLs mapped to users NN47250-500 (320657-F Version 02.
PAGE 409
Configuring and managing security ACLs 409 Security ACL filters A security ACL filters packets to restrict or permit network traffic. These filters can then be mapped by name to authenticated users, ports, VLANs, virtual ports, or Distributed APs. You can also assign a class-of-service (CoS) level that marks the packets matching the filter for priority handling. A security ACL contains an ordered list of rules called access control entries (ACEs), which specify how to handle packets.
PAGE 410
Configuring and managing security ACLs Order in which ACLs are applied to traffic WSS Software provides different scopes (levels of granularity) for ACLs. You can apply an ACL to any of the following scopes: • User • VLAN • Virtual port (physical ports plus specific VLAN tags) • Physical Port (network ports or Distributed APs) WSS Software begins comparing traffic to ACLs in the order the scopes are listed above.
PAGE 411
Configuring and managing security ACLs 411 Setting a source IP ACL You can create an ACE that filters packets based on the source IP address and optionally applies CoS packet handling. (For CoS details, see “Class of Service” (page 412).) You can also determine where the ACE is placed in the security ACL by using the before editbuffer-index or modify editbuffer-index variables with an index number. You can use the hits counter to track how many packets the ACL filters.
PAGE 412
Configuring and managing security ACLs Table 1: Common IP protocol numbers Number IP Protocol 17 User Datagram Protocol (UDP) 46 Resource Reservation Protocol (RSVP) 47 Generic Routing Encapsulation (GRE) protocol 50 Encapsulation Security Payload for IPSec (IPSec-ESP) 51 Authentication Header for IPSec (IPSec-AH) 55 IP Mobility (Mobile IP) 88 Enhanced Interior Gateway Routing Protocol (EIGRP) 89 Open Shortest Path First (OSPF) protocol 103 Protocol Independent Multicast (PIM) protoc
PAGE 413
Configuring and managing security ACLs 413 AP forwarding prioritization occurs automatically for Wi-Fi Multimedia (WMM) traffic. You do not need to configure ACLs to provide WMM prioritization. For non-WMM devices, you can provide AP forwarding prioritization by configuring ACLs. If you disable WMM, AP forwarding prioritization is optimized for SpectraLink Voice Priority (SVP) instead of WMM, and the AP does not tag packets it sends to the WSS.
PAGE 414
Configuring and managing security ACLs Setting an ICMP ACL With the following command, you can use security ACLs to set Internet Control Message Protocol (ICMP) parameters for the ping command: set security acl ip acl-name {permit [cos cos] | deny} icmp {source-ip-addr mask | any} {destination-ip-addr mask | any} [type icmp-type] [code icmp-code] [[precedence precedence] [tos tos] | [dscp codepoint]] [before editbuffer-index | modify editbuffer-index] [hits] An ICMP ACL can filter packets by source an
PAGE 415
Configuring and managing security ACLs 415 Table 3: Common ICMP message types and codes (continued) ICMP Message Type (Number) ICMP Message Code (Number) Time Exceeded (11) • • Parameter Problem (12) None Time to Live (TTL) Exceeded (0) Fragment Reassembly Time Exceeded (1) Timestamp (13) None Timestamp Reply (14) None Information Request (15) None Information Reply (16) None Nortel WLAN—Security Switch 2300 Series Configuration Guide
PAGE 416
Configuring and managing security ACLs Setting TCP and UDP ACLs Security ACLs can filter TCP and UDP packets by source and destination IP address, precedence, and TOS level. You can apply a TCP ACL to established TCP sessions only, not to new TCP sessions. In addition, security ACLs for TCP and UDP can filter packets according to a source port on the source IP address and/or a destination port on the destination IP address, if you specify a port number and an operator in the ACE.
PAGE 417
Configuring and managing security ACLs 417 For example, the following command permits UDP packets sent from IP address 192.168.1.7 to IP address 192.168.1.8, with any UDP destination port less than 65,535. It puts this ACE first in the ACL, and counts the number of hits generated by the ACE. WSS# set security acl ip acl-5 permit udp 192.168.1.7 0.0.0.0 192.168.1.8 0.0.0.
PAGE 418
Configuring and managing security ACLs Determining the ACE order The set security acl command creates a new entry in the edit buffer and appends the new entry as a rule at the end of an ACL, unless you specify otherwise. The order of ACEs is significant, because the earliest ACE takes precedence over later ACEs. To place the ACEs in the correct order, use the parameters before editbuffer-index and modify editbuffer-index. The first ACE is number 1.
PAGE 419
Configuring and managing security ACLs 419 Committing a Security ACL To put the security ACLs you have created into effect, use the commit security acl command with the name of the ACL. For example, to commit acl-99, type the following command: WSS# commit security acl acl-99 success: change accepted. To commit all the security ACLs in the edit buffer, type the following command: WSS# commit security acl all success: change accepted.
PAGE 420
Configuring and managing security ACLs Viewing security ACL information To determine whether a security ACL is committed, you can check the edit buffer and the committed ACLs. After you commit an ACL, WSS Software removes it from the edit buffer. To display ACLs, use the following commands: show security acl editbuffer show security acl info all editbuffer show security acl info show security acl Use the first two commands to display the ACLs that you have not yet committed to nonvolatile storage.
PAGE 421
Configuring and managing security ACLs 421 Viewing security ACL details You can display the contents of one or all security ACLs that are committed. To display the contents of all committed security ACLs, type the following command: WSS# show security acl info ACL information for all set security acl ip acl-999 (hits #2 0) ---------------------------------------------------1. deny IP source IP 192.168.0.1 0.0.0.0 destination IP any 2. permit IP source IP 192.168.0.2 0.0.0.
PAGE 422
Configuring and managing security ACLs Clearing security ACLs The clear security acl command removes the ACL from the edit buffer only. To clear a security ACL, enter a specific ACL name, or enter all to delete all security ACLs. To remove the security ACL from the running configuration and nonvolatile storage, you must also use the commit security acl command.
PAGE 423
Configuring and managing security ACLs 423 Mapping user-based security ACLs When you configure administrator or user authentication, you can set a Filter-Id authorization attribute at the RADIUS server or at the WSS’s local database. The Filter-Id attribute is a security ACL name with the direction of the packets appended—for example, acl-name.in or acl-name.out.
PAGE 424
Configuring and managing security ACLs You can also map a security ACL to a user group. For details, see “Assigning a security ACL to a user or a group” (page 530). For more information about authenticating and authorizing users, see “About Administrative Access” (page 71) and “AAA tools for network users” (page 475). NN47250-500 (320657-F Version 02.
PAGE 425
Configuring and managing security ACLs 425 Mapping security ACLs to ports, VLANs, virtual ports, or distributed APs Security ACLs can be mapped to ports, VLANs, virtual ports, and Distributed APs.
PAGE 426
Configuring and managing security ACLs ACL acljoe is mapped to: Port 4 In WSS# clear security acl map acljoe port 4 in success: change accepted. After you clear the mapping between port 4 and ACL acljoe, the following is displayed when you enter show security acl map: WSS# show security acl map acljoe ACL acljoe is mapped to: Clearing a security ACL mapping does not stop the current filtering function if the ACL has other mappings.
PAGE 427
Configuring and managing security ACLs 427 Adding another ACE to a security ACL The simplest way to modify a security ACL is to add another ACE. For example, suppose you wanted to modify an existing ACL named acl-violet. Follow these steps: 1 To display all committed security ACLs, type the following command: WSS# show security acl info ACL information for all set security acl ip acl-violet (hits #2 0) ---------------------------------------------------1. permit IP source IP 192.168.253.1 0.0.0.
PAGE 428
Configuring and managing security ACLs Placing one ACE before another You can use the before editbuffer-index portion of the set security acl command to place a new ACE before an existing ACE. For example, suppose you want to deny some traffic from IP address 192.168.254.12 in acl-111.
PAGE 429
Configuring and managing security ACLs 429 Modifying an existing security ACL You can use the modify editbuffer-index portion of the set security acl command to modify an active security ACL. For example, suppose the ACL acl-111 currently blocks some packets from IP address 192.168.254.12 with the mask 0.0.0.255 and you want to change the ACL to permit all packets from this address.
PAGE 430
Configuring and managing security ACLs Clearing security ACLs from the edit buffer Use the rollback command to clear changes made to the security ACL edit buffer since it was last committed. The ACL is rolled back to its state at the last commit command.
PAGE 431
Configuring and managing security ACLs 431 1. permit SRC source IP 192.168.1.1 0.0.0.0 4 To clear the uncommitted acl-111 ACE from the edit buffer, type the following command: WSS# rollback security acl acl-111 5 To ensure that you have cleared the acl-111 ACE, type the following command. Only the uncommitted acl-a now appears.
PAGE 432
Configuring and managing security ACLs ACE ensures that traffic that does not match the first ACE is permitted. Without this additional ACE at the end, traffic that does not match the other ACE is dropped. NN47250-500 (320657-F Version 02.
PAGE 433
Configuring and managing security ACLs 433 Filtering based on DSCP values You can configure an ACE to filter based on a packet’s Differentiated Services Code Point (DSCP) value, and change the packet’s CoS based on the DSCP value. A CoS setting marked by an ACE overrides the CoS setting applied from the switch’s QoS map. Table 2 lists the CoS values to use when reassigning traffic to a different priority.
PAGE 434
Configuring and managing security ACLs The following commands perform the same CoS reassignment as the commands in “Using the dscp option” (page 433). They remap IP packets from IP address 10.10.50.2 that have DSCP value 46 (equivalent to precedence value 5 and ToS value 12), to have CoS value 7 when they are forwarded to any 10.10.90.x address on Distributed AP 4: WSS# set security acl ip acl2 permit cos 7 ip 10.10.50.2 0.0.0.0 10.10.90.0 0.0.0.255 precedence 5 tos 12 success: change accepted.
PAGE 435
Configuring and managing security ACLs 435 General guidelines Nortel recommends that you follow these guidelines for any wireless VoIP implementation: • Ensure end-to-end priority forwarding by making sure none of the devices that will forward voice traffic resets IP ToS or Diffserv values to 0. Some devices, such as some types of Layer 2 switches with basic Layer 3 awareness, reset the IP ToS or Diffserv value of untrusted packets to 0. WSS Software uses IP ToS values to prioritize voice traffic.
PAGE 436
Configuring and managing security ACLs Enabling VoIP support for TeleSym VoIP To enable VoIP support for TeleSym packets, which use UDP port 3344, for all users in VLAN corp_vlan, perform the following steps: 1 Configure an ACE in ACL voip that assigns IP traffic from any IP address with source UDP port 3344, addressed to any destination address, to CoS queue 6: WSS# set security acl ip voip permit cos 6 udp any eq 3344 any 2 Configure another ACE to change the default action of the ACL from deny to
PAGE 437
Configuring and managing security ACLs 437 Enabling SVP optimization for SpectraLink phones SpectraLink’s Voice Interoperability for Enterprise Wireless (VIEW) Certification Program is designed to ensure interoperability and high performance between SVP phones and WLAN infrastructure products. Nortel WSSs and APs are VIEW certified. This section describes how to configure WSSs and APs for SVP phones. Nortel recommends that you plan for a maximum of 6 wireless phones per AP.
PAGE 438
Configuring and managing security ACLs Configuring a service profile for WPA To configure a service profile for SVP phones that use WPA: • Create the service profile and add the voice SSID to it. • Enable the WPA information element (IE). This also enables TKIP. Leave TKIP enabled. • Disable 802.1X authentication and enable preshared key (PSK) authentication instead. • Enter the PSK key.
PAGE 439
Configuring and managing security ACLs 439 Configuring a VLAN and AAA for voice clients WSS Software requires all clients to be authenticated by RADIUS or the local database, and to be authorized for a specific VLAN. WSS Software places the user in the authorized VLAN. • Configure a VLAN for voice clients. Note. You can use the same VLAN for other clients. However, it is a best practice to use the VLAN primarily, if not exclusively, for voice traffic. • Disable IGMP snooping in the VLAN.
PAGE 440
Configuring and managing security ACLs WSS# set security acl map SVP vlan v1 in WSS# set security acl map SVP vlan v1 out WSS# commit security acl SVP The first ACE is needed only if the active-scan feature is enabled in the radio profile. The ACE ensures that active-scan reduces its off-channel time in the presence of FTP traffic from the TFTP server, by setting the CoS of the server traffic to 7. This ACE gives CoS 7 to UDP traffic from TFTP server 10.2.4.
PAGE 441
Configuring and managing security ACLs 441 Restricting client-to-client forwarding among IP-only clients You can use an ACL to restrict clients in a VLAN from communicating directly at the IP layer. Configure an ACL that has ACEs to permit traffic to and from the default router (gateway), an ACE that denies traffic between all other addresses within the subnets, and another ACE that allows traffic that doesn’t match the other ACEs. Note. AN ACL can restrict IP forwarding but not Layer 2 forwarding.
PAGE 442
Configuring and managing security ACLs Security ACL configuration scenario The following scenario illustrates how to create a security ACL named acl-99 that consists of one ACE to permit incoming packets from one IP address, and how to map the ACL to a port and a user: 1 Type the following command to create and name a security ACL and add an ACE to it. WSS# set security acl ip acl-99 permit 192.168.1.1 0.0.0.
PAGE 443
Managing keys and certificates Why use keys and certificates? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 443 About keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445 Creating keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451 Displaying certificate and key information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 444
Managing keys and certificates Wireless security through TLS In the case of wireless or wired authentication 802.1X users whose authentication is performed by the WSS, the first stage of any EAP transaction is Transport Layer Security (TLS) authentication and encryption. WLAN Management Software and Web View also require a session to the WSS that is authenticated and encrypted by TLS. Once a TLS session is authenticated, it is encrypted.
PAGE 445
Managing keys and certificates 445 PEAP-MS-CHAP-V2 security PEAP performs a TLS exchange for server authentication and allows a secondary authentication to be performed inside the resulting secure channel for client authentication. For example, the Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP-V2) performs mutual MS-CHAP-V2 authentication inside an encrypted TLS channel established by PEAP.
PAGE 446
Managing keys and certificates For EAP (802.1X) users, the public-private key pairs and digital certificates can be stored on a RADIUS server. In this case, the WSS operates as a pass-through authenticator. NN47250-500 (320657-F Version 02.
PAGE 447
Managing keys and certificates 447 Public key infrastructures A public-key infrastructure (PKI) is a system of digital certificates and certification authorities that verify and authenticate the validity of each party involved in a transaction through the use of public key cryptography.
PAGE 448
Managing keys and certificates Public and private keys Nortel’s identity-based networking uses public key cryptography to enforce the privacy of data transmitted over the network. Using public-private key pairs, users and devices can send encrypted messages that only the intended receiver can decrypt. Before exchanging messages, each party in a transaction creates a key pair that includes the public and private keys.
PAGE 449
Managing keys and certificates 449 Digital certificates Digital certificates bind the identity of network users and devices to a public key. Network users must authenticate their identity to those with whom they communicate, and must be able to verify the identity of other users and network devices, such as switches and RADIUS servers. The Nortel WLAN 2300 system supports the following types of X.
PAGE 450
Managing keys and certificates PKCS #7, PKCS #10, and PKCS #12 object files Public-Key Cryptography Standards (PKCS) are encryption interface standards created by RSA Data Security, Inc., that provide a file format for transferring data and cryptographic information. Nortel supports the PKCS object files listed in Table 1. Table 1: PKCS Object files supported by Nortel File Type Standard Purpose PKCS #7 Cryptographic Message Contains a digital certificate signed by a CA.
PAGE 451
Managing keys and certificates 451 The keys are 512 bytes long. WSS Software automatically generates self-signed certificates only in cases where no certificate is already configured. WSS Software does not replace self-signed certificates or CA-signed certificates that are already configured on the switch. You can replace an automatically generated certificate by creating another self-signed one or by installing a CA-signed one.
PAGE 452
Managing keys and certificates Choosing the appropriate certificate installation method for your network Depending on your network environment, you can use any of the following methods to install certificates and their public-private key pairs. The methods differ in terms of simplicity and security. The simplest method is also the least secure, while the most secure method is slightly more complex to use. • Self-signed certificate—The easiest method to use because a CA server is not required.
PAGE 453
Managing keys and certificates 453 Table 2: Procedures for creating and validating certificates (continued) Certificate Installation Method Steps Required Instructions Certificate 1. Generate a public-private key pair on the WSS. • Signing Request 2. Generate a CSR on the switch as a PKCS #10 (CSR) certificate • object file. 3. Give the CSR to a CA and receive a signed certificate (a PEM-encoded PKCS #7 object • file). 4. Paste the PEM-encoded file into the CLI to store the certificate on the WSS. 5.
PAGE 454
Managing keys and certificates Creating public-private key pairs To use a self-signed certificate or Certificate Signing Request (CSR) certificate for WSS authentication, you must generate a public-private key pair. To create a public-private key pair, use the following command: crypto generate key {admin | domain | eap | ssh | web} {128 | 512 | 1024 | 2048} Choose the key length based on your need for security or to conform with your organization’s practices.
PAGE 455
Managing keys and certificates 455 Generating self-signed certificates After creating a public-private key pair, you can generate a self-signed certificate. To generate a self-signed certificate, use the following command: crypto generate self-signed {admin | eap | web} When you type the command, the CLI prompts you to enter information to identify the certificate.
PAGE 456
Managing keys and certificates Installing a key pair and certificate from a PKCS #12 object file PKCS object files provide a file format for storing and transferring storing data and cryptographic information. (For more information, see “PKCS #7, PKCS #10, and PKCS #12 object files” (page 450).) A PKCS #12 object file, which you obtain from a CA, includes the private key, a certificate, and optionally the CA’s own certificate.
PAGE 457
Managing keys and certificates 457 Creating a CSR and installing a certificate from a PKCS #7 object file After creating a public-private key pair, you can obtain a signed certificate of authenticity from a CA by generating a Certificate Signing Request (CSR) from the WSS. A CSR is a text block with an encoded request for a signed certificate from the CA. Note. Many certificate authorities have their own unique requirements.
PAGE 458
Managing keys and certificates Installing a CA’s own certificate If you installed a CA-signed certificate from a PKCS #7 file, you must also install the PKCS #7 certificate of that CA. (If you used the PKCS #12 method, the CA’s certificate is usually included with the key pair and server certificate.) To install a CA’s certificate, use the following command: crypto ca-certificate {admin | eap | web} PEM-formatted-certificate When prompted, paste the certificate under the prompt.
PAGE 459
Managing keys and certificates 459 Key and certificate configuration scenarios The first scenario shows how to generate self-signed certificates. The second scenario shows how to install CA-signed certificates using PKCS #12 object files, and the third scenario shows how to install CA-signed certificates using CSRs (PKCS #10 object files) and PKCS #7 object files. (For SSH configuration information, see “Managing SSH” (page 130).
PAGE 460
Managing keys and certificates Creating self-signed certificates To manage the security of the WSS for administrative access by WMS and Web View, and the security of communication with 802.1X users and Web-based AAA users, create Admin, EAP, and Web-based AAA public-private key pairs and self-signed certificates. Follow these steps: 1 Set time and date parameters, if not already set. (See “Configuring and managing time parameters” (page 139).
PAGE 461
Managing keys and certificates 461 Email Address: admin@example.
PAGE 462
Managing keys and certificates Installing CA-signed certificates from PKCS #12 object files This scenario shows how to use PKCS #12 object files to install public-private key pairs, CA-signed certificates, and CA certifies for administrative access, 802.1X (EAP) access, and Web-based AAA access. 1 Set time and date parameters, if not already set. (See “Configuring and managing time parameters” (page 139).) 2 Obtain PKCS #12 object files from a certificate authority.
PAGE 463
Managing keys and certificates 463 WSS# crypto pkcs12 eap 20481x.p12 Unwrapped from PKCS12 file: keypair device certificate CA certificate WSS# crypto pkcs12 web 2048web.p12 Unwrapped from PKCS12 file: keypair device certificate CA certificate Note. WSS Software erases the OTP password entered with the crypto otp command when you enter the crypto pkcs12 command.
PAGE 464
Managing keys and certificates Installing CA-signed certificates using a PKCS #10 object file (CSR) and a PKCS #7 object file This scenario shows how to use CSRs to install public-private key pairs, CA-signed certificates, and CA certifies for administrative access, 802.1X (EAP) access, and Web-based AAA access. 1 Set time and date parameters, if not already set. (See “Configuring and managing time parameters” (page 139).
PAGE 465
Managing keys and certificates 465 7 To install the administrative certificate on the WSS, type the following command to display a prompt: WSS# crypto certificate admin Enter PEM-encoded certificate 8 Paste the signed certificate text block into the WSS switch’s CLI, below the prompt. 9 Display information about the certificate, to verify it: WSS# show crypto certificate admin 10 Repeat step 3 through step 9 to obtain and install EAP (802.1X) and Web-based AAA certificates.
PAGE 466
Managing keys and certificates User credential requirements The user credentials that WSS Software checks for on RADIUS servers or in the local database differ depending on the type of authentication rule that matches on the SSID or wired access requested by the user. • For a user to be successfully authenticated by an 802.
PAGE 467
Configuring AAA for network users About AAA for network users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467 AAA tools for network users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475 Configuring 802.1X authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482 Configuring authentication and authorization by MAC address . . . . . . . . . . . . . . . .
PAGE 468
Configuring AAA for network users Authentication When a user attempts to access the network, WSS Software checks for an authentication rule that matches the following parameters: • For wireless access, the authentication rule must match the SSID the user is requesting, and the user’s username or MAC address. • For access on a wired authentication port, the authentication rule must match the user’s username or MAC address.
PAGE 469
Configuring AAA for network users 469 Authentication algorithm WSS Software can try more than one of the authentication types described in “Authentication types” to authenticate a user. WSS Software tries 802.1X first. If the user’s NIC supports 802.1X but fails authentication, WSS Software denies access. Otherwise, WSS Software tries MAC authentication next. If MAC authentication is successful, WSS Software grants access to the user.
PAGE 470
Configuring AAA for network users Figure 1. Authentication flowchart for wireless network users Client associates with Nortel radio or requests access from wired authentication port Client requests encrypted SSID? Yes 802.1X rule that matches SSID? Client responds to 802.1X? Yes No No Yes Authent. Allow succeeds? Yes Client No No Refuse Client Authent.
PAGE 471
Configuring AAA for network users 471 Last-resort access to an SSID does not require a special user (such as last-resort-ssid) to be configured. Instead, if the fallthru authentication type on the SSID’s service profile is set to last-resort, and the SSID does not have any 802.1X or MAC access rules, a user can access the SSID without entering a username or password.
PAGE 472
Configuring AAA for network users SSID name “Any” In authentication rules for wireless access, you can specify the name any for the SSID. This value is a wildcard that matches on any SSID string requested by the user. For 802.1X and Web-based AAA rules that match on SSID any, WSS Software checks the RADIUS servers or local database for the username (and password, if applicable) entered by the user.
PAGE 473
Configuring AAA for network users 473 accessing the SSID managed by the service profile (in addition to any attributes supplied by a RADIUS server or the switch’s local database).
PAGE 474
Configuring AAA for network users Accounting WSS Software also supports accounting. Accounting collects and sends information used for billing, auditing, and reporting—for example, user identities, connection start and stop times, the number of packets received and sent, and the number of bytes transferred. You can track sessions through accounting information stored locally or on a remote RADIUS server.
PAGE 475
Configuring AAA for network users 475 Summary of AAA features Depending on your network configuration, you can configure authentication, authorization, and accounting (AAA) for network users to be performed locally on the WSS or remotely on a RADIUS server. The number of users that the local WSS database can support depends on your platform. AAA for network users controls and monitors their use of the network: • Classification for customized access.
PAGE 476
Configuring AAA for network users “Wildcards” and groups for network user classification “Wildcarding” lets you classify users by username or MAC address for different AAA treatments. A user wildcard is a string used by AAA and IEEE 802.1X or Web-based AAA methods to match a user or set of users. MAC address wildcards match authentication methods to a MAC address or set of MAC addresses. User wildcards and MAC address wildcards can make use of wildcards.
PAGE 477
Configuring AAA for network users 477 AAA methods for IEEE 802.1X and Web network access The following AAA methods are supported by Nortel for 802.1X and Web network access mode: • Client certificates issued by a certificate authority (CA) for authentication. • (For this method, you assign an authentication protocol to a user. For protocol details, see “IEEE 802.1X Extensible Authentication Protocol types” (page 480).) • The WSS switch’s local database of usernames and user groups for authentication.
PAGE 478
Configuring AAA for network users Remote authentication with local backup You can use a combination of authentication methods; for example, PEAP offload and local authentication. When PEAP offload is configured, the WSS offloads all EAP processing from server groups; the RADIUS servers are not required to communicate using the EAP protocols. (For details, see “Configuring 802.1X Acceleration” (page 484).
PAGE 479
Configuring AAA for network users 479 Authentication proceeds as follows: 1 When user Jose@example.com attempts authentication, the WSS sends an authentication request to the first AAA method, which is server-group-1. Because server-group-1 contains two servers, the first RADIUS server, server-1, is contacted. If this server responds, the authentication proceeds using server-1. 2 If server-1 fails to respond, the WSS retries the authentication using server-2.
PAGE 480
Configuring AAA for network users IEEE 802.1X Extensible Authentication Protocol types Extensible Authentication Protocol (EAP) is a generic point-to-point protocol that supports multiple authentication mechanisms. EAP has been adopted as a standard by the Institute of Electrical and Electronic Engineers (IEEE). IEEE 802.1X is an encapsulated form for carrying authentication messages in a standard message exchange between a user (client) and an authenticator.
PAGE 481
Configuring AAA for network users 481 Ways a WSS can use EAP Network users with 802.1X support cannot access the network unless they are authenticated. You can configure a WSS to authenticate users with EAP on a group of RADIUS servers and/or in a local user database on the WSS, or to offload some authentication tasks from the server group. Table 2 details these three basic WSS authentication approaches. (For information about digital certificates, see “Managing keys and certificates” (page 443).
PAGE 482
Configuring AAA for network users Effects of authentication type on encryption method Wireless users who are authenticated on an encrypted service set identifier (SSID) can have their data traffic encrypted by the following methods: • Wi-Fi Protected Access (WPA) encryption • Non-WPA dynamic Wired Equivalent Privacy (WEP) encryption • Non-WPA static WEP encryption (For encryption details, see “Configuring user encryption” (page 291).
PAGE 483
Configuring AAA for network users 483 (For more information about user wildcards, see “User wildcards” (page 47).
PAGE 484
Configuring AAA for network users Configuring 802.1X Acceleration You can configure the WSS to offload all EAP processing from server groups. In this case, the RADIUS server is not required to communicate using the EAP protocols. For PEAP-MS-CHAP-V2 offload, you define a complete user profile in the local WSS database and only a username and password on a RADIUS server. For example, the following command authenticates all wireless users who request SSID marshes at example.
PAGE 485
Configuring AAA for network users 485 Using pass-through The pass-through method causes EAP authentication requests to be processed entirely by remote RADIUS servers in server groups. For example, the following command enables users at EXAMPLE to be processed via server group shorebirds or swampbirds: WSS# set authentication dot1X ssid marshes EXAMPLE/* pass-through shorebirds swampbirds The server group swampbirds is contacted only if all the RADIUS servers in shorebirds do not respond.
PAGE 486
Configuring AAA for network users Authenticating through a local database To configure the WSS to authenticate and authorize a user against the local database in the WSS, use the following command: set authentication dot1x {ssid ssid-name | wired} user-wildcard [bonded] protocol local For example, the following command authenticates 802.1X user Jose for wired authentication access via the local database: WSS# set authentication dot1X Jose wired peap-mschapv2 local success: change accepted.
PAGE 487
Configuring AAA for network users 487 Binding user authentication to machine authentication Bonded Authentication™ (bonded authentication) is a security feature that binds an 802.1X user’s authentication to authentication of the machine from which the user is attempting to log on. When this feature is enabled, WSS Software authenticates a user only if the machine from which the user logs on has already been authenticated separately.
PAGE 488
Configuring AAA for network users Nortel recommends that you make the rules as general as possible. For example, if the Active Directory domain is mycorp.com, the following userglobs match on all machine names and users in the domain: • host/*.mycorp.com (userglob for the machine authentication rule) • *.mycorp.com (userglob for the user authentication rule) If the domain name has more nodes (for example, nl.mycorp.com), use an asterisk in each node that you want to match globally.
PAGE 489
Configuring AAA for network users 489 To reset the Bonded Authentication period to its default value (0), use the following command: clear dot1x bonded-period Bonded Authentication configuration example To configure Bonded Authentication: • Configure separate authentication rules for the machine and for the user(s). • Set the Bonded Authentication period. • Verify the configuration changes. The following commands configure two 802.1X authentication rules for access to SSID mycorp.
PAGE 490
Configuring AAA for network users reauthentication period maximum requests key transmission reauthentication authentication control WEP rekey period WEP rekey Bonded period 3600 2 enabled enabled enabled 1800 enabled 60 Information for the 802.1X authentication rule for the machine (host/bob-laptop.mycorp.com) is also displayed. However, the bonded option is configured only for the user’s authentication rule.
PAGE 491
Configuring AAA for network users 491 Adding and clearing MAC users and user groups locally MAC users and groups can gain network access only through the WSS. They cannot create administrative connections to the WSS. A MAC user is created in a similar fashion to other local users except for having a MAC address instead of a username. MAC user groups are created in a similar fashion to other local user groups.
PAGE 492
Configuring AAA for network users Configuring MAC authentication and authorization The set authentication mac command defines the AAA methods by which MAC addresses can be used for authentication.
PAGE 493
Configuring AAA for network users 493 Changing the MAC authorization password for RADIUS When you enable MAC authentication, the client does not supply a regular username or password. The MAC address of the user’s device is extracted from frames received from the device. To authenticate and authorize MAC users via RADIUS, you must configure a single predefined password for MAC users, which is called the outbound authorization password.
PAGE 494
Configuring AAA for network users You can use Web-based AAA on both encrypted and unencrypted SSIDs. If you use Web-based AAA on an encrypted SSID, you can use static WEP or WPA with PSK as the encryption type. WSS Software provides a Nortel login page, which is used by default. You can add custom login pages to the WSS’s nonvolatile storage, and configure WSS Software to serve those pages instead. NN47250-500 (320657-F Version 02.
PAGE 495
Configuring AAA for network users 495 How Web portal Web-based AAA works 1 A Web-based AAA user attempts to access the network. For a wireless user, this begins when the user’s network interface card (NIC) associates with an SSID on a Nortel radio. For a wired authentication user, this begins when the user’s NIC sends data on the wired authentication port. 2 WSS Software starts a portal session for the user, and places the user in a VLAN.
PAGE 496
Configuring AAA for network users requested URL is invalid, the behavior gives the appearance that the requested URL is valid, since the browser receives a login page. Moreover, the browser might cache a mapping of the invalid URL to the WSS IP address. If the user enters an IP address, most browsers attempt to contact the IP address directly without using DNS.
PAGE 497
Configuring AAA for network users 497 Web-based AAA requirements and recommendations Note. WSS Software Version 5.0 does not require or support special user web-portal-ssid, where ssid is the SSID the Web-Portal user associates with. Previous WSS Software Versions required this special user for Web-Portal configurations. Any web-portal-ssid users are removed from the configuration during upgrade to WSS Software Version 5.0.
PAGE 498
Configuring AAA for network users Note. In WSS Software Version 4.1 and earlier, the VLAN was required to be statically configured on the WSS where Web-based AAA was configured and through which the user accessed the network. WSS Software Version 4.2 removes this restriction. The VLAN you want to place an authenticated Web-based AAA user on does not need to be statically configured on the switch where Web Portal is configured.
PAGE 499
Configuring AAA for network users 499 Caution! Without the Web-Portal ACL, Web-based AAA users will be placed on the network without any filters. Caution! Do not change the deny rule at the bottom of the Web-Portal ACL. This rule must be present and the capture option must be used with the rule. If the rule does not have the capture option, the Web Portal user never receives a login page.
PAGE 500
Configuring AAA for network users Network requirements The VLAN where users will be placed must have an IP interface, and the subnet the interface is in must have access to DHCP and DNS servers. WSS recommendations • Consider installing a Web-based AAA certificate signed by a trusted CA, instead of one signed by the WSS itself.
PAGE 501
Configuring AAA for network users 501 Configuring Web portal Web-based AAA To configure Web Portal Web-based AAA: 1 Configure an SSID or wired authentication port and set the fallthru authentication type to web-portal. The default for SSIDs and for wired authentication ports is none. 2 Configure individual Web-based AAA users.
PAGE 502
Configuring AAA for network users success: change accepted. WSS# set service-profile mycorp-srvcprof cipher-ccmp enable success: change accepted.
PAGE 503
Configuring AAA for network users 503 # Model 2350 # Last change occurred at 2006-6-13 13:24:46 ... set service-profile mycorp-srvcprof ssid-name mycorp set service-profile mycorp-srvcprof auth-fallthru web-portal set service-profile mycorp-srvcprof rsn-ie enable set service-profile mycorp-srvcprof cipher-ccmp enable set service-profile mycorp-srvcprof web-portal-acl portalacl set service-profile mycorp-srvcprof attr vlan-name mycorp-vlan ... set authentication web ssid mycorp ** local ...
PAGE 504
Configuring AAA for network users 2 sessions total This example shows two sessions. The session for alice has the user’s name and is flagged with an asterisk ( * ). The asterisk indicates that the user has completed authentication and authorization. The session for web-portal-mycorp indicates that a Web-based AAA user is on the network but is still being authenticated.
PAGE 505
Configuring AAA for network users 505 Using a custom login page By default, WSS Software serves the Nortel login page for Web login. To serve a custom page instead, do the following: 1 Copy and modify the Nortel page, or create a new page. 2 Create a subdirectory in the user files area of the WSS’s nonvolatile storage, and copy the custom page into the subdirectory. 3 Configure SSIDs and wired authentication ports to use the custom form, by specifying the location of the form. Note.
PAGE 506
Configuring AAA for network users • If the switch’s nonvolatile storage has a page in web named wba_form.html (web/wba_form.html), WSS Software serves this page. This applies to all wired authentication users. The wba_form.html page also is served to SSID users if the SSID’s service profile does not specify a custom page. • If there is no wba_form.html page and no custom page in the service profile (for an SSID), WSS Software serves the default page.
PAGE 507
Configuring AAA for network users 507 a Create a temporary service profile and configure a temporary, clear SSID on it: WSS# set service-profile tempsrvc success: change accepted. WSS# set service-profile tempsrvc ssid-name tempssid success: change accepted. WSS# set service-profile tempsrvc ssid-type clear success: change accepted. WSS# set service-profile tempsrvc auth-fallthru web-portal success: change accepted.
PAGE 508
Configuring AAA for network users 6 Save the modified page. 7 On the WSS, create a new subdirectory for the customized page. (The files must be on a TFTP server that the WSS can reach over the network.) WSS# mkdir mycorp-web-based aaa success: change accepted. 8 Copy the files for the customized page into the subdirectory: WSS# copy tftp://10.1.1.1/mycorp-login.html mycorp-web-based aaa/mycorp-login.html success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec] WSS# copy tftp://10.1.1.
PAGE 509
Configuring AAA for network users 509 Using dynamic fields in Web-based AAA redirect URLs You can include variables in the URL to which a Web-based AAA client is redirected after authentication and authorization. Table 3 lists the variables you can include in a redirect URL.
PAGE 510
Configuring AAA for network users https://saqqara.org/login.php?user=djoser To verify configuration of a redirect URL and other user attributes, type the show aaa command. NN47250-500 (320657-F Version 02.
PAGE 511
Configuring AAA for network users 511 Using an ACL other than portalacl By default, when you set the fallthru authentication type on a service profile or wired authentication port to web-portal, WSS Software creates an ACL called portalacl. WSS Software uses the portalacl ACL to filter Web-Portal user traffic while users are being authenticated. To use another ACL: 1 Create a new ACL and add the first rule contained in portalacl: set security acl ip portalacl permit udp 0.0.0.0 255.255.255.255 eq 68 0.0.
PAGE 512
Configuring AAA for network users Configuring the Web portal Web-based AAA session timeout period When a client that has connected through Web Portal Web-based AAA enters standby or hibernation mode, WSS Software may place the client’s Web Portal Web-based AAA session in the Deassociated state.
PAGE 513
Configuring AAA for network users 513 Configuring the Web Portal Web-based AAA Logout Function Configure the Web Portal web-based AAA to allow a user to manually terminate the session. When this feature is enabled, the Web Portal web-based AAA user is successfully authenticated and redirected to the requested page, a window appears behind the user browser. The window has a button labeled “Logout”. When you click Logout, a URL appears and terminates the user session on the Mobility Domain.
PAGE 514
Configuring AAA for network users To configure an SSID to allow last-resort access: • Set the SSID name, if not already set. • Set the fallthru access type of the SSID’s service profile to last-resort. • Set the vlan-name and other authorization attributes on the SSID’s service profile. • If the SSID type will be crypto (the default), configure encryption settings. You do not need to configure an access rule for last-resort access.
PAGE 515
Configuring AAA for network users 515 WEP Unicast Index: 1 WEP Multicast Index: Shared Key Auth: NO WPA and RSN enabled: ciphers: cipher-tkip, cipher-ccmp, cipher-wep40 authentication: 802.1X TKIP countermeasures time: 60000ms vlan-name = guest-vlan ... 1 Note. Beginning with WSS Software Version 5.0, the special user last-resort-ssid, where ssid is the SSID name, is not required and is not supported. If you upgrade a switch running an earlier version of WSS Software to 5.
PAGE 516
Configuring AAA for network users Configuring last-resort access for wired authentication ports To configure a wired authentication port to allow last-resort access: • Set the fallthru authentication type on the port to last-resort. • Create a user named last-resort-wired in the switch’s local database. The following commands configure wired authentication port 5 for last-resort access and add the special user: WSS# set port type wired-auth 5 auth-fall-thru last-resort success: change accepted.
PAGE 517
Configuring AAA for network users 517 Authentication process for users of a third-party AP 1 WSS Software uses MAC authentication to authenticate the AP. 2 The user contacts the AP and negotiates the authentication protocol to be used. 3 The AP, acting as a RADIUS client, sends a RADIUS access-request to the WSS. The access-request includes the SSID, the user’s MAC address, and the username. 4 For 802.1X users, the AP uses 802.1X to authenticate the user, using the WSS as its RADIUS server.
PAGE 518
Configuring AAA for network users Requirements Third-party AP requirements • The third-party AP must be connected to the WSS through a wired Layer 2 link. WSS Software cannot provide data services if the AP and WSS are in different Layer 3 subnets. • The AP must be configured as the WSS’s RADIUS client. • The AP must be configured so that all traffic for a given SSID is mapped to the same 802.1Q tagged VLAN. If the AP has multiple SSIDs, each SSID must use a different tag value.
PAGE 519
Configuring AAA for network users 519 Configuring authentication for 802.1X users of a third-party AP with tagged SSIDs To configure WSS Software to authenticate 802.1X users of a third-party AP, use the commands below to do the following: • Configure the port connected to the AP as a wired authentication port.
PAGE 520
Configuring AAA for network users The following command configures a RADIUS proxy entry for a third-party AP RADIUS client at 10.20.20.9, sending RADIUS traffic to the default UDP ports 1812 and 1813 on the WSS: WSS# set radius proxy client address 10.20.20.9 key radkey1 success: change accepted. The IP address is the AP’s IP address. The key is the shared secret configured on the RADIUS servers. WSS Software uses the shared secret to authenticate and encrypt RADIUS communication.
PAGE 521
Configuring AAA for network users 521 Configuring authentication for non-802.1X users of a third-party AP with tagged SSIDs To configure WSS Software to authenticate non-802.1X users of a third-party AP, use the same commands as those required for 802.1X users. Additionally, when configuring the wired authentication port, use the auth-fall-thru option to change the fallthru authentication type to last-resort or web-portal.
PAGE 522
Configuring AAA for network users Configuring access for any users of a non-tagged SSID If SSID traffic from the third-party AP is untagged, use the same configuration commands as the ones required for 802.1X users, except the set radius proxy port command. This command is not required and is not applicable to untagged SSID traffic. In addition, when configuring the wired authentication port, use the auth-fall-thru option to change the fallthru authentication type to last-resort or web-portal.
PAGE 523
Configuring AAA for network users 523 Table 5.Authentication attributes for local users Attribute Description Valid Value(s) encryption-type Type of encryption required for access by the client. Clients who attempt to use an unauthorized encryption method are rejected.
PAGE 524
Configuring AAA for network users Table 5.Authentication attributes for local users (continued) Attribute Description Valid Value(s) mobility-profile (network access mode only) Mobility Profile attribute for the user. (For more information, see “Configuring a Mobility Profile” (page 552).) Name of an existing Mobility Profile, which can be up to 32 alphanumeric characters, with no tabs or spaces. service-type Type of access the user is requesting. Note.
PAGE 525
Configuring AAA for network users 525 Table 5.Authentication attributes for local users (continued) Attribute Description Valid Value(s) start-date Date and time at which the user becomes eligible to access the network. WSS Software does not authenticate the user unless the attempt to access the network occurs at or after the specified date and time, but before the end-date (if specified). Date and time, in the following format: YY/MM/DD-HH:MM You can use start-date alone or with end-date.
PAGE 526
Configuring AAA for network users Table 5.Authentication attributes for local users (continued) Attribute Description Valid Value(s) time-of-day (network access mode only) Day(s) and time(s) during which the user is permitted to log into the network. After authorization, the user’s session can last until either the Time-Of-Day range or the Session-Timeout duration (if set) expires, whichever is shorter. One of the following: • • • • never—Access is always denied. any—Access is always allowed.
PAGE 527
Configuring AAA for network users 527 Table 5.Authentication attributes for local users (continued) Attribute Description Valid Value(s) url (network access mode only) URL to which the user is redirected after successful Web-based AAA. Web URL, in standard format. For example: http://www.example.com Note. You must include the http:// portion.
PAGE 528
Configuring AAA for network users Assigning attributes to users and groups You can assign authorization attributes to individual users or groups of users.
PAGE 529
Configuring AAA for network users 529 Assigning SSID default attributes to a service profile You can configure a service profile with a set of default AAA authorization attributes that are used when the normal AAA process or a location policy does not provide them. These authorization attributes are applied by default to users accessing the SSID managed by the service profile.
PAGE 530
Configuring AAA for network users Assigning a security ACL to a user or a group Once a security access control list (ACL) is defined and committed, it can be applied dynamically and automatically to users and user groups through the 802.1X authentication and authorization process. When you assign a Filter-Id attribute to a user or group, the security ACL name value is entered as an authorization attribute into the user or group record in the local WSS database or RADIUS server. Note.
PAGE 531
Configuring AAA for network users 531 The following command applies the incoming filters of acl-101 to the users who belong to the group eastcoasters: WSS# set usergroup eastcoasters attr filter-id acl-101.in success: change accepted. Assigning a security ACL on a RADIUS server To assign a security ACL name as the Filter-Id authorization attribute of a user or group record on a RADIUS server, see the documentation for your RADIUS server.
PAGE 532
Configuring AAA for network users Assigning encryption types to wireless users When a user turns on a wireless laptop or PDA, the device attempts to find an access point and form an association with it. Because APs support the encryption of wireless traffic, clients can choose an encryption type to use. You can configure APs to use the encryption algorithms supported by the Wi-Fi Protected Access (WPA) security enhancement to the IEEE 802.11 wireless standard.
PAGE 533
Configuring AAA for network users 533 success: change accepted. You can also specify a combination of allowed encryption types by summing the values. For example, the following command allows mac-fans to associate using either TKIP or WEP_104: WSS# set mac-usergroup mac-fans attr encryption-type 12 success: change accepted.
PAGE 534
Configuring AAA for network users Keeping users on the same VLAN even after roaming In some cases, a user can be assigned to a different VLAN after roaming to another WSS. Table 6 lists the ways a VLAN can be assigned to a user after roaming from one WSS to another. Table 6: VLAN assignment after roaming from one WSS to another Location Policy AAA keep-initial-vlan SSID VLAN Assigned By...
PAGE 535
Configuring AAA for network users 535 To enable keep-initial-vlan, use the following command: set service-profile name keep-initial-vlan {enable | disable} Enter this command on the switch that will be roamed to by users. The following command enables the keep-initial-vlan option on service profile sp3: WSS# set service-profile sp3 keep-initial-vlan enable success: change accepted.
PAGE 536
Configuring AAA for network users Figure 4.
PAGE 537
Configuring AAA for network users 537 Overriding or adding attributes locally with a location policy During the login process, the AAA authorization process is started immediately after clients are authenticated to use the WSS. During authorization, WSS Software assigns the user to a VLAN and applies optional user attributes, such as a session timeout value and one or more security ACL filters.
PAGE 538
Configuring AAA for network users About the location policy Each WSS can have one location policy. The location policy consists of a set of rules. Each rule contains conditions, and an action to perform if all conditions in the rule match. The location policy can contain up to 150 rules.
PAGE 539
Configuring AAA for network users 539 How the location policy differs from a security ACL Although structurally similar, the location policy and security ACLs have different functions. The location policy on a WSS can be used to locally redirect a user to a different VLAN or locally control the traffic to and from a user. In contrast, security ACLs are packet filters applied to the user throughout a Mobility Domain. (For more information, see “Configuring and managing security ACLs” (page 407).
PAGE 540
Configuring AAA for network users Setting the location policy To enable the location policy function on a WSS, you must create at least one location policy rule with one of the following commands: set location policy deny if {ssid operator ssid-name | vlan operator vlan-wildcard | user operator user-wildcard | port port-list | ap ap-num} [before rule-number | modify rule-number] set location policy permit {vlan vlan-name | inacl inacl-name | outacl outacl-name} if {ssid operator ssid-name | vlan opera
PAGE 541
Configuring AAA for network users 541 For example, the following command authorizes users at *.ny.ourfirm.com to access the bld4.tac VLAN, and applies the security ACL tac_24 to the traffic they receive: WSS# set location policy permit vlan bld4.tac outacl tac_24 if user eq *.ny.ourfirm.com The following command authorizes access to users on VLANs with names matching bld4.
PAGE 542
Configuring AAA for network users Clearing location policy rules and disabling the location policy To delete a location policy rule, use the following command: clear location policy rule-number Type show location policy to display the numbers of configured location policy rules. To disable the location policy on a WSS, delete all the location policy rules. Configuring accounting for wireless network users Accounting records come in three types: start, stop, and update.
PAGE 543
Configuring AAA for network users 543 Start Records Update and Stop Records Client’s MAC address Client’s MAC address AP port number and radio number AP port number and radio number AP’s MAC address AP’s MAC address Number of octets received by the WSS Number of octets sent by the switch Number of packets received by the switch Number of packets sent by the switch (For details about show accounting statistics output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.
PAGE 544
Configuring AAA for network users Configuring periodic accounting update records If you have configured WSS Software to use start-stop mode, by default accounting update records are generated when a user roams from one AP to another. Optionally, WSS Software can generate update records at specified periodic intervals. This can be done in one of the following ways: • By specifying a value for the acct-interim-interval attribute on the RADIUS server.
PAGE 545
Configuring AAA for network users 545 Enabling system accounting messages You can configure WSS Software to send an Accounting-On message (Acct-Status-Type = 7) to the RADIUS server when the WSS starts, and an Accounting-Off message (Acct-Status-Type = 8) to the RADIUS server when the WSS is administratively shut down.
PAGE 546
Configuring AAA for network users Viewing local accounting records To view local accounting records, type the following command: show accounting statistics NN47250-500 (320657-F Version 02.
PAGE 547
Configuring AAA for network users 547 Viewing roaming accounting records During roaming, accounting is treated as a continuation of an existing session, rather than a new session. The following sample output shows a wireless user roaming from one WSS to another WSS.
PAGE 548
Configuring AAA for network users Acct-Authentic=2 Acct-Multi-Session-Id=SESSION-4-1106424789 User-Name=Administrator@example.
PAGE 549
Configuring AAA for network users 549 Web Portal: enabled set authentication admin Jose sg3 set authentication console * none set authentication mac ssid mycorp * local set authentication dot1x ssid mycorp Geetha eap-tls set authentication dot1x ssid mycorp * peap-mschapv2 sg1 sg2 sg3 set accounting dot1x Nin ssid mycorp stop-only sg2 set accounting admin Natasha start-stop local user Nin Password = 082c6c64060b (encrypted) Filter-Id = acl-999.in Filter-Id = acl-999.
PAGE 550
Configuring AAA for network users set authentication dot1x ssid any ** peap-mschapv2 sg1 sg2 sg3 NN47250-500 (320657-F Version 02.
PAGE 551
Configuring AAA for network users 551 Using authentication and accounting rules together When you use accounting commands with authentication commands and identify users with user wildcards, WSS Software might not process the commands in the order you entered them. As a result, user authentication or accounting might not proceed as you intend, or valid users might fail authentication and be shut out of the network.
PAGE 552
Configuring AAA for network users success: change accepted. WSS# set authentication dot1x ssid mycorp * peap-mschapv2 local success: change accepted. The configuration order now shows that all 802.1X users are processed as you intended: WSS# show aaa ...
PAGE 553
Configuring AAA for network users 553 If roses-profile is configured for EXAMPLE\ users on your WSS, WSS Software checks its port list. If, for example, the current port for EXAMPLE\jose’s connection is on the list of allowed ports specified in roses-profile, the connection is allowed to proceed. If the port is not in the list (for example, EXAMPLE\jose is on port 12, which is not in the port list), the authorization fails and client EXAMPLE\jose is rejected.
PAGE 554
Configuring AAA for network users General use of network user commands The following example illustrates how to configure IEEE 802.1X network users for authentication, accounting, ACL filtering, and Mobility Profile assignment: 1 Configure all 802.1X users of SSID mycorp at EXAMPLE to be authenticated by server group shorebirds.
PAGE 555
Configuring AAA for network users 555 Users at EXAMPLE are now restricted to ports 2 and 5 through 9, as specified in the tulip Mobility Profile configuration. 7 Use the show aaa command to verify your configuration.
PAGE 556
Configuring AAA for network users Enabling RADIUS pass-through authentication The following example illustrates how to enable RADIUS pass-through authentication for all 802.1X network users: 1 Configure the RADIUS server r1 at IP address 10.1.1.1 with the string sunny for the key. Type the following command: WSS# set radius server r1 address 10.1.1.1 key sunny 2 Configure the server group sg1 with member r1. Type the following command: WSS# set server group sg1 members r1 3 Enable all 802.
PAGE 557
Configuring AAA for network users 557 Enabling PEAP-MS-CHAP-V2 authentication The following example illustrates how to enable local PEAP-MS-CHAP-V2 authentication for all 802.1X network users. This example includes local usernames, passwords, and membership in a VLAN. This example includes one username and an optional attribute for session-timeout in seconds. 1 To set authentication for all 802.
PAGE 558
Configuring AAA for network users Enabling PEAP-MS-CHAP-V2 offload The following example illustrates how to enable PEAP-MS-CHAP-V2 offload. In this example, all EAP processing is offloaded from the RADIUS server, but MS-CHAP-V2 authentication and authorization are done via a RADIUS server. The MS-CHAP-V2 lookup matches users against the user list on a RADIUS server. 1 Configure the RADIUS server r1 at IP address 10.1.1.1 with the string starry for the key.
PAGE 559
Configuring AAA for network users 559 Combining 802.1X Acceleration with pass-through authentication The following example illustrates how to enable PEAP-MS-CHAP-V2 offload for the marketing (mktg) group and RADIUS pass-through authentication for members of engineering. This example assumes that engineering members are using DNS-style naming, such as is used with EAP-TLS. A WSS server certificate is also required. 1 Configure the RADIUS server r1 at IP address 10.1.1.1 with the string starry for the key.
PAGE 560
Configuring AAA for network users Overriding AAA-assigned VLANs The following example shows how to change the VLAN access of wireless users in an organization housed in multiple buildings. Suppose the wireless users on the faculty of a college English department have offices in building A and are authorized to use that building’s bldga-prof- VLANs. These users also teach classes in building B.
PAGE 561
Configuring communication with RADIUS RADIUS overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561 Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563 Configuring RADIUS servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563 Configuring RADIUS server groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 562
Configuring communication with RADIUS Figure 1. Wireless Client, AP, WSS, and RADIUS Servers Client (with PDA) AP 1 AP 2 3 2 1 Client (with laptop) Client (with laptop) Wired connection(s) Wireless connection 4 RADIUS Server 1 RADIUS Server 2 840-9502-0021 WSS with local database In the example shown in Figure 1, the following events occur: 1 The wireless user (client) requests an IEEE 802.11 association from the AP .
PAGE 563
Configuring communication with RADIUS 563 Before you begin To ensure that you can contact the RADIUS servers you plan to use for authentication, send the ping command to each one to verify connectivity. ping ip-address You can then set up communication between the WSS and each RADIUS server group. Configuring RADIUS servers An authentication server authenticates each client with access to a switch port before making available any services offered by the switch or the wireless network.
PAGE 564
Configuring communication with RADIUS Configuring global RADIUS defaults You can change RADIUS values globally and set a global password (key) with the following command. The key string is the shared secret that the WSS uses to authenticate itself to the RADIUS server. set radius {deadtime minutes | encrypted-key string | key string | retransmit number | timeout seconds} (To override global settings for individual RADIUS servers, use the set radius server command.
PAGE 565
Configuring communication with RADIUS 565 Setting the system IP address as the source address By default, RADIUS packets leaving the WSS have the source IP address of the outbound interface on the switch. This source address can change when routing conditions change. If you have set a system IP address for the WSS, you can use it as a permanent source address for the RADIUS packets sent by the switch.
PAGE 566
Configuring communication with RADIUS Configuring individual RADIUS servers You must set up a name and IP address for each RADIUS server. To configure a RADIUS server, use the following command: set radius server server-name [address ip-address] [key string] The server name must be unique for this RADIUS server on this WSS. Do not use the same name for a RADIUS server and a RADIUS server group.
PAGE 567
Configuring communication with RADIUS 567 Deleting RADIUS servers To remove a RADIUS server from the WSS configuration, use the following command: clear radius server server-name Configuring RADIUS server groups A server group is a named group of up to four RADIUS servers. Before you can use a RADIUS server for authentication, you must first create a RADIUS server group and add the RADIUS server to that group.
PAGE 568
Configuring communication with RADIUS Creating server groups To create a server group, you must first configure the RADIUS servers with their addresses and any optional parameters.
PAGE 569
Configuring communication with RADIUS 569 When you configure load balancing, the first client’s RADIUS requests are directed to the first server in the group, the second client’s RADIUS requests are directed to the second server in the group, and so on. When the last server in the group is reached, the cycle is repeated. Note. WSS Software attempts to send accounting records to one RADIUS server, even if load balancing is configured.
PAGE 570
Configuring communication with RADIUS The RADIUS server coot is configured but not part of the server group shorebirds. 2 To add RADIUS server coot as the last server in the server group shorebirds, type the following command: WSS# set server group shorebirds members sandpiper heron egret coot success: change accepted. NN47250-500 (320657-F Version 02.
PAGE 571
Configuring communication with RADIUS 571 Deleting a server group To remove a server group, type the following command: clear server group group-name For example, to delete the server group shorebirds, type the following command: WSS# clear server group shorebirds success: change accepted.
PAGE 572
Configuring communication with RADIUS 5 Enable load balancing for shorebirds. Type the following command: WSS# set server group shorebirds load-balance enable 6 Display the configuration. Type the following command: WSS# show aaa Default Values authport=1812 acctport=1813 timeout=5 acct-timeout=5 retrans=3 deadtime=0 key=(null) author-pass=(null) Radius Servers Server Addr ---------------------sandpiper 192.168.253.17 seagull 192.168.243.12 egret 192.168.243.15 pelican 192.168.253.
PAGE 573
Managing 802.1X on the WSS Managing 802.1X on wired authentication ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573 Managing 802.1X encryption keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575 Setting EAP retransmission attempts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 Managing 802.1X client reauthentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 Managing other timers . . . . . . . .
PAGE 574
Managing 802.1X on the WSS Enabling and disabling 802.1X globally The following command globally enables or disables 802.1X authentication on all wired authentication ports on a WSS: set dot1x authcontrol {enable | disable} The default setting is enable, which permits 802.1X authentication to occur as determined by the set dot1X port-control command for each wired authentication port. The disable setting forces all wired authentication ports to unconditionally authorize all 802.
PAGE 575
Managing 802.1X on the WSS 575 Setting 802.1X port control The following command specifies the way a wired authentication port or group of ports handles user 802.1X authentication attempts: set dot1x port-control {forceauth | forceunauth | auto} port-list The default setting is auto, which allows the WSS to process 802.1X authentication normally according to the authentication configuration.
PAGE 576
Managing 802.1X on the WSS Enabling 802.1X key transmission The following command enables or disables the transmission of key information to the supplicant (client) in EAPoL key messages, after authentication: set dot1x key-tx {enable | disable} Key transmission is enabled by default. The WSS sends EAPoL key messages after successfully authenticating the supplicant (client) and receiving authorization attributes for the client.
PAGE 577
Managing 802.1X on the WSS 577 Configuring 802.1X key transmission time intervals The following command sets the number of seconds the WSS waits before retransmitting an EAPoL packet of key information: set dot1x tx-period seconds The default is 5 seconds. The range for the retransmission interval is from 1 to 65,535 seconds. For example, type the following command to set the retransmission interval to 300 seconds: WSS# set dot1x tx-period 300 success: dot1x tx-period set to 300.
PAGE 578
Managing 802.1X on the WSS Managing WEP keys Wired-Equivalent Privacy (WEP) is part of the system security of 802.1X. WSS Software uses WEP to provide confidentiality to packets as they are sent over the air. WEP operates on the AP. WEP uses a secret key shared between the communicators. WEP rekeying increases the security of the network. New unicast keys are generated every time a client performs 802.1X authentication. The rekeying process can be performed automatically on a periodic basis.
PAGE 579
Managing 802.1X on the WSS 579 Setting EAP retransmission attempts The following command sets the maximum number of times the WSS retransmits an 802.1X-encapsulated EAP request to the supplicant (client) before it times out the authentication session: set dot1x max-req number-of-retransmissions The default number of retransmissions is 2. You can specify from 0 to 10 retransmit attempts.
PAGE 580
Managing 802.1X on the WSS Enabling and disabling 802.1X reauthentication The following command enables or disables the reauthentication of supplicants (clients) by the WSS: set dot1x reauth {enable | disable} Reauthentication is enabled by default. Type the following command to reenable reauthentication of clients: WSS# set dot1x reauth enable success: dot1x reauthentication enabled. NN47250-500 (320657-F Version 02.
PAGE 581
Managing 802.1X on the WSS 581 Setting the maximum number of 802.1X reauthentication attempts The following command sets the number of reauthentication attempts that the WSS makes before the supplicant (client) becomes unauthorized: set dot1x reauth-max number-of-attempts The default number of reauthentication attempts is 2. You can specify from 1 to 10 attempts.
PAGE 582
Managing 802.1X on the WSS Setting the 802.1X reauthentication period The following command configures the number of seconds that the WSS waits before attempting reauthentication: set dot1x reauth-period seconds The default is 3600 seconds (1 hour). The range is from 60 to 1,641,600 seconds (19 days). This value can be overridden by user authorization parameters. WSS Software reauthenticates dynamic WEP clients based on the reauthentication timer.
PAGE 583
Managing 802.1X on the WSS 583 Setting the bonded authentication period The following command sets the Bonded Authentication (bonded authentication) period, which is the number of seconds WSS Software retains session information for an authenticated machine while waiting for the 802.1X client on the machine to start (re)authentication for the user.
PAGE 584
Managing 802.1X on the WSS Setting the 802.1X quiet period The following command configures the number of seconds a WSS remains quiet and does not respond to a supplicant (client) after a failed authentication: set dot1x quiet-period seconds The default is 60 seconds. The acceptable range is from 0 to 65,535 seconds. For example, type the following command to set the quiet period to 300 seconds: WSS# set dot1x quiet-period 300 success: dot1x quiet period set to 300.
PAGE 585
Managing 802.1X on the WSS 585 Setting the 802.1X timeout for an authorization server Use this command to configure the number of seconds before the WSS times out a request to a RADIUS authorization server. set dot1x timeout auth-server seconds The default is 30 seconds. The range is from 1 to 65,535 seconds. For example, type the following command to set the authorization server timeout to 60 seconds: WSS# set dot1x timeout auth-server 60 success: dot1x auth-server timeout set to 60.
PAGE 586
Managing 802.1X on the WSS Setting the 802.1X timeout for a client Use the following command to set the number of seconds before the WSS times out an authentication session with a supplicant (client): set dot1x timeout supplicant seconds The default is 30 seconds. The range of time is from 1 to 65,535 seconds. For example, type the following command to set the number of seconds for a timeout to 300: WSS# set dot1x timeout supplicant 300 success: dot1x supplicant timeout set to 300.
PAGE 587
Managing 802.1X on the WSS 587 Viewing 802.1X clients Type the following command to display active 802.
PAGE 588
Managing 802.1X on the WSS Viewing the 802.1X configuration Type the following command to display the 802.1X configuration: WSS# show dot1x config 802.1X user policy ---------------------'EXAMPLE\pc1' on ssid 'mycorp' doing EAP-PEAP (EAP-MSCHAPv2) 'EXAMPLE\bob' on ssid 'mycorp' doing EAP-PEAP (EAP-MSCHAPv2) (bonded) 802.
PAGE 589
Managing 802.1X on the WSS 589 Viewing 802.1X statistics Type the following command to display 802.1X statistics about connecting and authenticating: WSS# show dot1x stats 802.
PAGE 590
Managing 802.1X on the WSS NN47250-500 (320657-F Version 02.
PAGE 591
Configuring SODA endpoint security for a WSS About SODA endpoint security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591 Configuring SODA functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594 Sygate On-Demand (SODA) is an endpoint security solution that allows enterprises to enforce security policies on client devices without having to install any special software on the client machines.
PAGE 592
Configuring SODA endpoint security for a WSS • Connection Control – Controls network connections based on Domain, IP address, Port, and Service. For example, Connection Control can prevent a Trojan from sending out a confidential document, downloaded legitimately through an SSL VPN tunnel, to a malicious e-mail server (SMTP) using a second network tunnel.
PAGE 593
Configuring SODA endpoint security for a WSS 593 SODA endpoint security support on WSSs WSSs support SODA endpoint security functionality in the following ways: • SODA agent applets can be uploaded to a WSS, stored there, and downloaded by clients attempting to connect to the network. • The WSS can ensure that clients run the SODA agent security checks successfully prior to allowing them access to the network.
PAGE 594
Configuring SODA endpoint security for a WSS How SODA functionality works on WSSs This section describes how the SODA functionality is configured to work with a WSS, and the procedure that takes place when a user attempts to connect to an SSID where the SODA functionality is enabled. Note that in the current release, the SODA functionality works only in conjunction with the Web Portal Web-based AAA feature.
PAGE 595
Configuring SODA endpoint security for a WSS 595 1 Configure Web Portal Web-based AAA for the service profile. See “Configuring Web Portal Web-based AAA for the service profile” (page 596). 2 Using SODA manager, create the SODA agent. See “Creating the SODA agent with SODA manager” (page 597). 3 Copy the SODA agent to the WSS. “Copying the SODA agent to the WSS” (page 598) 4 Install the SODA agent files in a directory on the WSS. See “Installing the SODA agent files on the WSS” (page 599).
PAGE 596
Configuring SODA endpoint security for a WSS Configuring Web Portal Web-based AAA for the service profile In the current release, SODA functionality works in conjunction with the Web Portal AAA feature. Consequently, Web Portal AAA must be enabled for the service profile for which you want to configure SODA functionality. See “Configuring Web portal Web-based AAA” (page 501) for information on configuring this feature. NN47250-500 (320657-F Version 02.
PAGE 597
Configuring SODA endpoint security for a WSS 597 Creating the SODA agent with SODA manager Sygate On-Demand Manager (SODA Manager) is a Windows application used for configuring security policies based on locations, and for creating agents that enforce those security policies. For information on how to use SODA Manager to create security policies, see the documentation that came with the product.
PAGE 598
Configuring SODA endpoint security for a WSS Copying the SODA agent to the WSS After creating the SODA agent with SODA manager, you copy the .zip file to the WSS using TFTP. For example, the following command copies the soda.ZIP file from a TFTP server to the WSS: WSS# copy tftp://172.21.12.247/soda.ZIP soda.ZIP ....................................success: received 2912917 bytes in 11.230 seconds [ 259387 bytes/sec] success: copy complete. NN47250-500 (320657-F Version 02.
PAGE 599
Configuring SODA endpoint security for a WSS 599 Installing the SODA agent files on the WSS After copying the .zip file containing the SODA agent files to the WSS, you install the SODA agent files into a directory using the following command: install soda agent agent-file agent-directory directory This command creates the specified directory, unzips the specified agent-file and places the contents of the file into the directory.
PAGE 600
Configuring SODA endpoint security for a WSS Enabling SODA functionality for the service profile To enable SODA functionality for a service profile, use the following command: set service-profile name soda mode {enable | disable} When SODA functionality is enabled for a service profile, a SODA agent is downloaded to clients attempting to connect to an AP managed by the service profile. The SODA agent performs a series of security-related checks on the client.
PAGE 601
Configuring SODA endpoint security for a WSS 601 Disabling enforcement of SODA agent checks When SODA functionality is enabled for a service profile, by default the SODA agent checks are downloaded to a client and run before the client is allowed on the network. You can optionally disable the enforcement of the SODA security checks, so that the client is allowed access to the network immediately after the SODA agent is downloaded, rather than waiting for the security checks to be run.
PAGE 602
Configuring SODA endpoint security for a WSS Specifying a SODA agent success page When a client successfully runs the checks performed by the SODA agent, by default a dynamically generated page is displayed on the client indicating that the checks succeeded. You can optionally create a custom success page that is displayed on the client instead of the dynamically generated one.
PAGE 603
Configuring SODA endpoint security for a WSS 603 Specifying a SODA agent failure page When the SODA agent checks fail, by default a dynamically generated page is displayed on the client indicating that the checks failed. You can optionally create a custom failure page that is displayed on the client instead of the dynamically generated one.
PAGE 604
Configuring SODA endpoint security for a WSS Specifying a remediation ACL If the SODA agent checks fail on a client, by default the client is disconnected from the network. Optionally, you can specify a failure page for the client to load (with the set service-profile soda failure-page command, described above). You can optionally specify a remediation ACL to apply to the client when the failure page is loaded.
PAGE 605
Configuring SODA endpoint security for a WSS 605 Specifying a SODA agent logout page When a client closes the SODA virtual desktop, the client is automatically disconnected from the network. You can optionally specify a page that is loaded when the client logs out of the network.
PAGE 606
Configuring SODA endpoint security for a WSS Specifying an alternate SODA agent directory for a service profile By default, the WSS expects SODA agent files for a service profile to be located in a directory with the same name as the SSID configured for the service profile. You can optionally specify a different directory for the SODA agent files used for a service profile.
PAGE 607
Configuring SODA endpoint security for a WSS 607 Uninstalling the SODA agent files from the WSS To remove the directory on the WSS that contains SODA agent files, use the following command: uninstall soda agent agent-directory directory This command removes the SODA agent directory and all of its contents. All files in the specified directory are removed. The command removes the directory and its contents, regardless of whether it contains SODA agent files.
PAGE 608
Configuring SODA endpoint security for a WSS Displaying SODA configuration information To view information about the SODA configuration for a service profile, use the show service profile command. The following is an example of the output of the show service profile command for service profile sp1. In the example, the fields related to SODA functionality are highlighted in bold.
PAGE 609
Managing sessions About the session manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 Displaying and clearing administrative sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 Displaying and clearing network sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 613 Displaying and changing network session timers . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 610
Managing sessions Displaying and clearing all administrative sessions To view information about the sessions of all administrative users, type the following command: WSS# show sessions admin Tty Username Time (s) ------- ------------------------tty0 3644 tty2 tech 6 tty3 sshadmin 381 Type --------------Console Telnet SSH 3 admin sessions To clear the sessions of all administrative users, type the following command: WSS# clear sessions admin This will terminate manager sessions, do you wish to conti
PAGE 611
Managing sessions 611 Displaying and clearing an administrative console session To view information about the user with administrative access to the WSS through a console plugged into the switch, type the following command: WSS# show sessions console Tty Username Time (s) Type ------- ----------------------- -------tty0 5310 Console 1 console session To clear the administrative sessions of a console user, type the following command: WSS# clear sessions console This will terminate manager sessions, do you
PAGE 612
Managing sessions Displaying and clearing administrative Telnet sessions To view information about administrative Telnet sessions, type the following command: WSS# show sessions telnet Tty Username Time (s) Type ------- -------------------- -------- ---tty3 sshadmin 2099 SSH 1 telnet session To clear the administrative sessions of Telnet users, type the following command: WSS# clear sessions telnet This will terminate manager sessions, do you wish to continue? (y|n) [y]y NN47250-500 (320657-F Versio
PAGE 613
Managing sessions 613 Displaying and clearing client Telnet sessions To view administrative sessions of Telnet clients, type the following command: WSS# show sessions telnet client Session Server Address Server Port Client Port ---------------------------------------------0 192.168.1.81 23 48000 1 10.10.1.
PAGE 614
Managing sessions Note. Authorization attribute values can be changed during authorization. If the values are changed, show sessions output shows the values that are actually in effect following any changes. NN47250-500 (320657-F Version 02.
PAGE 615
Managing sessions 615 Displaying verbose network session information In the show sessions network commands, you can specify verbose to get more in-depth information. For example, to display detailed information for all network sessions, type the following command: WSS# show sessions network verbose User Name Sess IP or MAC ID Address VLAN Name Port/Radio ----------------------------------------------------------------------------------------EXAMPLE\wrong 5* 192.168.12.
PAGE 616
Managing sessions Displaying and clearing network sessions by username You can view sessions by a username or user wildcard. (For a definition of user wildcards and their format, see “User wildcards” (page 47).
PAGE 617
Managing sessions 617 Displaying and clearing network sessions by MAC address You can view sessions by MAC address or MAC address wildcard. (For a definition of MAC address wildcards and their format, see “MAC address wildcards” (page 47).
PAGE 618
Managing sessions Displaying and clearing network sessions by VLAN name You can view all session information for a specific VLAN or VLAN wildcard. (For a definition of VLAN wildcards and their format, see “VLAN wildcards” (page 48).
PAGE 619
Managing sessions 619 Displaying and clearing network sessions by session ID You can display information about a session by session ID. To find local session IDs, enter the show sessions command. You can view more detailed information for an individual session, including authorization parameters and, for wireless sessions, packet and radio statistics.
PAGE 620
Managing sessions Packets Bytes Rx Unicast 46309 7218167 Rx Multicast 1461 53269 Rx Encrypt Err 0 0 Tx Unicast 48828 6674559 Queue Tx Packets Tx Dropped Re-Transmit Background 79 0 0 BestEffort 3495 0 58 Video 0 0 0 Voice 43972 0 975 (For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.) The verbose option is not available with the show sessions network session-id command.
PAGE 621
Managing sessions 621 period of the idle timer, WSS Software changes the client’s session to the Disassociated state. The default idle timeout value is 180 seconds (3 minutes). You can change the timeout to a value from 20 to 86400 seconds. To disable the timeout, specify 0. Keepalive probes and the user idle timeout are configurable on a service-profile basis. Note. WSS Software temporarily keeps session information for disassociated web-portal clients to allow them time to reassociate after roaming.
PAGE 622
Managing sessions Disabling keepalive probes To disable or reenable keepalive probes in a service profile, use the following command: set service-profile name idle-client-probing {enable | disable} NN47250-500 (320657-F Version 02.
PAGE 623
Managing sessions 623 Changing or disabling the user idle timeout To change the user idle timeout for a service profile, use the following command: set service-profile name user-idle-timeout seconds For example, to change the user idle timeout for service profile sp1 to 6 minutes (360 seconds), use the following command: WSS# set service-profile sp1 user-idle-timeout 360 success: change accepted.
PAGE 624
Managing sessions NN47250-500 (320657-F Version 02.
PAGE 625
Rogue detection and counter measures About rogues and RF detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625 Summary of rogue detection features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630 Configuring rogue detection lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 631 Enabling countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 626
Rogue detection and counter measures Rogue classification When WSS Software detects a third-party wireless device that is not allowed on the network, WSS Software classifies the device as one of the following: • Rogue—The device is in the Nortel network but does not belong there. • Interfering device—The device is not part of the Nortel network but also is not a rogue.
PAGE 627
Rogue detection and counter measures 627 All the lists except the black list require manual configuration. You can configure entries in the black list and WSS Software also can place a client in the black list due to an association, reassociation or disassociation flood from the client. The rogue classification algorithm examines each of these lists when determining whether a device is a rogue. Figure 1 shows how the rogue detection algorithm uses the lists.
PAGE 628
Rogue detection and counter measures Figure 1. Rogue detection algorithm AP radio detects wireless packet. Source MAC in Ignore List? No SSID in Permitted SSID List? No Yes Yes OUI in Permitted Vendor List? No Generate an alarm. Yes Classify device as a rogue. Issue countermeasures (if enabled). Source MAC in Attack List? Yes No Rogue classification algorithm deems the device to be a rogue? No Device is not a threat. NN47250-500 (320657-F Version 02.
PAGE 629
Rogue detection and counter measures 629 RF detection scans All radios continually scan for other RF transmitters. Radios perform passive scans and active scans: • Passive scans—The radio listens for beacons and probe responses. • Active scans—The radio sends probe any requests (probe requests with a null SSID name) to solicit probe responses from other access points. Passive scans are always enabled and cannot be disabled.
PAGE 630
Rogue detection and counter measures Countermeasures are disabled by default. You can enable them on an individual radio-profile basis. When you enable them, all devices of interest that are not in the known devices list become viable targets for countermeasures. Countermeasures can be enabled against all rogue and interfering devices, against rogue devices only, or against devices explicitly configured in the WSS’s attack list.
PAGE 631
Rogue detection and counter measures 631 Table 1.Rogue detection features (continued) Applies To Rogue Detection Feature Description Third-Party APs Clients Attack list List of AP MAC addresses to attack. WSS Software can issue countermeasures against these APs whenever they are detected on the network. Yes No Ignore list List of MAC addresses to ignore Yes during RF detection.
PAGE 632
Rogue detection and counter measures By default, the permitted vendor list is empty and all vendors are allowed. If you configure a permitted vendor list, WSS Software allows only the devices whose OUIs are on the list. The permitted vendor list applies only to the WSS on which the list is configured. WSSs do not share permitted vendor lists.
PAGE 633
Rogue detection and counter measures 633 indicates that the device is using an allowed SSID. However, to cause WSS Software to stop classifying the device as a rogue, you must add the device’s MAC address to the ignore list. To add an SSID to the list, use the following command: set rfdetect ssid-list ssid-name The following command adds SSID mycorp to the list of permitted SSIDs: WSS# set rfdetect ssid-list mycorp success: ssid mycorp is now in ssid-list.
PAGE 634
Rogue detection and counter measures To display the client black list, use the following command: show rfdetect black-list The following example shows the client black list on a WSS: WSS# show rfdetect black-list Total number of entries: 1 Blacklist MAC Type Port TTL ----------------- ----------------- ------- --11:22:33:44:55:66 configured 11:23:34:45:56:67 assoc req flood 3 25 To remove a MAC address from the client black list, use the following command: clear rfdetect black-list mac-addr The follo
PAGE 635
Rogue detection and counter measures 635 Total number of entries: 1 Attacklist MAC Port/Radio/Chan RSSI SSID ----------------- ----------------- ------ -----------11:22:33:44:55:66 ap 2/1/11 -53 rogue-ssid To remove a MAC address from the attack list, use the following command: clear rfdetect attack-list mac-addr The following command clears MAC address 11:22:33:44:55:66 from the attack list: WSS# clear rfdetect attack-list 11:22:33:44:55:66 success: 11:22:33:44:55:66 is no longer in attacklist.
PAGE 636
Rogue detection and counter measures Total number of entries: 2 Ignore MAC ----------------aa:bb:cc:11:22:33 aa:bb:cc:44:55:66 Enabling countermeasures Caution! Countermeasures affect wireless service on a radio. When an AP radio is sending countermeasures, the radio is disabled for use by network traffic, until the radio finishes sending the countermeasures. Countermeasures are disabled by default. You can enable them on an individual radio profile basis.
PAGE 637
Rogue detection and counter measures 637 Using on-demand countermeasures in a Mobility Domain If you are using on-demand countermeasures in a Mobility Domain, you should enable the feature and synchronize the attack lists on all the WSSs in the Mobility Domain. This ensures a WSS attacks devices in its attack list, rather than devices that may be specified in the attack lists of other WSSs in the Mobility Domain, which could produce unexpected results.
PAGE 638
Rogue detection and counter measures Disabling or reenabling logging of rogues By default, a WSS generates a log message when a rogue is detected or disappears. To disable or reenable the log messages, use the following command: set rfdetect log {enable | disable} To display log messages on a switch, use the following command: show log buffer (This command has optional parameters. For complete syntax information, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.
PAGE 639
Rogue detection and counter measures 639 DoS attacks When Scheduled RF Scanning is enabled on APs, WSS Software can detect the following types of DoS attacks: • RF Jamming—The goal of an RF jamming attack is to take down an entire WLAN by overwhelming the radio environment with high-power noise. A symptom of an RF jamming attack is excessive interference. If an AP radio detects excessive interference on a channel, and Auto-RF is enabled, WSS Software changes the radio to a different channel.
PAGE 640
Rogue detection and counter measures Wireless bridge A wireless bridge can extend a wireless network outside the desired area. For example, someone can place a wireless bridge near an exterior wall to extend wireless coverage out into the parking lot, where a hacker could then gain access to the network. Ad-Hoc network An ad-hoc network is established directly among wireless clients and does not use the infrastructure network (a network using an AP).
PAGE 641
Rogue detection and counter measures 641 IDS log message examples Table 2 shows examples of the log messages generated by IDS. Table 2.IDS and DoS log messages Message Type Example Log Message Probe message flood Client aa:bb:cc:dd:ee:ff is sending probe message flood. Seen by AP on port 2, radio 1 on channel 11 with RSSI -53. Authentication message flood Client aa:bb:cc:dd:ee:ff is sending authentication message flood. Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
PAGE 642
Rogue detection and counter measures Table 2.IDS and DoS log messages (continued) Message Type Example Log Message Fake AP SSID (when FakeAP SSID attack detected from aa:bb:cc:dd:ee:ff. source MAC address is Seen by AP on port 2, radio 1 on channel 11 with RSSI -53 SSID myssid. known) Fake AP SSID (when FakeAP BSSID attack detected. source MAC address is Seen by AP on port 2, radio 1 on channel 11 with RSSI -53 SSID myssid.
PAGE 643
Rogue detection and counter measures 643 Displaying RF detection information You can use the CLI commands listed in Table 3 to display rogue detection information. Table 3.Rogue detection show commands Command Description show rfdetect clients [mac mac-addr] Displays all wireless clients detected on the air. show rfdetect counters Displays statistics for rogue and Intrusion Detection System (IDS) activity detected by the APs managed by a WSS.
PAGE 644
Rogue detection and counter measures Table 3.Rogue detection show commands (continued) Command Description show rfdetect attack-list Displays the list of wireless devices that you want APs to attack with countermeasures. (See “Configuring an attack list” (page 634).) show rfdetect ignore Displays the BSSIDs of third-party devices that WSS Software ignores during RF detection scans. (See “Configuring an ignore list” (page 635).
PAGE 645
Rogue detection and counter measures 645 Displaying rogue detection counters To display rogue detection statistics counters, use the following command: show rfdetect counters The command shows counters for rogue activity detected by the WSS on which you enter the command. WSS# show rfdetect counters Type Current Total -------------------------------------------------- ------------ -----------Rogue access points 0 0 Interfering access points 139 1116 Rogue 802.11 clients 0 0 Interfering 802.
PAGE 646
Rogue detection and counter measures Displaying SSID or BSSID information for a Mobility Domain To display SSID or BSSID information for an entire Mobility Domain, use the following command on the seed switch: show rfdetect mobility-domain [ssid ssid-name | bssid mac-addr] The following command displays summary information for all SSIDs and BSSIDs detected in the Mobility Domain: WSS# show rfdetect mobility-domain Total number of entries: 194 Flags: i = infrastructure, a = ad-hoc, u = unresolved c =
PAGE 647
Rogue detection and counter measures 647 In this example, two BSSIDs are mapped to the SSID. Separate sets of information are shown for each of the BSSIDs, and information about the listeners for each BSSID is shown. The following command displays detailed information for a BSSID. WSS# show rfdetect mobility-domain bssid 00:0b:0e:00:04:d1 BSSID: 00:0b:0e:00:04:d1 Vendor: Cisco SSID: notmycorp Type: rogue Adhoc: no Crypto-types: clear WSS-IPaddress: 10.8.121.
PAGE 648
Rogue detection and counter measures WSS# show rfdetect visible ap 3 radio 1 Total number of entries: 104 Flags: i = infrastructure, a = ad-hoc c = CCMP, t = TKIP, 1 = 104-bit WEP, 4 = 40-bit WEP, w = WEP(non-WPA) Transmit MAC Vendor Type Ch RSSI Flags SSID ----------------- ------- ----- --- ---- ------ -------------------------------00:07:50:d5:cc:91 Cisco intfr 6 -60 i----w r27-cisco1200-2 00:07:50:d5:dc:78 Cisco intfr 6 -82 i----w r116-cisco1200-2 00:09:b7:7b:8a:54 Cisco intfr 2 -54 i----00:0a:5e:4b
PAGE 649
Rogue detection and counter measures 649 Testing the RFPing The "rfping" command provides information about the RF link between the WSS and the client based on sending test packets to the client. The output of the command indicates the number of test packets received and acknowledged by the client as well as the client's signal strength and signal-to-noise ratio. The command is executed from the CLI superuser prompt.
PAGE 650
Rogue detection and counter measures NN47250-500 (320657-F Version 02.
PAGE 651
Managing system files About system files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651 Working with files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653 Managing configuration files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 Backing up and restoring the system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 652
Managing system files Displaying software version information To display the software, firmware, and hardware versions, use the following command: show version [details] The details option displays hardware and software information about the APs configured on the WSS. To display version information for a WSS, type the following command: WSS# show version Wireless Security Software, Version: 5.0.7.0 QA 20 Copyright (c) 2005 - 2006 Nortel. All rights reserved.
PAGE 653
Managing system files 653 (For additional information about the output, see the Nortel WLAN—Security Switch 2300 Series Command Line Reference.) Displaying boot information Boot information consists of the WSS Software version and the names of the system image file and configuration file currently running on the WSS. The boot command also lists the system image and configuration file that will be loaded after the next reboot. The currently running versions are listed in the Booted fields.
PAGE 654
Managing system files • Temporary—Contains log files and other files created by WSS Software The file and boot areas are in nonvolatile storage. Files in nonvolatile storage remain in storage following a software reload or power cycle. The files in the temporary area are removed following a software reload or power cycle. The boot area is divided into two partitions, boot0 and boot1. Each partition can contain one system image file. The file area can contain subdirectories.
PAGE 655
Managing system files 655 file:sysa_bak 12 KB Mar 15 2005, 19:18:44 file:testback 28 KB Apr 19 2005, 16:37:18 Total: 159 Kbytes used, 207663 Kbytes free The following command limits the output to the contents of the /tmp/core subdirectory: WSS# dir core: ============================================================================== = file: Filename Size Created core:command_audit.
PAGE 656
Managing system files The tmp:filename URL refers to a file in temporary storage. You can copy a file out of temporary storage but you cannot copy a file into temporary storage. The subdirname/ option specifies a subdirectory. If you are copying a system image file into nonvolatile storage, the destination-url must include the boot partition name.
PAGE 657
Managing system files 657 To copy file corpa-login.html from a TFTP server into subdirectory corpa in a WSS’s nonvolatile storage, type the following command: WSS# copy tftp://10.1.1.1/corpa-login.html corpa/corpa-login.html success: received 637 bytes in 0.
PAGE 658
Managing system files Note. WSS Software does not allow you to delete the currently running software image file or the running configuration. To delete a file, use the following command: delete url The URL can be a filename of up to 128 alphanumeric characters. To copy a file named testconfig to a TFTP server and delete the file from nonvolatile storage, type the following commands: WSS# copy testconfig tftp://10.1.1.1/testconfig success: sent 365 bytes in 0.
PAGE 659
Managing system files 659 Boot0: Total: 8928 Kbytes used, 3312 Kbytes free Boot1: Total: 8197 Kbytes used, 4060 Kbytes free =============================================================================== temporary files: Filename Size Created Total: 0 bytes used, 93537 Kbytes free Removing a subdirectory To remove a subdirectory from nonvolatile storage, use the following command: rmdir [subdirname] To remove subdirectory corp2, type the following example: WSS# rmdir corp2 success: change accepted.
PAGE 660
Managing system files set ip dns server 10.20.10.69 SECONDARY set ip route default 10.8.1.1 1 set log console disable severity debug set log session disable severity alert set log buffer enable severity error messages 200 set log trace disable severity error mbytes 10 set log server 192.168.253.
PAGE 661
Managing system files 661 To save the running configuration to the file loaded the last time the software was rebooted, type the following command: WSS# save config success: configuration saved. To save the running configuration to a file named newconfig, type the following command: WSS# save config newconfig success: configuration saved to newconfig.
PAGE 662
Managing system files Specifying a backup configuration file In the event that part of the configuration file is invalid or otherwise unreadable, WSS Software stops reading information in the configuration file and does not use it. You can optionally specify a backup file to load if WSS Software cannot load the original configuration file. To specify a backup configuration file, use the following command: set boot backup-configuration filename To specify a file called backup.
PAGE 663
Managing system files 663 files do not match, WSS Software does not restart the WSS but instead displays a message advising you to either save the configuration changes or use the force option.
PAGE 664
Managing system files The backup command stores the MAC address of the switch in the archive. By default, the restore command works only if the MAC address in the archive matches the MAC address of the switch where the restore command is entered. The force option overrides this restriction and allows you to unpack one switch’s archive onto another switch. Caution! Do not use the force option unless advised to do so by Nortel TAC.
PAGE 665
Managing system files 665 The following command restores system-critical files on a switch, from archive sysa_bak: WSS# restore system tftp:/10.10.20.9/sysa_bak success: received 11908 bytes in 0.150 seconds [ 79386 bytes/sec] success: restore complete. Upgrading the system image To upgrade the WSS from one WSS Software version to another, use the procedure in this section. For a given release, there may be notes and cautions that apply only to that release.
PAGE 666
Managing system files Upgrading an individual switch using the CLI 1 Save the configuration, using the save config command. 2 Back up the switch, using the backup system command. 3 Copy the new system image onto a TFTP server. For example, log on to http://www.nortel.com/support using a web browser on your TFTP server and download the image onto the server. 4 Copy the new system image file from the TFTP server into a boot partition in the switch’s nonvolatile storage.
PAGE 667
Managing system files 667 success: Boot partition set to boot1:NT504105.001 <4.1.5.1>. WSS# show boot Configured boot version: 5.0.5.1 Configured boot image: boot1:NT504105.001 Configured boot configuration: file:configuration Backup boot configuration: backup Booted version: 5.0.4.6 Booted image: boot0:NT504105.001 Booted configuration: file:configuration Product model: 2360/2361 WSS# reset system This will reset the entire system. Are you sure (y/n) y ...... rebooting ......
PAGE 668
Managing system files NN47250-500 (320657-F Version 02.
PAGE 669
Appendix A: Troubleshooting a WSS Fixing common WSS setup problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670 Recovering the system when the enable password is lost . . . . . . . . . . . . . . . . . . . . . 671 Configuring and managing the system log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672 Running traces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679 Using show commands . . . .
PAGE 670
Appendix A:Troubleshooting a WSS Fixing common WSS setup problems Table 1 contains remedies for some common problems that can occur during basic installation and setup of a WSS. Table 1: WSS setup problems and remedies Symptom Diagnosis Remedy WLAN Management Software or a web browser (if you are using Web View) warns that the WSS’s certificate date is invalid. The switch’s time and date are 1.
PAGE 671
Appendix A:Troubleshooting a WSS 671 Table 1: WSS setup problems and remedies (continued) Symptom Diagnosis Remedy Configuration information The configuration changes disappears after a software were not saved. reload. 1. Retype the commands for the missing configuration information. 2. Type the save config command to save the changes. Mgmt LED is quickly blinking amber. CLI stops at boot prompt (boot>). Type the boot command at the boot prompt. The WSS was unable to load the system image file.
PAGE 672
Appendix A:Troubleshooting a WSS Figure 1. WSS restart switch location Rst 100-240V 50/60 Hz 8A MAX Mgmt Console 21 DISCONNECT ALL POWER BEFORE SERVICING 22 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 Link AP Link AP 2 When you see descending numbers on the console, press q, then press Enter.
PAGE 673
Appendix A:Troubleshooting a WSS 673 Log message components Each log message contains the following components: Field Description Facility Portion of WSS Software that is affected Date Time and date the message is generated Severity Severity level of the message. (See Table 3: “Event severity levels” on page 674.
PAGE 674
Appendix A:Troubleshooting a WSS Table 3: Event severity levels Severity Description emergency The WSS is unusable. alert Action must be taken immediately. critical You must resolve the critical conditions. If the conditions are not resolved, the WSS can reboot or shut down. error The WSS is missing data or is unable to form a connection. warning A possible problem exists. notice Events that potentially can cause system problems have occurred. These are logged for diagnostic purposes.
PAGE 675
Appendix A:Troubleshooting a WSS 675 Logging to the log buffer The system log consists of rolling entries stored as a last-in first-out queue maintained by the WSS. Logging to the buffer is enabled by default for events at the error level and higher.
PAGE 676
Appendix A:Troubleshooting a WSS Logging to the console By default, console logging is enabled and messages at the error level and higher are sent to the console. To modify console logging, use the following command: set log console severity severity-level (See Table 3 on page 674 for information on severity levels.
PAGE 677
Appendix A:Troubleshooting a WSS 677 Setting Telnet session defaults Session logging is disabled by default, and the event level is set to information (info) or higher. To enable event logging to Telnet sessions and change the default event severity level, use the following command: set log sessions severity severity-level enable (For information on severity levels, see Table 3 on page 674.
PAGE 678
Appendix A:Troubleshooting a WSS Mark messages are disabled by default. When they are enabled, WSS Software generates a message at the notice level once every 300 seconds by default. To enable mark messages, use the following command: WSS# set log mark enable success: change accepted.
PAGE 679
Appendix A:Troubleshooting a WSS 679 Running traces Trace commands enable you to perform diagnostic routines. You can set a trace command with a keyword, such as authentication or sm, to trace activity for a particular feature, such as authentication or the session manager. Caution! Using the set trace command can have adverse effects on system performance. Nortel recommends that you use the lowest levels possible for initial trace commands, and slowly increase the levels to get the data you need.
PAGE 680
Appendix A:Troubleshooting a WSS Tracing 802.1X sessions Tracing 802.1X sessions can help diagnose problems with wireless clients. For example, to trace 802.1X activity for user tamara@example.com at level 4, type the following command: WSS# set trace dot1x user tamara@example.com level 4 success: change accepted. Displaying a trace Use the show trace command to show the trace areas that are enabled.
PAGE 681
Appendix A:Troubleshooting a WSS 681 If you attempt to send trace output to a Telnet session, be aware that tracing is disabled for areas processing packets that might be associated with the Telnet session.
PAGE 682
Appendix A:Troubleshooting a WSS Clearing the trace log To clear all messages from the trace log buffer, type the following command: WSS# clear log trace List of trace areas To see all WSS Software areas you can trace, type the following command: WSS# set trace? Using show commands To troubleshoot the WSS, you can use show commands to display information about different areas of the WSS Software.
PAGE 683
Appendix A:Troubleshooting a WSS 683 SQA: SQA2BServer set authentication dot1x *@xmpl.com pass-through sg1 set authentication dot1x *@xmpl.
PAGE 684
Appendix A:Troubleshooting a WSS 10.8.1.1 10.8.107.1 00:30:b6:3e:5c:a8 1 DYNAMIC RESOLVED 00:0b:0e:00:04:0c 1 LOCAL RESOLVED (For more information about ARP, see “Managing the ARP table” (page 144).) Port mirroring Port mirroring is a troubleshooting feature that copies (mirrors) traffic sent or received by a WSS port (the source port) to another WSS port (the observer). You can attach a protocol analyzer to the observer port to examine the source port’s traffic.
PAGE 685
Appendix A:Troubleshooting a WSS 685 Remotely monitoring traffic Remote traffic monitoring enables you to snoop wireless traffic, by using a AP as a sniffing device. The AP copies the sniffed 802.11 packets and sends the copies to an observer, which is typically a protocol analyzer such as Ethereal or Tethereal. How remote traffic monitoring works To monitor wireless traffic, an AP radio compares traffic sent or received on the radio to snoop filters applied to the radio by the network administrator.
PAGE 686
Appendix A:Troubleshooting a WSS To inform you of this condition, WSS Software generates a log message such as the following the first time an ICMP error message is received following the start of a snoop filter: AP Mar 25 13:15:21.681369 ERROR AP 3 ap_network: Observer 10.10.101.2 is not accepting TZSP packets To prevent ICMP error messages from the observer, Nortel recommends using the Netcat application on the observer to listen to UDP packets on the TZSP port.
PAGE 687
Appendix A:Troubleshooting a WSS 687 The snap-length num option specifies the maximum number of bytes to capture. If you do not specify a length, the entire packet is copied and sent to the observer. Nortel recommends specifying a snap length of 100 bytes or less. The following command configures a snoop filter named snoop1 that matches on all traffic, and copies the traffic to the device that has IP address 10.10.30.2: WSS# set snoop snoop1 observer 10.10.30.
PAGE 688
Appendix A:Troubleshooting a WSS Mapping a snoop filter to a radio You can map a snoop filter to a radio on a AP. To map a snoop filter to a radio, use the following command: set snoop map filter-name ap ap-num radio {1 | 2} You can map the same filter to more than one radio. You can map up to eight filters to the same radio. If more than one filter has the same observer, the AP sends only one copy of a packet that matches a filter to the observer.
PAGE 689
Appendix A:Troubleshooting a WSS 689 To remove all snoop filter mappings from all radios, use the following command: clear snoop map all Enabling or disabling a snoop filter A snoop filter does not take effect until you enable it. To enable or disable a snoop filter, use the following command: set snoop {filter-name | all} mode {enable | disable} Note. The filter mode is retained even if you disable and reenable the radio, or restart the AP or the WSS.
PAGE 690
Appendix A:Troubleshooting a WSS If the observer is a PC, you can use a Tcl script instead of Netcat if preferred. 1 Install the required software on the observer. 2 Configure and map snoop filters in WSS Software. 3 Start Netcat: ● On Linux, use a command such as the following: nc -l -u -p 37008 ip-addr > /dev/null & ● On Windows, use the following command: netcat -l -u -p 37008 -v -v Where ip-addr is the IP address of the AP to which the snoop filter is mapped.
PAGE 691
Appendix A:Troubleshooting a WSS 691 The following sections show how to gather system information and send it to NETS. The show tech-support command The show tech-support command combines a group of show commands to provide an in-depth snapshot of the status of the WSS. The output displays details about the system image and configuration used after the last reboot, the version, ports, AAA settings, and other configuration values, and the last 100 log messages.
PAGE 692
Appendix A:Troubleshooting a WSS In this example, the core file is netsys.core.217.tar. (The command_audit.cur file is not a core file and is created as part of normal system operation.) The following command copies the core file onto a TFTP server. WSS# copy core:netsys.core.217.tar tftp://192.168.0.233/netsys.core.217.tar ...........success: sent 573440 bytes in 1.431 seconds [ 400726 bytes/sec] success: copy complete.
PAGE 693
Appendix A:Troubleshooting a WSS 693 Sending information to NETS After you save the show tech-support output, as well as core files and debug messages (if applicable), you can send them to NETS. Nortel has an external FTP server for use by customers to upload WSS Software debugging information, WLAN Management Software plans, and core dumps relating to active cases in NETS.
PAGE 694
Appendix A:Troubleshooting a WSS NN47250-500 (320657-F Version 02.
PAGE 695
Appendix A: Enabling and logging onto Web View System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 695 Logging onto Web View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 696 Web View is a web-based management application available on WSSs. You can use Web View for common configuration and management tasks.
PAGE 696
Appendix A:Enabling and logging onto Web View Note. If you are configuring a new 2382, 2360/2361, or 2350, you can access Web View without any preconfiguration. Attach your PC directly to any 10/100 Ethernet port on a 2382 2360/2361 or 2350. Then enter http://192.168.100.1 in the web browser’s Location or Address field. Logging onto Web View 1 Type https://ip-addr in the Web browser’s Address or Location field and press Enter. For ip-addr, type an IP address you configured on the switch.
PAGE 697
Appendix A: Supported RADIUS attributes Supported standard and extended attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 697 Nortel vendor-specific attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701 Nortel WLAN Security Switch 2300 Series (WSS Software) supports the standard and extended RADIUS authentication and accounting attributes listed in Table 1 on page 698.
PAGE 698
Appendix A:Supported RADIUS attributes Table 1: 802.1X attributes Attribute Type Rcv in Access Resp? Sent in Access Reqst? Sent in Acct Reqst? User-Name 1 No Yes Yes String. Name of the user to be authenticated. Used only in Request packets. User-Password 2 No Yes No Password of the user to be authenticated, unless a CHAP-Password is used. CHAPPassword 3 No Yes No Password of the user to be authenticated, unless a User-Password is used.
PAGE 699
Appendix A:Supported RADIUS attributes 699 Table 1: 802.1X attributes (continued) Attribute Type Rcv in Access Resp? Sent in Access Reqst? Sent in Acct Reqst? ReplyMessage 18 Yes No No String. Text that can be displayed to the user. Multiple Reply-Messages can be included. If any are displayed, they must appear in the order in which they appear in the packet. State 24 Yes Yes No Can be sent by a RADIUS server in an Access-Challenge message to the WSS.
PAGE 700
Appendix A:Supported RADIUS attributes Table 1: 802.1X attributes (continued) Attribute Type Rcv in Access Resp? Sent in Access Reqst? Sent in Acct Reqst? Acct-StatusType 40 No No Yes Valid values: • Acct-Start • Acct-Interim-Update • Acct-Stop Acct-DelayTime 41 No No Yes Time in seconds for which the client has been trying to send the record. Acct-InputOctets 42 No No Yes Number of octets received from the port over the course of this service being provided.
PAGE 701
Appendix A:Supported RADIUS attributes 701 Table 1: 802.1X attributes (continued) Attribute Type Rcv in Access Resp? Sent in Access Reqst? Sent in Acct Reqst? Acct-MultiSession-Id 50 No No Yes Unique accounting ID that facilitates linking together multiple related sessions in a log file. Each linked session has a unique Acct-Session-Id but the same Acct-Multi-SessionId.
PAGE 702
Appendix A:Supported RADIUS attributes Table 2: Nortel VSAs Attribute Type, Vendor ID, Vendor Type Rcv in Access Resp? Sent in Access Reqst? Sent in Acct Reqst? Description VLAN-Name 26, 562, 231 Yes No Yes Name of the VLAN to which the client belongs. Mobility-Profile 26, 562, 232 Yes No No Name of the Mobility Profile used by the authorized client. Encryption-Type 26, 562, 3233 Yes No No Type of encryption used to authenticate the client.
PAGE 703
Appendix A: Traffic ports used by WSS software When deploying a Nortel wireless network, you might attach Nortel equipment to subnets that have firewalls or access controls between them. Nortel equipment uses various protocol ports to exchange information. To ensure full operation of your network, make sure the equipment can exchange information on the ports listed in Table 1.
PAGE 704
Appendix A:Traffic ports used by WSS software NN47250-500 (320657-F Version 02.
PAGE 705
Appendix A: DHCP server How the WSS software DHCP server works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 706 Configuring the DHCP server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 706 Displaying DHCP server information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 706
Appendix A:DHCP server How the WSS software DHCP server works When WSS Software receives a DHCP Discover packet, the DHCP server allocates an address from the configured range according to RFC 2131 and ARPs the address to ensure that it is not already in use. If the address is in use, the server allocates the next address in the range, and ARPs again. The process continues until WSS Software finds an address that is not in use.
PAGE 707
Appendix A:DHCP server 707 The following command enables the DHCP server on VLAN red-vlan to serve addresses from the 192.168.1.5 to 192.168.1.25 range: WSS# set interface red-vlan ip dhcp-server enable start 192.168.1.5 stop 192.168.1.25 success: change accepted. To remove all IP information from a VLAN, including the DHCP client and user-configured DHCP server, use the following command: clear interface vlan-id ip Note. This command clears all IP configuration information from the interface.
PAGE 708
Appendix A:DHCP server IP Address: 10.10.20.2 Subnet Mask: 255.255.255.0 Default Router: 10.10.20.1 DNS Servers: 10.10.20.4 10.10.20.5 DNS Domain Name: mycorp.com In addition to information for addresses leased from the VLANs where you configured the server, information for the Direct AP interface is also displayed. The Direct AP interface is an internal VLAN interface for directly connected APs. NN47250-500 (320657-F Version 02.
PAGE 709
Appendix A: Glossary 3DES A three-round application of the Data Encryption Standard (DES) that uses a 168-bit encryption key. See also DES. 802.1D The IEEE LAN specification for the operation of media access control (MAC) bridges. 802.1p An IEEE LAN standard method for classifying packets in bridged virtual LANs (VLANs). As part of 802.1Q protocol, 802.1p defines a field in the VLAN tag of a frame header that provides class-of-service (CoS) definitions at Layer 2. See also 802.1Q. 802.
PAGE 710
Appendix A:Glossary 802.11b/g radio A radio that can receive and transmit signals at IEEE 802.11b and 802.11g data rates. Nortel 802.11b/g radios allow associations from 802.11b clients as well as 802.11g clients by default, for networks that have a mixture of both client types. However, association by any 802.11b clients restricts the maximum data transmit rate for all clients. To allow the radios to operate at the higher 802.11g data rates, you can set 802.
PAGE 711
Appendix A:Glossary 711 AES Advanced Encryption Standard. One of the Federal Information Processing Standards (FIPS). The AES, documented in FIPS Publication 197, specifies a symmetric encryption algorithm for use by organizations to protect sensitive information. See 802.11i; CCMP. AP See Access Point (AP). association The process defined in IEEE 802.11 by which an authenticated mobile (wireless) station establishes a relationship with a wireless AP to gain full network access.
PAGE 712
Appendix A:Glossary BSSID Basic service set identifier. The 48-bit media access control (MAC) address of the radio in the AP that serves the stations in a basic service set (BSS). CA See certificate authority (CA). CBC-MAC See CCMP. CCI Co-channel interference. Obstruction that occurs when one signal on a particular frequency intrudes into a cell that is using that same frequency for transmission.
PAGE 713
Appendix A:Glossary 713 CPC Communications plenum cable. See plenum-rated cable. CRC Cyclic redundancy check. A primitive message integrity check. crypto See cryptography. cryptography The science of information security. Modern cryptography is typically concerned with the processes of scrambling ordinary text (known as plain text or clear text) into encrypted text at the sender’s end of a connection, and decrypting the encrypted text back into clear text at the receiver’s end.
PAGE 714
Appendix A:Glossary Diffserv Differentiated services. An architecture for providing different types or levels of service for network traffic. Diffserv aggregates flows in the network so that routers and switches need to distinguish only a relatively small number of aggregated flows, even if those flows contain thousands or millions of individual flows.
PAGE 715
Appendix A:Glossary 715 EAP Extensible Authentication Protocol. A general point-to-point protocol that supports multiple authentication mechanisms. Defined in RFC 2284, EAP has been adopted by IEEE 802.1X in an encapsulated form for carrying authentication messages in a standard message exchange between a user (client) and an authenticator.
PAGE 716
Appendix A:Glossary Extensible Authentication Protocol See EAP. Extensible Markup Language See XML. failover In a redundant system, an operation by which a standby (or secondary) system component automatically takes over the functions of an active (or primary) system component when the active component fails or is temporarily shut down or removed for servicing. During and after failover, the system continues its normal operations with little or no interruption in service.
PAGE 717
Appendix A:Glossary 717 group transient key See GTK. H.323 A set of International Telecommunications Union Telecommunication Standardization Sector (ITU-T) standards that define a framework for the transmission of real-time voice signals over IP packet-switched networks. hash A one-way algorithm from whose output the input is computationally infeasible to determine.
PAGE 718
Appendix A:Glossary IGMP snooping A feature that prevents the flow of multicast stream packets within a virtual LAN (VLAN) and forwards the multicast traffic through a path to only the clients that want to receive it. A WLAN—Security Switch (WSS) uses IGMP snooping to monitor the Internet Group Management Protocol (IGMP) conversation between hosts and routers. When the WSS detects an IGMP report from a host for a given multicast group, it adds the host’s port number to the list for that group.
PAGE 719
Appendix A:Glossary 719 LDAP Lightweight Directory Access Protocol. A protocol defined in RFC 1777 for management and browser applications that require simple read-write access to an X.500 directory without incurring the resource requirements of Directory Access Protocol (DAP). Protocol elements are carried directly over TCP or other transport, bypassing much of the session and presentation overhead.
PAGE 720
Appendix A:Glossary message-digest algorithm 5 See MD5. message integrity code See MIC. MIC Message integrity code. The IEEE term for a message authentication code (MAC). See MAC. Microsoft Challenge Handshake Authentication Protocol See MS-CHAP-V2. minimum data transmit rate The lowest rate at which an AP can transmit data to its associated mobile clients. If the data rate to a client drops below the minimum, the AP increases power, if Auto-RF is enabled.
PAGE 721
Appendix A:Glossary 721 Odyssey An 802.1X security and access control application for wireless LANs (WLANs), developed by Funk Software, Inc. OFDM Orthogonal frequency division multiplexing. A modulation technique that sends data across a number of narrow subcarriers within a specified frequency band. The wireless networking standards IEEE 802.11a and IEEE 802.11g are based on OFDM. orthogonal frequency division multiplexing See OFDM. pairwise master key See PMK. pairwise transient key See PTK.
PAGE 722
Appendix A:Glossary plenum A compartment or chamber to which one or more air ducts are connected. plenum-rated cable A type of cable approved by an independent test laboratory for installation in ducts, plenums, and other air-handling spaces. PMK Pairwise master key. A code derived from a master secret and used as an encryption key for IEEE 802.11 encryption algorithms. A PMK is also used to derive a pairwise transient key (PTK) for IEEE 802.11i robust security. See also master secret; PTK.
PAGE 723
Appendix A:Glossary 723 pseudorandom number generator See PRNG. PSK Preshared key. The IEEE 802.11 term for a shared secret, also known as a shared key. See shared secret. PTK Pairwise transient key. A value derived from a pairwise master key (PMK) and split into multiple encryption keys and message integrity code (MIC) keys for use by a client and server as temporal session keys for IEEE 802.11i robust security. See also 802.11i.
PAGE 724
Appendix A:Glossary restricted access Permission to use most WLAN Security Switch 2300 Series (WSS Software) command-line interface (CLI) commands required for viewing status information (show commands), except those that list security information in clear text. Users with restricted access can clear ARP requests and ping hosts. Compare enabled access.
PAGE 725
Appendix A:Glossary 725 security ACL Security access control list. An ordered list of rules to control access to and from a network by determining whether to forward or filter packets that are entering or exiting it. Associating a security ACL with a particular user, port, virtual LAN (VLAN), or virtual port on a WLAN—Security Switch (WSS) controls the network traffic to or from the user, port, VLAN, or virtual port. The rules in an ACL are known as access control entries (ACEs). See also ACE.
PAGE 726
Appendix A:Glossary subnet mobility The ability of a wireless user (client) to roam across Access Point (AP) and WLAN— Security Switch (WSS) switches in a virtual LAN (VLAN) while maintaining a single IP address and associated data sessions. supplicant A client that is attempting to access a network. syslog server A remote repository for log messages. Nortel WLAN Security Switch 2300 Series (WSS Software) supports up to four syslog servers on virtual LANs (VLANs) whose locations are configurable.
PAGE 727
Appendix A:Glossary 727 user A person who uses a client. In a Nortel WLAN 2300 system, users are indexed by username and associated with authorization attributes such as user group membership. user wildcard A Nortel convention for matching fully qualified structured usernames or sets of usernames during authentication by means of known characters plus two special “wildcard” characters. Double asterisks (**) represent all usernames.
PAGE 728
Appendix A:Glossary WEP Wired-Equivalent Privacy protocol. A security protocol, specified in the IEEE 802.11 standard, that attempts to provide a wireless LAN (WLAN) with a minimal level of security and privacy comparable to a typical wired LAN. WEP encrypts data transmitted over the WLAN to protect the vulnerable wireless connection between users (clients) and APs. Although appropriate for most home use, WEP is weak and fundamentally flawed for enterprise use. Compare AES; CCMP; TKIP.
PAGE 729
Appendix A:Glossary 729 WPA Wi-Fi Protected Access. The Wi-Fi Alliance’s version of the Temporal Key Integrity Protocol (TKIP) that also includes a message integrity code (MIC) known as Michael. Although WPA provides greater wireless security than the Wired-Equivalent Privacy protocol (WEP), WPA is not as secure as IEEE 802.11i, which includes both the RC4 encryption used in WEP and Advanced Encryption Standard (AES) encryption, but is not yet ratified by IEEE. See also AES; RC4; TKIP.
PAGE 730
Appendix A:Glossary NN47250-500 (320657-F Version 02.
PAGE 731
Index 731 Index Symbols (Access Points (APs) Wi-Fi Multimedia (WMM) 343 Numerics 802.11a 236, 237 802.11b 236, 237 802.11g 236, 237 802.11i. See RSN 802.1Q tagging 105 802.1X authentication 482 authentication port control 575 authorization 552 client reauthentication 580 clients 587 configuration display 588 information 586 key transmission 576 order of processing 551 protocol 480 quiet period 584 settings 573 statistics 589 timeout 585 802.
PAGE 732
Index prohibited for MAC users 491 administrative Certificate Signing Request 457 administrators accounting 77 console sessions, clearing 611 console sessions, displaying 611 privileges 73 sessions, clearing 609 sessions, displaying 609 Telnet client sessions, displaying and clearing 613 Telnet sessions, displaying and clearing 612 advisory notices, explanations of 41 AeroScout RFID tag support 331 affinity 105 configuring 108 in roaming VLANs 174 number 174 aging timeout ARP 145 FDB 113 alert logging l
PAGE 733
Index 733 server timeout 585 authorization attributes Encryption-Type 530 local database assignment 522 security ACL 530 user group assignment 530 authorization password MAC 493 outbound 493 authorization server timeout 585 Auto-AP profile 230 autonegotiation 97 Auto-RF locking down settings 327 autosensing 96 Avaya voice over IP 434 B backbone fast convergence 375 configuring 379 beacon interval 251 before editbuffer-index defined 418 locating an ACE 428 black list 633 blink mode 241 blocked ports, displa
PAGE 734
Index conventions 43 help 52 history buffer command reuse 51 IP address and mask notation 46 keyboard shortcuts 51 list formats 49 MAC address notation 46 MAC address wildcards 47 overview 43 port list conventions 49 subnet masks 46 syntax notation 45 tabs for command completion 51 text entry conventions 46 user wildcards 47 VLAN identification 50 wildcard mask notation 46 client black list 633 clients 802.1X 587 DNS 136 HTTPS 134 no network access, troubleshooting 670 NTP 143 Telnet 132 wireless.
PAGE 735
Index 735 date, configuring 139 daylight savings time, configuring 140 DEASSOCIATED user state, for roaming 175 debug logging level 674 default configuration recovering the system 671 default IP address, Web Quick Start 59 delimiter characters, for user wildcards 47 delivery traffic indication map (DTIM) interval 251 Denial-of-Service (DoS) protection 638 destination, logging 673 DHCP client 123 DHCP option 43 203 DHCP server 705 diagnostics 679 digital certificates.
PAGE 736
Index description 702 enrolling with a certificate authority 457 eq (equal to) operator in security ACLs 416 in the location policy 540 error logging level 674 EtherChannel interoperability 103 Ethernet ports, numbering conventions 49 Event-Timestamp attribute 701 Extensible Authentication Protocol (EAP).
PAGE 737
Index 737 query interval, configuring 393 query response interval 392 query response interval, configuring 395 robustness value 392 robustness value, configuring 397 router solicitation 397 statistics 402 timers 392 ignore list 635 image AP, force download 240 image file 651 boot information 653 calculating checksum 657 upgrading 665 info logging level 674 information element 300 informs, SNMP 158 input filters, reassigning 540 interfering device 626 Internet Control Message Protocol (ICMP) ACLs 414 Interne
PAGE 738
Index console users, scenario 80 defined 481 local override and backup authentication, scenario 81 local database 77 assigning encryption types in 532 assigning security ACLs in 530 clearing users from 77, 84 local facility, for log messages sent to a server 676 local override 70, 477 location policy compared to a security ACL 539 configuration scenario 560 configuring 540 defined 537 disabling 542 displaying rules in 541 order of rules in 541 location policy rules clearing 542 configuring 540 defined 5
PAGE 739
Index 739 affinity 105 affinity, configuring 108 clearing members from 170 clearing the configuration 170 configuration display 170 configuration scenario 176 configuration status 170 configuring 166 defined 165 members 166 monitoring roaming users 175 names 166 roaming VLANs in 174 seed 166 status 166 Mobility Profile 552 authorization 552 defined 552 Mobility-Profile attribute description 702 modify editbuffer-index defined 418 modifying an ACE 429 monitoring wireless traffic 685 monitors port statistics
PAGE 740
Index notification target, SNMP 161 notifications rogue detection 638 notifications, SNMP 158 NTP (Network Time Protocol) 142 AAA and management ports 703 client 143 displaying information 143 servers 142 update interval 143 O offload authentication configuring 484 defined 481 EAP 478, 484 PEAP and MS-CHAP-V2 484 PEAP-MS-CHAP-V2 configuration scenario 558 RADIUS 478, 484 one-time password 456, 462 online help, command line 52 operating system files 651 upgrading 665 other-querier-present interval 392 c
PAGE 741
Index 741 configuring 372 displaying 384 port fast convergence 375 configuring 377 port groups 101 displaying 102 EtherChannel interoperability 103 port lists authorization 553 conventions for 49 port priority 370 configuring 373 port types clearing 93 configuring 89 defaults 90 resetting 93 ports administrative state 97 autonegotiation 97 blocked by STP, displaying 385 clearing ACL maps from 531 filtering TCP and UDP packets by 416 HTTP 135 HTTPS 135 interface preference 95 mapping security ACLs to 425 nam
PAGE 742
Index displaying 276 enabling 271 removing 254 resetting a parameter 254 radios assigning to a radio profile 271 beacon interval 251 beaconing SSIDs 245 channels 227, 255 counters 278 disabling 271 DTIM interval 251 enabling 271 encryption 291 fragmentation threshold 252 long retry threshold 250 maximum receive threshold 253 maximum transmit threshold 253 preamble length 253 resetting 272 RTS threshold 252 short retry threshold 250 SSIDs 224, 244 transmit power 227, 255 RADIUS accounting ports 703 assig
PAGE 743
Index 743 monitoring roaming clients 175 required conditions for 175 timers in 175 user sessions 174 See also Mobility Domain roaming stations 173 roaming VLANs 174 robustness value 392 configuring 397 rogue access points detecting 625 rogue classification 626 rogue detection 625 AP signatures 637 attack list 634 classification 626 client black list 633 displaying information 643 feature summary 630 ignore list 635 logging 638 permitted SSID list 632 permitted vendor list 631 scans 629 scheduled RF scanning
PAGE 744
Index committed, viewing 420 compared to the location policy 539 configuration scenario 442 deleting 422 displaying details in 421 displaying maps for 425 hits 421 ICMP 414 IP 411 locating ACEs 428 mapping 425 mapping to users 423, 530 modifying 426 operators 416 ordering 418 planning maps 409, 425 ports 425 reassigning in a location policy rule 540 sample hit rate 421 TCP 416 TCP source and destination ports 416 UDP 416 UDP source and destination ports 416 user-based 423 virtual ports 425 VLANs 425 wil
PAGE 745
Index 745 informs 158 notifications, rogue detection 638 trap receiver 161 traps 158 SNMP ports for get and set operations 703 for traps 703 snooping wireless traffic 685 snooping. See IGMP snooping SNTP. See NTP (Network Time Protocol) software AP, force download 240 software version, displaying 652 Spanning Tree Protocol.
PAGE 746
Index system image file 651 incomplete load, troubleshooting 671 upgrading 665 system image version 652 system IP address 126 assigning to VLAN 126 required on a Mobility Domain seed 166 system logs configuring 674 destinations 673 disabling output to the console 676 displaying the configuration of 678 managing 672 message components 673 severity levels 673 system recovery, lost password 671 system time, configuring 139 T tabs, for command completion 51 tag type 105 target buffer 673 console 673 server
PAGE 747
Index 747 output, displaying 680 results 681 running 679 traffic monitoring 685 traffic ports, typical, in a Mobility Domain 703 transmit power 227 configuring 255 Transport Layer Security (TLS) encryption 444 trap receiver 161 traps 158 troubleshooting avoiding unintended AAA processing 551 blinking amber Mgmt LED 671 client authentication failure 670 common WSS setup problems 670 incomplete boot load 671 invalid certificate 670 missing configuration 671 no network access 670 show commands 682 system trace
PAGE 748
Index Vendor-Specific attribute, 802.1X attribute 699 vendor-specific attributes. See VSAs (vendor-specific attributes) verbose session output 615 version, displaying 652 virtual LANs.
PAGE 749
Index 749 wildcard masks 412 notation conventions 46 wildcards in MAC address wildcards 47 in user wildcards 47 in VLAN wildcards 48 masks for in security ACLs 412 wildcards. See MAC address wildcards; user wildcards; VLAN wildcards wired authentication ports 89 802.1X settings 573 configuring 92 Wired-Equivalent Privacy. See WEP (Wired-Equivalent Privacy) wireless bridges 640 wireless session encryption 445 WLAN 2300 System Software CLI. See CLI (command-line interface) WLAN—Security Switch.
PAGE 750
Index NN47250-500 (320657-F Version 02.
PAGE 751
Command Index B backup system 663, 665 boot OPT+=default 672 C clear {ap | dap} radio 272 clear accounting system 545 clear boot config 662 clear dap 94, 239 clear dap image 341 clear dot1x bonded-period 489 clear dot1x max-req 579 clear dot1x port-control 575 clear dot1x quiet-period 584 clear dot1x reauth-max 581 clear dot1x reauth-period 582 clear dot1x timeout auth-server 585 clear dot1x timeout supplicant 586 clear dot1x tx-period 577 clear fdb 113 clear igmp statistics 402 clear interface 125 cl
PAGE 752
Command Index clear service-profile 245 clear service-profile soda agent-directory 606 clear service-profile soda failure-page 603 clear service-profile soda logout-page 605 clear service-profile soda remediation-acl 604 clear service-profile soda success-page 602 clear sessions 609 clear sessions admin 610 clear sessions admin ssh 132 clear sessions admin telnet 134 clear sessions console 611 clear sessions network mac-addr 617 clear sessions network session-id 620 clear sessions network user 616 clear
PAGE 753
Command Index 753 save trace 678 set {ap | dap} bias 240 set {ap | dap} blink 240, 241 set {ap | dap} force-image-download 240 set {ap | dap} name 239 set {ap | dap} radio auto-tune max-power 326 set {ap | dap} radio channel 255 set {ap | dap} radio mode 271 set {ap | dap} radio radio-profile 271 set {ap | dap} radio tx-power 255 set {ap | dap} upgrade-firmware 240 set accounting admin 78 set accounting dot1X 542 set accounting system 545 set ap radio radio-profile 306, 309 set arp 145 set arp agingtime 145
PAGE 754
Command Index set ip telnet 133 set ip telnet server 132 set location policy 540 set log 674 set log buffer disable 675 set log buffer severity 675 set log console 676 set log console enable 676 set log current disable 677 set log current enable 677 set log current severity 677 set log mark 674 set log server 674, 676 set log sessions 677 set log sessions disable 677 set log trace 677 set log trace disable 677 set mac-user 491 set mac-user attr encryption-type 532 set mac-user attr filter-id 423, 530 se
PAGE 755
Command Index 755 set security l2-restrict 108 set server group 568 set server group load-balance 569 set server group members 569 set service-profile 303, 307 set service-profile auth-dot1x 305 set service-profile auth-fallthru 246 set service-profile auth-psk 304 set service-profile beacon 245 set service-profile cac-mode 359 set service-profile cac-session 360 set service-profile cipher-ccmp 304, 308 set service-profile cipher-tkip 304, 308 set service-profile cipher-wep104 304, 308 set service-profile c
PAGE 756
Command Index show {ap | dap} config 273 show {ap | dap} counters 278 show {ap | dap} status 276 show aaa 548, 571, 682 show accounting statistics 546 show arp 144 show auto-tune neighbors 328, 329 show boot 653 show config 659 show crypto ca-certificate 458 show crypto certificate 458 show crypto key ssh 131 show dap boot-configuration 277 show dap config auto 232 show dap connection 275 show dap global 274 show dap qos-stats 364 show dap status auto 234 show dap unconfigured 274 show dhcp-server 707 s
PAGE 757
Command Index 757 show snmp counters 164 show snmp notification target 164 show snmp notify profile 163 show snmp status 163 show snmp usm 163 show snoop 688 show snoop info 687 show snoop map 688 show snoop stats 689 show spantree 383 show spantree backbonefast 380 show spantree blockedports 385 show spantree portfast 378 show spantree portvlancost 384 show spantree statistics 386 show spantree uplinkfast 382 show summertime 141 show system 126, 229 show timedate 142 show timezone 140 show trace 680 show t
PAGE 758
Nortel WLAN—Security Switch 2300 Series Configuration Guide Nortel WLAN—Security Switch 2300 Series Release 6.0 Document Number: NN47250-500 Document Status: Standard Document Version: 02.01 Part Code: 320657-F Release Date: October 2007 Copyright © Nortel Networks Limited 2007 All Rights Reserved The information in this document is subject to change without notice.