Wireless Arrays XR and XN Series February 7, 2013 Release 6.
Wireless Array ™ XR and XN Series All rights reserved. This document may not be reproduced or disclosed in whole or in part by any means without the written consent of Xirrus, Inc.
Trademarks is a registered trademark of Xirrus, Inc. All other trademarks and brand names are marks of their respective holders. Please see Legal Notices, Warnings, Compliance Statements, and Warranty and License Agreements in “Appendix C: Notices” on page 471. Xirrus, Inc. 2101 Corporate Center Drive Thousand Oaks, CA 91320 USA Tel: Fax: 1.805.262.1600 1.800.947.7871 Toll Free in the US 1.866.462.3980 www.xirrus.
Wireless Array Table of Contents List of Figures.................................................................................... xiii Introduction ......................................................................................... 1 The Xirrus Family of Products ............................................................................... 1 Nomenclature .................................................................................................... 2 Why Choose the Xirrus Wireless Array? ..
Wireless Array Notes and Cautions ........................................................................................ 21 Screen Images .................................................................................................. 21 Product Specifications ........................................................................................... 22 Installing the Wireless Array........................................................... 23 Installation Prerequisites ................................
Wireless Array Installing Your Wireless Array ............................................................................ 59 Choosing a Location ....................................................................................... 59 Wiring Considerations ............................................................................ 59 Mounting the Array ....................................................................................... 62 Dismounting the Array .........................................
Wireless Array Network Map ................................................................................................ 105 Content of the Network Map Window .............................................. 106 Spanning Tree Status .................................................................................... 108 Routing Table ................................................................................................ 109 ARP Table ................................................................
Wireless Array Stations (Application Control) .................................................................... 155 System Log Window ........................................................................................... 156 IDS Event Log Window ...................................................................................... 157 Configuring the Wireless Array.................................................... 159 Express Setup .................................................................
Wireless Array Access Control List ....................................................................................... 227 Global Settings .............................................................................................. 230 External Radius ............................................................................................. 234 About Creating User Accounts on the RADIUS Server .................. 234 Internal Radius ...................................................................
Wireless Array RF Monitor .............................................................................................. 314 RF Resilience .......................................................................................... 315 RF Power & Sensitivity ......................................................................... 316 RF Spectrum Management ................................................................... 318 Station Assurance ................................................................
Wireless Array Configuration ......................................................................................... 364 Diagnostics ............................................................................................. 366 Web Page Redirect ................................................................................. 368 Network Tools ........................................................................................ 369 Progress and Status Frames .........................................
Wireless Array management .................................................................................................. 409 more ................................................................................................................ 410 netflow ............................................................................................................ 411 no ..................................................................................................................... 412 quit ..........
Wireless Array Gigabit 1 and Gigabit 2 ......................................................................... 444 Server Settings ............................................................................................... 444 NTP .......................................................................................................... 444 Syslog ...................................................................................................... 444 SNMP .............................................
Wireless Array Hardware Warranty Agreement ....................................................................... 491 Glossary of Terms.......................................................................... 493 Index................................................................................................
Wireless Array xii
Wireless Array List of Figures Figure 1. Figure 2. Figure 3. Figure 4. Figure 5. Figure 6. Figure 7. Figure 8. Figure 9. Figure 10. Figure 11. Figure 12. Figure 13. Figure 14. Figure 15. Figure 16. Figure 17. Figure 18. Figure 19. Figure 20. Figure 21. Figure 22. Figure 23. Figure 24. Figure 25. Figure 26. Figure 27. Figure 28. Figure 29. Figure 30. Figure 31. Figure 32. Figure 33. Figure 34. Xirrus Arrays: XR Series ............................................................................
Wi-Fi Array Figure 35. Figure 36. Figure 37. Figure 38. Figure 39. Figure 40. Figure 41. Figure 42. Figure 43. Figure 44. Figure 45. Figure 46. Figure 47. Figure 48. Figure 49. Figure 50. Figure 51. Figure 52. Figure 53. Figure 54. Figure 55. Figure 56. Figure 57. Figure 58. Figure 59. Figure 60. Figure 61. Figure 62. Figure 63. Figure 64. Figure 65. Figure 66. Figure 67. Figure 68. Figure 69. Figure 70. Figure 71. xiv Network Interface Ports.................................................................
Wireless Array Figure 72. Figure 73. Figure 74. Figure 75. Figure 76. Figure 77. Figure 78. Figure 79. Figure 80. Figure 81. Figure 82. Figure 83. Figure 84. Figure 85. Figure 86. Figure 87. Figure 88. Figure 89. Figure 90. Figure 91. Figure 92. Figure 93. Figure 94. Figure 95. Figure 96. Figure 97. Figure 98. Figure 99. Figure 100. Figure 101. Figure 102. Figure 103. Figure 104. Figure 105. Figure 106. Figure 107. Figure 108. Controls for Location Map ......................................................
Wi-Fi Array Figure 109. Figure 110. Figure 111. Figure 112. Figure 113. Figure 114. Figure 115. Figure 116. Figure 117. Figure 118. Figure 119. Figure 120. Figure 121. Figure 122. Figure 123. Figure 124. Figure 125. Figure 126. Figure 127. Figure 128. Figure 129. Figure 130. Figure 131. Figure 132. Figure 133. Figure 134. Figure 135. Figure 136. Figure 137. Figure 138. Figure 139. Figure 140. Figure 141. Figure 142. Figure 143. Figure 144. Figure 145. xvi Time Settings (Manual Time)........................
Wireless Array Figure 146. Figure 147. Figure 148. Figure 149. Figure 150. Figure 151. Figure 152. Figure 153. Figure 154. Figure 155. Figure 156. Figure 157. Figure 158. Figure 159. Figure 160. Figure 161. Figure 162. Figure 163. Figure 164. Figure 165. Figure 166. Figure 167. Figure 168. Figure 169. Figure 170. Figure 171. Figure 172. Figure 173. Figure 174. Figure 175. Figure 176. Figure 177. Figure 178. Figure 179. Figure 180. Figure 181. Figure 182. Source of Channel Setting ..........................
Wi-Fi Array Figure 183. Figure 184. Figure 185. Figure 186. Figure 187. Figure 188. Figure 189. Figure 190. Figure 191. Figure 192. Figure 193. Figure 194. Figure 195. Figure 196. Figure 197. Figure 198. Figure 199. Figure 200. xviii Login Window ........................................................................................ 376 Logging In................................................................................................ 378 Help Window................................................
Wireless Array Introduction These topics introduce the Xirrus Wireless Array, including an overview of its key features and benefits. “The Xirrus Family of Products” on page 1. “Why Choose the Xirrus Wireless Array?” on page 3. “Wireless Array Product Overview” on page 5. “Key Features and Benefits” on page 14. “Advanced Feature Sets” on page 16. “About this User’s Guide” on page 19. The Xirrus Family of Products Figure 1.
Wireless Array The XN Series of Xirrus Wireless Arrays The Xirrus Wireless Arrays have the speed and reach of IEEE 802.11n technology. The XN Series of Arrays feature the capacity and performance needed to replace switched Ethernet to the desktop. XN Series Arrays integrate multiple Integrated Access Points—radios with high-gain directional antennas for increased range and coverage.
Wireless Array used (for example, XR-4830). The Wireless Array’s operating system is referred to as the ArrayOS. The Web Management Interface for browser-based management of the Array is referred to as WMI. The XR Series Arrays have very flexible radio capabilities — each of the radios may be independently configured to support IEEE802.11a, 11b, 11g, or 11n clients or a combination of client types.
Wireless Array 802.11a Operates in the 5 GHz range with a maximum speed of 54 Mbps. 802.11b Operates in the 2.4 GHz range with a maximum speed of 11 Mbps. 802.11g Supports a higher transmission speed of 54 Mbps in the 2.4 GHz range and is backwards compatible with 802.11b. 802.11n Uses multiple antennas per radio to boost transmission speed as high as 450Mbps, increasing throughput, range, and maximum number of users. 802.11n is backwards compatible with 802.11a/b/g.
Wireless Array Wireless Array Product Overview Part of the family of Xirrus products, the Wireless Array is a high capacity, multimode device designed with up to four times the coverage and eight times the bandwidth and user density compared with legacy thin access point wireless products. Its distributed intelligence eliminates the use of separate controllers and their accompanying bottlenecks.
Wireless Array XR Wireless Array Product Family XR500 Series Arrays These Arrays have one Gigabit Ethernet port and two radios—one multi-state radio (2.4GHz or 5GHz) and one 5GHz radio. They support 300Mbps, connecting up to 240 users at one time. The XR500 provides flexibility for delivering wireless service in low-to-medium user density scenarios, in challenging deployments in areas with high RF attenuation, and in isolated or physically separated locations.
Wireless Array up to 900Mbps of bandwidth (up to 450 Mbps per radio). The XR-1000 provides flexibility for delivering wireless service in low user density scenarios, challenging deployments in areas with high RF attenuation, and in isolated or physically separated locations. The elliptical-shaped coverage pattern produced by its directional antennas is ideal for covering facilities with central hallways and adjacent rooms commonly found in office buildings, hotels, and dormitories.
Wireless Array XR-4000 Series Arrays These Arrays include models with two Gigabit Ethernet ports and four or eight radios (IAPs), connecting up to 640 users at one time and offering a maximum wireless bandwidth of 3.6 Gbps (up to 450 Mbps per radio). Smaller models may be upgraded to eight radios later when your needs change. Feature XR-4420 XR-4430 XR-4820 XR-4830 Number of radios: 802.
Wireless Array XR-6000 Series Arrays These Arrays include models with four Gigabit Ethernet ports and up to sixteen radios, connecting up to 1280 users at one time and offering a maximum wireless bandwidth of 7.2 Gbps (up to 450 Mbps per radio). Smaller models may be upgraded to sixteen radios later when your needs change. A 10 Gigabit modular Ethernet expansion port (DVI connector) is available to meet high traffic demands. It is used only with an optional Xirrus 10 Gig fiber optics adapter.
Wireless Array Why Choose the Xirrus Wireless Array? XN Wireless Array Product Family The following tables provide an overview of the main features supported by the XN Array product family. XN Family of Arrays Feature XN16 XN12 XN8 XN4 Number of 802.11a/b/g/n radios 4 4 4 4 Number of 802.
Wireless Array Enterprise Class Security The latest and most effective wireless encryption security standards, including WPA (Wireless Protected Access) and WPA2 with 802.11i AES (Advanced Encryption Standard) are available on the Wireless Array. In addition, the use of an embedded RADIUS server (or 802.1x with an external RADIUS server) ensures user authentication — multiple Arrays can authenticate to the optional XMS, ensuring only authorized Arrays become part of the wireless network.
Wireless Array position relative to the Array. Radios may be assigned to 2.4 GHz and/or 5.0 GHz bands in any desired pattern. Partial pattern coverage If desired, the Wireless Array can be deployed close to an exterior wall. In this case, half of all available radios have been deactivated to prevent redundant signals from “bleeding” beyond the site’s perimeter wall.
Wireless Array Enterprise Class Management The Wireless Array can be configured with its default RF settings, or the RF settings can be customized using the Array’s embedded Web Management Interface (WMI). The WMI enables easy configuration and control from a graphical console, plus a full complement of troubleshooting tools and statistics. Figure 5. WMI: Array Status In addition, a fully featured Command Line Interface (CLI) offers IT professionals a familiar management and control environment.
Wireless Array For deployments of more than five Arrays, we recommend that you use the Xirrus Management System (XMS). The XMS offers a rich set of features for fine control over large deployments. Key Features and Benefits This section describes some of the key product features and the benefits you can expect when deploying the Wireless Array (the XR-7630 product is used as an example in this section). High Capacity and High Performance Figure 6.
Wireless Array Extended Coverage One XR-7630 solution enables you to replace fifteen access points (including one omnidirectional IAP for monitoring the network). Fifteen IAP radios with integrated directional antennas provide increased wireless range and enhanced data rates in all directions. With a Wireless Array deployed, far fewer access points are needed and wired-like resiliency is delivered throughout your wireless network.
Wireless Array Secure Wireless Access Multiple layers of authentication and encryption ensure secure data transmissions. The Wireless Array is 802.11i compliant with line-rate encryption support for 40 and 128 bit WEP, WPA and WPA2 with TKIP and AES encryption. Authentication is provided via 802.1x, including PEAP, EAP-TLS, EAP-TTLS, EAP-SIM, EAP-GRC, and LEAP (Lightweight Extensible Authentication Protocol) passthrough.
Wireless Array of higher speed 802.11n wireless and its increased use of the 5GHz spectrum adds to the number of variables today's wireless networks must accommodate. Backwards compatibility with older clients is crucial, however their operation in a wireless network can significantly hinder the performance of faster clients. As an example, 802.11b wireless stations communicate more than 10 times slower than 802.11n stations.
Wireless Array dedicated threat sensor radio scanning all channels in the 2.4GHz and 5GHz spectrums, RSM searches for security threats and automatically mitigates them. High performance encryption/decryption in the enterprise wireless network is a must. The wireless network needs to support each client using the highest level of encryption (WPA2 Enterprise/128 bit AES) and without degrading the overall performance of the network.
Wireless Array wireless controller with the necessary computing and memory resources to provide these functions securely at the network's edge. The key elements of the RAM package include: RF Analysis – An embedded Spectrum Analyzer leverages the dedicated threat sensor radio in each Wireless Array to provide a continual view of utilization, interference, and errors across all available wireless channels.
Wireless Array The Web Management Interface Offers an overview of the product’s embedded Web Management Interface, including its content and structure. It emphasizes what you need to do to ensure that any configuration changes you make are applied, and provides a list of restricted characters. It also includes instructions for logging in to the Array with your Web browser.
Wireless Array Appendix C: Notices Contains the legal notices, licensing, and compliance statements for the Array. Please read this section carefully. Glossary of Terms Provides an explanation of terms directly related to Xirrus product technology, organized alphabetically. Index The index is a valuable information search tool. Use the index to locate specific topics discussed in this User’s Guide. Simply click on any page number in the index to jump to the referenced topic.
Wireless Array Product Specifications Please refer to the Xirrus web site for the latest specifications for these Arrays— www.xirrus.
Wireless Array Installing the Wireless Array The instructions for completing a successful installation include the following topics: “Installation Prerequisites” on page 23. “Planning Your Installation” on page 26. “Installation Workflow” on page 57. “Installing Your Wireless Array” on page 59. “Powering Up the Wireless Array” on page 63. “Establishing Communication with the Array” on page 66. “Performing the Express Setup Procedure” on page 71.
Wireless Array ! The Array’s Ethernet ports should be connected to an Ethernet switch, not an Ethernet hub — if a hub is used, we recommend that you do not bondpair Ethernet ports. Secure Shell (SSH) utility To establish secure remote command line access to the Array, you need a Secure Shell (SSH) utility, such as PuTTY. The utility must be configured to use SSH-2, since the Array will only allow SSH-2 connections. Secure Web browser Either Internet Explorer (version 7.
Wireless Array Optional Network Components The following network components are optional. Xirrus Management System (XMS) The optional XMS offers powerful management features for small or large Wireless Array deployments. External RADIUS server Although your Array comes with an embedded RADIUS server, for 802.1x authentication in large deployments you may want to add an external RADIUS server. Client Requirements The Wireless Array should only be used with Wi-Fi certified client devices.
Wireless Array Planning Your Installation This section provides guidelines and examples to help you plan your Xirrus Wireless Array deployment to achieve the best overall coverage and performance. We recommend you conduct a site survey to determine the best location and settings for each Array you install. The following topics are discussed: “General Deployment Considerations” on page 26 “Coverage and Capacity Planning” on page 28 “IEEE 802.
Wireless Array frequency) noise at your location. To maximize wireless range, follow these basic guidelines: 1. Keep the number of walls and ceilings between the Array and your receiving devices to a minimum — each wall or ceiling can reduce the wireless range from between 3 and 90 feet (1 to 30 meters). Position your devices so that the number of walls or ceilings is minimized. 2. Be aware of the direct line between each device. For example, a wall that is 1.
Wireless Array Coverage and Capacity Planning This section considers coverage and capacity for your deployment(s), including placement options, RF patterns and cell sizes, area calculations, roaming considerations, and channel allocations. Note that several advanced features in this section are part of the Xirrus Advanced RF Performance Manager (RPM). They require the license installed on the Array to include support for RPM. Please see “About Licensing and Upgrades” on page 361.
Wireless Array 3. If using multiple Arrays in the same area, maintain a distance of at least 100ft/30m between Arrays if there is direct line-of-sight between units, or at least 50ft/15m if a wall or other barrier exists between units. RF Patterns The Wireless Array allows you to control — automatically or manually — the pattern of wireless coverage that best suits your deployment needs.
Wireless Array service into public areas. The same principle applies if you want to restrict service to an adjacent room within the site. Custom Coverage Where there are highly reflective objects in proximity to the Array, you can turn off specific radios to avoid interference and feedback. reflective object Figure 11.
Wireless Array greatly so the actual rates may be different depending on the specific network deployment. The XN4 has a smaller range than the larger Arrays. Fine Tuning Cell Sizes Adjusting the transmit power allows you to fine tune cell sizes. There are four standard sizes — Small, Medium, Large, or Max (the default is Max). There is also an Auto setting that automatically determines the best cell size, and a Manual setting that allows you to choose your power settings directly.
Wireless Array If you are installing many units in proximity to each other, we recommend that you use Auto Cell Size; otherwise, reduce the transmit power using manual settings to avoid excessive interference with other Arrays or installed APs. See also, “Coverage and Capacity Planning” on page 28. Sharp Cell XR500 Series radios are omni-directional rather than directional (sectored),. This feature is not applicable to these Arrays.
Wireless Array Allocating Channels Because the Wireless Array is a multi-channel device, allocating the best channels to radios is important if peak performance is to be maintained. Automatic Channel Selection We recommend that you allow the Array to make intelligent channel allocation decisions automatically. In the automatic mode, channels are allocated dynamically, driven by changes in the environment.
Wireless Array Manual Channel Selection You can manually assign channels on a per radio basis, though manual selection is not recommended (and not necessary). To avoid co-channel interference, do not select adjacent channels for radios that are physically next to each other. Maintain channel separation Figure 15.
Wireless Array IEEE 802.11n Deployment Considerations Note that the license installed on the Array must include support for 802.11n. Please see “About Licensing and Upgrades” on page 361. The Xirrus Arrays support IEEE 802.11n on all IAPs, in both 2.4 GHz and 5 GHz bands. Use of 802.
Wireless Array 802.11n’s speed improvements and because they are optional and configurable, as opposed to the parts of 802.11n that are fixed. While the settings for 802.11n IAPs come pre-configured on the Array for robust performance in typical usage, you should review the settings for your deployment, especially channel bonding. A global setting is provided to enable or disable 802.11n mode. See “Global Settings .11n” on page 304 to configure 802.11n operation.
Wireless Array MIMO Processed Signal Antenna 1 Signal Attenuation Receiver Antenna 2 Signal Antenna 3 Signal Frequency Across Subcarriers Figure 17. MIMO Signal Processing Multipath signals were considered to be interference by 802.11a/b/g radios, and degraded performance. In 802.11n, these signals are used to enhance performance. This extra sensitivity can be used for greater range or higher data rates. The enhanced signal is the processed sum of individual antennas.
Wireless Array Multiple Data Streams — Spatial Multiplexing Spatial Multiplexing transmits completely separate data streams on different antennas (in the same channel) that are recombined to produce new 802.11n data rates. Higher data rates are achieved by splitting the original data stream into separate data streams. Each separate stream is transmitted on a different antenna (using its own RF chain). MIMO signal processing at the receiver can detect and recover each stream.
Wireless Array Channel Bonding Channel bonding increases data rates by combining two adjacent 20 MHz channels into one 40 MHz channel. This increases the data rate to slightly more than double. A bonded 40 MHz channel is specified in terms of the Primary channel and the adjacent channel to Bond. The Bond channel is represented by +1 to use the channel above the Primary channel, or -1 to use the channel below.
Wireless Array Improved MAC Throughput These changes make 802.11n transmission of MAC frames 40% more efficient than legacy transmission: MAC data frames are combined and given a single PHY header. Implicit Block ACK acknowledges all data frames within a combined frame. Spacing between frames is reduced.
Wireless Array Obtaining Higher Data Rates The data rate increase obtained by using 802.11n on an Array is incremental, based on the technologies that are applied and the options that you select: Higher encoding rates (Mandatory in 802.11n) Spatial Streams (Mandatory, but multiplier varies directly with number of streams selected.) Channel Bonding (Mandatory in 802.11n, apply multiplier to IAP if it is bonded.) Short Guard Interval (Optional) See Figure 21 to see the 802.
Wireless Array 802.11n Capacity 802.11n offers major increases in capacity over previous 802.11 standards, as shown in the table below. 802.11 Mode # Channels Max Theoretical Capacity Fast Ethernet No Yes 802.11 a/n: 3 Streams 23 23 * 450 Mbps = 10.2 Gbps 802.11 a/n: 2 Streams 23 23 * 300 Mbps = 6.8 Gbps 802.11 a/n: 1 Stream 23 23 * 150 Mbps = 3.4 Gbps 802.11 a 23 23 * 54 Mbps = 1.2 Gbps 802.11 g/n: 3 Streams 3 3 * 450 Mbps = 1.
Wireless Array In addition, the Array has full failover protection between the bonded-pair Gigabit ports (see following table). Bridges Data? Bridges Management Traffic? Fails Over To: IP address Fast Ethernet No Yes None DHCP or static Gigabit port Yes Yes Bonded port DHCP or static Bonded Gigabit port Yes Yes Bonded port Same Interface The Wireless Array Gigabit Ethernet ports actually support a number of modes: 802.
Wireless Array Switch Failover Protection To ensure that service is continued in the event of a switch failure, you can connect Arrays having multiple Gigabit ports to more than one Ethernet switch (not a hub). Ethernet connections Backup switch Ethernet switch Figure 23. Switch Failover Protection Gigabit Ethernet connections must be on the same subnet.
Wireless Array Power Planning All XR and XN Series Array models support Power over Gigabit Ethernet (PoGE) with an integrated splitter. This section discusses PoGE power. Power over Gigabit Ethernet To deliver power to the Array, you must use Xirrus-supplied may use the optional XP1, XP2, or XP8 Power over Gigabit Ethernet (PoGE) modules. They provide power over Cat 5e or Cat 6 cables to the Array without running power cables — see Figure 4 on page 12.
Wireless Array Security Planning This section offers some useful guidelines for defining your preferred encryption and authentication method. For additional information, see “Understanding Security” on page 209 and the Security section of “Frequently Asked Questions” on page 452. Note that several advanced features in this section are part of the Xirrus Advanced RF Security Manager (RSM). They require the license installed on the Array to include support for RSM.
Wireless Array also be authenticated via RADIUS when preferred, or to meet particular security standards. Xirrus Internal RADIUS server Recommended for smaller numbers of users (about 100 or less). Supports EAP-PEAP only Pre-Shared Key Uses a pass-phrase or key that is manually distributed to all authorized users. The same passphrase is given to client devices and entered into each Array.
Wireless Array Port Requirements A number of ports are used by various Array features and by the Xirrus Management System (XMS). The Port Requirements table on page 49 lists ports and the features that require them (XMS port requirements are included in the table for your convenience). If you are using a feature, please make sure that the ports that it requires are not blocked by firewalls or other policies, and that they do not conflict with any other port assignments.
Wireless Array The following table lists port requirements for the Array and for XMS, how they are used, and whether they may be changed. Port Application Peer Configurable Array icmp Ping XMS Server No 20 tcp 21 tcp FTP Client Yes 22 tcp SSH Client Yes 23 tcp Telnet Client Yes 25 tcp SMTP Mail Server No 69 udp TFTP TFTP Server No 123 udp NTP NTP Server No 161 udp SNMP XMS Server No 162 udp SNMP Traphost Note Up to four Traphosts may be configured.
Wireless Array Port Application Peer Configurable XMS icmp Ping Arrays No 22 tcp SSH Arrays Yes 25 tcp SMTP Mail Server Yes 123 udp NTP NTP Server No 161 udp SNMP Arrays No 162 udp SNMP Traphost 1 Arrays Via XMS config file 443 tcp HTTPS Arrays No 514 udp Resident Syslog server Internal* Via XMS config file 1099 tcp RMI Registry Internal* No 2000 tcp XMS Back-end Server Internal* No 3306 tcp MySQL Database Internal* No 8001 tcp Status Viewer Internal* No 8
Wireless Array See Also Management Control External Radius Services VLAN Management Installing the Wireless Array 51
Wireless Array Network Management Planning Network management can be performed using any of the following methods: Command Line Interface, using an SSH (Secure Shell) utility, like PuTTY. The utility must be set up to use SSH-2, since the Array will only allow SSH-2 connections. Web-based management, using the Array’s embedded Web Management Interface (WMI). This method provides configuration and basic monitoring tools, and is good for small deployments (one or two units).
Wireless Array WDS Planning WDS (Wireless Distribution System) creates wireless backhauls between Arrays, allowing your wireless network to be expanded using multiple Arrays without the need for a wired backbone to link them (see Figure 25). WDS features include: One to three IAPs may be used to form a single WDS link, yielding up to 1350 Mbps bandwidth per link. Up to three different WDS links may be created on a single Array.
Wireless Array Figure 26. A Multiple Hop WDS Connection Multiple WDS links can provide link redundancy (failover capability - see Figure 27). A network protocol (Spanning Tree Protocol — STP) prevents Arrays from forming network loops. Figure 27.
Wireless Array WDS links have a Host/Client relationship similar to the usual IAP/station pattern for Arrays: A WDS Client Link associates/authenticates to a host (target) Array in the same way that a station associates to an IAP. The client side of the link must be configured with the root MAC address of the target (host) Array. A WDS Host Link acts like an IAP by allowing one WDS Client Link to associate to it. An Array may have both client and host links.
Wireless Array Common Deployment Options The following table lists some typical and recommended deployment options for a number of the features that have been discussed in this chapter.
Wireless Array Installation Workflow This workflow illustrates the steps that are required to install and configure your Wireless Array successfully. Review this flowchart before attempting to install the unit on a customer’s network.
Wireless Array Failover Planning Installation Prerequisites Planning Your Installation Power Planning Wireless Array Product Overview Security Planning 58 Installing the Wireless Array
Wireless Array Installing Your Wireless Array This section provides instructions for completing a physical installation of your Xirrus Wireless Array. Choosing a Location Based on coverage, capacity and deployment examples previously discussed, choose a location for the Array that will provide the best results for your needs. The Wireless Array was designed to be mounted on a ceiling where the unit is unobtrusive and wireless transmissions can travel unimpeded throughout open plan areas.
Wireless Array Once you have determined the best location for your Wireless Array, you must run cables to the location for the following services: Power No separate power cable to the Array is required when using PoGE modules. The PoGE module requires a dedicated AC power outlet (100 - 240 VAC). Network Gigabit POE1 — If using PoGE modules, the total of all Cat 5e or Cat 6 cable segments from the Gigabit Ethernet switch to an Array Ethernet port must be less than 100m long.
Wireless Array ! ! The Array’s Ethernet ports should be plugged into an Ethernet switch, not an Ethernet hub — if a hub is used, we recommend that you connect only one Ethernet port. The Gigabit1 Ethernet interface is the primary port for both data and management traffic. If a single Ethernet connection is used, it must be connected to the Gigabit1 Ethernet interface. See also, “Failover Planning” on page 42.
Wireless Array Mounting the Array A number of options are available for mounting Arrays: Ceiling mount Wall mount Secure mount in a locking indoor enclosure I-Beam mount in a protective enclosure (gymnasium mount) Factory enclosure A detailed Quick Installation Guide is provided with the mounting option that you selected when ordering your Array. Please follow the provided instructions carefully.
Wireless Array Powering Up the Wireless Array When powering up, the Array follows a specific sequence of LED patterns showing the boot progress, and following a successful boot will provide extensive status information. Ethernet Activity and Status LEDs IAP LEDs Figure 30. LED Locations Array LED settings may be altered or disabled entirely for diagnostic purposes or for personal preference.
Wireless Array Array LED Operating Sequences Use the following tables to review the operating sequences of the Array’s LEDs.
Wireless Array LED Operation when Array is Running The normal LED operation when the Array is running is shown in the table below. Note that behavior may be modified using “LED Settings” on page 334 or via the CLI. LED Status Reason IAP LED is OFF IAP is down IAP LED is solid ON IAP is up, but no associations and no traffic IAP LED heartbeat IAP is up, with stations associated but no traffic IAP LED flashing IAP is up, passing traffic Flashing at 10 Hz Flashing at 5 Hz Flashing at 2.
Wireless Array Establishing Communication with the Array The Array may be configured through the Command Line Interface (CLI) using SSH, or on a browser via the graphical Web Management Interface (WMI). You may use the CLI via the serial management port (console—on all Arrays except the XR500 and XR-1000 Series), the Fast Ethernet port, or any of the Gigabit Ethernet ports. You can use the WMI via any of the Array’s Ethernet ports. Gigabit POE (gig1) Figure 31.
Wireless Array Serial (Console) Gigabit POE1 (gig1) Gigabit POE2 (gig2) Gigabit 3 (gig3) Gigabit 4 (gig4) Figure 34. Network Interface Ports—XR-6000 Series Serial Fast Ethernet Gigabit 1 Gigabit 2 Figure 35. Network Interface Ports The Xirrus Xircon utility may also be used to communicate with Arrays locally as an alternative to using a serial connection to the console. This is especially useful for the XR500 and XR-1000 Series, which do not have a console port.
Wireless Array IP address of 10.0.1.1 and both Gigabit1 and its bonded pair port (if any) will default to 10.0.2.1 with a mask of 255.255.255.0. If the Array is connected to a network that provides DHCP addresses, the IP address can be determined by the following three methods: 1. The simplest way to address the Array is using its default hostname which is the Array’s serial number (for example, XR4012N0823091CACD). If your network provides DHCP and DNS, then you can use this hostname. 2.
Wireless Array Starting the WMI Use this procedure to log in to the WMI via your Web browser. 1. Establish a network connection and open your Web browser. 2. Connect to the Wireless Array using its host name or IP address as described in the previous section. Logging In When logging in to the Array, use the default user name and password — the default user name is admin, and the default password is admin.
Wireless Array 2. In the left hand frame, in the Configuration section, click Express Setup. 3. License Key: Enter the key that was provided for the Array. The key was provided to you in an email as an attachment in the form of an Excel file (.xls). Enter the key exactly as it appears in the file. Click the Apply button to apply the key. 4. Now you may verify the features provided by the key. In the Status section of the left hand frame, click Array and then click Information.
Wireless Array Performing the Express Setup Procedure The Express Setup procedure establishes global configuration settings that enable basic Array functionality. Changes made in this window will affect all radios. Figure 36.
Wireless Array Procedure for Performing an Express Setup 1. Host Name: Specify a unique host name for this Array. The host name is used to identify the Array on the network. Use a name that will be meaningful within your network environment, up to 64 alphanumeric characters. The default is Xirrus-WiFi-Array. 2. Location Information: Enter a brief but meaningful description that accurately defines the physical location of the Array.
Wireless Array For improved security, you should also take the additional steps described in “Securing Low Level Access to the Array” on page 78. c. 9. Configuration Server Protocol: Choose DHCP to instruct the Array to use DHCP to assign IP addresses to the Array’s Ethernet interfaces, or choose Static if you intend to enter IP addresses manually. If you choose the Static IP option, you must enter the following IP Settings: Address: Enter a valid IP address for this Array.
Wireless Array required to use a VPN connection through a secure SSH utility, like PuTTy. • WEP (Wired Equivalent Privacy) — An optional IEEE 802.11 function that offers frame transmission privacy similar to a wired network. WEP generates secret shared encryption keys that both source and destination stations can use to alter frame bits to avoid disclosure to eavesdroppers. • WPA (Wi-Fi Protected Access) — A Wi-Fi Alliance standard that contains a subset of the IEEE 802.
Wireless Array 10. Admin Settings: This section allows you to change the default admin username, password, and privileges for the Array. You may change the password and leave the user name as is, but we suggest that you change both to improve Array security. a. New Admin User (Replaces user “admin”): Enter the name of a new administrator user account.
Wireless Array b. Time Zone: Select your time zone from the choices available in the pull-down list. c. Auto Adjust Daylight Savings: If you are not using NTP, check this box if you want the system to adjust for daylight savings automatically, otherwise leave this box unchecked (default). d. Use Network Time Protocol: Check this box if you want to use an NTP server to synchronize the Array’s clock.
Wireless Array seconds, am/pm) in the corresponding fields. If you don’t want to adjust the current time, this box should be left unchecked (default). k. Adjust Date (month/day/year): If you are not using NTP, check this box if you want to adjust the current system date. When the box is checked, the date fields become active. Enter the revised date (month, day and year) in the corresponding fields. If you don’t want to adjust the current date, this box should be left unchecked (default). 12.
Wireless Array 14. Click on the Save changes to flash button at the top right if you wish to make your changes permanent. This ends the Express Setup procedure. See Also Establishing Communication with the Array Installation Prerequisites Installation Workflow Logging In Multiple SSIDs Security Securing Low Level Access to the Array Most management of the Xirrus Array is done via the Web Management Interface (WMI) as you just saw in “Performing the Express Setup Procedure” on page 71.
Wireless Array In normal circumstances Xirrus Arrays should be configured and managed through secure shell (SSH) or via the Web Management Interface (WMI). A connection is established using either the Array hostname or DHCP-assigned IP address, or via the other options described in “Using the Ethernet Ports” on page 67. Xircon may be needed in special circumstances as directed by Xirrus Customer Support for troubleshooting Array problems or IP connectivity.
Wireless Array 1. To access CLI via the WMI, click CLI under the Tools section on the left (for detailed instructions see “CLI” on page 371). Skip to Step 4 on page 80. To access CLI via SSH, see “Establishing a Secure Shell (SSH) Connection” on page 377. Then proceed to the next step. 2. At the login as prompt, log in to CLI using the username and password that you set in Step 10 on page 75. login as: jsmith jsmith@xr4012802207c's password: Xirrus Wi-Fi Array ArrayOS Version 6.1.
Wireless Array off disables both CLI and XBL access aos-only enables only CLI (i.e. ArrayOS) access boot-only enables only XBL access Note that there is a WMI setting for changing Xircon access, timeout period, and the UDP port used. This may be used instead of CLI if you wish. See “Management Control” on page 221. Note that you cannot change the XBL username and password via the WMI.
Wireless Array 82 Installing the Wireless Array
Wireless Array The Web Management Interface This topic provides an overview of the Xirrus Wireless Array’s embedded Web Management Interface (WMI), used for establishing your network’s configuration settings and wireless operating parameters. It also includes login instructions.
Wireless Array An Overview The WMI is an easy-to-use graphical interface to your Wireless Array. It allows you to configure the product to suit your individual requirements and ensure that the unit functions efficiently and effectively. Options allow you to choose among different appearances for the WMI. See “Options” on page 373. Figure 38. Web Management Interface—Option = New Style Figure 39.
Wireless Array Figure 40. Web Management Interface—Option = Classic Style Figure 41.
Wireless Array Structure of the WMI The content of the WMI is organized by function and hierarchy, shown in the following table. Click on any item below to jump to the referenced destination.
Wireless Array Configuration Windows Express Setup Network Network Interfaces Network Bonds DNS Settings CDP Settings Services Time Settings (NTP) NetFlow Wi-Fi Tag System Log SNMP DHCP Server VLANs VLAN Management Tunnels Tunnel Management Security Admin Management Admin Privileges Admin RADIUS Management Control Access Control List Global Settings External Radius Internal Radius Rogue Control List SSIDs SSID Management Active IAPs Per-SSID Access Control List Groups Group Management The Web Management In
Wireless Array User Interface Left frame Right frame Array info Top level menu (expand/collapse) Pull-down menu Help Log Message counters Click to configure IAP/view statistics Figure 42.
Wireless Array The WMI has been designed with simplicity in mind, making navigation quick and easy. In the following example, you’ll see that windows are divided into left and right frames. The left frame contains three main elements: Menu organized by function (for example, Network, SSIDs, Security, etc.). Click a heading, such as Network, to display a summary of its current configuration, as well as an associated pull-down menu.
Wireless Array The right frame displays the status information or configuration parameters for the Wireless Array. This is where you review the Array’s current status and activity or input data (if you want to make changes). The green Array information bar at the top of the frame describes the Array — the Name and IP address allow you to quickly confirm that WMI is connected to the correct Array. The current Uptime since the last reboot is also shown.
Wireless Array Utility Buttons At the bottom of each window you will find a set of useful buttons — a Feedback button, a Print button and a Help button. Print button Feedback button Help button Figure 44. WMI: Utility Buttons Click on the Feedback button to generate a Web page that allows you to submit your comments to Xirrus, Inc. Click on the Print button to send a print file of the active window to your local printer. Click on the Help button to access the Array’s online help system.
Wireless Array Logging In Use this procedure to log in to the WMI via your Web browser. 1. Establish a network connection and open your Web browser. 2. If your network supports DHCP and DNS, enter the Array’s default host name in the browser’s URL. The default host name is simply the Array’s serial number (for example, XN0823091CACD). Otherwise, enter the Array’s IP address. This may be determined as described in “Using the Ethernet Ports” on page 67. 3.
Wireless Array after rebooting. This will save the entire current configuration, not only the changes on current WMI page. Character Restrictions When inputting strings in the WMI (for example, assigning SSIDs, host name, password, etc.), use common alphanumeric characters. Some of the fields in the WMI will not accept special characters, so use of the following characters should typically be avoided: & < The Web Management Interface > ' “ / \ 93
Wireless Array 94 The Web Management Interface
Wireless Array Viewing Status on the Wireless Array These windows provide status information and statistics for your Array using the product’s embedded Web Management Interface (WMI). You cannot make configuration changes to your Array from these windows. The following topics have been organized into functional areas that reflect the flow and content of the Status section of the navigation tree in the left frame of the WMI.
Wireless Array Array Status Windows The following Array Status windows are available: Array Summary — displays information on the configuration of all Array interfaces, including IAPs. Array Information — provides version/serial number information for all Array components. Array Configuration — shows all configuration information for the Array in text format. Admin History — shows all current and past logins since the last reboot.
Wireless Array Content of the Array Summary Window The Array Summary window is sub-divided into the Ethernet Interfaces section and the Integrated Access Points (radio) section, providing you with the following information: Ethernet Settings Summary This section provides information about network interface devices. To make configuration changes to these devices, go to “Network Interfaces” on page 171. • Interface: Lists the network interfaces that are available on the Array.
Wireless Array 98 Bond Settings Summary This section provides information about the relationship that has been selected for the Gigabit ports. For detailed explanations and to make configuration changes, see “Network Bonds” on page 175. • Bond: Lists all network bonds that have been configured. • Mode: Shows the type of relationship that has been selected for the Gigabit ports. • Ports: Shows the Gigabit ports that are part of this bond.
Wireless Array Figure 47. Disabled IAP (Partial View) • Channel: Shows which channel each IAP is using, and the channel setting. To avoid co-channel interference, adjacent radios should not be using adjacent channels. To make channel selections for a specific IAP, go to “IAP Settings” on page 274. • Wi-Fi Mode: Shows the 802.11 client types that the IAP has been configured to support. • Antenna: Shows which antenna is being used by each IAP.
Wireless Array Figure 48. IAP Cells 100 • Tx Power: Shows the transmit power for each IAP. • Rx Threshold: Shows the receive threshold for each IAP. • Stations: Informs you how many client stations are currently associated with each IAP. • WDS Link/Distance: The WDS Link on this radio (if any), and whether the link has been set to support Long Distance Links. See “WDS” on page 338. • MAC Address/BSSID: Shows the MAC address for each IAP.
Wireless Array Array Information This is a status only window that shows you the current firmware versions utilized by the Array, serial numbers assigned to each module, MAC addresses, licensing information, recent boot timestamps, and current internal temperatures and fan speed. Note that the License Features row lists the features that are supported by your Array’s license. See “About Licensing and Upgrades” on page 361 and “Advanced Feature Sets” on page 16 for more information. Figure 49.
Wireless Array You cannot make configuration changes in this window, but if you are experiencing issues with network services, you may want to print the content of this window for your records. Array Configuration This is a status only window that allows you to display the configuration settings assigned to the Array, based on the following filter options: Running — displays the current configuration (the one running now). Saved — displays the saved configuration from this session.
Wireless Array To also include the default configuration settings in the output, choose your configuration then click in the Include Defaults check box. If Include Defaults is disabled, then only the changes from the default configuration are shown. Admin History It is useful to know who else is currently logged in to an array while you're configuring it. It's also nice to see who has logged in since the array booted.
Wireless Array DHCP Leases — displays information about IP addresses (leases) that the Array has allocated to client stations. Connection Tracking/NAT — lists connections that have been established for client stations. CDP Neighbors — lists neighboring network devices using Cisco Discovery Protocol. Network Assurance — shows results of connectivity tests for network servers. Undefined VLANs — shows VLANs present on an 802.
Wireless Array WMI windows that allow you to change or view configuration settings associated with the network interfaces include: “Network Interfaces” on page 171 “Network Bonds” on page 175 “DNS Settings” on page 181 “CDP Settings” on page 183 Network Map This window offers detailed information about this Array and all neighboring Arrays, including how the Arrays have been set up within your network. Figure 53.
Wireless Array Content of the Network Map Window By default, the network map shows the following status information for each Array: 106 Array Name: The host name assigned to the Array. To establish the host name, go to “Express Setup” on page 161. You may click the host name to access WMI for this Array. IP Address: The Array’s IP address. You may click the address to access WMI for this Array. If DHCP is enabled, the Array’s IP address is assigned by the DHCP server.
Wireless Array To see additional information, select from the following checkboxes at the bottom of the page. This will show the columns described below. Hardware Model: The model number of each Array (XR-4820, XR-7630, etc.), plus the amount of RAM memory and the speed of the processor. Serial: Displays the serial number of each Array. License License: The license key of each Array. Licensed Features: Lists the optional features enabled by the key, if any.
Wireless Array Spanning Tree Status Multiple active paths between stations can cause loops in the network. If a loop exists in the network topology, the potential exists for the duplication of messages. The spanning tree protocol is a link management protocol that provides path redundancy while preventing undesirable loops. For a wireless network to function properly, only one active path can exist between two stations.
Wireless Array Routing Table This status-only window lists the entries in the Array’s routing table. The table provides the Array with instructions for sending each packet to its next hop on its route across the network. Figure 55. Routing Table See Also VLANs Configuring VLANs on an Open SSID ARP Table This status-only window lists the entries in the Array’s ARP table. For a device with a given IP address, this table lists the device’s MAC address.
Wireless Array DHCP Leases This status-only window lists the IP addresses (leases) that the Array has allocated to client stations. For each, it shows the IP address assigned from one of the defined DHCP pools, and the MAC address and host name of the client station. The start and end time of the lease show how long the allocation is valid. The same IP address is normally renewed at the expiration of the current lease. Figure 57.
Wireless Array Click the Show Hostnames checkbox at the top of the page to display name information (if any) for the source and destination location of the connection. The Hostname columns will replace traffic statistics columns. You may sort the rows based on any column that has an active column header, indicated when the mouse pointer changes to the hand icon . Click Refresh to update the information at any time. Click Auto Refresh to instruct the Array to refresh this window automatically.
Wireless Array Network Assurance This status-only window shows the results of ongoing network assurance testing. Figure 60. Network Assurance The Array checks connectivity to network servers that you have configured (for example, DNS and NTP servers) on an ongoing basis. For each server, this list shows the server’s host name (if any), IP address, and status. Network assurance must be enabled on the Array in order to perform these connectivity tests and display this information.
Wireless Array Undefined VLANs This status-only window lists VLANs that have not been configured on the Array, but that are being detected on the Array’s trunk port(s), i.e. wired ports. See “VLANs” on page 199. Figure 61. Undefined VLANs This feature alerts you to the fact that an 802.1Q trunk to the Array has VLANs that are not being properly handled on the Array. To reduce unnecessary traffic, only VLANs that are actually needed on the Array should normally be on the trunk, e.g.
Wireless Array RF Monitor Windows Every Wireless Array includes an integrated RF spectrum analyzer as a standard feature. The spectrum analyzer allows you to characterize the RF environment by monitoring throughput, signal, noise, errors, and interference levels continually per channel. This capability uses the assigned threat-sensor (monitor) radio. The associated software is part of the ArrayOS.
Wireless Array IAPs The RF Monitor — IAPs window displays traffic statistics and RF readings observed by each Array IAP (radio). Note that the data is an instantaneous snapshot for the IAP — it is not an average or a cumulative total. To graph these values over time for a particular channel, see “Channel History” on page 121. For detailed information on the measurements displayed, please see “Spectrum Analyzer Measurements” on page 118. Figure 62.
Wireless Array You may sort the rows based on any column that has an active column header, indicated when the mouse pointer changes to the hand icon . Click Refresh to update the information at any time. Click Auto Refresh to instruct the Array to refresh this window automatically. Spectrum Analyzer The RF measurements for this feature are obtained by the monitor radio. You must have a radio set to monitor mode for any data to be available. See “IAP Settings” on page 274.
Wireless Array Select Display Options Click Channel number to highlight Figure 64. RF Spectrum Analyzer The Spectrum Analyzer offers several display options: To display horizontal bar graphs, click the Rotate checkbox at the bottom of the data window. In the rotated view, if you wish to view data as a numerical table, click the Text checkbox. Click again to return to a graphical display. The text option is only available in the rotated view.
Wireless Array When viewing a graphical display, click Bars to have the bar graphs displayed against a gray background — you may find this easier on the eyes. This operation is not available when Text is selected. You may sort the rows based on any column that has an active column header, indicated when the mouse pointer changes to the hand icon Sorting is only available in the rotated view. . At the bottom left of the frame, you may select whether to display only 2.
Wireless Array some channels since the monitor radio is set to receive at a very sensitive level, enabling it to hear packets from devices at far distances. Average RSSI: Average RSSI level seen on 802.11 packets received on the channel. A dash value “-“means no RSSI data was available for the interval. Average Data Rate: Average data rate over time (per byte, not per packet) seen on 802.11 packets received on the channel. A dash value “-“means no data rate information was available for the interval.
Wireless Array The Intrusion Detection window provides the easiest method for classifying rogue APs as Blocked, Known, Approved, or Unknown. Choose one or more APs using the checkbox in the Select column, then use the buttons on the upper left to classify them with the following actions: Approve, Set Known, Block, or Set Unknown.
Wireless Array Channel History The RF Monitor — Channel History window focuses on traffic statistics and RF readings observed for just one channel that you select in the Channel field. A new set of readings is added every 10 seconds for a 5 GHz channel, or every 5 seconds for a 2.4 GHz channel. For descriptions of the measurements displayed, please see “Spectrum Analyzer Measurements” on page 118. Figure 66. RF Monitor — Channel History Figure 66 presents the data in graphical form.
Wireless Array Figure 67. RF Monitor — Channel History (Rotated) If you select Rotate and Text together, data is presented as a numerical table. (Figure 68) Click Pause to stop collecting data, or Resume to continue. Figure 68.
Wireless Array Radio Assurance Radio Assurance mode is only available if the Array’s license includes the Xirrus Advanced RF Analysis Manager (RAM). If a setting is unavailable (grayed out), then your license does not support the feature. Please see “About Licensing and Upgrades” on page 361. When Radio Assurance mode is enabled, the monitor radio performs loopback tests on the Array’s radios.
Wireless Array times, if any, that radio assurance has performed each of the following types of resets since the last reboot, as described in Radio Assurance: Monitor Beacon Phy MAC System (i.e.
Wireless Array Station Status Windows The following Station Status windows are available: Stations — this list describes all stations associated to the Array. Location Map — displays a map showing the approximate locations of all stations associated to the array. RSSI — for each associated station, this displays the Received Signal Strength Indicator at each of the Array’s IAPs. Signal-to-Noise Ratio (SNR) — for each associated station, this displays the SNR at each of the Array’s IAPs.
Wireless Array Stations This status-only window shows client stations currently visible to the Array. You may choose to view only stations that have Associated to the Array, or only stations that are Unassociated, or both, by selecting the appropriate checkboxes above the list.
Wireless Array reverse the sort order. You may select a specific station and perform one of the following actions by clicking the associated button: Deny Access: Sends a de-authentication frame to the selected station and explicitly denies it access by adding its MAC address to the Deny List in the Access Control List window. To permit access again, go to “Access Control List” on page 227 and delete the station from the Deny list.
Wireless Array Location Map The Location Map shows the approximate locations of stations relative to this Array. The location of each station is computed based on the RSSI of its signal as received by the Array. The distance is adjusted based on the environment setting that you selected. You may display just the stations associated to this Array, unassociated stations (shown in gray), or both. The station count is shown on the right, above the map.
Wireless Array completely obscure another. You may minimize a station that is not of interest by clicking it. There is also a Minimize All button. You may replace the range-finder background image above with your own custom image of the floorplan of the area served by the Array — see “Working with the Custom Image” on page 131 Hover the mouse over a station to show detailed information.
Wireless Array Display Associated/Unassociated: Select whether to display stations that are associated to the Array, stations that are not associated, or both. Display 2.4 GHz/5 GHz: Select whether to display 802.11bgn stations, or 802.11an stations, or both. Preferred Label: This field is located on the top of the window towards the right. It selects the type of label to be displayed for stations: Netbios Name, IP Address, MAC Address, or Manufacturer.
Wireless Array Environment: This field is located on the top right of the window. Select the type of environment for this Array’s deployment: Indoor open (few walls or obstructions), Indoor walled (typical wall or cubicle construction), or Indoor dense (many walls or obstructions, or unusually dense walls). Scale: This view-only value shows the approximate distance represented by each hashmark on the default map background.
Wireless Array RSSI For each station that is associated to the Array, the RSSI (Received Signal Strength Indicator) window shows the station’s RSSI value as measured by each IAP. In other words, the window shows the strength of the station’s signal at each radio. You may choose to display Unassociated Stations as well with a checkbox at the bottom of the window. Figure 73. Station RSSI Values By default, the RSSI is displayed numerically.
Wireless Array the Auto Refresh check box to instruct the Array to refresh this window automatically. See Also Station Status Windows RF Monitor Windows Signal-to-Noise Ratio (SNR) For each station that is associated to the Array, the Signal-to-Noise Ratio (SNR) window shows the station’s SNR value as measured by each IAP. In other words, the window shows the SNR of the station’s signal at each IAP radio.
Wireless Array Figure 76. Station SNR Values — Colorized Graphical View In either graphical or tabular view, you may sort the rows based on any column that has an active column header, indicated when the mouse pointer changes to the hand icon . Click on the Refresh button to refresh the station list, or click in the Auto Refresh check box to instruct the Array to refresh this window automatically.
Wireless Array Noise Floor For each station that is associated to the Array, the Noise Floor window shows the ambient noise affecting a station’s signal as measured by each IAP. The noise floor is the RSSI value when the station is not transmitting, sometimes called a Silence value. In other words, the window shows the noise floor of the station’s signal at each IAP radio. The noise floor value can be very useful for characterizing the environment of a station to determine the cause of poor performance.
Wireless Array Figure 78. Station Noise Floor Values — Colorized Graphical View In either graphical or tabular view, you may sort the rows based on any column that has an active column header, indicated when the mouse pointer changes to the hand icon . Click on the Refresh button to refresh the station list, or click in the Auto Refresh check box to instruct the Array to refresh this window automatically.
Wireless Array Max by IAP This status-only window shows the maximum number of client stations that have historically been associated to the Array. For each IAP, the list shows the IAP’s state and channel number, the current number of stations associated, and the highest number of stations that have been associated over various periods of time: hour, day, week, month, and year.
Wireless Array Station Assurance Station assurance monitors the quality of the connections that users are experiencing on the wireless network. This window shows client stations that have had connectivity issues. You may enable or disable the station assurance feature and set thresholds for the problems that it checks, such as excessive packet retry or packet error rates, or stations that are unable to stay associated to the Array.
Wireless Array See Also IAPs Station Status Windows Station Assurance Viewing Status on the Wireless Array 139
Wireless Array Statistics Windows The following Array Statistics windows are available: IAP Statistics Summary — provides an overview of the statistical data associated with all IAPs. Expands to show links for displaying detailed statistics for individual IAPs. Per-IAP Statistics — provides detailed statistics for an individual IAP. Network Statistics — displays statistical data associated with each network (Ethernet) interface.
Wireless Array You can Refresh the data (update the window with the latest information) or Clear the data (reset all content to zero and begin counting again) at any time by clicking on the appropriate button. You can also click in the Auto Refresh check box to instruct the Array to refresh this window automatically. See Also System Log Window Global Settings (IAP) Global Settings .11an Global Settings .
Wireless Array Figure 82. Individual IAP Statistics Page You can Refresh the data (update the window with the latest information) or Clear the data (reset all content to zero and begin counting again) at any time by clicking on the appropriate button. You can also click in the Auto Refresh check box to instruct the Array to refresh this window automatically. See Also System Log Window Global Settings (IAP) Global Settings .11an Global Settings .
Wireless Array Network Statistics This is a status only window that allows you to review statistical data associated with each network (Ethernet) interface and its activity. You can Refresh the data (update the window with the latest information) or Clear the data (reset all content to zero and begin counting again) at any time by clicking on the appropriate button. You can also click in the Auto Refresh check box to instruct the Array to refresh this window automatically.
Wireless Array VLAN Statistics This is a status only window that allows you to review statistical data associated with your assigned VLANs. You can refresh the information that is displayed on this page at any time by clicking on the Refresh button, or select the Auto Refresh option for this window to refresh automatically. The Clear All button at the lower left allows you to clear (zero out) all VLAN statistics. Figure 84.
Wireless Array WDS Statistics The main WDS Statistics window provides statistical data for all WDS client and host links. To access data about a specific WDS client or host link, simply click on the desired link in the left frame to access the appropriate window. You may also choose to view a sum of the statistics for all client links, all host links, or all links (both client and host links). Figure 85.
Wireless Array IDS Statistics The Xirrus Array employs a number of IDS/IPS (Intrusion Detection System/ Intrusion Prevention System) strategies to detect and prevent malicious attacks on the wireless network. This status-only window provides detailed intrusion detection statistics for the selected IAP. Use the Display Averages checkbox at the upper left to select the output format — check this option to express each statistic as an average rate, or leave it blank to display raw counts.
Wireless Array Filter Statistics The Filter Statistics window provides statistical data for all configured filters. The name, state (enabled — on or off), and type (allow or deny) of each filter is shown. For enabled filters, this window shows the number of packets and bytes that met the filter criteria. Click on a column header to sort the rows based on that column. Click on a filter name to edit the filter settings. Figure 87.
Wireless Array Station Statistics This status-only window provides an overview of statistical data for all stations. Stations are listed by MAC address, and Receive and Transmit statistics are summarized for each. For detailed statistics for a specific station, click the desired MAC address in the Station column and see “Per-Station Statistics” on page 149. Figure 88.
Wireless Array Per-Station Statistics This window provides detailed statistics for the selected station. This window is accessed from the Station Statistics window — click the MAC address of the desired entry in the Station column to display its Per-Station Statistics window. Receive and Transmit statistics are listed by Rate — this is the data rate in Mbps. For a summary of statistics for all stations, see “Station Statistics” on page 148.
Wireless Array Application Control Windows This feature is only available if the Array license includes Application Control. See “About Licensing and Upgrades” on page 361. Application Control data is only available from XR Series Array models. It is not available on XN Arrays. The Application Control feature provides real-time visibility of application usage by users across the wireless network.
Wireless Array Traffic flows for specific applications may be controlled by sending them into VLANs that are designated for that type of traffic. Application Control can track application usage over time to monitor trends. Usage may be tracked by Array, VLAN, or station. Many hundreds of applications are recognized and grouped into a number of categories. The distributed architecture of Xirrus Arrays allows Application Control to scale naturally as you grow the network.
Wireless Array The Application Control window has three sections: Selection Criteria allow you to choose the type of data to show, and to filter for a single VLAN or station. Pie Charts present a color coded at-a-glance view of the top ten applications being used by the network. Traffic Tables beneath the pie charts list the applications in use along with traffic statistics.
Wireless Array By Category: Check this box if you wish to analyze and list traffic by what types of applications are in use, such as Games or Collaboration. Auto Refresh instructs the Array to periodically refresh this window automatically. Use the Refresh button to refresh the window right now. Pie Charts Figure 91. Application Control (Pie Charts) These charts provide a quick way to determine how your wireless bandwidth is being used.
Wireless Array Traffic Tables Figure 92. Application Control (Station Traffic) These tables provide detailed information about how your wireless bandwidth is being used. There are tables for Station Traffic and/or Array Management Traffic, depending on which checkboxes you selected. Similarly, there are tables for By Application and/or By Category, depending on your selections. In addition to showing traffic statistics, there are two unique and highly useful columns.
Wireless Array When you find risky or unproductive applications taking up bandwidth on the network, you can easily create Filters to control them. See “Filter Management” on page 347. You may use filters to: Block problematic traffic, such as BitTorrent or Y8. Prioritize mission critical traffic—by increasing the QoS assigned to the traffic. See “Understanding QoS Priority on the Wireless Array” on page 244.
Wireless Array System Log Window This is a status only window that allows you to review the system log, where system alerts and messages are displayed. Although there are no configuration options available in this window, you do have the usual choice of deciding how the event messages are sorted by clicking in the column header for the desired field (Time Stamp, Priority, or Message). Time Stamp — sorts the list based on the time the event occurred.
Wireless Array IDS Event Log Window This status only window displays the Intrusion Detection System (IDS) Event log, listing any detected attacks on your network. For descriptions of the types of attacks detected, as well as the settings to fine-tune IDS on the Array, please see “Intrusion Detection” on page 328. The displayed messages may be filtered by using the Filter Event setting, which allows you to select just one type of intrusion to display.
Wireless Array 158 Period — the length of the window used to determine whether the count of this type of event exceeded the threshold. Current — the count of this type of event for the current period. Average — the average count per period of this type of event. Maximum — the maximum count per period of this type of event.
Wireless Array Configuring the Wireless Array The following topics include procedures for configuring the Array using the product’s embedded Web Management Interface (WMI). Procedures have been organized into functional areas that reflect the flow and content of the WMI.
Wireless Array Note that the Configuration menu section may be collapsed down to hide the headings under it by clicking it. Click again to display the headings. (See Figure 43 on page 89.) This chapter only discusses using the configuration windows on the Array.
Wireless Array Express Setup Use the Express Setup page to establish global configuration settings that enable basic Array functionality. Any changes you make in this window will affect all radios. Figure 96.
Wireless Array When finished, click Save changes to flash if you wish to make your changes permanent. Procedure for Performing an Express Setup 1. Host Name: Specify a unique host name for this Array. The host name is used to identify the Array on the network. Use a name that will be meaningful within your network environment, up to 64 alphanumeric characters. The default is the Array’s serial number. 2.
Wireless Array a. Enable Interface: Choose Yes to enable this network interface, or choose No to disable the interface. b. Allow Management on Interface: Choose Yes to allow management of the Array via this Gigabit interface, or choose No to deny all management privileges for this interface. Note that for XN Arrays, the 10/100 Ethernet port is also known as the Management Port, and management is always enabled on this port. c. 9.
Wireless Array b. Wireless Security: Select the desired wireless security scheme (Open, WEP or WPA). Make your selection from the choices available in the pull-down list. • Open — This option offers no data encryption and is not recommended, though you might choose this option if clients are required to use a VPN connection through a secure SSH utility, like PuTTy. • WEP (Wired Equivalent Privacy) — An optional IEEE 802.11 function that offers frame transmission privacy similar to a wired network.
Wireless Array d. Confirm Encryption Key/Passphrase: If you entered a WEP key or WPA passphrase, confirm it here. e. Click Apply SSID Settings when done. 10. Admin Settings: This section allows you to change the default admin username, password, and privileges for the Array. You may change the password and leave the user name as is, but we suggest that you change both to improve Array security. a. New Admin User (Replaces user “admin”): Enter the name of a new administrator user account.
Wireless Array b. Time Zone: Select your time zone from the choices available in the pull-down list. c. Auto Adjust Daylight Savings: If you are not using NTP, check this box if you want the system to adjust for daylight savings automatically, otherwise leave this box unchecked (default). d. Use Network Time Protocol: Check this box if you want to use an NTP server to synchronize the Array’s clock.
Wireless Array j. Adjust Time (hrs:min:sec): If you are not using NTP, check this box if you want to adjust the current system time. When the box is checked, the time fields become active. Enter the revised time (hours, minutes, seconds, am/pm) in the corresponding fields. If you don’t want to adjust the current time, this box should be left unchecked (default). k. Adjust Date (month/day/year): If you are not using NTP, check this box if you want to adjust the current system date.
Wireless Array 14. Click Save changes to flash at the upper right to make your changes permanent, i.e., these settings will still be in effect after a reboot.
Wireless Array Network This is a status-only window that provides a snapshot of the configuration settings currently established for the Ethernet interfaces. DNS Settings and CDP Settings (Cisco Discovery Protocol) are summarized as well. You must go to the appropriate configuration window to make changes to any of the settings displayed here (configuration changes cannot be made from this window). You can click on any item in the Interface column to “jump” to the associated configuration window.
Wireless Array Spanning Tree Status Network Statistics 170 Configuring the Wireless Array
Wireless Array Network Interfaces XR500, XR-1000, and XR-2000 Series Arrays have one Gigabit Ethernet interface, while XR-4000 Series Arrays have two, and XR-6000 Series models have four. This window allows you to establish configuration settings for these interfaces. Figure 99.
Wireless Array On XN Series Arrays, this window configures the 10/100 Fast Ethernet interface and the Gigabit 1 and Gigabit2 interfaces When finished making changes, click Save changes to flash if you wish to make your changes permanent. When the status of a port changes, a Syslog entry is created describing the change. Network Interface Ports The following diagram shows the location of network interface ports on the underside of an XR Series Array.
Wireless Array 2. LED Indicator: Choose Enabled to allow the LED for this interface to blink with traffic on the port, or choose Disabled to turn the LED off. The LED will still light during the boot sequence, then turn off. This option is only available for the Gigabit interfaces. 3. Allow Management on Interface: Choose Yes to allow management of this Array via the selected network interface, or choose No to deny all management privileges for this interface.
Wireless Array 5. Configuration Server Protocol / IP Settings: Choose DHCP to instruct the Array to use DHCP when assigning IP addresses to the Array, or choose Static IP if you intend to enter IP addresses manually. If you select the Static IP option you must specify the IP address, IP subnet mask and default gateway. a. Address: If you selected the Static IP option, enter a valid IP address for the Array. To use any of the remote connections (Web, SNMP, or SSH), a valid IP address must be established.
Wireless Array Network Bonds On models with more than one Gigabit port these ports may be bonded, i.e. configured to work together in sets. For example, one port may provide active backup or load balancing for another, or other options as described in this section. XR-6000 Series Arrays have four Gigabit ports, and you may specify which ports are bonded to work together as a pair. You may also select more than two ports to work together in one group.
Wireless Array If a set of Gigabit ports have been bonded, the IP address, IP mask, IP gateway, IP DHCP, and Management settings are shared between bonded ports. Any changes you make to these settings on one member will be reflected in the settings of the other members. Other settings may be configured individually. Procedure for Configuring Network Bonds Configure the bonding behavior of the Gigabit network interfaces. The fields for each of these bonds are the same, and include: 1.
Wireless Array (a) Active backup (b) Aggregate using 802.3ad Figure 102. Port Modes (a, b) b. Aggregate Traffic from gig ports using 802.3ad — The Array sends network traffic across all member Gigabit ports to increase link speed to the network. These ports act as a single logical interface, using a load balancing algorithm to balance traffic across the ports. For nonIP traffic (such as ARP), the last byte of the destination MAC address is used to do the calculation.
Wireless Array (c) Transmit on all ports Figure 103. Port Modes (c) (d) Load balance traffic Figure 104.
Wireless Array d. Load balance traffic between gig ports — This option provides trunking, similar to option (b) — Aggregate Traffic from gig1 & gig2 using 802.3ad, but it does not use 802.3ad and it uses a different load balancing algorithm to determine the outgoing Gigabit port. The outgoing port used is based on an exclusive OR of the source and destination MAC address. Like option (b), this mode also provides load balancing and fault tolerance. See Figure 104 (d). 2.
Wireless Array Active VLANs list. If you create new VLANs, they will not be passed unless you take action to add them to the list. 5. Mirror — Specify one of the active bonds (Bondx) that is to be mirrored by this bond (Bondy). (Figure 105) All wireless traffic received on the Array is transmitted out both Bondx and Bondy. All traffic received on Bondx is passed on to the onboard processor as well as out Bondy. All traffic received on Bondy is passed on to the onboard processor as well as out Bondx.
Wireless Array 6. When done configuring bonds as desired, click Save changes to flash if you wish to make your changes permanent. See Also Network Interfaces DNS Settings Network Network Statistics Spanning Tree Status DNS Settings This window allows you to establish your DNS (Domain Name System) settings. The Array uses these DNS servers to resolve host names into IP addresses.
Wireless Array Procedure for Configuring DNS Servers 1. DNS Host Name: Enter a valid DNS host name. 2. DNS Domain: Enter the DNS domain name. 3. DNS Server 1: Enter the IP address of the primary DNS server. 4. DNS Server 2 and DNS Server 3: Enter the IP address of the secondary and tertiary DNS servers (if required). 5. Use DNS settings assigned by DHCP: If you are using DHCP to assign the Array’s IP address, you may turn this option On.
Wireless Array CDP Settings CDP (Cisco Discovery Protocol) is a layer 2 network protocol used to share information (such as the device manufacturer and model, network capabilities, and IP address) with other directly connected network devices. Wireless Arrays can both advertise their presence by sending CDP announcements, and gather and display information sent by neighbors (see “CDP Neighbors” on page 111). This window allows you to establish your CDP settings.
Wireless Array Services This is a status-only window that allows you to review the current settings and status for services on the Array, including DHCP, SNMP, Syslog, and Network Time Protocol (NTP) services. For example, for the DHCP server, it shows each DHCP pool name, whether the pool is enabled, the IP address range, the gateway address, lease times, and the DNS domain being used.
Wireless Array Time Settings (NTP) This window allows you to manage the Array’s time settings, including synchronizing the Array’s clock with a universal clock from an NTP (Network Time Protocol) server. We recommend that you use NTP for proper operation of SNMP in XMS (the Xirrus Management System), since a lack of synchronization will cause errors to be detected. Synchronizing the Array’s clock with an NTP server also ensures that Syslog time-stamping is maintained across all units.
Wireless Array 5. Setting Time Manually a. Adjust Time (hrs:min:sec): If you are not using NTP, check this box if you want to adjust the current system time. When the box is checked, you may enter a revised time (hours, minutes, seconds, am/pm) in the corresponding fields. If you don’t want to adjust the current time, this box should be left unchecked (default). b. Adjust Date (month/day/year): If you are not using NTP, check this box if you want to adjust the current system date.
Wireless Array d. NTP Primary Authentication Key: Enter your key, which is a string of characters. e. NTP Secondary Server: Enter the IP address or domain name of an optional secondary NTP server to be used in case the Array is unable to contact the primary server. You may use the authentication fields as described above if you wish to set up authentication for the secondary server.
Wireless Array interfaces allows administrators to track usage by various areas. Traffic flow information may be used to engineer networks for better performance. Some features, such as Netflow, are only available if the Array’s license includes the Xirrus Advanced RF Analysis Manager (RAM). If a setting is unavailable (grayed out), then your license does not support the feature. See “About Licensing and Upgrades” on page 361. Procedure for Configuring NetFlow 1.
Wireless Array Procedure for Configuring Wi-Fi Tag 1. Enable Wi-Fi Tag: Choose Yes to enable Wi-Fi tag functionality, or choose No to disable this feature. 2. Wi-Fi Tag UDP Port: If you enabled Wi-Fi tagging, enter the port on the Array which the Wi-Fi tagging server will use to query the Array for tagging data. When queried, the Array will send back information on the tags it has observed.
Wireless Array System Log This window allows you to enable or disable the Syslog server, define primary, secondary, and tertiary servers, set up email notification, and set the level for Syslog reporting for each server and for email notification — the Syslog service will send Syslog messages at the selected severity or above to the defined Syslog servers and email address.
Wireless Array 3. Local File Size (1-2000 lines): Enter a value in this field to define how many Syslog records are retained locally on the Array’s internal Syslog file. The default is 2000. 4. Primary Server Address (Hostname or IP) and Port: If you enabled Syslog, enter the hostname or IP address of the primary Syslog server. You may also change the port used on the server if you do not wish to use 514, the default port. 5.
Wireless Array additional recipients by separating the email addresses with semicolons (;). 7. Station Formatting: If you are sending event information to a Splunk server, select Key/Value to send data in Splunk’s expected format, otherwise leave this at the default value of Standard. See “About Using the Splunk Application for Xirrus Arrays” on page 193. 8. Syslog Levels: For each of the Syslog destinations, choose your preferred level of Syslog reporting from the pull-down list.
Wireless Array About Using the Splunk Application for Xirrus Arrays Splunk may be used to provide visibility into client experience and analyze usage on XR Series Wireless Arrays. A Splunk application (Splunk for Xirrus XR Wireless Arrays) has been developed to present this operational intelligence at a glance. The app includes field extractions, event types, searches and dashboards to help shine a light on station status and activity.
Wireless Array SNMP This window allows you to enable or disable SNMP v2 and SNMP v3 and define the SNMP parameters. SNMP allows remote management of the Array by the Xirrus Management System (XMS) and other SNMP management tools. SNMP v3 was designed to offer much stronger security. You may enable either SNMP version, neither, or both. Complete SNMP details for the Array, including trap descriptions, are found in the Xirrus MIB, available at support.xirrus.
Wireless Array Procedure for Configuring SNMP SNMPv2 Settings 1. Enable SNMPv2: Choose Yes to enable SNMP v2 functionality, or choose No to disable this feature. When used in conjunction with the Xirrus Management System, SNMP v2 (not SNMP v3) must be enabled on each Array to be managed with XMS. The default for this feature is Yes (enabled). 2. SNMP Read-Write Community String: Enter the read-write community string. The default is xirrus. 3.
Wireless Array 10. SNMP Read-Write Privacy Password: Enter the read-write password for privacy (i.e., a key for encryption). The default is xirrus-rw. 11. SNMP Read-Only Username: Enter the read-only user name. This username and password do not allow configuration changes to be made on the Array. The default is xirrus-ro. 12. SNMP Read-Only Authentication Password: Enter the read-only password for authentication (i.e., logging in). The default is xirrus-ro. 13.
Wireless Array System Log Time Settings (NTP) DHCP Server This window allows you to create, enable, modify and delete DHCP (Dynamic Host Configuration Protocol) address pools. DHCP allows the Array to provide wireless clients with IP addresses and other networking information. The DHCP server will not provide DHCP services to the wired side of the network.
Wireless Array 3. Lease Time — Default: This field defines the default DHCP lease time (in seconds). The factory default is 300 seconds, but you can change the default at any time. 4. Lease Time — Max: Enter a value (in seconds) to define the maximum allowable DHCP lease time. The default is 300 seconds. 5. Network Address Translation (NAT): Check this box to enable the Network Address Translation feature. 6.
Wireless Array VLANs This is a status-only window that allows you to review the current status of configured VLANs. VLANS are virtual LANs used to create broadcast domains. You should create VLAN entries on the Array for all of the VLANs in your wired network if you wish to make traffic from those VLANs available on the wireless network. Each tagged VLAN should be associated with a wireless SSID (see “VLAN Management” on page 201).
Wireless Array Virtual Tunnel Server (VTS) Tunneling capability is provided by a Virtual Tunnel Server. You supply the server and deploy it in your network using open-source VTun software, available from vtun.sourceforge.net. To enable the Array to use tunneling for a VLAN, simply enter the IP address, port and secret for the tunnel server as described in Step 11 on page 203. VTun may be configured for a number of different tunnel types, protocols, and encryption types.
Wireless Array VLAN Management This window allows you to assign and configure VLANs. After creating a new VLAN (added to the list of VLANs), you can modify the configuration parameters of an existing VLAN or delete a selected VLAN. You may create up to 32 VLANs. Figure 117. VLAN Management The Wireless Array supports dynamic VLAN assignments specified by RADIUS policy settings. When RADIUS sends these assignments, the Array dynamically assigns wireless stations to VLANs as requested.
Wireless Array Procedure for Managing VLANs 202 1. Default Route: This option sets a default route from the Array. The Array supports a default route on native and tagged interfaces. Once the default route is configured the Array will attempt to use Address Resolution Protocol (ARP) to find the default router. ARP finds the MAC address of a device with a given IP address by sending out a broadcast message requesting this information.
Wireless Array 10. Gateway: If the DHCP option is disabled, enter the IP gateway address for this VLAN association. 11. Tunnel Server: If this VLAN is to be tunneled, enter the IP address or host name of the tunnel server that will perform the tunneling. For more information on virtual tunnels, please see “Understanding Virtual Tunnels” on page 199. 12. Port: If this VLAN is to be tunneled, enter the port number of the tunnel server. 13. New Secret: Enter the password expected by the tunnel server. 14.
Wireless Array Tunnels This read-only window allows you to review the tunnels that have been defined on the Array. It lists all tunnels and their settings, including the type of authentication and the local and remote endpoints for each tunnel. Figure 118. Tunnel Summary About Xirrus Tunnels Xirrus Arrays offer GRE (Generic Routing Encapsulation) tunneling with VLAN support.
Wireless Array encapsulation is stripped and the resultant packets are passed to your switch with 802.1q VLAN tags for final Layer 2 processing. The process occurs in reverse for packets traveling in the other direction. One tunnel is able to transport up to 16 VLANs. Tunnel Management This window allows you to create tunnels. Figure 119. Tunnel Management Procedure for Managing Tunnels 1. New Tunnel Name: Enter a name for the new tunnel in this field, then click on the Create button.
Wireless Array 8. MTU: Set maximum transmission unit (MTU) size. 9. Interval: The tunnel mechanism will ping the current remote endpoint periodically to ensure that it is still reachable. Enter the ping interval (in seconds). 10. Failures: Enter the number of consecutive ping failures that will cause the Array to consider the tunnel to be down. 11. Click Save changes to flash if you wish to make your changes permanent. 12.
Wireless Array 1. For each tunnel, select the SSIDs that are to be bridged to the remote endpoint. Clear the checkbox for any SSID that you no longer wish to include in the tunnel. 2. Click Save changes to flash if you wish to make your changes permanent.
Wireless Array Security This status- only window allows you to review the Array’s security parameters. It includes the assigned network administration accounts, Access Control List (ACL) values, management settings, encryption and authentication protocol settings, and RADIUS configuration settings. There are no configuration options available in this window, but if you are experiencing issues with security, you may want to print this window for your records. Figure 121.
Wireless Array Security settings are configured with the following windows: “Admin Management” on page 214 “Admin Privileges” on page 216 “Admin RADIUS” on page 218 “Management Control” on page 221 “Access Control List” on page 227 “Global Settings” on page 230 “External Radius” on page 234 “Internal Radius” on page 238 “Rogue Control List” on page 240 Understanding Security The Xirrus Wireless Array incorporates many configurable security features.
Wireless Array The Array allows you to establish the following data encryption configuration options: • Open — this option offers no data encryption and is not recommended, though you might choose this option if clients are required to use a VPN connection through a secure SSH utility, like PuTTy. • WEP (Wired Equivalent Privacy) — this option provides minimal protection (though much better than using an open network).
Wireless Array The encryption mode (WEP, WPA, etc.) is selected in the SSIDs >SSID Management window (see “SSID Management” on page 249). The encryption standard used with WPA or WPA2 (AES or TKIP) is selected in the Security>Global Settings window under WPA Settings (see “Global Settings” on page 230). Choosing an authentication method: User authentication ensures that users are who they say they are.
Wireless Array address in the Deny list. The Wireless Array will accept up to 1,000 ACL entries. Certificates and Connecting Securely to the WMI When you point your browser to the Array to connect to the WMI, the Array presents an X.509 security certificate to the browser to establish a secure channel. One significant piece of information in the certificate is the Array’s host name. This ties the certificate to a particular Array and ensures the client that it is connecting to that host.
Wireless Array The Array’s certificate is signed by a Xirrus CA that is customized for your Array and its current host name. By default, browsers will not trust the Array’s certificate. You may import the Xirrus certificate to instruct the browser to trust the Xirrus CA on all future connections to Arrays. The certificate for the Xirrus CA is available on the Array, so that you can import it into your browser’s cache of trusted CAs (right alongside VeriSign, for example).
Wireless Array you obtain it from the CA. This certificate will be tied to the Array’s host name and private key. See “External Certification Authority” on page 226 for more details. Admin Management This window allows you to manage network administrator accounts (create, modify and delete). It also allows you to limit account access to a read only status. When finished, click on the Save changes to flash button if you wish to make your changes permanent. Figure 123.
Wireless Array 5. Click on the Create button to add this administrator ID to the list. 6. Click Save changes to flash if you wish to make your changes permanent.
Wireless Array Admin Privileges This window provides a detailed level of control over the privileges of Array administrators. Administrators may be assigned one of eight Privilege Levels. You may define the privilege level of each major feature (Configuration Section) that may be configured on the Array. For example, say that you set the privilege level to 4 for Reboot Array, Security, Radius Server, and SNMP, and you leave all other configuration sections at the default privilege level of 1.
Wireless Array If you are using an Admin RADIUS server to define administrator accounts, please see “RADIUS Vendor Specific Attribute (VSA) for Xirrus” on page 463 to set the privilege level for each administrator. Procedure for Configuring Admin Privileges 1. Privilege Level Names (optional): You may assign a Name to each Privilege Level. The name may be used to describe the access granted by this level.
Wireless Array Admin RADIUS This window allows you to set up authentication of network administrators via RADIUS. Using RADIUS to control administrator accounts for logging in to Arrays has these benefits: Centralized control of administrator accounts. Less effort — you don't have to set up user names and passwords on each Array; just enter them once on the RADIUS server and then all of the Arrays can pull from the RADIUS server. Enforced policies — you may set password rules (e.g.
Wireless Array Figure 125. Admin RADIUS Procedure for Configuring Admin RADIUS Use this window to enable/disable administrator authentication via RADIUS, and to set up primary and secondary servers to use for authentication of administrators attempting to log in to the Array. 1. Admin RADIUS Settings: a. Enable Admin RADIUS: Click Yes to enable the use of RADIUS to authenticate administrators logging in to the Array. You will need to specify the RADIUS server(s) to be used. b.
Wireless Array c. 2. Timeout (seconds): Define the maximum idle time (in seconds) before the RADIUS server’s session times out. The default is 600 seconds. Admin RADIUS Primary Server: This is the RADIUS server that you intend to use as your primary server. a. Host Name / IP Address: Enter the IP address or domain name of this external RADIUS server. b. Port Number: Enter the port number of this RADIUS server. The default is 1812. c.
Wireless Array Management Control This window allows you to enable or disable the Array management interfaces and set their inactivity time-outs. The supported range is 300 (default) to 100,000 seconds. Figure 126. Management Control Procedure for Configuring Management Control 1. Management Settings: a. Maximum login attempts allowed (1-255): After this number of consecutive failing administrator login attempts via ssh or telnet, the Failed login retry period is enforced. The default is 3.
Wireless Array b. Failed login retry period (0-65535 seconds): After the maximum number (defined above) of consecutive failing administrator login attempts via ssh or telnet, the administrator’s IP address is denied access to the array for the specified period of time (in seconds). The default is 0. c. Pre-login Banner: Text that you enter here will be displayed above the WMI login prompt. (Figure 127) Figure 127. Pre-login Banner d.
Wireless Array 3. Telnet: a. On/Off: Choose On to enable Array management over a Telnet connection, or Off to disable this feature. SSH offers a more secure connection than Telnet, and is recommended over Telnet. b. Connection Timeout 30-100000 (Seconds): Enter a value in this field to define the timeout (in seconds) before your Telnet connection is disconnected. The value you enter here must be between 30 seconds and 100,000 seconds. c. 4.
Wireless Array c. Boot only: Choose this radio button to enable Xircon access at the Xirrus Boot Loader (XBL) level only. ArrayOS level (CLI) access to the Array is disabled. d. Connection Timeout 30-100000 (Seconds): Enter a value in this field to define the timeout (in seconds) before your Xircon connection is disconnected. The value you enter here must be between 30 seconds and 100,000 seconds. e. 5. Port: Enter a value in this field to define the port used by Xircon. The default port is 22612.
Wireless Array 7. Management Modes a. Network Assurance: Click the On button to enable this mode. Network assurance checks network connectivity to each server that you configure, such as the NTP server, RADIUS servers, SNMP trap hosts, etc. By proactively identifying network resources that are unavailable, the network manager can be alerted of problems potentially before end-users notice an issue.
Wireless Array automatically creates a security certificate for that host name. That certificate uses Xirrus as the signing authority. Thus, in order to avoid having certificate errors on your browser when using WMI: • You must have assigned a host name to the Array and rebooted at some time after that. • Use Import Xirrus Authority into Browser • Access WMI by using the host name of the Array rather than its IP address. b. HTTPS (X.
Wireless Array b. Upload Signed Certificate: To use a custom certificate signed by an authority other than Xirrus, use the Browse button to locate the certificate file, then click Upload to copy it to the Array. The Array’s web server will be restarted and will pick up the new certificate. This will terminate any current web sessions, and you will need to reconnect and re-login to the Array. 10. To create a Certificate Signing Request a.
Wireless Array There is also a per-SSID ACL (see “Per-SSID Access Control List” on page 262). If the same MAC address is listed in both the global ACL and in an SSID’s ACL, and if either ACL would deny that station access to that SSID, then access will be denied. Figure 128. Access Control List Procedure for Configuring Access Control Lists 1. Access Control List Type: Select Disabled to disable use of the Access Control List, or select the ACL type — either Allow List or Deny List.
Wireless Array 3. Delete: You can delete selected MAC addresses from this list by clicking their Delete buttons. 4. Click Save changes to flash if you wish to make your changes permanent.
Wireless Array Global Settings This window allows you to establish the security parameters for your wireless network, including WEP, WPA, WPA2 and RADIUS authentication. When finished, click Save changes to flash if you wish to make your changes permanent. For additional information about wireless network security, refer to “Security Planning” on page 46 and “Understanding Security” on page 209. Figure 129.
Wireless Array Procedure for Configuring Network Security 1. RADIUS Server Mode: Choose the RADIUS server mode you want to use, either Internal or External. Parameters for these modes are configured in “External Radius” on page 234 and “Internal Radius” on page 238. WPA Settings These settings are used if the WPA or WPA2 encryption type is selected on the SSIDs >SSID Management window or the Express Setup window (on this window, encryption type is set in the SSID Settings: Wireless Security field). 2.
Wireless Array WEP Settings These settings are used if the WEP encryption type is selected on the SSIDs > SSID Management window or the Express Setup window (on this window, encryption type is set in the SSID Settings: Wireless Security field). Click the Show Cleartext button to make the text that you type in to the Key fields visible. WEP encryption does not support high throughput rates or features like frame aggregation or block acknowledgements (see Improved MAC Throughput), per the IEEE 802.
Wireless Array 9. Click Save changes to flash if you wish to make your changes permanent. After configuring network security, the configuration must be applied to an SSID for the new functionality to take effect.
Wireless Array External Radius This window allows you to define the parameters of an external RADIUS server for user authentication. To set up an external RADIUS server, you must choose External as the RADIUS server mode in Global Settings. Refer to “Global Settings” on page 230. Figure 130. External RADIUS Server If you want to include user group membership in the RADIUS account information for users, see “Understanding Groups” on page 264.
Wireless Array Procedure for Configuring an External RADIUS Server 1. Primary Server: This is the external RADIUS server that you intend to use as your primary server. a. Host Name / IP Address: Enter the IP address or domain name of this external RADIUS server. b. Port Number: Enter the port number of this external RADIUS server. The default is 1812. c.
Wireless Array see below) to terminate a user with a Disconnect Message (DM). Or RADIUS may send a Change-of-Authorization (CoA) Message to the Array to change a user’s privileges due to dynamically changing session authorizations. RADIUS will use the DAS port on the Array for this purpose. The default is port 3799. c. NAS Identifier: From the point of view of a RADIUS server, the Array is a client, also called a network access server (NAS).
Wireless Array 5. f. Secondary Port Number: If using a secondary accounting server, enter its port number. The default is 1813. g. Secondary Shared Secret / Verify Secret: If using a secondary accounting server, enter the shared secret that it will be using, then reenter the shared secret to verify that you typed it correctly. Click Save changes to flash if you wish to make your changes permanent.
Wireless Array Internal Radius This window allows you to define the parameters for the Array’s internal RADIUS server for user authentication. However, the internal RADIUS server will only authenticate wireless clients that want to associate to the Array. This can be useful if an external RADIUS server is not available. To set up the internal RADIUS server, you must choose Internal as the RADIUS server mode in Global Settings. Refer to “Global Settings” on page 230. Figure 131.
Wireless Array Procedure for Creating a New User 1. User Name: Enter the name of the user that you want to authenticate to the internal RADIUS server. 2. SSID Restriction: (Optional) If you want to restrict this user to associating to a particular SSID, choose an SSID from the pull-down list. 3. User Group: (Optional) If you want to make this user a member of a previously defined user group, choose a group from the pull-down list. This will apply all of the user group’s settings to the user.
Wireless Array Access Control List Management Control Security Understanding Groups Rogue Control List This window allows you to set up a control list for rogue APs, based on a type that you define. You may classify rogue APs as blocked, so that the Array will take steps to prevent stations from associating with the blocked AP. See “About Blocking Rogue APs” on page 331. The Array can keep up to 5000 entries in this list.
Wireless Array Procedure for Establishing Rogue AP Control 1. Rogue BSSID/SSID: Enter the BSSID, SSID, or manufacturer string to match for the new rogue control entry. The Match Only radio buttons specify what to match (e.g., the MAC address, SSID, or manufacturer). You may use the “*” character as a wildcard to match any string at this position. For example, 00:0f:7d:* matches any string that starts with 00:0f:7d:. Xirrus Arrays start with 00:0f:7d: or 50:60:28:.
Wireless Array SSIDs This status-only window allows you to review SSID (Service Set IDentifier) assignments. It includes the SSID name, whether or not an SSID is visible on the network, any security and QoS parameters defined for each SSID, associated VLAN IDs, radio availability, and DHCP pools defined per SSID. Click on an SSID’s name to jump to the edit page for the SSID.
Wireless Array SSIDs are managed with the following windows: “SSID Management” on page 249 “Active IAPs” on page 261 “Per-SSID Access Control List” on page 262 SSIDs are discussed in the following topics: “Understanding SSIDs” on page 243 “Understanding QoS Priority on the Wireless Array” on page 244 Understanding SSIDs The SSID (Service Set Identifier) is a unique identifier that wireless networking devices use to establish and maintain wireless connectivity.
Wireless Array The wireless security mode needed to join this SSID. The wireless Quality of Service (QoS) desired for this SSID. The wired VLAN associated with this SSID. As an example, one SSID named accounting might require the highest level of security, while another named guests might have low security requirements. Another example may define an SSID named voice that supports voice over Wireless LAN phones with the highest Quality of Service (QoS) definition.
Wireless Array The Wireless Array’s Quality of Service Priority feature (QoS) allows traffic to be prioritized according to your requirements. For example, you typically assign the highest priority to voice traffic, since this type of traffic requires delay to be under 10 ms. The Array has four separate queues for handling wireless traffic at different priorities, and thus it supports four traffic classes (QoS levels). Figure 135. Priority Level—IEEE 802.1p (Layer 2) IEEE802.
Wireless Array a Layer 3 packet to determine the Quality of Service (QoS) required. DSCP replaces the outdated Type of Service (TOS) field. The description below describes how both of these priority levels are mapped to the Array’s four traffic classes. End-to-End QoS Handling Wired QoS - Ethernet Port: Ingress: Incoming wired packets are assigned QoS priority based on their SSID and 802.1p tag (if any), as shown in the table below. This table follows the mapping recommended by IEEE802.11e.
Wireless Array Egress: Outgoing wired packets are IEEE 802.1p tagged at the Ethernet port for upstream traffic, thus enabling QoS at the edge of the network. FROM Array QoS (Wireless) TO Priority Tag 802.1p (Wired) 1 (Lowest priority) 1 0 0 2 (Default) 5 3 (Highest priority) 6 Wireless QoS - Radios: Each SSID can be assigned a separate QoS priority (i.e., traffic class) from 0 to 3, where 3 is highest priority and 2 is the default. See “SSID Management” on page 249.
Wireless Array • DSCP 40 is typically used for video traffic and is set to QoS level 2. • DSCP 48 is typically used for voice traffic and is set to QoS level 3—the highest level • All other DSCP values are set to QoS level 0 (the lowest level— Best Effort). Packet Filtering QoS classification Filter rules can be used to redefine the QoS priority level to override defaults. See “Filter Management” on page 347.
Wireless Array Use the honeypot feature carefully as it could interfere with legitimate SSIDs and prevent clients from associating to another available network. SSID Management This window allows you to manage SSIDs (create, edit and delete), assign security parameters and VLANs on a per SSID basis, and configure the Web Page Redirect functionality. Create new SSID Configure parameters Set traffic limits / usage schedule Configure encryption/authentication Configure RADIUS server Figure 137.
Wireless Array Procedure for Managing SSIDs 1. New SSID Name: To create a new SSID, enter a new SSID name to the left of the Create button (Figure 137), then click Create. The SSID name may only consist of the characters A-Z, a-z, 0-9, dash, and underscore. You may create up to 16 SSIDs. SSID List (top of page) 250 2. SSID: Shows all currently assigned SSIDs. When you create a new SSID, the SSID name appears in this table. Click any SSID in this list to select it. 3.
Wireless Array • 3 — The highest QoS priority setting, normally used to give priority to voice traffic. The QoS setting you define here will prioritize wireless traffic for this SSID over other SSID traffic, as described in “Understanding QoS Priority on the Wireless Array” on page 244. The default value for this field is 2. 8. DHCP Pool: If you want to associate an internal DHCP pool to this SSID, choose the pool from the pull--down list. An internal DHCP pool must be created before it can be assigned.
Wireless Array Each SSID supports only one encryption type at a time (except that WPA and WPA2 are both supported on an SSID if you select WPA-Both). If you need to support other encryption types, you must define additional SSIDs. The encryption standard used with WPA or WPA2 is selected in the Security>Global Settings window (page 230). For an overview of the security options, see “Security Planning” on page 46 and “Understanding Security” on page 209.
Wireless Array . Set Encryption Configure Radius, Accounting Figure 138. SSID Management 13. Roaming: For this SSID, select whether to enable fast roaming between IAPs or Arrays at L2&L3 (Layer 2 and Layer 3), at L2 (Layer 2 only), or disable roaming (Off). You may only select fast roaming at Layers 2 and 3 if this has been selected in Global Settings (IAP). See “Understanding Fast Roaming” on page 273. 14.
Wireless Array URL. For example, some wireless devices and users may not have a correctly configured 802.1x (RADIUS) supplicant. Utilizing WPR’s Webbased login, users may be authenticated without using an 802.1x supplicant. See “Web Page Redirect Configuration Settings” on page 255 for details of WPR usage and configuration. When using WPR, it is particularly important to adhere to the SSID naming restrictions detailed in Step 1. 15.
Wireless Array station limits are set, both will be enforced. As soon as either limit is reached, no new stations can associate until some other station has terminated its association. 17. Overall Traffic: Choose Unlimited if you do not want to place a restriction on the traffic for this SSID, or enter a value in the Packets/Sec field to force a traffic restriction. 18.
Wireless Array See “Group Management” on page 266. Note that if you change the management HTTPS port, WPR uses that port, too. See “HTTPS” on page 224. Figure 139. WPR Internal Splash Page Fields (SSID Management) Note that when users roam between Arrays, their WPR Authentication will follow them so that re-authentication is not required.
Wireless Array After authentication, the browser is redirected back to the captured URL. If you want the user redirected to a specific landing page instead, enter its address in Landing Page URL. Both the Internal Login and External Login options of WPR perform authentication using your configured RADIUS servers. Internal Splash page This option displays a splash page instead of the first user-requested URL. The splash page files reside on the Array.
Wireless Array To set up external login page usage, set Server to External Login. Enter the URL of the external web server in Redirect URL, and enter that server’s shared secret in Redirect Secret. Select the RADIUS Authentication Type. This is the protocol used for authentication of users, CHAP or PAP (the default). • PAP (Password Authentication Protocol), is a simple protocol. PAP transmits ASCII passwords over the network “in the clear” (unencrypted) and is therefore considered insecure.
Wireless Array Logo Header Internal Login Page Background Footer Figure 140. Customizing an Internal Login or Splash Page Background Image — specify an optional jpg, gif, or png file to display in the background of the page. Other customizations (logo, header, footer) will overlay the background, so that it will not be visible in those areas. Logo Image — specify an optional jpg, gif, or png file to display at the top of the page. Header Text File — specify an optional .
Wireless Array parameters as those described in “Procedure for Configuring Network Security” on page 231 RADIUS Configuration Settings The RADIUS settings section will be displayed if you set Authentication (Step 10 on page 251) to RADIUS MAC and you did not check the Global checkbox (Step 12). This means that you wish to set up a RADIUS server to be used for this particular SSID.
Wireless Array Active IAPs By default, when a new SSID is created, that SSID is active on all IAPs. This window allows you to specify which IAPs will offer that SSID. Put differently, you can specify which SSIDs are active on each IAP. This feature is useful in conjunction with WDS. You may use this window to configure the WDS link IAPs so that only the WDS link SSIDs are active on them. Figure 141. Setting Active IAPs per SSID Procedure for Specifying Active IAPs 1.
Wireless Array Per-SSID Access Control List This window allows you to enable or disable the use of the per-SSID Access Control List (ACL), which controls whether a station with a particular MAC address may associate to this SSID. You may create access control list entries and delete existing entries, and control the type of list. There is one ACL per SSID, and you may select whether its type is an Allow List or a Deny List, or whether use of this list is disabled.
Wireless Array • Deny List: Denies the listed MAC addresses permission to associate to the Array. All others are allowed. In addition to these lists, other authentication methods (for example, RADIUS) are still enforced for users. 3. MAC Address: If you want to add a MAC address to the ACL, enter the new MAC address here, then click the Add button. The MAC address is added to the ACL. You may use a wildcard (*) for one or more digits to match a range of addresses.
Wireless Array Groups This is a status-only window that allows you to review user (i.e., wireless client) Group assignments. It includes the group name, Radius ID, Device ID, VLAN IDs and QoS parameters and roaming layer defined for each group, and DHCP pools and web page redirect information defined for the group. You may click on a group’s name to jump to the edit page for the group.
Wireless Array A group allows you to define a set of parameter values to be applied to selected users. For example, you might define the user group Students, and set its VLAN, security parameters, web page redirect (WPR), and traffic limits. When a new user is created, you can apply all of these settings just by making the user a member of the group. The group allows you to apply a uniform configuration to a set of users in one step.
Wireless Array Radius ID to the Array. This will allow the Array to identify the group to which the user belongs. See Also External Radius Internal Radius SSIDs Understanding QoS Priority on the Wireless Array Web Page Redirect Configuration Settings Understanding Fast Roaming Group Management This window allows you to manage groups (create, edit and delete), assign usage limits and other parameters on a per group basis, and configure the Web Page Redirect functionality. Figure 144.
Wireless Array 3. Enabled: Check this box to enable this group or leave it blank to disable it. When a group is disabled, users that are members of the group will behave as if the group did not exist. In other words, the options configured for the SSID will apply to the users, rather than the options configured for the group. 4. Radius ID: Enter a unique Radius ID for the group, to be used on an external Radius server.
Wireless Array The QoS setting you define here will prioritize wireless traffic for this group versus other traffic, as described in “Understanding QoS Priority on the Wireless Array” on page 244. The default value for this field is 2. 8. DHCP Pool: (Optional) To associate an internal DHCP pool to this group, select it from the pull--down list. Only one pool may be assigned. An internal DHCP pool must be created before it can be assigned. To create a DHCP pool, go to “DHCP Server” on page 197. 9.
Wireless Array traffic, and/or limit connection times. If limits are set in more than one place, all limits will be enforced: As soon as any station limit is reached, no new stations can associate until some other station has terminated its association. As soon as any traffic limit is reached, it is enforced. If any connection date/time restriction applies, it is enforced. You can picture this as a logical AND of all restrictions.
Wireless Array 18. Click Save changes to flash if you wish to make your changes permanent.
Wireless Array IAPs This status-only window summarizes the status of the Integrated Access Points (radios). For each IAP, it shows whether it is up or down, the channel and wireless mode, the antenna that it is currently using, its cell size and transmit and receive power, how many users (stations) are currently associated to it, whether it is part of a WDS link, and its MAC address. Figure 145.
Wireless Array Figure 146. Source of Channel Setting Arrays have a fast roaming feature, allowing them to maintain sessions for applications such as voice, even while users cross boundaries between Arrays. Fast roaming is set up in the Global Settings (IAP) window and is discussed in: “Understanding Fast Roaming” on page 273 IAPs are configured using the following windows: “IAP Settings” on page 274 “Global Settings (IAP)” on page 280 “Global Settings .
Wireless Array Understanding Fast Roaming To maintain sessions for real-time data traffic, such as voice and video, users must be able to maintain the same IP address through the entire session. With traditional networks, if a user crosses VLAN or subnet boundaries (i.e., roaming between domains), a new IP address must be obtained. Mobile wireless users are likely to cross multiple roaming domains during a single session (especially wireless users of VoIP phones).
Wireless Array IAP Settings This window allows you to enable/disable IAPs, define the wireless mode for each IAP, specify the channel to be used and the cell size for each IAP, lock the channel selection, establish transmit/receive parameters, select antennas, and reset channels. Buttons at the bottom of the list allow you to Reset Channels, Enable All IAPs, or Disable All IAPs. When finished, click Save changes to flash if you wish to make your changes permanent. Figure 147.
Wireless Array Procedure for Manually Configuring IAPs 1. In the Enabled column, check the box for an IAP to enable it, or uncheck the box if you want to disable the IAP. In the Band column, select the wireless band for this IAP from the choices available in the pull-down menu, either 2.4GHz or 5 GHz. Choosing the 5GHz band will automatically select an adjacent channel for bonding.
Wireless Array 3. In the Channel column, select the channel you want this IAP to use from the channels available in the pull-down list. The list shows the channels available for the IAP selected (depending on which band the IAP is using). Channels that are shown in color indicate conditions that you need to keep in mind: • RED — Usage is not recommended, for example, because of overlap with neighboring radios.
Wireless Array • +1 — Bond this channel to the next higher channel number. Auto Channel bonding does not apply. This option is only available for some of the channels. • -1 — Bond this channel to the next lower channel number. Auto Channel bonding does not apply. This option is only available for some of the channels. 5. Click the Lock check box if you want to lock in your channel selection so that an autochannel operation (see Advanced RF Settings) can’t change it. 6.
Wireless Array For additional information about cell sizes, go to “Coverage and Capacity Planning” on page 28. 7. If you are using WDS to provide backhaul over an extended distance, use WDS Dist. (Miles) to prevent timeout problems associated with long transmission times. Set the approximate distance in miles between this IAP and the connected Array in this column. This increases the wait time for frame transmission accordingly. 8.
Wireless Array Global Settings .11bgn Global Settings .
Wireless Array Global Settings (IAP) Figure 148.
Wireless Array This window allows you to establish global IAP settings. Global IAP settings include enabling or disabling all IAPs (regardless of their operating mode), and changing settings for beacons, station management, and advanced traffic optimization — including multicast processing, load balancing, and roaming. Changes you make on this page are applied to all IAPs, without exception. Procedure for Configuring Global IAP Settings 1.
Wireless Array 5. Wi-Fi Alliance Mode: Set this On if you need Array behavior to conform completely to Wi-Fi Alliance standards. This mode is normally set to Off. Beacon Configuration 6. Beacon Interval: When the Array sends a beacon, it includes with it a beacon interval, which specifies the period of time before it will send the beacon again. Enter the desired value in the Beacon Interval field, between 20 and 1000 Kusecs. A Kusec is 1000 microseconds = 1 millisecond.
Wireless Array intelligence to decide to either delay the traffic stream, associate with a different AP, or establish a best-effort traffic stream outside the operation of WMM-Admission Control. The default setting is Off. 11. WMM ACM Voice: Click On to enable Wireless Multimedia Admission Control for voice calls. When admission control for voice is enabled, the Array evaluates a voice request from a client device against the network load and channel conditions.
Wireless Array 16. Max Phones per IAP: This option allows you to control the maximum number of phones that are allowed per IAP. The default is set to a maximum of 16 but you can reduce this number, as desired. Enter a value in this field between 0 (no phones allowed) and 16. This admission control feature applies only to Spectralink phones. It does not apply to all VoIP phones in general. 17.
Wireless Array even though it must be sent out at the speed of the slowest connected station. An example of a situation that might benefit from the use of this mode is ghosting all the laptops in a classroom using multicast. One multicast stream at, say, 6 Mbps is probably more efficient than thirty unicast streams. The next three options convert multicast to unicast. Packets are sent directly to the stations at the best possible data rates.
Wireless Array To add a new IP address to the list, type it in the top field and click the Add button to its right. You may only enter IP addresses—host names are not allowed. This is because mDNS is a link local multicast address, and does not require IGMP to the gateway. To remove an entry, select it in the list and click Delete. To remove all entries from the list, click Reset. 21.
Wireless Array • If you enter service types, then this acts as an allow filter, and mDNS packets are passed only for the listed service types. Note that mDNS filtering may be used to filter the mDNS packet types that are forwarded within the same VLAN. Also, in conjunction with multicast forwarding, it may be used to filter the mDNS packet types that are forwarded across configured VLANs.
Wireless Array 22. Multicast VLAN Forwarding: This is a list of VLANs that participate in the multicast forwarding. Please see the description of multicast forwarding in Step 21 above. The VLANs you enter must be explicitly defined (see “VLANs” on page 199) in order to participate in multicast forwarding. In fact, the Array discards packets from undefined VLANs. To add a new VLAN to the list, enter its number or name in the top field and click the Add button to its right.
Wireless Array 23. MDNS Filter: There are many different types of services that may be specified in multicast query and response packets. The mDNS filters let you restrict forwarding, so that multicast packets are forwarded only for the services that you explicitly specify. This list may be used to restrict the amount of Apple Bonjour multicast traffic forwarding. For example, you may restrict forwarding to just AppleTV and printing services.
Wireless Array performance possible. The benefit is dramatic. Consider a properly designed network (having -70db or better everywhere), where virtually every client should have a 54Mbps connection. In this case, broadcasts and multicasts will all go out at 54Mbps vs. the standard rate. Thus, with broadcast rate optimization on, broadcasts and multicasts use between 2% and 10% of the bandwidth that they would in Standard mode.
Wireless Array • Off: ARP filtering is disabled. ARP requests are broadcast to radios that have stations associated to them. • Pass-thru: The Array forwards the ARP request. It passes along only ARP messages that target the stations that are associated to it. This is the default value. • Proxy: The Array replies on behalf of the stations that are associated to it. The ARP request is not broadcast to the stations.
Wireless Array • Tunneled — in this Layer 3 technique, fast roaming target Arrays must be explicitly specified. To enable fast roaming, choose Broadcast or Tunneled, and set additional fast roaming attributes (Step 30). To disable fast roaming, choose Off. If you enable Fast Roaming, the following ports cannot be blocked: • Port 22610 — reserved for Layer 2 roaming using UDP to share PMK information between Arrays. • Ports 15000 to 17999 — reserved for Layer 3 roaming (tunneling between subnets). 30.
Wireless Array Global Settings .11an This window allows you to establish global 802.11a IAP settings. These settings include defining which 802.11a data rates are supported, enabling or disabling all 802.11an IAPs, auto-configuration of channel allocations for all 802.11an IAPs, and specifying the fragmentation and RTS thresholds for all 802.11an IAPs. Figure 149. Global Settings .11an Procedure for Configuring Global 802.11an IAP Settings 1. 2. 802.
Wireless Array to optimize data rates based on range, or click Optimize Throughput to optimize data rates based on throughput. The Restore Defaults button will take you back to the factory default rate settings. 3. 4. 802.11a IAP Control: Click Enable 802.11a IAPs to enable all 802.11an IAPs for this Array, or click Disable 802.11a IAPs to disable all 802.11an IAPs.
Wireless Array The following options may be selected for auto configuration: • Non-Radar: give preference to channels that are not required to use dynamic frequency selection (DFS) to avoid communicating in the same frequency range as some radar (also see Step 8 on page 282).
Wireless Array For an overview of RF power and cell size settings, please see “RF Power & Sensitivity” on page 316, “Capacity and Cell Sizes” on page 30, and “Fine Tuning Cell Sizes” on page 31. 6. Auto Cell Period (seconds): You may set up auto-configuration to run periodically, readjusting optimal cell sizes for the current conditions. Enter a number of seconds to specify how often auto-configuration will run. If you select None, then auto-configuration of cell sizing will not be run periodically.
Wireless Array Smaller fragmentation numbers can help to “squeeze” packets through in noisy environments. Enter the desired Fragmentation Threshold value in this field, between 256 and 2346. 12. RTS Threshold: The RTS (Request To Send) Threshold specifies the packet size. Packets larger than the RTS threshold will use CTS/RTS prior to transmitting the packet — useful for larger packets to help ensure the success of their transmission. Enter a value between 1 and 2347.
Wireless Array Global Settings .11bgn This window allows you to establish global 802.11b/g IAP settings. These settings include defining which 802.11b and 802.11g data rates are supported, enabling or disabling all 802.11b/g IAPs, auto-configuring 802.11b/g IAP channel allocations, and specifying the fragmentation and RTS thresholds for all 802.11b/g IAPs. Figure 150. Global Settings .
Wireless Array Procedure for Configuring Global 802.11b/g IAP Settings 1. 802.11g Data Rates: The Array allows you to define which data rates are supported for all 802.11g radios. Select (or deselect) 11g data rates by clicking in the corresponding Supported and Basic data rate check boxes. • Basic Rate — a wireless station (client) must support this rate in order to associate. • Supported Rate — data rates that can be used to transmit to clients. 2. 802.
Wireless Array data about its RF environment. In this case, it will pick a set of compatible channel assignments at random. On the XR500 and XR-1000 Series Arrays, the Factory Defaults button will not restore iap1 to monitor mode. You will need to restore this setting manually. Also, you may need to set Timeshare Mode again - see “RF Monitor” on page 314. The following options may be selected for auto configuration: • Negotiate: negotiate air-time with other Arrays before performing a full scan.
Wireless Array 7. Auto Cell Period (seconds): You may set up auto-configuration to run periodically, readjusting optimal cell sizes for the current conditions. Enter a number of seconds to specify how often auto-configuration will run. If you select None, then auto-configuration of cell sizing will not be run periodically. You do not need to run Auto Cell often unless there are a lot of changes in the environment.
Wireless Array older, slower 802.11b stations. Protection avoids collisions by preventing 802.11b and 802.11g stations from transmitting simultaneously. When Auto CTS or Auto RTS is enabled and any 802.11b station is associated to the IAP, additional frames are sent to gain access to the wireless network. • Auto CTS requires 802.11g stations to send a slow Clear To Send frame that locks out other stations. Automatic protection reduces 802.11g throughput when 802.
Wireless Array 17. RTS Threshold: The RTS (Request To Send) Threshold specifies the packet size. Packets larger than the RTS threshold will use CTS/RTS prior to transmitting the packet — useful for larger packets to help ensure the success of their transmission. Enter a value between 1 and 2347. See Also Coverage and Capacity Planning Global Settings (IAP) Global Settings .11an Global Settings .
Wireless Array Global Settings .11n This window allows you to establish global 802.11n IAP settings. These settings include enabling or disabling 802.11n mode for the entire Array, specifying the number of transmit and receive chains (data stream) used for spatial multiplexing, setting a short or standard guard interval, auto-configuring channel bonding, and specifying whether auto-configured channel bonding will be static or dynamic. Before changing your settings for 802.
Wireless Array Procedure for Configuring Global 802.11n IAP Settings 1. 2. 802.11n operation is allowed only if the Array’s license includes this feature. Please see “About Licensing and Upgrades” on page 361. 802.11n Data Rates: The Array allows you to define which data rates are supported for all 802.11n radios. Select (or deselect) 11n data rates by clicking in the corresponding Supported and Basic data rate check boxes.
Wireless Array 306 6. Auto bond 5 GHz channels: Select Enabled to use Channel Bonding on 5 GHz channels and automatically select the best channels for bonding. The default is Enabled. See “Channel Bonding” on page 39. 7. 5 GHz channel bonding: Select Dynamic to have auto-configuration for bonded 5 GHz channels be automatically updated as conditions change.
Wireless Array Global Settings .11u Understanding 802.11u As the number of access points available in public venues increases, mobile devices users have a harder time distinguishing usable SSIDs from the tens, if not hundreds of access points visible. Using the 802.11u protocol, access points may broadcast information about the services and access that they offer and to respond to queries for additional information related to the facilities that the downstream service network provides.
Wireless Array Cellular Networks. The service network may have arrangements with one or more cellular service providers who can transparently provide wireless and Internet connectivity. Figure 152. 802.11u Global Settings Procedure for Configuring 802.11u Settings Use this window to establish the 802.11u configuration. 308 1. 802.11u Internetworking. Click On to enable 802.11u protocol operation. 2. Access Network Type: This indicates the type of network supported by the access point.
Wireless Array a. Chargeable public network b. Emergency services only network c. Free public network d. Personal device network e. Private network with guest access f. Test or experimental network g. Wildcard 3. Internet Connectivity. Click Provided if Internet connectivity is available through the access point from the back end provider to which the mobile user ends up belonging.
Wireless Array 8. IPv4 Availability. Select the type of IPv4 addressing that will be assigned by the network upon connection. NATed addresses are IP addresses that have been changed by mapping the IP address and port number to IP addresses and new port numbers routable by other networks. Double NATed addresses go through two levels of NATing. Port restricted IPv4 addresses refer to specific UDP and TCP port numbers associated with standard Internet services; for example, port 80 for web pages.
Wireless Array and click Add. The OI will appear in the list. An OI may be deleted by selecting it in the list and clicking Delete. All OIs may be deleted by clicking Reset. 11. Domain Names. Use this control to build up a list of domain names. Enter the name in the Add field and click Add, and it will appear in the list. A name may be deleted by selecting it in the list and clicking Delete. All names may be deleted by clicking Reset. 12. Cell Network.
Wireless Array 14. Venue Names. The list of names associated with the venue are specified here. A venue name may be added to the list in English or Chinese. Enter the name in the appropriate field and click Add. The name will appear in the list. A name may be deleted by selecting it in the list and clicking Delete. All names may be deleted by clicking Reset.
Wireless Array Advanced RF Settings This window allows you to establish RF settings, including automatically configuring channel allocation and cell size, and configuring radio assurance and standby modes. Changes you make on this page are applied to all IAPs, without exception. Figure 153.
Wireless Array About Standby Mode Standby Mode supports the Array-to-Array fail-over capability. When you enable Standby Mode, the Array functions as a backup unit, and it enables its radios if it detects that its designated target Array has failed. The use of redundant Arrays to provide this fail-over capability allows Arrays to be used in mission-critical applications. In Standby Mode, an Array monitors beacons from the target Array.
Wireless Array If Timeshare mode is selected, you may adjust the following settings: • Timeshare Scanning Interval (6-600): number of seconds between monitor (off-channel) scans. • Timeshare Station Threshold (0-240): when the number of stations associated to the monitor radio exceeds this threshold, scanning is halted. • Timeshare Traffic Threshold (0-50000): when the number of packets per second handled by the monitor radio exceeds this threshold, scanning is halted. RF Resilience 2.
Wireless Array 3. Enable Standby Mode: Choose Yes to enable this Array to function as a backup unit for the target Array, or choose No to disable this feature. See “About Standby Mode” on page 314. 4. Standby Target Address: If you enabled the Standby Mode, enter the MAC address of the target Array (i.e., the address of the primary Array that is being monitored and backed up by this Array). To find this MAC address, open the Array Info window on the target Array, and use the Gigabit1 MAC Address.
Wireless Array 7. Auto Cell Size Overlap (%): Enter the percentage of cell overlap that will be allowed when the Array is determining automatic cell sizes. For 100% overlap, the power is adjusted such that neighboring Arrays that hear each other best will hear each other at -70dB. For 0% overlap, that number is -90dB. The default value is 50%. 8. Auto Cell Min Cell Size: Use this setting if you wish to set the minimum cell size that Auto Cell may assign. The values are Default, Large, Medium, or Small.
Wireless Array RF Spectrum Management 12. Configuration Status: Shows the status of auto channel configuration. If an operation is in progress, the approximate time remaining until completion is displayed; otherwise Idle is displayed. 13. Band Configuration: Automatic band configuration is the recommended method for assigning bands to the abgn IAPs. It runs only on command, assigning IAPs to the 2.4GHz or 5GHz band when you click the Auto Configure button.
Wireless Array automatically, based on changes in the environment. This is the recommended method for channel allocation (see “RF Spectrum Management” on page 318). The following options may be selected for auto configuration: • Negotiate: negotiate air-time with other Arrays before performing a full scan. Negotiating is slower, but if multiple Arrays are configuring channels at the same time the Negotiate option ensures that multiple Arrays don't select the same channels.
Wireless Array 15. Auto Channel Configuration Mode: This option allows you to instruct the Array to auto-configure channel selection for each enabled IAP when the Array is powered up. Choose On Array PowerUp to enable this feature, or choose Disabled to disable this feature. 16. Auto Channel Configure on Time: This option allows you to instruct the Array to auto-configure channel selection for each enabled IAP at a time you specify here.
Wireless Array design, causing the client to bounce between multiple arrays and not stay connected longer than the time to re-associate and then jump again. This can be corrected with RF adjustments. Station assurance alerts you to the fact that this station is encountering problems. Figure 154. Station Assurance (Advanced RF Settings) 19. Enable Station Assurance: This is enabled by default. Click No if you wish to disable it, and click Yes to re-enable it.
Wireless Array 24. Max Packet Retry Rate: (%) Station assurance detects whether the packet retry rate percentage reaches this threshold during a period. 25. Min Packet Data Rate: (Mbps) Station assurance detects whether the packet data rate falls below this threshold during a period. 26. Min Received Signal Strength: (dB) Station assurance detects whether the strength of the signal received from the station falls below this threshold during a period. 27.
Wireless Array Uplink and Downlink Speeds Link Status Friendly Name Connection Capabilities The access point will restrict the protocols that can be used by a specification of protocol and port numbers. Procedure for Hotspot 2.0 Settings Use this window to establish the Hotspot 2.0 configuration. 1. Hotspot 2.0. Click Enabled to enable Hotspot 2.0 operation. 2. Downstream Group-addressed Forwarding.
Wireless Array Figure 155. Hotspot 2.0 Settings 5. English/Chinese Operator Friendly Name. Enter an English or Chinese name into one of the fields. An incorrectly entered name can be deleted by clicking the corresponding Delete. 6. Connection Capabilities. A Hotspot 2.0 access point limits the particular protocols that clients may use. The set of default protocols is shown initially. This table specifies the protocols in terms of: a. A common Name, such as FTP or HTTP. b. A Protocol number.
Wireless Array d. Status: one of open, closed or unknown. Any of the entries may be deleted by clicking the corresponding Delete button. New entries may be created by entering the name of the protocol in the box beside the Create button, and then clicking Create. The new protocol will be added to the list with zeros in the protocol fields and unknown for the status. Enter the appropriate Protocol and Port values before setting the Status field to open.
Wireless Array 1. Enter the realm name. Enter the name of a realm in the box to the left of the Create button and click Create. The realm will be added to the NAI Realms list. Any of the realms may be deleted by clicking the corresponding Delete button. 2. Enter Authentication Information. The NAI EAP page is used to specify authentication for a realm. Click on the name of a realm to go to the NAI EAP page for that realm. See “NAI EAP” on page 326.
Wireless Array 3. • EAP-FAST • EAP-MSCHAP-V2 • EAP-SIM • EAP-TLS • EAP-TTLS • GTC • MD5-Challenge • None • PEAP Specify Authentication Parameters. Each of the authentication methods may specify up to five authentication parameters. To specify the parameters click on the number corresponding to the authentication method; i.e. 1, 2, 3, 4, or 5. This displays the EAP n Auth Parameter Configuration below the list of EAP Methods.
Wireless Array Intrusion Detection The Xirrus Array employs a number of IDS/IPS (Intrusion Detection System/ Intrusion Prevention System) strategies to detect and prevent malicious attacks on the wireless network. Use this window to adjust intrusion detection settings. Figure 158. Intrusion Detection Settings The Array provides a suite of intrusion detection and prevention options to improve network security.
Wireless Array Denial of Service (DoS) or Availability Attack Detection A DoS attack attempts to flood an Array with communications requests so that it cannot respond to legitimate traffic, or responds so slowly that it becomes effectively unavailable. The Array can detect a number of types of DoS attacks, as described in the table below.
Wireless Array Type of Attack Description MIC Error Attack Generating invalid TKIP data to exceed the Array's MIC error threshold, suspending WLAN service. Disassociation Attack (Omerta) Sending forged disassociation frames to all stations on a channel in response to data frames. Deauthentication Attack Sending forged deauthentication frames to all stations on a channel in response to data frames. Duration Attack (Duration Field Spoofing) Injecting packets into the WLAN with huge duration values.
Wireless Array About Blocking Rogue APs If you classify a rogue AP as blocked (see “Rogue Control List” on page 240), then the Array will take measures to prevent stations from staying associated to the rogue. When the monitor radio is scanning, any time it hears a beacon from a blocked rogue it sends out a broadcast “deauth” signal using the rogue's BSSID and source address.
Wireless Array 2. Auto Block Unknown Rogue APs: Enable or disable auto blocking (see “About Blocking Rogue APs” on page 331). Note that in order to set Auto Block RSSI and Auto Block Level, you must set Auto Block Unknown Rogue APs to On. Then the remaining Auto Block fields will be active. 3. Auto Block RSSI: Set the minimum RSSI for rogue APs to be blocked. APs with lower RSSI values will not be blocked.
Wireless Array the specified number of seconds, then the Array declares that an attack has been detected. You may modify the Threshold and Period. For the Flood attack settings, you also have a choice of Auto or Manual. 7. • Manual mode — threshold and period settings are used to detect a flood. Packets received are simply counted for the specified time period and compared against the flood threshold. The default for all of the floods is Manual mode.
Wireless Array LED Settings This window assigns behavior preferences for the Array’s IAP LEDs. Figure 159. LED Settings Procedure for Configuring the IAP LEDs 1. LED State: This option determines which event triggers the LEDs, either when an IAP is enabled or when an IAP first associates with the network. Choose On Radio Enabled or On First Association, as desired. You may also choose Disabled to keep the LEDs from being lit. The LEDs will still light during the boot sequence, then turn off. 2.
Wireless Array DSCP Mappings DSCP is the 6-bit Differentiated Services Code Point (DiffServ) field in the IPv4 or IPv6 packet header, defined in RFC2474 and RFC2475. The DSCP value classifies the packet to determine the Quality of Service (QoS) required. DSCP replaces the outdated Type of Service (TOS) field. The DSCP Mappings page shows the default mapping of each of the 64 DSCP values to one of the Array’s four QoS levels, and allows you to change these mappings.
Wireless Array Roaming Assist Roaming assist is a Xirrus feature that helps clients roam to Arrays that will give them high quality connections. Some smart phones and tablets will stay connected to a radio with poor signal quality, even when there’s a radio with better signal strength within range. When roaming assist is enabled, the Array “assists” the device by deauthenticating it when certain parameters are met. This encourages a client with a high roaming threshold (i.e.
Wireless Array 3. Roaming Threshold: This is the difference in signal strength between radios that will trigger a deauthentication, as described in the discussion above. In most cases, this will be a negative number. Figure 161. Roaming Assist 4. Minimum Data Rate: If the station’s data rate (either Tx or Rx) falls below this rate, it will trigger a deauthentication. 5. Device Classes and Device Types: You can configure the device classes or types that will be assisted in roaming.
Wireless Array WDS This is a status-only window that provides an overview of all WDS links that have been defined. WDS (Wireless Distribution System) is a system that enables the interconnection of access points wirelessly, allowing your wireless network to be expanded using multiple access points without the need for a wired backbone to link them. The Summary of WDS Client Links shows the WDS links that you have defined on this Array and identifies the target Array for each by its base MAC address.
Wireless Array and the maximum number of IAPs in the link. Then you will select the IAPs to be used in the link. When the client link is created, each member IAP will associate to an IAP on the host Array. You may wish to consider configuring the WDS link IAPs so that only the WDS link SSIDs are active on them. See “Active IAPs” on page 261. Client Link a2(52) a10(52) a3(149) a9(149) a4(40) a8(40) Wired LAN HOST CLIENT Figure 163.
Wireless Array in miles between this IAP and the connected Array in the WDS Dist. (Miles) column. This will increase the wait time for frame transmission accordingly. See Also SSID Management Active IAPs WDS Client Link IAP Assignments: WDS Client Links WDS Statistics WDS Client Links This window allows you to set up a maximum of four WDS client links. Figure 164.
Wireless Array Procedure for Setting Up WDS Client Links WDS Client Link Settings: 1. 2. Host Link Stations: Check the Allow checkbox to instruct the Array to allow stations to associate to IAPs on a host Array that participates in a WDS link. The WDS host IAP will send beacons announcing its availability to wireless clients. This is disabled by default. Once an IAP has been selected to act as a WDS client link, no other association will be allowed on that IAP.
Wireless Array The higher the weight, the lower the influence of a new RSSI reading. This is not exactly a percentage, but a factor in the formula for computing the current RSSI value based on new readings: StoredRSSI = (StoredRSSI * RoamingAvgWeight + NewRSSIReading * (100 - RoamingAvgWeight)) / 100 This prevents erroneous or out-of-line RSSI readings from causing the WDS link to jump to a new array. Such readings can result from temporary obstructions, external interference, etc. 5.
Wireless Array Links. To allow any Xirrus Array to be accepted as a WDS target, enter the Xirrus OUI: 00:0f:7d:00:00:00 (this is useful for roaming in a mobile deployment, as described in Step 3 on page 341. 11. Target SSID: Enter the SSID that the target Array is using. 12. Username: Enter a username for this WDS link. A username and password is required if the SSID is using PEAP for WDS authentication from the internal RADIUS server. 13. Password: Enter a password for this WDS link. 14.
Wireless Array Filters This feature is only available if the Array’s license includes the Xirrus Advanced RF Security Manager (RSM). If a setting is unavailable (grayed out), then your license does not support the feature. Please see “About Licensing and Upgrades” on page 361. The Wireless Array’s integrated firewall uses stateful inspection to speed the decision of whether to allow or deny traffic. Filters are used to define the rules used for blocking or passing traffic.
Wireless Array without application of all defined filtering rules. Stateful inspection runs automatically on the Array. The rest of this section describes how to view and manage filters. Filters are organized in groups, called Filter Lists. A filter list allows you to apply a uniform set of filters to SSIDs or Groups very easily. The read-only Filters window provides you with an overview of all filter lists that have been defined for this Array, and the filters that have been created in each list.
Wireless Array Procedure for Managing Filter Lists 1. Stateful Filtering: Stateful operation of the integrated firewall can be Enabled or Disabled. If you have a large number of filters and you don’t want to apply them in a stateful manner, you may use this option to turn the firewall off. 2. Application Control: Operation of the Application Control feature may be Enabled or Disabled. See “Application Control Windows” on page 150.
Wireless Array 9. Click Save changes to flash if you wish to make your changes permanent. 10. Click a filter list to go to the Filter Management window to create and manage the filters that belong to this list. Filter Management This window allows you to create and manage filters that belong to a selected filter list, based on the filter criteria you specify. Filters are an especially powerful feature when combined with the intelligence provided by the “Application Control Windows” on page 150.
Wireless Array Based on Application Control’s analysis of your wireless traffic, you can create filters to enhance wireless usage for your business needs: Usage of non-productive and risky applications like BitTorrent can be restricted. Traffic for mission-critical applications like VoIP and WebEx may be given higher priority (QoS). Non- critical traffic from applications like YouTube may be given lower priority (QoS).
Wireless Array Viewing or modifying existing filter entries: 4. Filter: Select a filter entry if you wish to modify it. Source and destination details are displayed below the bottom of the list. 5. On: Use this field to enable or disable this filter. 6. Log: Log usage of this filter to Syslog. 7. Type: Choose whether this filter will be an Allow filter or a Deny filter. If you define the filter as an Allow filter, then any associations that meet the filter criteria will be allowed.
Wireless Array 13. Move Up/Down: The filters are applied in the order in which they are displayed in the list, with filters on the top applied first. To change an entry’s position in the list, just click its Up or Down button. 14. To delete a filter, click its Delete button. Select an existing filter entry in the list to view or modify the following, shown below the list of filters: 15. Source Address: Define a source address to match as a filter criterion.
Wireless Array 18. Applications: If you wish this filter to apply to a specific application, such as WebEx, click the letter or number that it starts with. Then select the desired application. You may select a Category or an Application, but not both. 19. Click Save changes to flash if you wish to make your changes permanent.
Wireless Array Clusters This feature is not avialable on XR500 Series Arrays. Clusters allow you to configure multiple Arrays at the same time. Using WMI (or CLI), you may define a set of Arrays that are members of the cluster. Then you may enter Cluster mode for a selected cluster, which sends all successive configuration commands issued via CLI or WMI to all of the member Arrays. When you exit cluster mode, configuration commands revert to applying only to the Array to which you are connected.
Wireless Array Cluster Definition This window allows you to create clusters. All existing clusters are shown, along with the number of Arrays currently in each. Up to 16 clusters may be created, with up to 50 Arrays in each. Figure 170. Cluster Definition Procedure for Managing Cluster Definition 1. New Cluster Name: Enter a name for the new cluster in the field to the left of the Create button, then click Create to add this entry. The new cluster is added to the list in the window.
Wireless Array Cluster Management This window allows you to add Arrays to or delete them from a selected cluster. A cluster may include a maximum of 50 Arrays. Note that the Array on which you are currently running WMI is not automatically a member of the cluster. If you would like it to be a member, you must add it explicitly. Figure 171. Cluster Management Procedure for Managing Clusters 354 1. Edit Cluster: Select the cluster to display and manage on this window.
Wireless Array Cluster Operation This window puts WMI into Cluster Mode. In this mode, all configuration operations that you execute in WMI or CLI are performed on the members of the cluster. They are not performed on the Array where you are running WMI, unless it is a member of the cluster. An XR-1000 Series Array cannot act as the Cluster controller. It will operate correctly as a member of a cluster.
Wireless Array 2. Select a WMI window for settings that you wish to configure for the cluster, and proceed to make the desired changes. 3. Proceed to any additional pages where you wish to make changes. 4. Some Status and Statistics windows will present information for all Arrays in the cluster. 5. Click the Save button when done if you wish to save changes on the cluster member Arrays. 6. Exit: Click the Exit button to the right of the operating cluster to terminate Cluster Mode.
Wireless Array You have the option to show aggregate information for the cluster members, or click the Group by Array check box to separate it out for each Array. You may terminate cluster mode operation by clicking the Exit button to the right of the Group by Array check box.
Wireless Array 358 Configuring the Wireless Array
Wireless Array Using Tools on the Wireless Array These WMI windows allow you to perform administrative tasks on your Array, such as upgrading software, rebooting, uploading and downloading configuration files, and other utility tasks. Tools are described in the following sections: “System Tools” on page 360 “CLI” on page 371 “Options” on page 373 “Logout” on page 376 Note that the Tools menu section may be collapsed down to hide the headings under it by clicking it.
Wireless Array System Tools This window allows you to manage files for software images, configuration, and Web Page Redirect (WPR), manage the system’s configuration parameters, reboot the system, and use diagnostic tools. Status is shown here Progress is shown here Figure 175.
Wireless Array Some tools, such as Network Tools and Diagnostics, are only available if the Array’s license includes the Xirrus Advanced RF Analysis Manager (RAM). If a tool is unavailable (grayed out), then your license does not support the feature. See “About Licensing and Upgrades” on page 361. About Licensing and Upgrades The Array’s license determines many of the features that are available on the Array.
Wireless Array Network Tools Progress and Status Frames System 1. Save & Reboot or Reboot: Use Save & Reboot to save the current configuration and then reboot the Array. The LEDs on the Array indicate the progress of the reboot, as described in “Powering Up the Wireless Array” on page 63. Alternatively, use the Reboot button to discard any configuration changes which have not been saved since the last reboot. You may specify an optional Delay period in seconds to wait before the reboot starts. 2.
Wireless Array 3. License Key: If Xirrus provides you with a new license key for your Array, use this field to enter it, then click the Apply button to the right. A valid license is required for Array operation, and it controls the features available on the Array. If you upgrade your Array for additional features, you will be provided with a license key to activate those capabilities. If you attempt to enter an invalid key, you will receive an error message and the current key will not be replaced.
Wireless Array 6. The Remote Boot Image or Configuration update happens every time that the Array reboots. If you only want to fetch the remote image or configuration file one time, be sure to turn off the remote option (blank out the field on the System Tools page) after the initial download. When a remote boot image is used, the image is transferred directly into memory and is never written to the compact flash.
Wireless Array • history/saved-yyyymmdd-pre-update.conf: history/saved-yyyymmdd-post-update.conf: Two files are saved for an upgrade: the setting values from just before an upgrade was performed, and the initial values afterward. The filename includes the upgrade date. • history/saved-yyyymmdd-auto.conf: Each time you use the Save changes to flash button, an “auto” file is saved with the settings current at that time. • history/saved-yyyymmdd-pre-reset.conf: history/saved-yyyymmdd-post-reset.
Wireless Array Note that the configuration is automatically saved to a file in a few situations, as described in Step 8 above. Important! When you have initially configured your Array, or have made significant changes to its configuration, we strongly recommend that you save the configuration to a file in order to have a safe backup of your working configuration. 10. Download Current Configuration: Click on the link titled xs_current.
Wireless Array is complete, the filename xs_diagnostic.log will be displayed in blue and provides a link to the newly created log file. Click the link to download this file to the C:\ folder on your local computer. (Figure 176) Click Create to create log Then click this link to save log file to local computer Figure 176. Saving the Diagnostic Log This feature is only used at the request of Customer Support.
Wireless Array Web Page Redirect The Array uses a Perl script and a cascading style sheet to define the default splash/login Web page that the Array delivers for WPR. You may replace these files with files for one or more custom pages of your own. See Step 15 below to view the default files. See Step 14 on page 253 for more information about WPR and how the splash/login page is used. Each SSID that has WPR enabled may have its own page. Custom files for a specific SSID must be named based on the SSID name.
Wireless Array 14. Remove File: Enter the name of the WPR file you want to remove, then click on the Delete button. You can use the List Files button to show you a list of files that have been saved on the Array for WPR. The list is displayed in the Status section at the bottom of the WMI window. You must reboot to make your changes take effect. 15. Download Sample Files: Click on a link to access the corresponding sample WPR files: • wpr.pl — a sample Perl script. • hs.
Wireless Array accessing the network, you can quickly determine if there is a basic RADIUS problem by using the RADIUS Ping tool. For example, in Figure 179 (A), RADIUS Ping is unable to contact the server. In Figure 179 (B), RADIUS Ping verifies that the host information and secret for a RADIUS server are correct, but that the user account information is not. Select RADIUS allows you to select a RADIUS server that you have already configured.
Wireless Array 19. Execute System Command: Click Execute to start the specified command. Progress of command execution is displayed in the Progress frame. Results are displayed in the Status frame. Progress and Status Frames The Progress frame displays a progress bar for commands such as Software Upgrade and Ping. The Status frame presents the output from system commands (Ping and Trace Route), as well as other information, such as the results of software upgrade. 20.
Wireless Array To enter a command, simply type it in. The command is echoed and output is shown in the normal way — that is, the same way it would be if you were using the CLI directly. You may use the extra scroll bar inside the right edge of the window to scroll through your output. If output runs past the right edge of the screen, there is also a horizontal scroll bar at the bottom of the page.
Wireless Array Options This window allows you to customize the behavior and appearance of the WMI. By default, the Array uses the New style option, shown below. Figure 181. WMI Display Options Procedure for Configuring Options 1. Style: This option allows you to change the appearance and operation of the user interface. Select one of the available styles from the drop-down list. Click the Apply button to view the WMI with the selected style.
Wireless Array Figure 182. iPhone Style Option For example, the iPhone style option (Figure 182) has a more compact display, suitable for use on smart phones. It shows the main menu in the orange bar at the top, rather than as a tree in its own frame on the left. Clicking one of the menu choices at the top in Figure 182 will display a drop-down menu with the options for that menu choice. Menus may be toggled on and off by clicking on the headers (Status, Configuration, etc.). 2.
Wireless Array 3. Close Menu Section when Deselected: When you click a main section such as SSIDs in the left frame of the WMI (the navigation tree), the section is expanded to show submenu choices. Click Yes to automatically close any open submenus when you select a different section. If you click No, all menu sections will remain expanded once opened. No is the default.
Wireless Array Logout Click on the Logout button to terminate your session. When the session is terminated, you are presented with the Array’s login window. Figure 183.
