Gebruiksaanwijzing /service van het product WX2200 3CRWX220095A van de fabrikant 3Com
Ga naar pagina of 728
http://www.3Com.com/ Part No. 10015909 Published June 2 007 Wir eless LAN Mobility System W ir eless LAN Switch and Contr oller Configuration Guide WX4400 3CRWX440095A WX2200 3CRWX220095A WX1200 3CRWX.
3Com Corporati on 350 Campus Drive Marlborough, MA USA 01752-3064 Copyright © 2 007, 3Com Corporatio n. All rights reserved . No part of this documen tatio n may be repro duced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without writt en permission fr om 3Com Cor poration.
C ONTENTS A BOUT T HIS G UIDE Conventions 23 Documentation 24 Documentation Comments 25 1 U SING THE C OMMAND -L INE I NTERFACE Overview 27 CLI Conventions 27 Command Prompt s 28 Syntax Notation 28 T .
Web Quick Start Parameters 40 Web Quick Start Requir ements 41 Accessing the Web Quick Start 41 CLI quickstart Command 44 Quickstart Example 46 Remote WX Configuration 49 Opening the QuickStart Networ.
Setting the Maximum Number of Login Att empts 67 Specifying Minimum Passwor d Length 68 Configuring Passwo rd Expiratio n T ime 69 Restoring Access to a Locked-Out User 70 Displaying Password Informat.
Configuring the System IP Address 108 Designating the System IP Address 108 Displaying the System IP Addr ess 108 Clearing the System IP Address 108 Configuring and Managing IP Routes 108 Displaying I.
Adding an ARP Entry 131 Changing the Aging T imeout 131 Pinging Anothe r Device 132 Logging In to a Remote Device 132 T racing a Route 133 IP Interfaces and Services Configur ation Scenario 135 7 C ON.
Configuring WX-WX Security 158 Monitoring the VLANs and T unne ls in a Mobility Domain 159 Displaying Roaming Stations 159 Displaying Roaming VLANs and Their Af finities 160 Displaying T unnel Informa.
Configuring MAPs 213 Specifying the Country of Operation 213 Configuring an Auto-AP Pr ofile fo r Automatic MAP Config uration 218 Configuring MAP Port Parameters 224 Configuring MAP-WX Security 229 C.
Setting Strictness for RF Load Balancin g 270 Exempting an SSID from RF Load Balancing 271 Displaying RF Load Ba lancing Information 271 12 C ONFIGURING WLAN M ESH S ER VICES WLAN Mesh Services Overvi.
Enabling Dynamic WEP in a WP A Network 304 Configuring Encryption f or MAC Clients 306 14 C ONFIGURING RF A UTO -T UNING Overview 311 Initial Channel and Power Assignment 311 Channel and Power T uning 312 RF Auto-T uning Parameters 314 Changing RF Auto-T uning Settings 316 Selecting A vailable Channels on t he 802.
Enabling U-APSD Support 342 Configuring Call Admission Contr ol 343 Configuring Static CoS 343 Changing CoS Mappings 344 Using the Client’ s DSCP V alue to Classify QoS Level 344 Enabling Br oadcast.
18 C ONFIGURING AND M ANAGING IGMP S NOOPING Overview 369 Disabling or Reenabling IGMP Snooping 369 Disabling or Reenabling Pr oxy Reportin g 370 Enabling the Pseudo-Querier 370 Changing IGMP Timers 3.
Mapping Security ACLs 390 Mapping User -Based Se curity ACLs 390 Mapping Security ACLs to Ports, VLANs, Virtual Ports, or Distributed MAPs 392 Modifying a Security ACL 394 Adding Another ACE to a Secu.
Key and Certificate Configuration Scenarios 427 Creati ng Self-Signed Certificates 427 Installing CA-Signed Certificates from PKCS #12 Object Files 429 Installing CA-Signed Certificates Usin g a PKCS .
Configuring Last-R esort Access for Wired Authenticatio n Ports 481 Configuring AAA for Users of Third-Party APs 482 Authentication P r ocess for Us ers of a Third-Party AP 482 Requirements 483 Configuring Authenticatio n for 802.1X Users of a Thir d-Par ty AP with T agged SSIDs 484 Configuring Authenticatio n for Non-802.
22 C ONFIGURING C OMMUNICATION WITH RADIUS RADIUS Overview 519 Befor e Y ou Begin 521 Configuring RADIUS Servers 521 Configuring Global RADIUS Defaults 522 Setting the System IP Addr e ss as the Sourc.
24 C ONFIGURING SODA E NDPOINT S ECURITY FOR A WX S WITCH About SODA Endpoint Security 543 SODA Endpoint Security Su pport on WX Switches 544 How SODA Functionality Works on WX Switches 545 Configurin.
26 R OGUE D ETECTION AND C OUNTERMEASURES Overview 567 About Rogues a nd RF Detection 567 Rogue Access Points and Clients 567 RF Detection Scans 571 Countermeasures 572 Mobility Domain Requirement 5 7.
27 M ANAGING S YSTEM F ILES About System Files 5 99 Displaying Software V ersion Information 599 Displaying Boot Information 601 Working wit h Files 602 Displaying a List of Files 602 Copying a File 6.
Displaying a T race 632 Stopping a T race 632 About T race Results 633 Displaying T race Results 633 Copying T race Results to a Server 634 Clearing the T race Log 634 List of T race Areas 634 Using d.
C S UPPORTED RADIUS A TTRIBUTES Attributes 651 Supported Standard and Extended Attributes 652 3Com V endor -Specific Attributes 659 D T RAFF IC P ORTS U SED BY MSS E DHCP S ERVER How the MSS DHCP Serv.
A BOUT T HIS G UIDE This guide describes the configurat ion commands for the 3Com Wire less LAN Switch WXR100, WX1200, or 3Com W ir eless LAN Controller WX4400, WX2200. This guide is intended for System integr ators who ar e configuring the WXR100, WX1200, WX44 00, or WX2200.
24 A BOUT T HIS G UIDE This manual uses the follo wi ng text and syntax conventions: Documentation The MSS documentation set includ es the following documents. Wireless Switch Manager (3WXM) Rele ase Notes These notes provide information about the 3WXM sof twar e r elease, including new features and bug fixes.
Documentation Comments 25 Wireless Switch Manager Ref erence Manual This manual shows you how to plan , configure, deploy , and manage a Mobility System wireless LAN (WLAN) using the 3Com Wireless Switch Manager (3WXM).
26 A BOUT T HIS G UIDE Please note that we can only r esp ond to comments and questions about 3Com product documentation at this e-mail address. Qu estions related to technical support or sales should be dire cted in the first instance to your network supplier .
1 U SING THE C OMMAND -L INE I NTERFACE Mobility System Software (MSS) op erates a 3Com Mobility System wireless LAN (WLAN) consisting of 3Com Wireless S witch Mana ger software, Wireless LAN Switches (WX1200 or WXR100), Wireless LAN Controllers (WX4400 or WX2200), and Managed Access Points (MAPs).
28 C HAPTER 1: U SING THE C OMMAND -L INE I NTERFACE Command Prompts By default, the MSS CLI provides the following pr ompt for restricted users. The mmmm portion shows the WX model number (for example, 1200) and the nnnnnn portion shows the last 6 digits of the WX media access control (MAC) addr ess.
CLI Conventions 29 The CLI has specific notation requirements for MAC addresses, IP addresses, and masks, and allows you to g r oup usernames, MAC addresses, virtual LAN (VLAN) name s, and ports in a single command. 3Com recommends that you do not use the same name with differ ent capitalizations for VLANs or access co ntrol lists (ACLs).
30 C HAPTER 1: U SING THE C OMMAND -L INE I NTERFACE Wildcard Masks Security access control lists (ACLs) use source and destination IP addresses and wildca rd masks to de termine whe ther the WX filters or forwards IP packets. Matching packets ar e either permitted or denied network access.
CLI Conventions 31 MAC Address Globs A media access control (MAC) address glob is a similar method for matching some authentication, aut horization, and accounting (AAA) and forwarding database (FDB) commands to one or more 6-byte MAC addresses.
32 C HAPTER 1: U SING THE C OMMAND -L INE I NTERFACE To m a t c h all VLANs, use the double-asterisk (**) wildcar d characters with no delimiters. T o match any numbe r of characters up to, but not including, a delimiter character in th e glob, use th e single-asterisk (*) wildcard.
Command-Line Editing 33 Virtual LAN Identification The names of virtual LANs (VLANs), whic h ar e used in Mobility Domain™ communications, are set by you and can be changed. In co ntrast, VLAN ID numbers , which the WX switch uses locally , are determined when the VLAN is first configured and cannot be changed.
34 C HAPTER 1: U SING THE C OMMAND -L INE I NTERFACE History Buffer Th e history buffer stores the last 63 commands you entered during a terminal session . Y ou can use the Up Ar row and Down Arr ow ke ys to select a command that yo u want to repeat fr om the history buffer .
Using CLI Help 35 rollback Remove changes to the edited ACL table save Save the running configuration to pers istent storage set Set, use 'set help' for more informati on telnet telnet IP ad.
36 C HAPTER 1: U SING THE C OMMAND -L INE I NTERFACE Understanding Command Descriptions Each command description in the Wireless LAN Switch and Controller Command Reference contains the following elements: A command name, which shows the keywords but not the variables.
2 WX S ETUP M ETHODS This chapter describes the methods you can use to configure a WX switch, and refers you to information for each method. Depending on your configuration needs, you can use one or a combination of these methods.
38 C HAPTER 2: WX S ETUP M ETHODS 3Com Wire less Switch Manager Y ou can use 3Com Wireless Swit ch Manage r to r emotely c onfigur e a switch using o ne of the fo llowing tech niques: Drop ship—On model WXR100 only , you can press the factory reset switch during power on until the right LED above por t 1 flashes for 3 seconds.
How a WX Switch Gets its Configuration 39 How a WX Switch Gets its Configuration Figure 1 shows how a WX switch gets a configuration when you power it on.
Web Quick Start (WXR100, WX1 200 and WX2200 Only) 40 Web Quick Start (WXR100, WX1200 and WX2200 Only) Y ou can use the Web Quick Start to configure the switch to provide wireless access to up to ten network users.
Web Quick Start (WXR100, WX1 200 and WX2200 Only) 41 Web Quick Start Requirements T o use the Web Quick Start, you need the following: AC power source for the switch PC with an Ethernet po rt .
42 C HAPTER 2: WX S ETUP M ETHODS This is a temporary , well-known address assigned to the unconfigur ed switch when you power it on. Th e W eb Quick Start enables you to change this address. The first page of t he Quick Start Wizard appears. 6 Click Start to begin.
Web Quick Start (WXR100, WX1 200 and WX2200 Only) 43 Her e is an example: 8 Review the configuration settings, then click Finish to save the changes or click Back to change settings.
44 C HAPTER 2: WX S ETUP M ETHODS CLI quickstart Command The quickstart command runs a script that interactively helps you configure the following items: System name Country code (regulatory domain) System IP address Default route 802.
CLI quickstart Command 45 The command automatically places all po rts that are not used for dir ectly connected MAPs into the default VLAN (VLAN 1). The quickstart command prompts you for an administrat ive username and password for managing t he switch over the network.
46 C HAPTER 2: WX S ETUP M ETHODS Quickstart Example Th is example configur es the following parameters: System name: WX1200-Corp Country code (regulatory domain): US System IP address: 172.16.0.21, on IP interface 172.16.0.21 255.255.255.
CLI quickstart Command 47 If you configure time and date parame ters, you will be r equired to enter a name for the timezone, and then ente r the value of the timez one (the offset fr om UTC) separately . Y ou can use a string of up to 32 alphabetic characters as the timezone name.
48 C HAPTER 2: WX S ETUP M ETHODS Specify the port number that needs t o be tagged [1-2, <CR> ends config]: Admin username [admin]: wxadmin Admin password [optional]: letmein Enable password [op.
Remote WX Configuration 49 8 Save the configuration changes. WXR100-aabbcc# save config Remote WX Configuration Y ou can use 3Com W ir eless Switch Manager Services running in your corporate network to configure WX switches in remote of fices.
50 C HAPTER 2: WX S ETUP M ETHODS T o open the network plan: 1 Install 3WXM, if not already installed. (See the “Getting Started” chapter of the Wireless Switch Manager User’ s Guide or the “Installing 3WXM” chapter of the Wireless Switch Manager Ref erence Manual .
3 C ONFIGURING AAA FOR A DMINISTRATIVE AND L OCAL A CCESS 3Com Mobility System Softwa re (MSS) supports authentication, authorization, and accounting (AAA) for secure network connections. As administra tor , you must establish ad ministrative access for your self and optionally other local users before you can configure the WX for operation.
52 C HAPTER 3: C ONFIGURING AAA FOR A DMINISTRATIVE AND L OCAL A CCESS 5 Customized authentication. Y ou can requir e authentication for all users or for only a subset of users.
Overview 53 Figure 3 T ypical 3Com Mobility System WX switch Core router Layer 2 switches WX switches B uilding 1 D a t a ce n t e r F loo r 3 F loo r 2 Layer 2 or Layer 3 switches RADIUS or AAA Serve.
54 C HAPTER 3: C ONFIGURING AAA FOR A DMINISTRATIVE AND L OCAL A CCESS Before Y ou Start Before r eading more of this chapter , read the W ireless LAN Switch and Controller Quick Start Guide to set up a WX switch and the attached MAPs for basic service.
First-Time Configurati on via the Console 55 First-Time Configuration via the Console Administrators must initially configur e the WX switch with a computer or terminal connected to the WX co nsole port thr ough a serial cable. T elnet access is not init ially enabled.
56 C HAPTER 3: C ONFIGURING AAA FOR A DMINISTRATIVE AND L OCAL A CCESS Setting the WX Switch Enable Password There is one enable passwor d for the entire WX switch.
First-Time Configurati on via the Console 57 3WXM Enable Password If you use 3WXM to continue config uring the switch, you will need to enter the switch’ s enable pas swor d when you upload the switch’ s configuration into 3WXM. (For 3WXM information, see the Wireless Switch Manager Reference Manual .
58 C HAPTER 3: C ONFIGURING AAA FOR A DMINISTRATIVE AND L OCAL A CCESS The authentication method none you can specify for administrative access is different from the fallthru authentication type None, which applies only to network access. The authentication method none allows access to the WX switch by an administrator .
Configuring Accounti ng for Administrative Users 59 Although MSS allows you to configure a user passw ord for the special “last-resort” guest user , the password has no effect. Last-resort users can never access a WX in administrative mode and never require a password.
60 C HAPTER 3: C ONFIGURING AAA FOR A DMINISTRATIVE AND L OCAL A CCESS Y ou can select either start-stop or stop-only accounting modes. The stop-only mode sends only stop records, wher eas start-stop sends both start and stop recor ds, ef fectively doubling the number of accounting recor ds.
Displaying the AAA Configuration 61 Displaying the AAA Configuration T o display your AAA configuration, type the following command: WX1200# display aaa Default Values authport=1812 acctport=1813 time.
62 C HAPTER 3: C ONFIGURING AAA FOR A DMINISTRATIVE AND L OCAL A CCESS Administrative AAA Configuration Scenarios The following scenario s illustrate typica l configurations for administrative and local authent ication. For all scen arios, the administ rator is Natasha with the password m@Jor .
Administrative AAA Configuration Scenarios 63 Natasha also adds the RADIUS server ( r1 ) to the RADIUS server group sg1 , and configures T elnet administrative users for authenticati on thr ough the group. She types the following commands in this order: WX1200# set server group sg1 members r1 success: change accepted.
64 C HAPTER 3: C ONFIGURING AAA FOR A DMINISTRATIVE AND L OCAL A CCESS Local Override and Backup Local Authentication This scenario illustrates how to enable local ove rride authentication for console users. Local override mean s that MSS attempts authentication first via the local d atabase.
4 M ANAGING U SER P ASSWOR DS This chapter describes how to manage user passwords, configure user passwords, and how to display password information. Overview 3COM r ecommends that all users create passwords that are memorable to themselves, difficul t for others to guess, and not subject to a dictionary attack.
66 C HAPTER 4: M ANAGING U SER P ASSWOR DS Only one unsuccessful login a ttempt is allowed in a 10-second period for a user or session. All administrative logins, logouts, logouts due to idle timeout, and disconnects are logged. The audit log file on the WX switch ( command_audit.
Configuring Passwords 67 Enabling Password Restrictions T o activate password restrictions for network and administrative users, use the following command: set authentication password-restrict { enabl.
68 C HAPTER 4: M ANAGING U SER P ASSWOR DS Y ou can specify a number between 0 – 2147483647. Specifying 0 causes the number of allowable login attempts to reset to the default values. If a user is locked out of the system , you can r estore the user’ s access with the clear user lockout co mmand.
Configuring Passwords 69 Configuring Password Expiration Time T o specify how long a user’ s passwor d is valid be fore it must be r eset, use the following command: set user username expire-passwor.
70 C HAPTER 4: M ANAGING U SER P ASSWOR DS Restoring Access to a Locked-Out Us er If a user’ s password has expired, or the user is unable to log in within the configured limit for logi n attempts, then the user is locked out of the system, and cannot gain access without the intervention of an administrator .
5 C ONFIGURING AND M ANAGING P ORTS AND VLAN S This chapter describes how to conf igure and manage ports and VLANs. Configuring and Managing Ports Y ou can configure and display information for the fo.
72 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S All WX switch ports are network ports by default. Y ou must set th e port type for ports directly connected to MAP access ports and to wired user stations that must be authenticate d to access the network.
Configuring and Managing Ports 73 Setting a Port for a Dire ctly Connected MAP Before configuring a port as a MAP access port, you must use the set system countrycode command to set the IEEE 802.11 countr y-specific regulations on the WX switch. (See “Specifying the Countr y of Operation” on page 213.
74 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S Y ou cannot configure any gigabit Ethernet port, or port 7 or 8 on a WX1200 switch, or port 1 on a WXR100, as a MAP port. T o manage a MAP on a switch model that does not have 10/100 Ethernet ports, configure a Distributed MAP connecti on on the switch.
Configuring and Managing Ports 75 For the serial- id paramete r , specify the serial ID of the MAP . The serial ID is listed on the MAP case. T o display the serial ID using the CLI, use the display version details command. The model and radiotype parameters have the same options as they do with the set port type ap command.
76 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S This command configures port 7 as a wired authentication port supporting one interface and one simultaneous user sessio n.
Configuring and Managing Ports 77 A cleared port is not placed in any VLANs, not even the default VLAN (VLAN 1). T o clear a port, use the followin g command: clear port type port-list For example, to.
78 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S Configuring Interface Prefer ence on a Dual-Interface Gigabit Ethernet Port (WX4400 only) The gigabit Ether net ports on a WX4400 have two physical interfaces: a 1000BASE-TX copper interface an d a 1000BASE-SX or 1000BASE- LX fiber interface.
Configuring and Managing Ports 79 Configuring Port Operating Parameters Autonegotiation is enabled by default on a WX switch’ s 10/100 Ether net ports and gigab it Ethernet ports.
80 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S T o set the port speed on ports 1 and 3 thr ough 5 to 10 Mbps, type the following command: WX1200# set port speed 1,3-5 10 Gigabit Ports — Autonegotiation and Flow Contr ol WX gigabit ports use autonegotiation by default to determine capabilities for 802.
Configuring and Managing Ports 81 Resetting a Port Y ou can reset a port by togglin g its link state and PoE state. MSS disables the port’ s link and PoE (if applicable) for at least one second, then r eenables them.
82 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S Displaying PoE State T o display the PoE stat e of a port, use the following command: display port poe [ port-list ] T o display PoE informa.
Configuring and Managing Ports 83 Clearing Statistics Counters T o clear all po rt statistics counters, use the following command: clear port counters The counters begin incrementing again, starting from 0. Monitoring Port Statistics Y ou can display port statistics in a format that continually updates the counters.
84 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S Use the keys listed in T able 8 to control the monitor display . T o monitor port statistics b eginning with octet statistics (t he default).
Configuring and Managing Ports 85 Configuring Load-Sharing Port Gr oups A port group is a set of physical ports that function together as a single link and provide load sharing and link r edundancy . Only network ports can participate in a port group.
86 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S T o configure a port gr oup named ser ver1 containing ports 1 through 5 and enable the link, type the following command: WX1200# set port-group name server1 1-5 mode on success: change accepted.
Configuring and Managing VLANs 87 Displaying Port Group Information T o display port group information, use the following co mmand: display port-group [ name group-name ] T o display the configu ratio.
88 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S VLANs are not configured on MAP access ports or wir ed authentication ports, because the VLAN membership of these types of ports is determined dynamically through the authentication and authorization process.
Configuring and Managing VLANs 89 Y ou assign a user to a VLAN b y settin g one of the following att ributes on the RADIUS servers or in the local user database: T unnel-Private-Group-ID — This attribute is described in RFC 2868, RADIUS Attributes for T unnel Prot ocol Support .
90 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S Because the default VLAN (VLAN 1) might not be in the same subnet on each switch, 3Com reco mmends that you do not rename the default VLAN or use it for user traffic. Instead, configur e other VLANs for user traffic.
Configuring and Managing VLANs 91 If the WX switch that is not in the user’ s VLAN has a choice of more than one other WX switch through which to tunnel the user’ s traffic, the switch selects the other switch based on an affi nity value.
92 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S Y ou must assign a name to a VLAN before you can add ports to the VLAN. Y ou can configur e the name and add po rts with a single s et vlan command or separate set vlan commands. Once you assign a VLAN number to a VLAN, you cannot change the number .
Configuring and Managing VLANs 93 Removing an Entire VLAN or a VLAN Port T o remove an entir e VLAN or a specific port and tag value fr om a VLAN, use the following command: clear vlan vlan-id [ port .
94 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S Restricting Layer 2 Forwarding Among Clients By default, clients within a VLAN are able to communicate with one another directly at Layer 2. Y ou can enhance network security by restricting Layer 2 forwar ding among clients in the sa me VLAN.
Configuring and Managing VLANs 95 The following commands restrict Layer 2 forwarding of client data in VLAN abc_air to the default routers with MAC addr ess aa:b b:cc:dd:ee:ff and 11:22:33:44:55:66, a.
96 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S Managing the Layer 2 Forwarding Database A WX switch uses a Layer 2 forwar ding database (FDB) to forward traffic within a VLAN. The entries in the forwarding database map MAC addresses to the physical or virt ual ports connected to those MAC addresses within a particular VLAN.
Managing the Layer 2 Forwarding Datab ase 97 Displaying Forwarding Database Information Y ou can display the forwarding database size and the entries contained in the database.
98 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S T o display all entries that begin wi th 00 , type the following command: WX1200# display fdb 00:* * = Static Entry.
Managing the Layer 2 Forwarding Datab ase 99 Configuring the Aging Timeout Period The aging timeout period specifies how long a dynamic entry can r emain unused before the softwar e r emoves the entry from the database. Y ou can change the aging timeou t period on an individual VLAN basis.
100 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S Port and VLAN Configuration Scenario This scenario assigns names to por ts, and config ur es MAP access ports, wired authentication ports, a load -sharing port group, and VLANs. 1 Assign names to ports to identify their fu nctions, and verify the configuration change.
Port and VLAN Configuration Scenario 101 ==================================== ================================ =========== Boot Time: 2000-03-18 22:59:19 Uptime: 0 days 00:13:45 ======================.
102 C HAPTER 5: C ONFIGURING AND M ANAGING P ORTS AND VLAN S 4 Configure ports 5 and 6 as wir ed authentication ports and verify the configuration change.
6 C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES This chapter describes how to conf igure IP interfaces and services. MTU Support Mobility System Software (MSS ) supports standard maximum transmission units (MTUs) of 1 514 byte s for standard Ethernet packets and 1518 bytes for Ether net packets with an 802.
104 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES Configuring and Managing IP Interfaces Many features, including the following, require an IP interface on the WX switch: Man.
Configuring and Managing IP Interfaces 105 The DHCP client is enabled b y default on an unconfigured WXR100 when the factory reset switch is pressed and held during p ower on.
106 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES If the switch is powered down or restarted, MSS does not re tain the values received fr om the DHCP server . However , if the IP interface goes down but MSS is still running, MSS attempts to r euse the address when the interface comes back up.
Configuring and Managing IP Interfaces 107 Displaying DHCP Client Information T o di splay DHCP client information, type the following command: WX1200# display dhcp-client Interface: corpvlan(4) Configuration Status: Enabled DHCP State: IF_UP Lease Allocation: 65535 seconds Lease Remaining: 65532 seconds IP Address: 10.
108 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES Configuring the System IP Address Y ou can designate one of the IP addre sses configur ed on a WX switch to be the system IP address of the switch.
Configuring and Managing IP Routes 10 9 A destination ca n be a subnet or networ k. If two static r outes specify a destination, the mor e specific rout e is always chosen (longest prefix match). For example, if you have a static r oute with a destinat ion of 10.
110 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES Displaying IP Routes T o display IP routes, use the following command: display ip route [ destination ] The destination parameter specifies a de stination IP address.
Configuring and Managing IP Routes 11 1 If a VLAN is administratively disabled or all of the links in the VLAN go down or are disabled, MSS removes the VLAN’ s routes from the r oute table. If the direct r oute requir ed by a static route goes down, MSS changes the static route state to Down.
112 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES T o add two default routes and configure MSS to always use the r oute through 10.2.4.69 when the WX interface to that default router is up, type the following commands: WX1200# set ip route default 10.
Managing the Management Services 113 Managing the Management Services MSS provides the following services for managing a WX switch over the network: Secure Shell (SSH) — SSH provides a secur e connection to the CLI through TCP port 22. Te l n e t — T elnet provides a nonsecure connection to the CLI through TCP port 23.
114 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES SSH requir es an SSH authentication ke y . Y ou can generate one or allow MSS to generate one. The first time an SSH client attempts to access the SSH server on a W X switch, the switch automatica lly generates a 1024-byte SSH key .
Managing the Management Services 115 T o add administrative user wxadmin with password letmein , and use RADIUS server group sg1 to authenticat e the user , type the following commands: WX1200# set us.
116 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES T o clear all SSH server sessions , type the followin g command: WX1200# clear sessions admin ssh This will terminate manager se.
Managing the Management Services 117 Displaying T elnet Status T o display the status of the T elnet server , use the following command: display ip telnet T o display the T elnet server status an d th.
118 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES T o display the T elnet server sessions on a WX switch, type the following command: WX1200# display sessions admin Tty Username .
Managing the Management Services 119 The command lists the TCP port number on which the switch listens for HTTPS connections. The command also lists the last 10 devices to establish HTTP S connection s with th e switch and when the connections were established.
120 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES Setting a Message of the Day (MOTD) Banner Y ou can configure the WX switch to display a Message of the Day (MOTD) banner , which is a string of text that is displayed before the beginning of the login pr ompt for a user’ s CLI session.
Configuring and Managing DNS 121 After these commands are entered, when the user logs on, the MOTD banner is displayed, followed by the text Do you agree? If the user ent ers y , then the login proceeds; if not, then the user is disconnected.
122 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES Configuring a Default Domain Name Y ou can configure a single default domain name for DNS queries. The WX switch appends the d efault domai n name to hostnames you enter in commands.
Configuring and Managing Aliases 12 3 Configuring and Managing Aliases An alias is a string that r epr esents an IP address. Y ou can use aliases as shortcuts in CLI commands. For ex ample, you can configure alias pubs1 for IP address 10.10.10.20, and enter ping pubs1 as a shortcut for ping 10.
124 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES Configuring and Managing Time Parameters Y ou can configure the system time and date statically or by using Network T ime Protocol (NTP) servers. In each case, you can specify the offset fr om Coordinated Universal Ti me (UTC) by setting the time zone.
Configuring and Managing Time Parameters 125 Setting the Time Zone The time zone paramete r adjusts the system date, and optionally the time, by applying an offset to UTC. T o set the time zone, use the following command: set timezone zone-name {- hours [ minutes ]} The zone name can be up to 32 alph anumeric ch aracters long, with no spaces.
126 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES The summer -name can be up to 32 alphanumeric characters long, with no spaces. The start and end dates and times are optional. If you do not specify a start and end time, MS S impl ements the time change starting at 2:00 a.
Configuring and Managing Time Parameters 127 Statically Configuring the System Time and Date T o statically configure the system time and date, use the following command: set timedate { date mmm dd yyyy [ time hh:mm:s s ]} The day of week is automat ically calculated from the day you set.
128 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES MSS adjusts the NTP reply according to the following time parameters configured on the WX switch: Offset fr om UTC (configur.
Configuring and Managing Time Parameters 129 Resetting the Update Interval to the Default T o reset the update interval to th e default value, use the following command: clear ntp update-interval Enabling the NTP Client The NTP client is disabled by def ault.
130 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES Managing the ARP Ta b l e The Address Resolution Protocol (ARP ) table maps IP addr esses to MAC addresses. An ARP entry en ters the table in one of the following ways: Added automatically by the WX switch.
Managing the ARP Table 131 Adding an ARP Entry MSS automatically adds a local entry for a WX switch and dynamic entries for addresses learned from traffic r eceived by the switch. Y ou can add th e following types of entries: Dynamic — Ages out based on the aging timeout.
132 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES Pinging Another Device T o verify that another device in the network can receive IP packets sent by the WX switch, use the follo.
Tracing a Route 133 When you press Ctrl+t or type exit to end the client session, the management session returns to the local WX pr ompt: WX1200-remote> Session 0 pty tty2.
134 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES T o identify the next hop, traceroute again sends a UDP packet, but this time with a TTL value of 2. The first r outer decrements the TTL field by 1 and sends the datagram to the next router .
IP Interfaces and Service s Configuration Scenario 135 IP Interfaces and Services Configuration Scenario This scenario con figur es IP interface s, assigns one of the interfaces to be the system IP addr ess, and configur es a default r oute, DNS parameters, and time and date parameters.
136 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES 3 Configure a default r oute through a de fault r outer attached to the WX switch and verify the conf igurat ion change. T ype the following commands: WX1200# set ip route default 10.
IP Interfaces and Service s Configuration Scenario 137 WX1200# display summertime Summertime is enabled, and set to 'P DT'. Start : Sun Apr 04 2004, 02:00:00 End : Sun Oct 31 2004, 02:00:00 Offset : 60 minutes Recurring : yes, starting at 2:00 am of first Sunday of April and ending at 2:00 am on last Sunday of October.
138 C HAPTER 6: C ONFIGURING AND M ANAGING IP I NTERFACES AND S ERVICES.
7 C ONFIGURING SNMP MSS supports Simple Network Manageme nt Protocol (SNMP) versions 1, 2c, and 3. Overview The MSS SNMP engine (also called the SNMP server or agent ) can run any combination of the following SNMP versions: SNMPv1—SNMPv1 is the simplest a nd least secure SNMP version.
140 C HAPTER 7: C ONFIGURING SNMP Set the minimum level of security allowed for SNMP message exchanges. Configure a notification pr ofile or modify the default one, to enable sending of notifications to notif ication targets. By default, notifications of all types are dropped (not sent).
Configuring SNMP 141 The c omm-string can be u p to 32 alphanumeric characters long, wit h no spaces. Y ou can configure up to 10 community string s. The access level specifi es the r ead-write privil.
142 C HAPTER 7: C ONFIGURING SNMP The usm-username can be up to 32 alphanumeric ch aracters long, with no spaces. Y ou can co nfigur e up to 20 SNMPv3 u sers. The snmp-engine-id option sp ecifies a unique identifier for an instance of an SNMP engine. T o send informs, you must specify the engine ID of the inform receiver .
Configuring SNMP 143 3des —T riple DES encryption is used. aes —Advanced Encryption Stand ar d (AES) encryption is used. If the encryption type is des , 3des , or aes , you can specify a passphrase or a hexadecimal key . T o specify a passphrase, use the encrypt-pass-phrase string option.
144 C HAPTER 7: C ONFIGURING SNMP T o set the minimum level of security MSS requires for SNMP , use the following command: set snmp security { unsecured | authe nticated | encrypted | auth-req-unsec-notify } Y ou can specify one of the following options: unsecured —SNMP message exchanges are not secure.
Configuring SNMP 145 The profile-name can be up to 32 alphanumer ic characters long, with no spaces. T o modify the default notification profile, specify default . The notification- type can be one of the following: APBootT raps— Generated when a MAP boots.
146 C HAPTER 7: C ONFIGURING SNMP DAPConnectW arningT raps —generated whe n a Distributed MAP whose fingerprint has n ot been configured in MSS establishes a management session with the switch. DeviceFailT raps— Generated when an event with an Alert severity occurs.
Configuring SNMP 147 RFDetectInterferingRogueDisappearT raps —Gene rated when an interfering device is no longer detected. RFDetectSpoofedMacAPT raps —Generated when MSS detects a wireless packet with the sour ce MAC address of a 3Com MAP , but without the spoofed MAP’ s signature (fingerprint).
148 C HAPTER 7: C ONFIGURING SNMP WX1200# set snmp notify profile snmp prof_rfdetect send RFDetectInterferingRogueAPTraps success: change accepted. WX1200# set snmp notify profile snmp prof_rfdetect send RFDetectInterferingRogueDisappearTra ps success: change accepted.
Configuring SNMP 149 T o configure a notification target for traps from SNMPv3, use the following command: set snmp notify target target-num ip -addr [ :udp-port-number ] usm trap user username [ prof.
150 C HAPTER 7: C ONFIGURING SNMP The inform or trap optio n specifies whether the MSS SNMP engine expects the tar get to ack nowledge notifications sent to the target by the WX switch. Use inform if you want acknowledgements. Use trap if you do not want acknowledgements.
151 C HAPTER 7: C ONFIGURING SNMP This command configures target 1 at IP addr ess 10.10.40.9. The target’ s SNMP engine ID is based on its addr ess. The MSS SNMP engine will send notifications based on the default pr ofile, and will requir e the target to acknowledge receiving them.
152 C HAPTER 7: C ONFIGURING SNMP Displaying Notification Profiles T o display notification profile s, use the following command: display snmp notify profile The command lists settings separately for each notification pr ofile. The use count indicates how many notification targets use the profile.
8 C ONFIGURING AND M ANAGING M OBILITY D OMAIN R OAMING A Mobility Domain is a system of WX switches an d managed access points (MAPs) working together to support roaming wireless users (clients). T unnels and virtual ports betw een the WX switches in a Mobility Domain allow users to roam without any disruption to network connectivity .
154 C HAPTER 8: C ONFIGURING AND M ANAGING M OBILITY D OMAIN R OAMING Configuring a Mobility Domain The WX switches in a Mobility Domain use their system IP address for Mobility Domain communication.
Configuring a Mobility Domain 155 Optionally , you can conf igur e a redu ndant seed WX switch, which takes over seed duties if the primary seed becomes unava ilable.
156 C HAPTER 8: C ONFIGURING AND M ANAGING M OBILITY D OMAIN R OAMING Configuring Mobility Domain Seed Redundancy Y ou can optionally specify a secondar y seed in a Mobility Domain. The secondary seed provides redundancy for the primary seed switch in the Mobility Domain.
Configuring a Mobility Domain 157 Displaying Mobility Domain Status T o view the status of the Mobility Dom ain for the WX switch, use the display mobility-domain command.
158 C HAPTER 8: C ONFIGURING AND M ANAGING M OBILITY D OMAIN R OAMING Configuring WX-WX Security Y ou can enhance security on your ne twork by en abling WX-WX security . WX-WX security encrypts management traffic exchanged by WX switches in a Mobility Domain.
Monitoring the VLANs and Tunnels in a Mobility Domain 159 Monitoring the VLANs and T unnels in a Mobility Domain T unnels connect WX switches. T unnels are formed automatically in a Mobility Domain to extend a VLAN to the WX switch that a r oaming station is associated with.
160 C HAPTER 8: C ONFIGURING AND M ANAGING M OBILITY D OMAIN R OAMING Displaying Roaming VLANs and Their Affinities The command display roaming vlan displays all VLANs in the Mobility Domain, the WX switches servic ing the VLANs, and their tunnel affinity values configur ed on each switch for the VLANs.
Understanding the Sessions of Roaming Users 161 Understanding the Sessions of Roaming Users When a wireless client su ccessfully roams fr om one MAP to another , its sessions ar e af fected in the following ways: The WX treats this client session as a roaming session and not a new session.
162 C HAPTER 8: C ONFIGURING AND M ANAGING M OBILITY D OMAIN R OAMING Effects of Timers on Roaming An unsuccessful roaming attempt might be caused by the following timers.
Mobility Domain Scenario 163 Mobility Domain Scenario The following scenario illustrates ho w to create a Mobility Domain named sunflower consisting of three members from a seed WX switch at 192.168.253.2 1: 1 Make the current WX switch the Mobility Domain seed.
164 C HAPTER 8: C ONFIGURING AND M ANAGING M OBILITY D OMAIN R OAMING vlan-wep 192.168.12.7 5 vlan-wep 192.168.15.5 5 7 T o display active roaming tunnel s, type the following command: WX1200# display.
9 C ONFIGURING N ETWORK D OMAINS A Network Domain is a group of ge ographically dispersed Mobilit y Domains that share information over a W AN li nk. This sh ar ed information allows a user configur ed in one Mob ility Domain to establish connectivity on a WX switch in a r emote Mobility Doma in.
166 C HAPTER 9: C ONFIGURING N ETWORK D OMAINS Figure 4 Network Domain In a Network Domain, one or more WX switches acts as a seed device. A Network Domain seed stores information about all of the VLANs on the Network Domain members. The Ne twork Domain seeds shar e this information among themselves, so that every seed has an identical database.
About the Network Domain Feature 167 Figure 5 illustrates how user Bob, who is based at Sales Of fice C gets connectivity and is placed in a VLAN when he visits the Corpo rate Of fice.
168 C HAPTER 9: C ONFIGURING N ETWORK D OMAINS 4 A VLAN tunnel is created between the WX switch at the Corporate Office and the WX switch at Sales Office C. 5 Bob establishes connectivity on the network at t he corporate of fice and is placed in VLAN Red.
Configuring a Network Domain 169 In the previous example, a WX swit ch in the Mobility Domain at the corporate office is configur ed as a me mber of a Network Domain that has a local seed, as well as seeds at the tw o branch offices and the thr ee sales offices.
170 C HAPTER 9: C ONFIGURING N ETWORK D OMAINS For example, the following command sets the current WX switch as a seed with the Network Domain California : WX1200# s et network-domain mode seed domain-name California success: change accepted.
Configuring a Network Domain 171 For example, the following command sets the current WX switch as a peer of the Netw ork Domain seed with IP address 192.168.9.254: WX1200# set network-domain peer 192. 168.9.254 success: change accepted. This command is valid on Ne twork Domain seeds only .
172 C HAPTER 9: C ONFIGURING N ETWORK D OMAINS T o specify 10.8.107.1 as an additional Networ k Domain seed for the WX switch to connect to if the 192.168.9.254 seed is unavailable, ent er the following command: WX1200# set network-domain mode memb er seed-ip 10.
Configuring a Network Domain 173 Clearing Network Domain Configuration fr om a WX Switch Y ou can clear all Network Domain configuration from a WX switch, rega rdl ess of whether the WX switch is a seed or a member of a Network Domain.
174 C HAPTER 9: C ONFIGURING N ETWORK D OMAINS Network Domain Scenario The following scenario illust rates how to cr eate a Network Domain named globaldom consisting of three Mobility Domains at two geographically separated sites. Figur e 7 below illustrates this scenario.
Network Domain Scenario 175 The following is the Network Domain configuration for this scenario: 1 Make the WX switch with IP addr ess 10.10.10.1 a seed of a Network Domain called globaldom and establish a peer relationship with the WX switch with IP address 20.
176 C HAPTER 9: C ONFIGURING N ETWORK D OMAINS 20.20.20.1 UP SEED 20.20.20.2 UP MEMBER 20.20.20.3 UP MEMBER 30.30.30.1 UP MEMBER 30.30.30.2 UP MEMBER Member Network Domain name: globaldo m Member State Mode --------------- ------------- ------ --------------- 10.
10 C ONFIGURING MAP A CCESS P OINTS MAPs contain radios that provide networking between your wir ed network and IEEE 802.11 wireless user s. A MAP connects to the wir ed network through a 10/100 Ether net link and connects to wireless users through radio signals.
178 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Figure 8 Example 3Com Network T o configure MAPs, perform the fo llowing tasks, in this or der: Specify the country o f operation. Configure MAP access ports, Distri buted AP connections, and dual homing.
MAP Overview 179 Y ou do not need to set channels and power if you use RF Auto-T uning to set these values. Y ou do no t need to specify an external antenna type unless a radio uses an exter nal antenna.
180 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Similar to ports configured for di rectly connected MAPs, distributed MAP configurations are number ed and can r eference a particular MAP . These number ed configurations do not, however , reference any physical port.
MAP Overview 181 If only 3COMWX is defined in DNS, the MAP contacts the WX with an IP address r eturned for 3COMWX. Distributed MAPs and STP A Distributed MAP is a leaf device. Y o u do not need to enable STP on the port that is directly connected to the MAP .
182 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Distributed MAPs and DHCP Option 43 The option 43 field in a DHCP Offer message can pr ovide a sim ple and effective way for MAPs to find WX switche s acr oss an intermediate Layer 3 network, and is especially useful in networks that are geographically distributed or have a flat domain name space.
MAP Overview 183 MAP Parameters T able 9 summarizes parameters that apply to individual MAPs, including dual-homing parameters. (For in formation abo ut parameters for individual radios, see “Configuri ng a Radio Profile” on page 240 and “Configuring Radio-Specific Parameters” on page 246.
184 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Resiliency and Dual-Hom ing Options for MAPs MAPs can support a wide variety of resiliency options. Redundancy for data link connections and for WX serv ices can be provided to the MAP .
MAP Overview 185 Dual-Homed Configuration Examples The following sections show examples of dual-homed con figurations. Y ou can use any of these configurations to dual home a MAP model that has two Ethernet ports.
186 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Dual-Homed Direct and Distribut ed Connections to WX Switches Figur e 11 shows an example of a dua l-homed configuration in which one MAP connection is direct and the othe r is distributed over the network.
MAP Overview 187 Dual-Homed Distributed Connecti ons to WX Switches on B oth MAP Ports Figur e 12 shows an example of a dual-homed configuration in which both MAP connections are distributed over the network.
188 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Dual-Homed Distributed Connections to WX Switches on One MAP Port Figure 13 shows an example of a MAP with a single physical link to a netwo rk containing three WX switches.
MAP Overview 189 Boot Process for Distributed MAPs When a distributed MAP boots on the network, it uses the process described in this section. Note that th is pr ocess applies only to distributed MAPs; it does not apply to a dire ctly connected MAP .
190 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Static IP Address Configuration for Distributed MAPs In cases where DHCP is not availabl e, you can manually assign IP addr ess information to a Distributed MAP . This information is config ur ed thr ough the CLI.
MAP Overview 191 If no WX switches reply , the MAP repeatedly resends the Find WX messages. If no WX switches reply , the process continues with step 3. 2 If no IP addresses or hostnames were specified in the Option 43 field of the DHCP Offer message, the MAP send s a Find WX message to UDP port 5000 on the subnet broadcast addr ess.
192 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS If only wlan-switch is defined in DNS, the MAP sends a u nicast Find WX message to the WX switch whose IP address is r eturned for wlan-switch . If both 3Com and wlan-switch are defined in DNS, the MAP sends a unicast Find WX message to the WX switch whose IP address is returned for 3Com .
MAP Overview 193 How a Distributed MAP Contacts a WX Switch (Statically Configured Addr ess) When configuring a distributed MAP wi th static IP info rmation, you can specify the following information: a IP address, subnet mask, default gateway r outer , and whether the configured static IP address information is enabled for the MAP .
194 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS If ther e is no r e sponse to t he br oadcast Find WX message, the WX continues broadcasting the Find WX message for a period of time. If still no response is r eceived, then th e pr ocess skips to step 4 on page 191.
MAP Overview 195 Loading and Activating an Operational Image A MAP’ s operational image is the software that allows it to function on the network as a wireless access point. As part of the MAP boot process, an operational image is loaded int o the MAP’ s RAM an d activated.
196 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Figure 15 on page 198 shows an example of the boot process for a MAP connected through a Layer 3 network. Figure 16 on page 200 shows an example of the boot process for a dual-homed MAP that has one direct connection to a WX switch and an indirect connection through a Layer 2 network.
MAP Overview 197 1 The MAP sends a DHCP Discover message from the MAP port 1. 2 DHCP server rec eives the Discover message (thr ough a relay agent) and replies with a DHCP Of fer message containing IP address for the MAP , the router IP address for the MAP IP subnet, the DNS server address, and the domain name.
198 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Example MAP Boot over Layer 3 Network Figure 15 shows an example of th e boot process for a MAP connected through a Layer 3 network. Figure 15 MAP Booting over Layer 3 Network 1 The MAP sends DHCP Discover message fr om the MAP’ s port 1 .
MAP Overview 199 5 The DNS server sends t he system IP address of the WX switch mapped t o 3com.example.com . In this example, the address is for WX1. 6 The MAP sends a unicast Fin d WX message to WX1. 7 WX1 receives the Find WX message and compares the bias settings on each WX for the MAP .
200 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Example Boot of Dual-Homed MAP Figure 16 shows an example of the boot process for a MAP that is dual homed with a direct connection to WX1 and an indirect connection to WX2 and WX3.
MAP Overview 201 1 MAP sends a DHCP Discover message fr om the MAP’ s port 1. 2 Because WX1 is configured for direct attachment, WX1 responds privately to the MAP and pr ovides the MAP with its operational image (or indicates that the MAp should us e a locally stored image) and configuration from WX1.
202 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS After the MAP is configured with th e abov e information, the next time the MAP boots, the following ta kes place: 1 The MAP sends an ARP request for its own address, to ensure it is not in use elsewher e in the network.
MAP Overview 203 auth-fallthru web-auth Uses WebAAA for users who do not match an 802.1X o r MAC authentication rule for the SSID requested by the user. auth-psk disable Does no t support using a preshared key (PSK) to authenticate WPA clients. beacon enable Sends beacons to advertise the SSID managed by the service profile.
204 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS keep-initial-vlan disable Reassigns the user to a VLAN after roaming, instead of leaving the roamed user on the VLAN assigned by the switch where the user logged on. Note: Enabling this option does not retain the user’s initial VLAN assignment in all cases.
MAP Overview 205 tkip-mc-time 60000 Uses Michael countermeasures for 60,000 ms (60 seconds) following detection of a second MIC failure within 60 seconds. transmit-rates 802.11a: mandatory: 6.0,12.0,24.0 beacon-rate: 6.0 multicast-rate: auto disabled: none 802.
206 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS (T o configure a service profile, see “Configuring a Service Pr ofile” on page 233.) web-portal-acl portalacl Note: This is the default only if the fallthru type on the service profile has been set to web-portal .
MAP Overview 207 Public and Private SSIDs Each radio can support the following types of SSIDs: Encrypted SSID — Clients using this SSID must use encryption. Use the encrypted SSID for secured a ccess to your enterprise network. Clear SSID — Clients using this SSID do not use encryption.
208 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Radios and SSIDs AP2750 The radio MAC address equals the MAP base MAC address. The BSSIDs for the SSIDs configured on the radio end in ev en numbe rs. The first BSSID is equal to the MAP’s base MAC address.
MAP Overview 209 Encryption Encrypted SSIDs can use the following encryption methods: Wi -Fi Pr otected Access (WP A) Non-WP A d ynamic Wired Equivalent Privacy (WEP) Non-WP A s tatic WEP Dynamic WEP is enabled by default.
210 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS (T o configure a radio profile, see “C onfiguring a Radio Pr ofile” on page 240.) frag-threshold 2346 Uses the short-retry-cou nt for frames shor ter than 2346 bytes and uses the long-retry-count for frames that are 2346 bytes or longer.
MAP Overview 211 RF Auto-T uning The RF Auto- T uning feature dynamically assigns channel and power settings to MAP radios, and adjusts those settings when needed. RF Auto-T unin g can perform the following tasks: Assign initial channel and power setti ngs when a MAP radio is started.
212 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Although these parameters have default values, 3Com recommends that you change the values for each radio for optimal performance. For example, leaving the channel number on each radio set to its default value can result in high interfer ence among the radios.
Configuring MAPs 213 Configuring MAPs T o configure MAPs, perform the fo llowing tasks, in this order: Specify the country of operation. (See “Specifying the Country of Operation” on page 213.) Configure an Auto-AP profile for automatic configuration of Distributed MAPs.
214 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS T able 14 Country Codes Country Cod e Algeria DZ Argentina AR Australia AU Austria AT Bahrain BH Belgium BE Belize BZ Bolivia BO Boznia and Herzegovi.
Configuring MAPs 215 Honduras HN Hong Kong HK Hungary HU Iceland IS India IN Indonesia ID Ireland IE Israel IL Italy IT Jamaica JM Japan JP Jordan JO Kazakhstan KZ Kenya KE Kuwait KW Latvia LV Lebano .
216 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Oman OM Pakistan PK Panama PA Paraguay PY Peru PE Philippines PH Poland PL Portugal PT Puerto Rico PR Qatar QA Romania RO Russia RU Saudi Arabia SA S.
Configuring MAPs 217 The current software version might not support all of the countries listed here. T o verify the configur ation change, use the following command: display system The following commands set the country code to US (United States) and verify the setting: WX1200# set system countrycode US success: change accepted.
218 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Configuring an Auto-AP Pr ofile for Automatic MAP Configuration Y ou can use an Auto-AP profile to deploy unconfigured Distributed MAPs. A Distributed MAP that does not have a configuration on a WX switch can receive its configuration from the Auto-AP profile instead.
Configuring MAPs 219 For example, suppose the Mobility Do main has two WX switches, with the capacities and loads listed in T able 15. For WX1200 A: The Number of MAPs that can be configured on the switch, minus th e number that are configur ed, is 30 - 25 = 5.
220 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS The disconnected MAP can then begin the boot process again to find another WX switch that has an Auto-AP profile. When the MAP is disconnected, the MAP c lients experience a service disruption, and will attempt to associate with anoth er MA P if availa ble to reconnect to the SSID they wer e using.
Configuring MAPs 221 MAPs that receive their configurations from the Auto-AP profile also receive the radio settings from the radio pr ofile used by the Auto-AP profile. Lik ewise, the SSIDs and encryp tion settings come from the service profiles mapped to the radio profile.
222 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS MAP Parameters: set dap auto bias { high | low } set dap auto blink { enable | disable } set dap auto force-image-download { e nable | disable } set .
Configuring MAPs 223 Displaying Status Information for MAPs Configured by the Auto-AP Profile T o display status information for MAPs con figur ed by the Auto-AP profile, type the following command: W.
224 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS The MAP continue s to operate withou t interrup tion after you enter the set ap auto persistent command. The next time the MAP is restarted, the Auto-AP profile is not used to configur e the MAP . Inst ead, the persistent configuration is used.
Configuring MAPs 225 T o configure a MAP model MP-372 with serial-ID 0322199999, type the following command: WX# set ap 1 serial-id 0322199999 mo del mp-372 success: change accepted. (T o specify the exter nal antenna type, use the set ap radio antennatype command.
226 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Specifying WX Switch Information T o specify the WX switch a Distributed MAP contacts and att empts to use as its boot device, use the following comm.
Configuring MAPs 227 The following command configures Distributed MAP 1 to use VLAN tag 100: WX1200# set ap 1 boot-vlan vlan-tag 100 mode enable success: change accepted. Clearing a MAP fro m the Configuration T o clear MAP settings from a port, use the following command: When you clear a MAP , MSS ends user sessions that are using the MAP .
228 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS The defa ult bias i s high. T o change the bias for a Distributed MAP to low , type the following command: WX# set ap 1 bias low success: change accepted.
Configuring MAPs 229 The MAP loads its local image only if the WX is running MSS V ersion 5.0 or later and does not have a newe r MAP image than the one in the MAP’ s local storage.
230 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS The maximum transmission unit (MTU) for e ncrypted MAP management traffic is 1498 bytes, whe reas the MTU for un encrypted management traffic is 1474 bytes. Ma ke sure the devices in the intermedia te network between the WX switch and Distribu ted MAP can support the hig her MTU.
Configuring MAPs 231 T able 18 lists the MAP security options and whether a MAP can establish a management session with a WX based on the option settings. V erifying a MAP Fingerprint on a WX Switch T o verify a MAP fingerprint, find the fing erprint and use the set ap fingerprint command to enter the f ingerprint in MSS.
232 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS bssid2: 00:0b:0e:0a:60:02, ss id: 3Com Radio 2 type: 802.11a, state: config ure succeed [Enabled] operational channel: 48 opera tional power: 11 base.
Configuring MAPs 233 Fingerprint Log Message If MAP encryption is optional, and a MAP whose fingerprint has not been verified in MSS establishes a mana gement session with the WX, MSS generates a log .
234 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Y ou can include blank spaces in the name, if you delimit the name with single or double quotation marks. Y ou must use the same type of quotation mark (either single or double) on bo th ends of the string.
Configuring MAPs 235 SSIDs are beacone d by default. A MAP radio responds to an 802.11 probe any r equest only for a beaconed SSID. A clie nt that sends a probe any re que st rec ei ve s a separate response for each of the beaconed SSIDs supported by a radio.
236 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS T able 19 T r ansmit Rates Parameter Default Value Description mandatory 11a— 6.0,12.0,24 .0 11b— 1.0,2.0 11g— 1.0,2.0,5.5,11.0 Set of data transmission rates that clients are required to support in order to associate with an SSID on a MAP radio.
Configuring MAPs 237 T o change transmit rates for a ser vice pr ofile, use the following command: set service-profile name transmit-rates { 11a | 11b | 11g } mandatory rate-list [ disabled rate-list ] [ beacon-rate rate ] [ multicast-rate { rate | auto }] The following command sets 802.
238 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Data rate enforcement is useful if yo u want to completely prevent clients from transmitting at disabled data rates.
Configuring MAPs 239 Responding to keepalive messages requir es power use by a client. If you need to conserve power on the client (for example, on a V oIP handset), you can disable idle-client probing.
240 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS T o change the short retry threshold for service profile sp1 to 3, type the following command: WX1200# set service-profile sp1 short-retry 3 success: change accepted.
Configuring MAPs 241 Creating a New Pr ofile T o create a radio pr ofile, use the following command: set radio-profile name [ mode { enable | disab le }] Specify a name of up to 16 alphanumeric cha racters. Do not include t he mode enable or mode disable option.
242 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Changing the DTIM Interval The DTIM interval specifies the number of times after every beacon t hat a ra dio sends a delivery traffic indication map (DTIM). A MAP sends the multicas t and br oadcast frames stored in its buffers to clients who r equest them in response to the DTIM.
Configuring MAPs 243 T o change the R TS thr eshold, use the following command: set radio-profile name rts-threshold thresho ld The threshold can be a value fr om 256 bytes thr ough 3000 bytes.
244 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Changing the Maximum T ransmit Threshold The maximum transmission threshold specifies the number of milliseconds a frame scheduled to be transmitted by a ra dio can r emain in buf fe r memory .
Configuring MAPs 245 The default pr eamble length value is short . This command does not apply to 802.11a radios. T o change the preamble length advertised by 802.11b/g radios, use the following command: set radio-profile name preamble-length { long | short } T o configure 802.
246 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Y ou must disable all radios that are using a radio profile before you can remove the profile. (See “Disabling or Reenabling All Radios Using a Profile” on page 250.
Configuring MAPs 247 The maximum transmit power you can config ure on any 3Com radio is the highest setting allowed for the countr y of operation or the highest setting supported on the hard ware, whichever is lower .
248 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS T able 21 lists the exter nal antenna models you can use with these MAPs. T able 22 lists the exter nal antenna models you can use with the MP-620.
Configuring MAPs 249 T o configure antenna model ANT1060 for an MP-262 on MAP 1, type the following command: WX1200# set ap 1 radio 1 antennatype ANT1060 success: change accepted. Specifying the External Antenna Location In some cases, the set of valid channels for a radio differs depending on whether the antenna is located indoors or outdoors.
250 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS T o disable radio 1 on por t 6 without disabling the other rad ios using radio profile rp1 , type the following command: WX1200# set ap 6 radio 1 rad.
Disabling or Reena bling Radio s 251 Resetting a Radio to its Factory Default Settings T o disable a MAP radio and reset it to its factory default settings, use the following command: clear ap apnumbe.
252 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Configuring Local Packet Switching on MAPs MAPs can be configured to perform local packet switching . Local packet switching allows packets to be switched dir ectly from the MAP to the wired network, in stead of passing thr ough an intermediate WX switch.
Configuring Local Packet Switching on MAPs 253 Configuring Local Switching Configuring a MAP to perform local switching consists of the following tasks: Configuring a VLAN profile for the MAP , wh.
254 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS T o enable local switching for MA P 7, type the following command: WX# set ap 7 local-switching mode enable success: change accepted.
Configuring Local Packet Switching on MAPs 255 T o clear th e VLAN pr ofi le that had been applied to MAP 7, type the following command: WX# clear ap 7 local-switching vlan- profile success: change accepted.
256 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS Displaying MAP Information Y ou can display the follo wing MAP informatio n: MAP and radio-specific configuration setting s Connection inform.
Displaying MAP Information 257 force-rebalance: NO, Radio 2: type: 802.11a, mode: disa bled, channel: dynamic tx pwr: 17, profile: default auto-tune max-power: default, load-balance-group: , load-bala.
258 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS This command indicate s that the Mobility Do main contains four Distributed MAPs, with serial IDs M9DE4 8B012F00, M9DE48B123400, M9DE48B123600, an d M9DE48B123700. Each MAP is configured on two WX switches, with system IP ad dresses 10.
Displaying MAP Information 259 The WX does not need to be the one that booted the MAP , but it must have the MAP in its configuration. Also, the WX that booted the MAP must be in the same Mobility Doma in as the WX where you use the command.
260 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS (For information about the fields in the out put, see the Wireless LAN Switch and Controller Command Reference .
Displaying MAP Information 261 The following command displays the status of a Distributed MAP: WX# display ap status 1 AP: 7, AP model: AP3750, manufacture r 3Com, name: MAP07 ========================.
262 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS DNS IP: Mesh SSID: Mesh PSK: For information about the fields in the output, see the W ireless LAN Switch and Controller Command Reference .
Displaying MAP Information 263 (For information about the fields in the out put, see the Wireless LAN Switch and Controller Command Reference .) T o display statistics counters and other information for individual user sessions, use the dis play sessions network command.
264 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS (For information about the fields in the out put, see the Wireless LAN Switch and Controller Command Reference .
Displaying MAP Information 265 4 green local 1 4 radio_1 23 5 yellow tunnel wx_tun 5 radio_1 24 (For information about the fields in the out put, see the Wireless LAN Switch and Controller Command Reference .
266 C HAPTER 10: C ONFI GURING MAP A CCESS P OINTS T o display a summary of the security ACLs mapped on MAP 7, type the following command: WX# display ap acl map 7 ACL Type Class Mapping -------------.
11 C ONFIGURING RF L OAD B ALANCING FOR MAP S This section describes the following configuration tasks: Disabling or re-enabling RF load balancing Assigning radios to load balancing groups .
268 C HAPTER 11: C ONFI GURING RF L OAD B ALANCING FOR MAP S MSS balances the client load by ad justing how MAPs ar e perceived by clients. As the relative capacity of a MAP handling new clients falls.
Configuring RF Load Balancing 269 Assigning Radios to Load Balancing Gr oups Assigning radios to specific load ba lancing groups is optional. When you do this, MSS considers them to have exactly over lapping coverage areas, rather than using signal strength calculations to determine their overlapping coverag e.
270 C HAPTER 11: C ONFI GURING RF L OAD B ALANCING FOR MAP S Setting Strictness for RF Load Balancing T o perform R F load ba lancing, MS S makes MAP radi os with he avy client loads less visible to new clients, ca using them to associate wit h MAP radios that have a lighter load.
Displaying RF Load Balanci ng Information 271 Exempting an SSID from RF Load Balancing By default, RF load balanc ing is applied to client sessi ons for all SSIDs.
272 C HAPTER 11: C ONFI GURING RF L OAD B ALANCING FOR MAP S.
12 C ONFIGURING WLAN M ESH S ERVICES This section descr ibes how to configure the WLAN mesh services. WLAN Mesh Services Overview WLAN mesh services allow a MAP to provide wir eless services to clients without having a wired interface on the MAP . Instead of a wired interface, there is a radio link to another MAP with a wired interface.
274 C HAPTER 12: C ONFI GURING WLAN M ESH S ERVICES In the illustration, a client is associated with a Mesh AP , which is a MAP without a wired interface to the network. The Me sh AP is configur ed to communicate with a Mesh Portal AP , a MAP with wired connectivity to a WX switch.
Configuring WLAN Mesh Servic es 275 Configuring the Mesh AP Before a Mesh AP can be installed in a location untethered fr om the network, it must be preconfigur ed for mesh services, includ ing the mesh services SSID, and the pr e-shar ed key th at is used for establishing the connection between the Mesh AP and the Mesh Portal AP .
276 C HAPTER 12: C ONFI GURING WLAN M ESH S ERVICES Configuring the Service Pr ofile for Mesh Services Y ou configure the Mesh Portal AP to beacon the mesh services SSID.
Configuring WLAN Mesh Servic es 277 Enabling Link Calibration Packets on the Mesh Portal MAP A Mesh Portal MAP can be configured to emit link calibration packets to assist with positioning the Mesh AP . A link calibration packet is an unencrypted 802.
278 C HAPTER 12: C ONFI GURING WLAN M ESH S ERVICES Configuring Wireless Bridging Y ou can use WLAN mesh services in a wir eless bridge configuration, implementing MAPs as bridg e endpoints in a transparent Layer 2 bridge.
Displaying WLAN Mesh Services Information 279 When wireless bridging is enabled for a service profile, the MAPs with the applied service profile serve as bridge peers. When a Mesh AP associates with a Mesh Portal AP through this service profile, the Mesh Portal AP automatically co nfigur es the Mesh AP to operate in bridge mode.
280 C HAPTER 12: C ONFI GURING WLAN M ESH S ERVICES Radio 2 type: 802.11a, state: config ure succeed [Enabled] operational channel: 36 operational po wer: 17 bssid1: 00:0b:0e:fd:fd:cd, ssid: mesh-ss id (mesh) The display mesh li nks command displays inform ation about the links a MAP has to Mesh APs and Mesh Portal APs.
13 C ONFIGURING U SER E NCRYPTION Mobility System Software (MSS) encrypts wir eless user traffic for all users who are successfully authenticated to join an encrypte d SSID and who are then authorized to join a VLAN. Overview MSS supports the following types o f encryption for wireless user traffic: 802.
282 C HAPTER 13: C ONFI GURING U SER E NCRYPTION Y ou can configure an SSID to support any combinat ion of WP A, RSN, and non-WP A clients. For example, a radi o can simultaneously use T emporal Key Integrity Protocol (TKIP) encryption for WP A clients and WEP encryption for non-W P A clients.
Overview 283 Figure 20 shows the client support when the default encryption settings are used. A radio using the default encr yption settings encrypts traffic for non-WP A dynamic WEP clients but not for WP A clients or static WEP clients. Th e radio di sassociates fr om these ot her client s.
284 C HAPTER 13: C ONFI GURING U SER E NCRYPTION Configuring WP A Wi-Fi Protected Access (WP A) is a se curity enhancement to the IEEE 802.11 wireless standard. WP A provides enhanced encryption with new cipher suites and provides per -packet message integrity checks.
Configuring WPA 285 Figure 21 shows the client support when WP A encryp tion for TKIP only is enabled. A radio using WP A with TKIP encrypts traffic only for WP A TKIP clients but not for CCMP or WEP clie nts. The radio disassociates from these other clients.
286 C HAPTER 13: C ONFI GURING U SER E NCRYPTION Figure 22 shows the client support when both WEP encryption and TKIP are enabled. A radio using WP A with TKIP and WEP encrypts traffic for WP A TKIP clients, WP A WEP clients, and non-WP A dynamic WEP clients, but not for CCMP or static WEP clients.
Configuring WPA 287 TKIP Countermeasures WP A access po ints and clients verify the integrity of a wireless frame received on the network by generati ng a keyed message integrity check (MIC). The Michael MIC used with TKIP pr ovides a holddown mechanism to protect the network against tampering.
288 C HAPTER 13: C ONFI GURING U SER E NCRYPTION WP A Authentication Methods Y ou can configure an SSID to support one or both of the following authentication methods for WP A clients: 802.
Configuring WPA 289 Probe r esponse (sent by a MAP radio) — The WP A IE in a probe response frame lists the same WP A information that is contained in the beacon frame.
290 C HAPTER 13: C ONFI GURING U SER E NCRYPTION T able 24 lists the encryption support for WP A and non-WP A clients. Configuring WP A T o configure MAP radios to support WP A: 1 Create a service pr ofile for each SSID that will support WP A clients.
Configuring WPA 291 Creating a Service Profile for WP A Encryption parameters apply to all us ers who use the SSID conf igur ed by a service profile. T o create a servic e pr ofile, use the following .
292 C HAPTER 13: C ONFI GURING U SER E NCRYPTION After you type this command, the serv ice profile supports TKIP and 40-bit WEP . Microsoft Wind ows XP does not support WEP with WP A. T o configure a serv ice profile to provide WEP for XP clients, leave WP A disabled and see “Configuring WEP” on page 299.
Configuring WPA 293 The passphrase must be f r om 8 to 63 characters long, including blan ks. If you use blanks, you must enclose the string in quotation marks.
294 C HAPTER 13: C ONFI GURING U SER E NCRYPTION Displaying WP A Settings T o display the WP A settings in a service profile, use the following command: display service-profile { name | ? } T o displa.
Configuring WPA 295 Assigning the Service Profile to Radios an d Enabling the Radios After you configur e WP A settings in a service pr ofile , you can map the service profile to a radio pr ofile, a ssign the radio profile to radios, and enable the radios to activate the settings.
296 C HAPTER 13: C ONFI GURING U SER E NCRYPTION Configuring RSN (802.11i) Robust Security Network (RSN) provid es 802.11i support. RSN uses AES encryption. Y ou can configure a service profile to support RSN clients exclusively , or to support RSN with WP A clien ts, or even RSN, WP A and WEP clients.
Configuring RSN (802.11i) 297 Specifying the RSN Cipher Suites T o use RSN, at least one cipher suite must be enabled. Y ou can enable one or more of the following cipher suites: CCMP TKIP 40-bit WEP 104-bit WEP By default, TKIP is enabled and th e other cipher suites are disabled.
298 C HAPTER 13: C ONFI GURING U SER E NCRYPTION Changing the TKIP Countermeasures Timer V alue T o change the TKIP counter measur es timer , see “Chan ging the TKIP Countermeasures Timer V alue” on page 298. The procedur e is the same for WP A and RSN.
Configuring WEP 299 Configuring WEP Wired-Equivalent Privacy (WEP) is a security protocol defined in the 802.11 standard. WEP uses the RC4 encryption algorithm to encrypt data.
300 C HAPTER 13: C ONFI GURING U SER E NCRYPTION Figure 23 shows an example of a radio configur ed to provide static and dynamic WEP encryption for non-WP A c lients. The radio uses dynamically generated keys to encrypt traffic for dynamic WEP clients.
Configuring WEP 301 Setting Static WEP Key V alues MSS supports d ynamic WEP automati cally . T o enable static WEP , configure WEP keys and assign them to unicast and multicast traffic. Y ou can set the values of the four static WEP keys, then specify which of the keys to use for encrypting multicast frames and unicast frames.
302 C HAPTER 13: C ONFI GURING U SER E NCRYPTION T o configure an SSID that uses service pr ofile wepsrvc 4 to use WEP key index 4 for encrypting unicast traffic, type the following command: WX1200# set service-profile wepsrvc4 wep active-unicast-index 4 success: change accepted.
Encryption Configuration Scenarios 303 WX1200# display service-profile sp1 ssid-name: myco rp ssid-type: crypto Beacon: y es Proxy ARP: no DHCP restrict: no No broadcast: no Short retry limit: 5 Long .
304 C HAPTER 13: C ONFI GURING U SER E NCRYPTION force-image download: YES Radio 1: type: 802.11g, mode: ena bled, channel: 6 tx pwr: 1, profile: rp1 auto-tune max-power: default Radio 2: type: 802.11a, mode: enab led, channel: 36 tx pwr: 1, profile: rp1 auto-tune max-power: default 8 Save the configuration.
Encryption Configuration Scenarios 305 TKIP is already enabled by default when WP A is enabled. 6 Display the service pr ofile wpa-wep to verify the changes.
306 C HAPTER 13: C ONFI GURING U SER E NCRYPTION auto-tune max-power: default Port 6: AP model: mp-252, POE: ena ble, bias: high, name: MAP11 boot-download-enable: YES force-image-download: YES Radio 1: type: 802.
Encryption Configuration Scenarios 307 4 V erify the AAA configu ration changes. T ype the following command: WX1200# display aaa Default Values authport=1812 acctport=1813 timeout= 5 acct-timeout=5 r.
308 C HAPTER 13: C ONFI GURING U SER E NCRYPTION 10 Configure a passphrase for the pr eshared key . T ype th e following command: WX1200# set service-profile wpa-wep-for-mac psk-phrase "passphrase to convert into a presha red key" success: change accepted.
Encryption Configuration Scenarios 309 WX1200# display ap config Port 4: AP model: MP-241, POE: ena ble, bias: high, name: MAP04 boot-download-enable: YES force-image-download: YES Radio 1: type: 802.
310 C HAPTER 13: C ONFI GURING U SER E NCRYPTION.
14 C ONFIGURING RF A UTO -T UNING The RF Auto- T uning feature dynamically assigns channel and power settings to MAP radios, and adjusts those settings when needed. Overview RF Auto-T uning can perform the followin g tasks: Assign initial channel and power setti ngs when a MAP radio is started.
312 C HAPTER 14: C ONFI GURING RF A UTO -T UNING During radio operation, MSS periodically reevaluates the channel and changes it if needed . (See “Channel T uning” on page 313.) Initial power assignment —The MAP sets a radio’ s initial power level to the maximum value a llowed for the country code (regulatory domain).
Overview 313 Power T uning By default, the switch evaluates the scan results for possible power changes every 300 seconds (5 minutes), and raises or lowers the power level if needed. If RF Auto-T uning determines that a power change is needed on a radio, MSS ramps the power up or down until the new power level is r eached.
314 C HAPTER 14: C ONFI GURING RF A UTO -T UNING A radio also can change its channel before th e channel tuning interval expires to respond to RF anomalies. An RF a nomaly is a sudden major change in the RF environment, such as sudden major interfer ence on the channel.
Overview 315 channel-holddown 90 0 MSS maintains the channel setting on a radio for at least 900 seconds regardless of RF changes. channel-lock down disabled MSS continues to dynamically change channels if needed based on network conditions.
316 C HAPTER 14: C ONFI GURING RF A UTO -T UNING Changing RF Auto-T uning Settings Y ou can change the following RF Au to-T uning settings: Channel tuning Power tuning Minimum transport data rate Selecting A vailable Channels on the 802.11a Radio Y ou can configure the 802.
Changing RF Auto-Tuning Settings 317 Changing the Channel T uning Interval The default channel tuning interval is 3600 seconds. Y ou can change the interval to a value from 0 to 65535 seco nds. If you set the interval to 0, RF Auto-T unin g does not reevaluate th e channel at regular intervals.
318 C HAPTER 14: C ONFI GURING RF A UTO -T UNING Changing the Power T uning Interval The default power t uning interval is 600 seconds. Y ou can change the interval to a value from 1 to 65535 seconds.
Displaying RF Auto-Tuning Information 319 T o verify the static settings, use the display { ap | dap } c onfig command. T o save the locked down settings, you must save the switch’ s configuration.
320 C HAPTER 14: C ONFI GURING RF A UTO -T UNING T o display the RF Au to-T uning sett ings that you can configure on an individual radio, use the following commands: display ap config [ port-list [ r.
Displaying RF Auto-Tuning Information 321 T o display neighbor information for rad io 1 on the directly connected MAP on port 2, type th e following command: WX1200# display auto-tune neighbors ap 2 r.
322 C HAPTER 14: C ONFI GURING RF A UTO -T UNING.
1 5 C ONFIGURING MAP S T O B E A ER O S COUT L ISTENERS AeroScout RFID tags ar e wireless transmi tters that you can place on assets such as office equipment to track the equipment ’ s lo cation.
324 C HAPTER 15: C ONFI GURING MAP S T O B E A ERO S COUT L ISTENERS Configuring MAP Radios to Listen for AeroScout RFID Ta g s T o configure MAP radios to listen for AeroScout RFID tags: Configure a service profile for the Ae r oScout listeners and set the SSID type to clear (unencrypted).
Locating an RFID Tag 325 WX1200# set ap 69 radio 1 channel 7 success: change accepted. WX1200# set ap 67 radio 1 radio-prof ile rfid-listeners mode enable success: change accepted. WX1200# set ap 68 radio 1 radio-prof ile rfid-listeners mode enable success: change accepted.
326 C HAPTER 15: C ONFI GURING MAP S T O B E A ERO S COUT L ISTENERS 1 Connect to 3Com Wireless Switch Ma nager Services (the server) and open the network plan that c ontains the site information. 2 Select the Monitor tool bar option (at th e top of the main 3Com Wireless Switch Manager window).
16 C ONFIGURING Q UALITY OF S ERVICE This chapter describes the Quality of Service (QoS) features supported in MSS and how to configure and manage them. About QoS MSS supports Layer 2 and Layer 3 cla ssification a nd marking of traffic, and optimized forwarding of wire less traf fic for time-sensitive applications such as voice and video.
328 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE QoS parameters configured in service profiles CAC mode Call Admission Control, which regulates addition of new VoIP sessions on MAP radios.
About QoS 329 Transmit rates Data transmission rates supported by each radio type. The following categories are specified: Beacon Multicast Mandatory (a client mu st support at least one of these rates to associate) Disabled Standard (valid rates that are not disabled and are not mandatory) Defaults: Mandatory: - 802.
330 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE QoS Mode MSS suppor ts Layer 2 and Layer 3 classifi cation and marking of traffic, to help provide end-to-end QoS throughout the network. The following modes of QoS are supported: Wi-Fi Multimedia (WMM)—Provides wireless QoS for time-sensitive applications such as voice and video.
WMM QoS Mode 331 The static CoS option enables you to easily se t CoS for all traf fic on an SSID by marking all the SSID’ s tra ffic with the same CoS va lue. Y ou can use ACLs to override CoS markings or set CoS for non-WMM traffic. The following sections describe each of these options.
332 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE Figure 24 QoS on WX Switches—Classification of Ingr ess Packets WX receives packet. Ye s No (802.1p = 0) 802.1p value Set packet CoS 1 -> 1 2 -> 2 3 -> 3 4 -> 4 5 -> 5 6 -> 6 7 -> 7 based on 802.
WMM QoS Mode 333 Figure 25 QoS on WX Switches—Marking of Egr ess Packets WX has classified Ye s No VLAN tag Mark 802.1p 1 -> 1 2 -> 2 3 -> 3 4 -> 4 5 -> 5 6 -> 6 7 -> 7 with CoS value: Ye s No ingress packet. Egress interface has 802.
334 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE Figure 26 QoS on MAPs—Classification and Mark ing of Packets from Clients to WX MAP receives pac ket from client. Set pack et CoS 1 -> 1 2 -> 2 3 -> 3 4 -> 4 5 -> 5 6 -> 6 7 -> 7 based on 802.
WMM QoS Mode 335 Figure 27 QoS on MAPs—Classification and Ma rking of Packets fr om WX to Clients The following sectio ns describe in more detail how the WMM QoS mode works on WX switches and MAPs.
336 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE WMM QoS on the WX Switch MSS performs classification on ingress to determine a packet’ s CoS valu e. This CoS value is used to mark the pack et at the egr ess interface. The classification and marking pe rfo rmed by the switch depend on whether the ingress interface has an 802.
WMM QoS Mode 337 Y ou also can use ACLs to override ma rking for specific packets. Configure ACEs that use the dscp option to match on ingr ess DSCP value, and use the cos option to ma rk CoS. A CoS value assig ned by an ACE overrides the inter nal CoS value.
338 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE (T o display a MAP’ s CoS ma ppings and queue usage statistics, see “Displaying MAP Forwarding Queue Statistics” on page 349.) Figure 28 shows an example of end-to-end QoS in a 3Com network. In this example, voice traffic is prioritized based on WMM.
WMM QoS Mode 339 The MAP encapsulates the data in an IP tunnel packet, and marks the DSCP value in the tunnel header based on the internal CoS value. In this example, the MAP maps inte rnal CoS 7 to DSCP 56 and marks the IP tunnel header’ s DSCP field with valu e 56.
340 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE In this example, the MAP places th e packet in the V oice forwarding queue. The V oice queue has statistically more access to the air than the other queues, so the user’ s voice traffic receives priority treatment.
WMM QoS Mode 341 Broadcast Contr ol Y ou also can enhance bandwidth availa bility on an SSID by enabling the following broadcast contr ol features: Proxy ARP—WX r esponds on behalf of wireless clients to ARP r equests for their IP addr esses.
342 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE Changing QoS Settings Y ou can change the settings of the following QoS option s: QoS mode U-APSD support CAC state and maximum number o.
Changing QoS Settings 343 Configuring Call Admission Control T o configure CAC for an SSID, enable the feature on the SSID’ s se rvice profile. When enabled, CAC limits the number of active se ssions a radio can have to 14 by default. Y ou can change the maximu m number of sessions to a value from 0 to 100.
344 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE For example, to configure static CoS 7 for service pr ofile sp1 , use the following commands: WX1200# set service-profile sp1 static-cos enable success: change accepted. WX1200# set service-profile sp1 cos 7 success: change accepted.
Displaying QoS Information 345 Enabling Br oadcast Control T o enable broadcast control features on a service-pr ofile basis, using the following commands: set service-profile name proxy-arp { enable .
346 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE Tune Power Interval: 6 00 Channel Holddown: 300 Power Backoff Timer: 10 Countermeasures: none Active-Scan: y es QoS Mode: w mm Service profiles: sp1 In this example, the QoS mode is WMM.
Displaying QoS Information 347 Configuration information for some se ttings appears in other chapters. T o configure transmit rates, or the long or short retr y , see “Configuring a Service Profile” on pag e 233. T o configure the user -idle timeout and idle-client probing, see “Displaying and Chan ging Network Session Timers” on page 565.
348 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE 40-49 5 5 5 5 5 5 5 5 6 6 50-59 6 6 6 6 6 6 7 7 7 7 60-63 7 7 7 7 Egress QoS Marking Map (cos-to-dscp) CoS Level 0 1 2 3 4 5 6 7 ===================.
Displaying QoS Information 349 Displaying the DSCP Ta b l e T o display the standard mappings of DSCP , T oS, and precedence values, use the following command: WX1200# display qos dscp-table DSCP TOS .
350 C HAPTER 16: C ONFI GURING Q UALITY OF S ERVICE.
17 C ONFIGURING AND M ANAGING S PANNING T RE E P RO T O C O L The purpose of the Spanning T ree Pr otocol (STP) is to maintain a loop-free network. A loop-free path is acco mplished when a device r ecognizes a loop in the topology and blocks one or more r edundant paths.
352 C HAPTER 17: C ONFI GURING AND M ANAGING S PANNING T REE P ROTOCOL Enabling the Spanning T ree Protocol STP is disabled by default. Y ou can enable STP globally or on individual VLANs.
Changing Standard Sp anning Tree Parameters 353 Port Cost Po rt cost is a numeric value that STP adds to the total cost of a path to the root bridge. When a designated br idge has multiple equal-cost paths to the root bridge, the designated bridge uses the path with the lowest total cost.
354 C HAPTER 17: C ONFI GURING AND M ANAGING S PANNING T REE P ROTOCOL T o change the bridge prior ity of VLAN pink to 69, type the following command: WX1200# set spantree priority 69 vla n pink success: change accepted.
Changing Standard Sp anning Tree Parameters 355 The command applies only to the ports you specify . Th e port cost on other ports remains unchanged. T o reset the cost of ports 3 and 4 in the default VLAN to the default value, type the following command: WX1200# clear spantree portcost 3-4 success: change accepted.
356 C HAPTER 17: C ONFI GURING AND M ANAGING S PANNING T REE P ROTOCOL Resetting the STP Port Priority to the Default V alue T o reset the STP port priority to the default value, use one of the follow.
Changing Standard Sp anning Tree Parameters 357 The command applies only to the ports you specify . Th e port cost on other ports remains unchanged. Changing Spanning Tr e e T i m e r s Y ou can chang.
358 C HAPTER 17: C ONFI GURING AND M ANAGING S PANNING T REE P ROTOCOL The all option applies the change to all VLANs. Alternatively , specify an individual VLAN. T o change the for war ding delay on VLAN pink to 20 seconds, type the following command: WX1200# set spantree fwddelay 20 vla n pink success: change accepted.
Configuring and Managing STP Fast Convergenc e Features 359 Backbone Fast Convergence Backbone fast convergenc e accelerates a port’ s recovery following the failur e of an indir ect link.
360 C HAPTER 17: C ONFI GURING AND M ANAGING S PANNING T REE P ROTOCOL Displaying Port Fast Convergence Information T o display port fast convergence information, use the f ollowing command: display s.
Displaying Spanning Tree Information 361 Configuring Uplink Fast Convergence T o enable or disable uplink fast convergence, use the following command: set spantree uplinkfast { enable | disable } Disp.
362 C HAPTER 17: C ONFI GURING AND M ANAGING S PANNING T REE P ROTOCOL T o list only the ports that are in the active (forwar ding) state, enter the active option.
Displaying Spanning Tree Information 363 Displaying Blocked STP Ports T o display information about ports that ar e in the ST P blocking state, use the following command: display spantree blockedports.
364 C HAPTER 17: C ONFI GURING AND M ANAGING S PANNING T REE P ROTOCOL Port based information statistics config BPDU's xmitted(port/VLAN) 0 (1) config BPDU's received(port/VLAN) 21825 (43649.
Spanning Tree Configuration Scenario 365 Other port specific info dynamic max age transition 0 port BPDU ok count 21825 msg age expiry count 0 link loading 0 BPDU in processing FALSE num of similar BP.
366 C HAPTER 17: C ONFI GURING AND M ANAGING S PANNING T REE P ROTOCOL 7 up down auto network 10/100BaseTx 8 up down auto network 10/100BaseTx 2 Configure a backbone VLAN and verify the c onfiguration change. T ype the following commands: WX1200# set vlan 10 name backbone po rt 1-2 success: change accepted.
Spanning Tree Configuration Scenario 367 4 Reconnec t or r eena ble ports 21 and 22 and verif y the c hange. T ype the following commands: WX1200# set port enable 1-2 success: set "enable" o.
368 C HAPTER 17: C ONFI GURING AND M ANAGING S PANNING T REE P ROTOCOL.
18 C ONFIGURING AND M ANAGING IGMP S NOOPING Internet Group Management Protocol (IGMP) snooping contr ols multicast traffic on a WX switch by forwardi ng packets for a multicast group only on the ports that are connected to members of the gr oup.
370 C HAPTER 18: C ONFI GURING AND M ANAGING IGMP S NOOPING Disabling or Reenabling Proxy Reporting Pr oxy r eporting re duces multic ast ov erhead by sending only one report for each active group to the multicast r outers, instead of sending a separate report fr om each multicast receiver .
Changing IGMP Timers 371 Last member query interval — Number of tenths of a seco nd that the WX switch waits for a r esponse to a group-specific query after receiving a leave message for that group, before r emoving the r eceiver that sent the leave message from the list of receivers for the gr oup.
372 C HAPTER 18: C ONFI GURING AND M ANAGING IGMP S NOOPING Enabling Router Solicitation A WX switch can search for multicast r outers by sending multicast router solicitation messages. This message in vites multicast r outers that receive the message and that support router solicitation to immediately advertise themselves to the WX switch.
Displaying Multicast Information 37 3 Adding or Removing a Static Multicast Router Port T o add or remove a static multicast router port, use the following command: set igmp mrouter port port-list { e.
374 C HAPTER 18: C ONFI GURING AND M ANAGING IGMP S NOOPING 237.255.255.255 5 10.10.10.13 00:02:04:06:08:0d 258 237.255.255.255 5 10.10.10.14 00:02:04:06:08:0e 258 237.
Displaying Multicast Information 37 5 Displaying Multicast Queriers T o display information about the mu lticast querier only without also displaying all the other multicas t information, u se the fol.
376 C HAPTER 18: C ONFI GURING AND M ANAGING IGMP S NOOPING Displaying Multicast Receivers T o display information about the mult icast receivers only without also displaying all the other multicas t .
19 C ONFIGURING AND M ANAGING S ECURITY ACL S A security access control list (ACL) filters packets for the purpose of discarding them, permitting them, or permitting them with modification (marking) for class-of-serv ice (CoS) pr iority tr eatment.
378 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S Figure 29 Setting Security ACLs Security ACL Filters A security ACL filters pack ets to restrict or permit network traffic. These filters can then be mapped by name to authenticated users, po rts, VLANs, virtual ports, or Distributed MAPs.
About Security Access Con trol Lists 379 The order in which ACEs ar e listed in an ACL is important. MSS applies ACEs that ar e higher in the list be for e ACEs lower in the li st. (See “Modifying a Security ACL” on page 394 .) An implicit “deny all” rule is always pr ocessed as the last AC E of an ACL.
380 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S Selection of User ACLs Identity-based ACLs (ACLs m apped to users) take pr ecedence over location-based ACLs (ACLs mapped to VLANs, ports, virtual ports, or Distributed MAPs).
Creating and Committing a Security ACL 381 The simplest security ACL permits or denies packets from a source IP address: set security acl ip acl-name { permit [ cos cos ] | deny } source-ip-addr mask .
382 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S Wildcard Masks When you specify source and destinat ion IP addr esses in an ACE, you must also include a mask for each in the form source-ip-add r mask and destination-ip-addr mask. The mask is a wildcar d mask.
Creating and Committing a Security ACL 383 MAP forwarding prioritization occurs automatically for W i-Fi Multimedia (WMM) traffic. Y ou do not need to configure ACLs to provide WMM prioritization. For non-WMM devices, you can provide MAP forwarding prioritization by configuring ACLs.
384 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S T ype-of-service level is 12 (minimum delay plus maximum throughput). Prece dence is 7 (network contr ol). WX1200# set security acl ip acl-3 pe rmit icmp 192.168.1.3 0.0.0.0 192.168.
Creating and Committing a Security ACL 385 Setting TCP a nd UDP ACLs Security ACLs can filter TCP and UDP packets by source and destination IP address, preced ence, and TOS lev el. Y ou can apply a TCP ACL to established TCP sessions only , not to new TCP sessions.
386 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S For example, the following command pe rmits pack ets sent fr om IP address 192.168.1.5 to 192.
Creating and Committing a Security ACL 387 T o specify the order of the commands, use the following parameters: before editbuffer -index inserts an ACE befor e a specific location.
388 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S ACLs do not take effect until you map them to something (a user , Distributed MAP , VLAN, port, or vir tual port). T o map an ACL, see “Mapping Security ACLs” on page 390. T o display the mapped ACLs, use the display security acl command, without the editbuf fer or info option.
Creating and Committing a Security ACL 389 Y ou can also view a specific security ACL. For example, to view acl-2 , type the following command: WX1200# display security acl info ac l-2 ACL information for acl-2 set security acl ip acl-2 (hits #1 0 ) ------------------------------------ ---------------- 1.
390 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S Clearing Security ACLs The clear security acl command removes the ACL from the edit buffer only . T o clear a security ACL, enter a specific ACL name, or enter all to delete all security ACLs.
Mapping Security ACLs 391 T o map a security ACL to a us er session, follow these steps: 1 Create the securi ty ACL. For ex ampl e, to filter packets coming from 192.168.253.1 and goin g to 192.168.253.12, type the following: WX1200# set security acl ip acl-222 permit ip 192.
392 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S Mapping Security ACLs to Ports, VLANs, Virtual Ports, or Distributed MAPs Security ACLs can be mapped to ports, VLANs, virtual ports, and Distributed MAPs.
Mapping Security ACLs 393 T o display a summary of the securi ty ACLs mapped on a MAP (i n this example, MA P 7), type the following c ommand: WX# display ap acl map 7 ACL Type Class Mapping ---------.
394 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S If you no longer need the security ACL, delete it from the configuration with the clear security acl and commit securi ty acl commands.
Modifying a Security ACL 39 5 2 T o add anothe r ACE to the end of acl-violet , type the following command: WX1200# set security acl ip acl-viol et permit 192.168.123.11 0.0.0.255 hits 3 T o commit the updated security ACL acl-violet , type the following command: WX1200# commit security acl acl-viol et success: change accepted.
396 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S 3 T o view the results, type the following command: WX1200# display security acl info ACL information for all set security acl ip acl-111 (hits #4 0) ------------------------------------ ---------------- 1.
Modifying a Security ACL 39 7 3 T o view the results, type the following command: WX1200# display security acl info ACL information for all set security acl ip acl-111 (hits #4 0) ------------------------------------ ---------------- 1. permit IP source IP 192.
398 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S 3 T o view details about these uncommitted ACEs, type the following command. WX1200# display security acl info al l editbuffer ACL edit-buffer information for all set security acl ip acl-111 (ACEs 3, add 3, del 0, modified 2) ------------------------------------ ---------------- 1.
Using ACLs to Change CoS 399 Using ACLs to Change CoS For WMM or non-WMM traffic, you can change a packet’ s priority by using an A CL to cha nge the packet’ s CoS value. A CoS value a ssigned by an ACE overrides th e CoS value assigned by the switch’ s QoS map.
400 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S T able 34 lists the CoS values to use when r eassigning traffic to a di ffer ent priority . The CoS deter mines the MAP forwarding queue to use for the traffic when sending it to a wireless client.
Enabling Prioritization fo r Legacy Voice over IP 40 1 The following commands perform the same CoS reassignment as the commands in “Using the dscp Option” on page 400.
402 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S General Guidelines 3Com recommends that you follow these guidelines for any wireless V oIP implementation: Ensure end-to-end priority forwarding by making sure none of the devices that will forward voice traf fic resets IP T oS or Diffserv values to 0.
Enabling Prioritization fo r Legacy Voice over IP 40 3 If you are upgr ading a switch running MSS V ersion 3.x to MSS V ersion 4.x, and the switch uses ACLs to map V oIP traffic to CoS 4 or 5, and you plan to leave WMM enabled, 3Com recommends that you change the ACLs to map the traffic to CoS 6 or 7.
404 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S 3 Commit the ACL to the configuration: WX4400# commit security acl voip Enabling SVP Optimization for SpectraLink Phones SpectraLink’ s V.
Enabling Prioritization fo r Legacy Voice over IP 40 5 Configuring a Service Profile for RSN (WP A2) T o configure a service pr ofile for SVP phones that use RSN (WP A 2): Create the service profile an d add the voice SSID to it. Enable the RSN information eleme nt (IE).
406 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S The following commands config ure a servi ce pr ofile called vowlan-wpa2 for RSN: WX4400# set service-profile vowlan-wpa ssid-name phones W.
Enabling Prioritization fo r Legacy Voice over IP 40 7 Configuring a VLAN for V oice Clients MSS requir es all clients to be authenticated by RADIUS or the local database, and to be authorized for a specific VLAN. MSS places the user in the authorized VLAN.
408 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S WX1200# set security acl ip SVP perm it cos 7 119 0.0.0.0 255.255.255.255 0.0.0.0 255.255.
Restricting Client-To-Client Fo rwarding Among IP-Only Clients 409 Setting 802.11b/g Radios to 802.11b (f or Siemens SpectraLink V oIP Phones only) If you plan to use Siemens SpectraLin k V oice over IP (V oIP) phone s, you must change the MAP radios that will support the phone s to operate in 802.
410 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S 3 Configure an ACE that denies all IP traf fic fr om any IP address in the 10.10.11.0/24 subnet to any addr ess in the same subnet. WX1200# set secu rity acl ip c2c deny ip 10.10.11.0 0.0.0.
Security ACL Conf iguration Scenario 411 4 To m a p acl-99 to port 6 to filter incoming packets, type the following command: WX1200# set security acl map acl-99 port 6 in mapping configuration accepted Because every security ACL includes an implicit rule denying all traffic that is not permitted, port 6 n ow accepts packets only fr om 192.
412 C HAPTER 19: C ONFI GURING AND M ANAGING S ECURITY ACL S.
20 M ANAGING K EYS AND C ERTIFICATES A digital certificate is a form of elec tr onic identification for computers. The WX switch requires digital certificates to authenticate its communications to 3Co.
414 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES Wireless Security through TLS In the case of wireless or wir ed authentication 802.1X users whose authentication is performed by the WX switch, the first stage of any EAP transaction is T ransport Layer Se curity (TLS) authentication and encryption.
About Keys and Certificates 415 About Keys and Certificates Public-private key pairs and digital si gnatures and certificates allow keys to be gene rated dy namically so t hat data ca n be secur ely e ncrypted an d delivered.
416 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES Public Key Infrastructures A public-key infrastructur e (PKI) is a system of digital certificates and certification authorities that verif y and authenticate the validity of each party involved in a t ransaction through the use of public key cryptography .
About Keys and Certificates 417 EAP certificate —Used by the WX switch to authenticate itself to EAP clients. WebAAA certificate —Used by the WX switch to authenticate itself to WebAAA clients, who use a web page served by a WX switch to log onto the network.
418 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES Certificates Automatically Generated by MSS The first time you boot a switch with MSS V ersion 4.2 or later , MSS automatically generates keys and sel f-signed certificates, in cases where certificates are not already co nfigur ed or installed.
Creating Keys and Certificates 419 Creating Keys and Certificates Public-private key pairs and digi tal certificat es ar e r equired for management access with 3Com W ir eless Switch Manager or Web Manager, or for network access by 80 2.1X or W ebAAA users.
420 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES Choosing the Appropriate Certificate Installation Method for Y our Network Depending on your network environment, you can use any of the following methods to install certificates and th eir public-private key pairs.
Creating Keys and Certificates 421 Creating Public-Private Key Pairs T o use a self-signed certificate or Certificate Signing Request (CSR) certificate for WX switch authentication, you must gen erate a public-private key pair .
422 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES Some key lengths apply only to specific ke y types. For example, 128 applies only to domain keys . SSH requir es an SSH authentication key , but you can allo w MSS to generate it automatically .
Creating Keys and Certificates 423 Installing a Key Pair and Certificate fr om a PKCS #12 Object File PKCS object files provide a file format for storin g and transferring storing data and cryptographic info rmatio n. (For mor e information, see “PKCS #7, PKCS #10, and PKCS #12 Object Files” on page 417.
424 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES Creating a CSR and Installing a Certificate from a PKCS #7 Object File After creating a public-private key pair , you can obtain a signed certificate of authenticity from a CA by gene rating a Certificate Signing Request (CSR) from the WX switch.
Creating Keys and Certificates 425 2 Use a text editor to open the PKCS #7 file, and copy and paste the entire text block, including t he beginning and ending delimiters, into the CLI. Y ou must paste the entire block, from the beginning -----BEGIN CERTIFICA TE----- to the end -----END CERTIFICA TE-----.
426 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES Displaying Certificate and Key Information T o display information about certif ica tes installed on a WX switch, use the following commands: display.
Key and Certificate Configuration Scenarios 427 Key and Certificate Configuration Scenarios The first scenario shows how to gene rat e self-signed certificates.
428 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES Unstructured Name: WX in wiring clos et 4 Self-signed cert for eap is WX1200# crypto generate self-signed web Country Name: US State Name: CA Locality Name: San Francisco Organizational Name: example Organizational Unit: IT Common Name: WX 6 Email Address: admin@example.
Key and Certificate Configuration Scenarios 429 WX1200# display crypto certificate w eb Certificate: Version: 3 Serial Number: 999 (0x3e7) Subject: C=US, ST=CA, L=PLEAS, O=M ycorp, OU=SQA, CN=BOBADMIN.
430 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES For example: WX1200# crypto otp admin SeC%#6@o%c OTP set WX1200# crypto otp eap SeC%#6@o%d OTP set WX1200# crypto otp web SeC%#6@o%e OTP set 5 Unpack the PKCS #12 object files into the certificate and key storage area on the WX switch.
Key and Certificate Configuration Scenarios 431 Installing CA-Signed Certificates Using a PKCS #10 Object File (CSR) and a PKCS #7 Object File This scenario shows how to use CSRs to install public-private key pairs, CA-signe d certificates , and CA certif ie s for administrative access, 802.
432 C HAPTER 20: M ANAGING K EYS AND C ERTIFICATES 7 T o install the administ rative certi ficate on the WX switch, type the following command to display a prompt: WX1200# crypto certificate admin Enter PEM-encoded certificate 8 Paste the signed certificate text block into the WX switch’ s CLI, below the pr ompt.
21 C ONFIGURING AAA FOR N ETWORK U SERS The following sections describe the MSS authentication, authorizat ion, and accounting (AAA) features in detail. About AAA for Network Users Network users include the fo llowing types of users: Wireless users — Users who access the network by associating with an SSID on a 3Com radio.
434 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Each authentication rule specifies wh er e the user cre dentials ar e stor ed. The location can be a group of RADIUS servers or the switch’ s local database.
About AAA for Network Users 435 SSID —If 802.1X or MAC authentication do not apply to th e SSID (no 802.1X or MAC access rules ar e configured for the SSID), the default authorization attributes set on the SS ID are applied to the user and the user is allowed onto the network.
436 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Figure 30 Authentication Flowchart for Network Users last-resort? web? none? Client associates with MAP radio or requests access from wired authentication port Use fallthru authentication Ye s No Ye s Ye s Ye s Ye s No Ye s Ye s No No No No Client requests encrypted SSID? Client 802.
About AAA for Network Users 437 SSID Name “Any” In authentication rules for wirele ss access, you can specify the name any for the SSID. This value is a wildcar d that matches on any SSID string re quested by the use r .
438 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS For a user to be successfully authenticated based on the MAC add r ess of the user device, the MAC address must be configur ed on the RADIUS servers used by the authentication rule or in the WX local database, if the local database is us ed by the rule.
About AAA for Network Users 439 MSS provides the following VSAs, which you can assign to users configured in the local database or on a RADIUS server: Encryption-T ype — Specifies the type of encryption requir ed for access by the client. Clients who attempt to use an unauthorized encryption meth od ar e rejected.
440 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS In addition to configuring authorizatio n attributes for users on RADIUS servers or the WX local database, you can also configure attributes within a service profile.
AAA Tools for Network Users 441 Authorization for access control. Authorization pr ovides access control by means of such mechanis ms as per -user security access control lists (ACLs), VLAN membersh ip, Mobility Domain assignment, and timeout enforcement.
442 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS “Globs” and Gr oups for Network User Classification “Globbing” lets you classify users by user name or MAC addr ess for differ ent AAA tr eatments. A user glob is a string used by AAA and IEEE 802.
AAA Tools for Network Users 443 Y ou can use the local database or R ADIUS servers for MAC access as well. If you use RADIUS servers, make su re you configure the password for the MAC addr ess user as 3Com . (This is the de fault author ization passwor d.
444 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Remote Authentication with Local Backup Y ou can use a combination of authenticatio n methods; for example, PEAP offload and local au thentication.
AAA Tools for Network Users 445 Figure 31 shows the r esults of this combinat ion of methods. Figure 31 Remote Authentication with PEAP Of fload using Local Authenticatio n as Backup Authentication proceeds as follows: 1 When user Jose@example.
446 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS If one of the RADIUS servers in the group does respond, but it indicates that the user does no t exist on the RADIUS server , or that the user is not permitted on the network, then authentication for the user fails, regardless of any additional methods.
AAA Tools for Network Users 447 W ays a WX Switch Can Use EAP Network users with 80 2.1X support cann ot access the network u nless they are authenticated.
448 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Effects of Authentication T ype on Encryption Method Wi r eless users who are authenticated on an encrypted service set identifier (SSID) can ha.
Configuring 802.1 X Authentication 449 Configuring 802.1X Authentication The IEEE 802.1X standard is a framewo rk for passing EAP pr o tocols over a wired or wir eless LAN. Within th is f ramework, you can use TLS, PEAP-TTLS, or EAP-MD5. Most EAP protocols can be passed thr ough the WX switch to the RADIUS server .
450 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS For example, the following command authen ticates all wir eless users who request SS ID marshes at example.
Configuring 802.1 X Authentication 451 Binding User Authentication to Machine Authentication Bonded Auth™ (bond ed authentication) is a security feature that binds an 802.1X user auth entication to authentication of th e machine fr om which the user is attempting to log on.
452 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Authentication Rule Requir ements Bonded authentication r equir es an 802.1X auth entication rule for the machine itself, and a separate 802.1X authenticati on rule for the user(s). Use the bonded option in the user authentication rule, but not in the machine authentication rule.
Configuring 802.1 X Authentication 453 host/*.nl.mycorp.com (userglob for the machine authentication rule) *.nl.mycorp.com (userglob for th e user authentication rule) host/*.de.mycorp.com (user glob for the machine authentication rule) *.
454 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Bonded Auth Configuration Example T o configure Bonded Auth: Configure separate authentication rules for the machine and for the user(s). Set the Bonded Auth period. V erify the config uration changes.
Configuring 802.1 X Authentication 455 In the following example, bob.mycorp.com uses Bonded Auth, and the Bonded Auth period is set to 60 seconds. WX1200# display dot1x config 802.1X user poli cy ------------------ ---- 'host/bob-laptop.mycorp.com' on ssid 'mycorp' doing PASSTHRU 'bob.
456 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Configuring Authentication and Authorization by MAC Address Y ou must sometimes authenticate us ers based on the MAC addresses of their devices rather than a user name-password or certificate.
Configuring Authenticatio n and Authorization by MAC Address 45 7 For example, type the follow ing command to add MAC user 01:0f:03:04:05:06 to group macfans: WX1200# set mac-user 01:0f:03:04:05: 06 group macfans success: change accepted.
458 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS If the switch’ s configurat ion does not contain a set authentication mac command that matches a non-802.1X client’ s MAC address, MSS tries MAC authentication by default. Y ou can also glob MAC addresses.
Configuring Authenticatio n and Authorization by MAC Address 45 9 Changing the MAC Authorization Password for RADIUS When you enable MAC authentication, the client does not supply a re gular username or passwor d. The MAC addr ess of th e user’ s device is extracted from frames rece ived from the device.
460 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Configuring Web Portal WebAAA WebAAA simplifies secur e access to unencrypted SSIDs. When a use r requests access to an SSID or atte mpts to access a web page befor e logging onto the network, MSS serves a log in page to the user’ s browser .
Configuring Web Portal W ebAAA 461 3 The user opens a Web br owser . The Web br owser sends a DNS r equest for the IP address of the home page or a URL requested by the user .
462 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS If the WX does not receive a r eply to a client’ s DNS request, the WX spoofs a reply to the browser by sending the WX switch’ s own IP address as the resolution to the br owser’ s DNS query .
Configuring Web Portal W ebAAA 463 Her e are some example s of co mmon names in th e recommended format: webaaa.login webaaa.customername.com portal.
464 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Fallthru authentication type—The fallthr u authentication type for each SSID and wired authentication port that you want to support WebAAA, must be set to web-portal .
Configuring Web Portal W ebAAA 465 CAUTION: W ithout the W eb-Portal ACL, WebAAA users will be placed on the network without any filters. CAUTION: Do not change the deny rule at the bo ttom of the ACL. This rule must be present and the capture option must be used with the rule.
466 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS T o modify a W ebAAA user’ s access a fter the user is authenticated and authorized, map an ACL to the individual WebAAA user . Changes you make to the ACL mapped to the web-portal- ssid or web-portal-wired user do not affect user access after authentication and au thorization are complete.
Configuring Web Portal W ebAAA 467 Configuring Web Portal WebAAA T o configure W eb Portal WebAAA: 1 Configure an SSID or wir ed authentication port and set the fallthru authentication type to web-portal . The default for SSIDs and fo r wir ed authentication ports is none .
468 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS WX1200# set service-profile mycorp-srvcprof auth-fallthru web-portal success: change accepted. WX1200# set service-profile mycorp-srvcprof attr vlan-name mycorp-vlan success: change accepted. WX1200# set service-profile mycorp-srvcprof rsn-ie enable success: change accepted.
Configuring Web Portal W ebAAA 469 The rule does not by itself allow a ccess to all usernames. The ** value simply makes all username s eligible for authentica tion, in this case by searching the switch’ s local database for the matching user names and passwords.
470 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Displaying Session Information for W eb Portal W ebAAA Users T o display user session informati on for Web Portal W ebAAA users, use the followi.
Configuring Web Portal W ebAAA 471 Using a Custom Login Page By default, MSS serves the 3Com login page for W eb login. T o serve a custom page instead, do the followin g: 1 Copy and modify the 3Com p a ge, or cr eate a new page.
472 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS MSS uses the following process to find the login page to display to a user: If the user is att empting to access an SSID and a custom page is specified in the service profile, MSS serves the custom pa ge.
Configuring Web Portal W ebAAA 473 5 Save the modified page. Filenames and paths for image so urce f iles must be relative to the HTML page. For example, if login page mycorp-login.html and image file mylogo.gif are located in subdirector y mycorp/, specify the image source as mylogo.
474 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS c Change the greeting: <h3> Welcome to Mycorp’s Wireless LAN </h3> d Change the war ning statement if desir ed: <B>WARNING:</B> My corp’s warning text. e Do not change the form (delimited by the <form name => and </form> tags.
Configuring Web Portal W ebAAA 475 For the url , specify the full path; for example, mycorp-webaaa/mycorp-login.html . If the custom login page includes *.gif or *.jpg images, their path names are interpreted r elative to the directory from which the page is served.
476 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS When user piltdown is successfully authenticated an d authorized, MSS redir ects the user to the following URL: http://myserver .
Configuring Web Portal W ebAAA 477 5 Commit the new ACL to the configuration, using the following command: commit security acl 6 Change the Web-Portal ACL name set on the service profile, using the following command: set service-profile name web-portal-acl aclname 7 V erify the change by disp laying the service profile.
478 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS T o change the Web Portal W ebAAA session timeout period, use the following command: set service-profile name web-portal- session-timeout seconds Y ou can specify from 5 – 2,800 seconds. The default is 5 seconds.
Configuring Last-Resort Access 479 The URL should be of the fo rm https:// host /logout.html . By default, the logout URL uses the IP addr ess of the WX switch as the host part of the URL. Th e host can be eith er an IP address or a hostname. Specifying the logout URL is useful if you want to standardize it across your network.
480 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Y ou do not need to configure an access rule for last-r esort access. Last-resort access is automatically enabled on all service profiles and wired authentication ports that have the fallthru authentication type set to last-resort .
Configuring Last-Resort Access 481 WEP Unicast Index: 1 WEP Multicast Index: 1 Shared Key Auth: NO WPA and RSN enabled: ciphers: cipher-tkip, cipher-ccm p, cipher-wep40 authentication: 802.1X TKIP countermeasures time: 60000 ms vlan-name = guest-vlan .
482 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Configuring AAA for Users of Thir d-Party APs A WX switch can pr ovide network ac cess for users associated with a third-party AP that has authentica ted the users with RADIUS.
Configuring AAA for Users of Third-Party APs 483 For any users of an AP that sends SSID traffic to the WX on an untagged VLAN, the WX does not use 802.1X. The WX sends a RADIUS query for the special username web-portal-wired or last-r esort-wired , depending on the fallthru authenti cation type specified for the wired authentication port.
484 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS WX Switch Requirements The WX port connect ed to the third-party AP must be configured as a wired authentication port. If SSID tr af fic from the AP is tagged, the same VLAN tag value must be used on the wired authentication port.
Configuring AAA for Users of Third-Party APs 485 Configure a MAC authentication rule for the AP . Use the following command: set authentication mac wired mac-addr-glob method1 Configure the WX port connected to the AP as a RADIUS proxy for the SSID supported by the AP .
486 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS The following command configures a MAC authentication rule that matches on the third-party AP’ s MAC address. Because the AP is connected to the WX switch on a wired authentication port, the wire d option is used.
Assigning Authorization Attributes 487 Configuring Authentication for Non-802.1X Users of a Third-Party AP with T agged SSIDs T o configure MSS to authenticate no n-802.1X users of a thir d-party AP , use the same commands as those required for 802.1X users.
488 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS T able 43 lists the authorization attributes supported by MSS. (For brief descriptions of all the RADIUS a ttributes and 3Com vendor -specific a.
Assigning Authorization Attributes 489 end-date Date and time after which the user is no longer allowed to be on the network. Date and time, in the following format: YY/MM/DD-HH:MM You can use end-date alone or with start-date . You also c an use start-date , end-date , or both in conjunction with time-of-day .
490 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS service-type Type of access the user is requesting. One of the following numbers: 2 —Framed; for network user access 6 —Administrative; for administrative access to the WX switch, with authorization to access the enabled (configuration) mode.
Assigning Authorization Attributes 491 start-date Date and time at which the user becomes eligible to access the network. MSS does not authenticate the user unless the attempt to access the network occurs at or after the specified date and time, but before the end-date (i f specified).
492 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Assigning Attributes to Users and Groups Y ou can assign author ization attributes to individual users or groups of users.
Assigning Authorization Attributes 493 T o change the value of an authorization at tribute, r eenter the command with the new value. T o assign an authorization attribute to a user’ s configu ration on a RADIUS server , see the document ation for your RADIUS server .
494 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS All of the authorization attribu tes listed in T a ble 40 on page 448 can be specified in a service profile except ssid .
Assigning Authorization Attributes 495 Y ou can set filters for inc oming and outgoi ng packet s: Use acl-name .in to filter traffic that enters the WX switch from users via a MAP access port or wired authentication port, or from the network via a network port.
496 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Assigning Encryption Ty p e s t o W i r e l e s s Users When a user turns on a wireless laptop or PDA, the device attempts to find an access point and form an association with it. Because M APs support the encryp tion of wir eless traffic, clients can choose an encryption type to use.
Assigning Authorization Attributes 497 For example, the following command restricts the MAC user group mac-fans to access the network by using only TKIP: WX1200# set mac-usergroup mac-fans a ttr encryption-type 4 success: change accepted. Y ou can also specify a combination of allowed encryption types by summing the values.
498 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Keeping Users on the Same VLAN Even After Roaming In some cases, a user can be assigne d to a differ ent VLAN after roaming to another WX switch. T able 46 lists the ways a VLAN can be assigned to a user after r oaming from one WX to another .
Overriding or Adding Attribute s Locally with a Location Policy 49 9 SSID means the VLAN is set on the r oamed-to switch, in th e service profile for the SSID the user is associated with. (The Vlan-name attribute is set by the set service-profile name attr vlan-name vlan-id command, entere d on the roamed-to switch.
500 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS About the Location Policy Each WX switch can have one location policy . The location policy co nsists of a set of rules. Each rule contains conditions, and an action to perform if all conditions in the rule match.
Overriding or Adding Attribute s Locally with a Location Policy 50 1 Setting the Location Policy T o enable the location policy function on a WX swit ch, you must create at least one location policy r.
502 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS The following command places all users who are authorized for SSID tempvendor_a into VLAN kiosk_1 : WX1200# set location policy permit vlan kiosk_1 if ssi d eq tempvendor_a success: change accepted.
Overriding or Adding Attribute s Locally with a Location Policy 50 3 For example, suppose you have configured the following location policy rules: WX1200 display location policy Id Clauses ------------------------------------ ---------------------------- 1) deny if user eq *.
504 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Configuring Accounting for Wireless Network Users Accounting record s come in three types: start-stop, stop-only , and update for network users. The recor ds pr ovide information about network resour ce usage.
Configuring Accounting for Wireles s Network Users 505 (For details about display accounting statistics ou tput, see the Wireless LAN Switch and Controller Command Reference . For information ab out accounting update records, see “Viewing Roaming Accounting Records” on page 505.
506 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS User-Name=Administrator@example.com Acct-Session-Time=209 Acct-Output-Octets=1280 Acct-Input-Octets=1920 Acct-Output-Packets=10 Acct-Input-Packe.
Displaying the AAA Configuration 507 Displaying the AAA Configuration T o view the r esults of the AAA comm ands you have set and verify their or der , type the display aaa command. The order in which the commands appear in the output de termines the order in which MSS matches them to users.
508 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS A voiding AAA Problems in Configuration Order This section describes some common AAA co nfiguration issues on the WX switch and how to avoid them.
Avoiding AAA Problems in Configuration Order 509 Configuration Producing an Incorrect Pr ocessing Or der For example, suppose you initially set up start-stop accounting as follows for all 802.1X users vi a RADIUS server group 1: WX1200# set accounting dot1x ssid my corp * start-stop group1 success: change accepted.
510 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS The configuration order now shows that all 802.1X users are pr ocessed as you intended: WX1200# display aaa .
Configuring a Mobility Profile 511 Y ou can then assign this Mo bility Pr ofile to one or more users. For example, to assign the Mobilit y Pr ofile roses-profile to all users at EXAMPLE, type the following command: WX1200# set user EXAMPLE* attr mobi lity-profile roses-profile success: change accepted.
512 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Network User Configuration Scenarios The following scenarios pr ovide examples of ways in which you use AAA commands to configure access for use.
Network User Configuration Scenarios 513 5 Create a Mobility Pr ofile called tulip by typing the following commands: WX1200# set mobility-profile name tu lip port 2,5 success: change accepted. WX1200# set mobility-profile mode en able success: change accepted.
514 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS 8 Save the configuration: WX1200# save config success: configuration saved. Enabling RADIUS Pass-Through Authentication The following example illustrates how to enable RADIUS pass-through authentication for all 802.
Network User Configuration Scenarios 515 3 T o assign Natasha to a VLAN named red , type the following command: WX1200# set user Natasha attr vlan-n ame red 4 T o assign Natasha a session timeou t val.
516 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS Combining EAP Offload with Pass-Through Authentication The following example illustrates how to enable PEAP-MS-CHAP-V2 offload for the marketing ( mktg ) group and RADIUS pass-through authentication for members of engine ering.
Network User Configuration Scenarios 517 1 Redirect bldga-prof- VLAN users to the VLAN bldgb-eng : WX1200# set location policy permit v lan bldgb-eng if vlan eq bldga-p rof-* 2 Allow writing instructo.
518 C HAPTER 21: C ONFI GURING AAA FOR N ETWO RK U SERS.
22 C ONFIGURING C OMMUNICATION WITH RADIUS For a list of the standard and extended RADIUS attributes and 3Com vendor -specific att ributes (VSAs) supported by MSS, see “Supported RADIUS Attributes” on page 651. RADIUS Overview Remote Auth entication Dial-In User Service (RADIUS) is a distributed client-server system.
520 C HAPTER 22: C ONFI GURING C OMMUNICATION WITH RADIUS Figure 33 Wireless Client, MAP , WX Switch, and RADIUS Servers In the example shown in Figur e 33, the following events occur: 1 The wireless user (client) requests an IEEE 802.11 association from the MAP .
Before You Begin 52 1 Before Y ou Begin T o ensure that you can contact the RADIUS servers you plan to use for authentication , send the ping command to each one to verify connectivity . ping ip-address Y ou can then set up communication between the WX switch and each RADIUS server group.
522 C HAPTER 22: C ONFI GURING C OMMUNICATION WITH RADIUS During the holddown, it is as if the dead RADIUS server d oes not exist. MSS skips over any de ad RADIUS servers to the next live server , or on to the next method if no more live server s ar e available, depending on your configuration.
Configuring RADIUS Servers 523 For example, the following command resets the dead-time timer to 0 minutes on all RADIUS servers in the WX configuration: WX1200# clear radius deadtime success: change accepted.
524 C HAPTER 22: C ONFI GURING C OMMUNICATION WITH RADIUS Y ou can configure multiple RADIUS servers. When you define server names and keys, case is si gnificant. For example: WX1200# set radius server rs1 addres s 10.6.7.8 key seCret success: change accepted.
Configuring RADIUS Server Groups 525 Creating Server Gr oups T o create a server gr oup, you must first configure the RADIUS servers with their addresses and any optio nal parameters.
526 C HAPTER 22: C ONFI GURING C OMMUNICATION WITH RADIUS Configuring Load Balancing Y ou can configure the WX switch to distribute authentication requests across RADIUS servers in a server gr oup, which is called load balancing.
Configuring RADIUS Server Groups 527 Adding Members to a Server Group T o add RADIUS servers to a server group, type the following command: set server group group-name members server-name1 [ server-name2 ] [ server-name3 ] [ server-na me4 ] The keyword members lists the RADIUS servers contained in the named server group.
528 C HAPTER 22: C ONFI GURING C OMMUNICATION WITH RADIUS The members of the gr oup remain configur ed, although no server groups are shown: WX1200# display aaa Default Values authport=1812 acctport=1.
RADIUS and Server Group Configuration Scenario 529 6 Display the configuration. T y pe the following command: WX1200# display aaa Default Values authport=1812 acctport=1813 timeout= 5 acct-timeout=5 r.
530 C HAPTER 22: C ONFI GURING C OMMUNICATION WITH RADIUS.
23 M ANAGING 802.1X ON THE WX S WITCH Certain settings for IEEE 802.1X se ssions on the WX switch ar e enabled by default. For best resu lts, change the settings only if you are awar e of a problem with the WX switch’ s 802.1X performance. For settings t hat you can reset with a clear command, MSS r everts to the default value.
532 C HAPTER 23: M ANAGING 802.1X ON THE WX S WITCH The default setting is enable , which permits 802.1X authentication to occur as determined by the set dot1X port-contr ol command for each wired authentication port. The disable setting forces all wir ed authentication ports to unconditionally author ize all 802.
Managing 802.1X Encryptio n Keys 533 Managing 802.1X Encryption Keys By default, the WX switch sen ds encryption key information to a wireless supplicant (client) in an Extensible Authentication Pr otocol over LAN (EAPoL) packet after authent ication is successful.
534 C HAPTER 23: M ANAGING 802.1X ON THE WX S WITCH T ype the following command to reset the retransmission interval to the 5-second default: WX1200# clear dot1x tx-period success: change accepted. Managing WEP Keys W ired-Equivalent Privacy (WEP) is part of the system security of 802.
Setting EAP Retransmission Attempts 535 T o reenable WEP reke ying, type the following command: WX1200# set dot1x wep-rekey enable success: wep rekeying enabled Configuring the Interval for WEP Rekeyi.
536 C HAPTER 23: M ANAGING 802.1X ON THE WX S WITCH Supplicant timeout (conf igur ed by the set dot1x timeout supplicant command) RADIUS session-timeout attribute If both of these timeouts are set, MSS uses the shorter of the two.
Managing 802.1X Client Reauthentication 537 The default number of reauthentication attempts is 2. Y o u can specify from 1 to 10 attempts. For example, type the following command to set the number of authentication attempts to 8: WX1200# set dot1x reauth-max 8 success: dot1x max reauth set to 8.
538 C HAPTER 23: M ANAGING 802.1X ON THE WX S WITCH Setting the Bonded Authentication Period The following command changes the Bonded Auth ™ (bonded authentication) period, which is th e numb er of seconds MSS retains session information fo r an authenticated machine while waiting for the 802.
Managing Other Timers 539 T ype the following command to reset the 802.1X quiet period to the default: WX1200# clear dot1x quiet-period success: change accepted. Setting the 802.1X Timeout for an Authorization Server Use this command to configure the number of seconds before the WX switch times out a request to a RADIUS authorization server .
540 C HAPTER 23: M ANAGING 802.1X ON THE WX S WITCH Displaying 802.1X Information This command displays 802.1X information for clients, stat istics, VLANs, and configurat ion. display dot1x { clients | stats | con fig } display dot1x clients displays the user name, MAC addr ess, VLAN, and state of active 802.
Displaying 802.1X Information 54 1 802.1X parameter setting ---------------- ------- supplicant timeout 30 auth-server timeout 30 quiet period 5 transmit period 5 reauthentication period 3600 maximum .
542 C HAPTER 23: M ANAGING 802.1X ON THE WX S WITCH.
24 C ONFIGURING SODA E NDPOINT S ECURITY FOR A WX S WITCH Sygate On-Demand (SODA) is an endpoin t security solution that allows enterprises to enforce security policies on client devices without having to install any special software on th e client machines.
544 C HAPTER 24: C ONFI GURING SODA E NDPOINT S ECURITY FOR A WX S WITCH Malicious Code Protection – Detects and blocks keystroke loggers that capture usernames and passwords, T rojans that create back-door user accounts, and Screen Scrapers that spy on user activity .
About SODA Endpoint Security 545 If the security ch ecks fail, the WX sw itch can deny the client acces s to the network, or g rant the client limited access based on a config ur ed security ACL. When the client closes the Virt ual Desktop, the WX switch can optionally disconnect the c lient from the network.
546 C HAPTER 24: C ONFI GURING SODA E NDPOINT S ECURITY FOR A WX S WITCH 6 Once the SODA agent files have been downloaded, one of the following can take place: a If the WX switch is configured to enfor ce the SODA agent security checks (the default), then the SODA agent checks a r e run on the user’ s computer .
Configuring SO DA Functionali ty 547 7 Specify a page for a client to lo ad when the SODA agent checks run successfully (optional). See “Speci fying a SODA Agent Success Page” on page 551. 8 Specify a page for a client to lo ad when the SODA agent checks fail (optional).
548 C HAPTER 24: C ONFI GURING SODA E NDPOINT S ECURITY FOR A WX S WITCH Note the following when creating the SODA agent in SODA Manager: The failure.html and success.html pages, when specified as success or failure URLs in SODA Manager , must be of the format: https:// hostname /soda/ssid/ xxx .
Configuring SO DA Functionali ty 549 Copying the SODA Agent to the WX Switch After cr eating the SODA agent with SO DA manager , you co py the .zip file to the WX switch using TF TP . For example, the following command copies the soda.ZIP file fr om a TF TP server to the WX switch: WX1200# copy tftp://172.
550 C HAPTER 24: C ONFI GURING SODA E NDPOINT S ECURITY FOR A WX S WITCH Enabling SODA Functionality for the Service Profile T o enable SODA functionality f or a service pr ofile, use the following co.
Configuring SO DA Functionali ty 551 Specifying a SODA Agent Success Page When a client successfully runs the ch ecks performed by the SODA agent, by default a dynamically generated pa ge is displayed on the clien t indicating that the checks succ eeded.
552 C HAPTER 24: C ONFI GURING SODA E NDPOINT S ECURITY FOR A WX S WITCH T o reset the failur e page to the default value, use the following command: clear service-profile name soda fail ure-page The page refers to a file on the WX switch.
Configuring SO DA Functionali ty 553 If configured, a r emediation ACL is ap plied to a client when the client loads the failure page. A client loads the failur e page only if the service profile is set to enfor ce SODA agent checks, and the client fails the SODA agent checks.
554 C HAPTER 24: C ONFI GURING SODA E NDPOINT S ECURITY FOR A WX S WITCH The following command specifies logout.html, in the soda-files directory on the WX switch, as the page to load when a client closes the SODA virt ual desktop: WX# set service-profile sp1 soda log out-page soda-files/logout.
Configuring SO DA Functionali ty 555 For example, the following command removes the directory sp1 and all of its contents: WX1200# uninstall soda agent agent-d irectory sp1 This will delete all files .
556 C HAPTER 24: C ONFI GURING SODA E NDPOINT S ECURITY FOR A WX S WITCH (For information about the fields in the out put, see the Wireless LAN Switch and Controller Command Reference .
25 M ANAGING S ESSIONS About the Session Manager A session is a r elate d set of comm unication transactions between an authenticated user (client) and the spec ific station to which the client is bound.
558 C HAPTER 25: M ANAGING S ESSIONS Displaying and Clearing All Administrative Sessions T o view information about the sessions of all admin istrative users, type the following command: WX1200> di.
Displaying and Clearing Administrative Sessions 559 Displaying and Clearing Administrative T elnet Sessions T o view information about administ rative T elnet sessions, type the following command: WX1.
560 C HAPTER 25: M ANAGING S ESSIONS Displaying and Clearing Network Sessions Use the following command to display information about network sessions: display sessions network [ user user-glob | mac-a.
Displaying and Clearing Network Sessions 561 Displaying V erbose Network Session Information In the display sessions network commands, you can specify verbose to get more in-depth information.
562 C HAPTER 25: M ANAGING S ESSIONS Displaying and Clearing Network Sessions by Username Y ou can view sessions by a username or user glob. (For a definition of user globs and their format, see “User Globs” on page 30.
Displaying and Clearing Network Sessions 563 Displaying and Clearing Network Sessions by MAC Address Y ou can view sessions by MAC addr ess or MAC address glob. (For a definition of MAC address globs and the ir format, see “MAC Address Globs” on page 31.
564 C HAPTER 25: M ANAGING S ESSIONS T o clear the sessions on a VLAN or set of VLANs, use the following command: clear sessions network vlan vlan-glob For example, the following command clears the se.
Displaying and Changing Network Session Timers 565 Last packet signal strength: -60 dBm Last packet data S/N ratio: 35 Protocol: 802.11 Session CAC: disabled (For information about the fields in the out put, see the Wireless LAN Switch and Controller Command Reference .
566 C HAPTER 25: M ANAGING S ESSIONS MSS temporarily keeps session inform ation for disassociated web-portal clients to allow them time to reasso ciate after roaming.
26 R OGUE D ETECTION AND C OUNTERMEASUR ES MAP radios automatically scan th e RF spectrum for other devices transmitting in the same sp ectrum. The RF scans discover third-party transmitters in addition to other 3Com radios. MSS considers the unknown transmitters to be devices of interest , which are potential rog ue s.
568 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Rogue Classification When MSS detects a third-party wireless device that is not allowed on the network, MSS classifies the device as one of the following: Rogue—The device is in the 3C om network but does not belong there.
About Rogues an d RF Detection 569 Rogue Detection Lists Rogue detection list s specify the thir d-party devices an d SSIDs that MSS allows on the network, and the device s MSS classifies as rogues. Y ou can configure the following rogue detection lists: Permitted SSID list—A list of SSIDs allowed in the Mobili ty Domain.
570 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Figure 34 Rogue Detection Algorithm MAP radio detects wireless packet. No Ye s Ye s Source MAC in SSID in Permitted Ignore List? Device is not a threat. SSID List? Ye s OUI in Permitted V endor List? No Source MAC in Attack List? No Generate an alarm.
About Rogues an d RF Detection 571 RF Detection Scans All radios co ntinually scan for ot her RF transmitters. Radios perform passive scans and active scans: Passive scans — The radio listens for beacons and probe r esponses.
572 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES When a MAP radio detects radar on a channel, the radio switches to another channel and doe s not attempt to use the channel where the radar was detected for 30 minutes . MSS also generates a message.
Summary of Rogue Detectio n Features 57 3 Summary of Rogue Detection Features T able 48 lists the rogue detection featur es in MSS. T able 48 Rogue Detection Features Rogue Detection Feature Description Applies To Third-Pa rty APs Clients Classification MSS can clas sify third-party APs as rogues or interfering devices.
574 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Configuring Rogue Detection Lists The following sections describe how to configure lists to specify the devices that are allowed on the networ k and the devices th at MSS should attack with countermeasures.
Configuring Rogue Detection Lis ts 575 If you add a device that MSS has classified as a rogue to the permitted vendor list, but not to the ignore list, MSS can still classify the device as a rogue. Adding an entry to the permit ted vendo r list mer ely indicates that the device is from an allowed vendo r.
576 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Configuring a Permitted SSID List The permitted SSID l ist specifies the SSIDs that ar e allowed on the network. If MSS detects packets for an SSID that is not on the list, the AP that sent the packets is classified as a rogue.
Configuring Rogue Detection Lis ts 577 The following command clears SSID mycorp fr om the permitted SSID list: WX1200# clear rfdetect ssid-list myc orp success: mycorp is no longer in ssid -list. Configuring a Client Black List The client black list specifies clients that ar e not allowed on the network.
578 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Configuring an Attack List The attack list specifies the MAC addresses of devices that MSS should issue countermeasures against when ever the devices are detected on the network. The attack list can cont ain the MAC addresses of APs and clients.
Configuring Rogue Detection Lis ts 579 The following command clears MAC ad dr ess 11:22:33:44:55:66 from the attack list: WX4400# clear rfdetect attack-list 1 1:22:33:44:55:66 success: 11:22:33:44:55:66 is no lon ger in attacklist.
580 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES The following command displays an ignore list containing two BSSIDs: WX4400# display rfdetect ignore Total number of entries: 2 Ignore MAC ----------------- aa:bb:cc:11:22:33 aa:bb:cc:44:55:66 Enabling Countermeasures Countermeasures ar e disabled by de fault.
Enabling Countermeasures 581 The following command disables countermeasures in radio profile radprof3 : WX4400# clear radio-profile radprof3 countermeasures success: change accepted.
582 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Disabling or Reenabling Active Scan When active scanning is enabled, th e MAP radios managed by the switch look for rogue devices by sending probe any frames (probes with a null SSID name), to solicit probe r esponses from other APs.
Enabling MAP Signatures 583 Creating an Encrypted RF Fingerprint Key as a MAP Signature T o crea te an encry pted RF fi ngerprin t key to use as a signa tur e for a MAP , use the following command: se.
584 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Disabling or Reenabling Logging of Rogues By default , a WX switch generates a log message when a r ogue is detected or disappears.
IDS and DoS Alerts 585 Flood Attacks A floo d attack is a type of Denial of Service attack. Du ring a floo d attack, a rogue wir eless device attempts to overwhelm the resources of other wireless devices by continuously in jecting management frames into the air .
586 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Decrypt errors—An excessive number of decrypt err ors can indicate that multiple clients are using the same MAC address.
IDS and DoS Alerts 587 Weak WEP Key Used by Client A weak initialization vector (IV) ma kes a WEP ke y easier to hack. MS S alerts you regar ding clients who are using weak WEP IVs so that you can strengthen the encryption on these clients or replace the clients.
588 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Management frame 6 flood Client aa:bb:cc:dd:ee:ff is sending rsvd mgmt frame 6 message flood. Seen by AP on port 2, radio 1 on channel 11 with RSSI -53. Management frame 7 flood Client aa:bb:cc:dd:ee:ff is sending rsvd mgmt frame 7 message flood.
IDS and DoS Alerts 589 Spoofed disassociation frames Disassociation frame from AP aa:bb:cc:dd:ee:ff is being spoofed. Seen by AP on port 2, radio 1 on channel 11 with RSSI -53. Null probe respons es AP aa:bb:cc:dd:ee:ff is sending null probe responses.
590 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Displaying RF Detection Information Y ou can use the CLI commands listed in T able 50 to display rogue detection information. Spoofed AP AP Mac aa:bb:cc:dd:ee:ff(ss id myssid) is being spoofed. Received fingerprint 112234 3 does not match our fingerprint 123344.
Displaying RF Detection Information 591 (For information about the fields in the out put, see the Wireless LAN Switch and Controller Command Reference .) display rfdetect data Displays information about all BSSIDs detected on the air, and labels those that are from rogues or interfering devices.
592 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Displaying Rogue Clients T o display the wireless c lients detected by a WX switch, use the following command: display rfdetect clients [ mac ma.
Displaying RF Detection Information 593 Displaying Rogue Detection Counters T o display rogue detection statis tics counters, use the following command: display rfdetect counters The command shows counters for rogue activity de tected by the WX switch on which you enter the command.
594 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Access points not present in ssid-li st 0 0 Access points not present in vendor- list 0 0 Clients not present in vendor-list 0 0 Clients added to automatic black-lis t 0 0 MSS generates log messages for most of these statistics.
Displaying RF Detection Information 595 WX-IPaddress: 10.8.121.102 Port/Ra dio/Ch: 3/1/11 Mac: 00:0b:0e:00: 0a:6a Device-type: interfering Adhoc: no Crypto-types: clear RSSI: -85 SSID: 3Com-webaaa BSSID: 00:0b:0e:00:7a:8a Vendor: 3Co m SSID: 3Com-webaaa Type: intfr Adhoc: no Crypto-types: clear WX1200-IPaddress: 10.
596 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES Displaying RF Detect Data T o display information about the APs detected by an individual WX switch, use the following command: display rfdetect data Y ou can enter this command on an y switch in the Mobility Dom ain.
Displaying RF Detection Information 597 00:0a:5e:4b:4a:c6 3Com intfr 11 -85 i-t--- 3Com-tkip 00:0a:5e:4b:4a:c8 3Com intfr 11 -83 i----w 3Com-voip 00:0a:5e:4b:4a:ca 3Com intfr 11 -85 i----- 3Com-webaaa .
598 C HAPTER 26: R OGUE D ETECTION AND C OUNTERMEASURES.
27 M ANAGING S YSTEM F ILES A W i reless Swit ch (WX) contains no nv olatile storage. MSS allows you to manage the files in nonvolatile storag e. In addition, you can copy files between the WX switch and a TF TP server on the network.
600 C HAPTER 27: M ANAGING S YST EM F ILES T o display version in formation for a WX switch, type the follo wing command: WX# display version Mobility System Software, Version: 6 .0.0.2 REL Copyright (c) 2002 - 2006 3Com Corpo ration. All rights reserved.
About System Files 601 Displaying Boot Information Boot information consist s of the MSS version and the names of t he system image file and configuration file curr ently running on the WX switch. The boot command also lists the system image and configuration file that will be loaded after the next r eboot.
602 C HAPTER 27: M ANAGING S YST EM F ILES Working with Files The following section describe how to manage files stored on the WX switch. Displaying a List of Files Files ar e store d on a WX switch i.
Working with Files 603 ==================================== ================================ =========== Boot: Filename Size Creat ed boot0:WXA30001.Rel 9780 KB Aug 23 20 05, 15:54:08 *boot1:WXA40101.
604 C HAPTER 27: M ANAGING S YST EM F ILES The following command limits the output to the contents of the /tmp/core subdirectory: WX1200# dir core: ==================================== ================================ =========== file: Filename Size Creat ed core:command_audit.
Working with Files 605 The tftp:// ip-addr / filename URL refers to a file on a TF TP ser ver . If DNS is configured on the WX switch, you can s pecify a TF TP server’ s hostname as an alternative to specifying the IP addr ess. The tmp: filename URL r efers to a file in temp orary storage.
606 C HAPTER 27: M ANAGING S YST EM F ILES The above comma nd copies the file to the same fi lename. T o rename the file when copying it, type the following command: WX1200# copy tftp://10.1.1.1/newconf ig wxconfig success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec] T o copy system imag e wxb04102.
Working with Files 607 4 Enter a command such as the followin g to calculate the checksum for the file: WX1200# md5 boot0:wxb04102.rel MD5 (boot0:WX040003.020) = b9cf7f527 f74608e50c70e8fb896392a Y ou must include the boot partition name in the filename.
608 C HAPTER 27: M ANAGING S YST EM F ILES Creating a Subdirecto ry Y ou can create subdir ectories in the user files area of nonvolatile storage. T o create a subdir ectory , use the following comman.
Managing Configuration Files 609 Managing Configuration Files A configuration file contains CLI commands that set up the WX sw itch. The switch loads a designated conf iguration file immediately after loading the system softwar e when the softwar e is re booted.
610 C HAPTER 27: M ANAGING S YST EM F ILES set log server 192.168.253.11 severi ty critical set timezone PST -8 0 set summertime PDT start first sun apr 2 0 end lastsun oct 2 0 set system name WX1200 set system countrycode US set system contact 3Com-pubs set radius server r1 address 192.
Managing Configuration Files 611 T o save the running configuration to a file named newconfig , type the following command: WX1200# save config newconfig success: configuration saved to newc onfig.
612 C HAPTER 27: M ANAGING S YST EM F ILES Specifying a Backup Configuration File In the event that part of the configuration file is invalid or otherwise unreadable, MSS stops reading information in the configuration file and does not use it. Y ou can optionally spec ify a backup file to load if MSS cannot load the original configu ration file.
Backing Up and Restoring the System 613 T o back up the cur r ent configuration file named configur ation and r eset the WX switch to t he factory default configuration, type the following commands: WX1200# copy configuration tftp://10 .1.1.1/backupcfg success: sent 365 bytes in 0.
614 C HAPTER 27: M ANAGING S YST EM F ILES Both commands have options to specif y the types of files you want to back up and r estor e: critical —Backs up or restor es system files, including the configuration file used when booting, and certific ate files.
Backing Up and Restoring the System 615 Managing Configuration Changes The backup command places the boo t configuration file into the archive. (The boot configuration file is the Configured boot conf iguration in the display boot command’ s output.
616 C HAPTER 27: M ANAGING S YST EM F ILES The following command restor es syst em-critical files on a switch, fr om archive sysa_bak : WX1200# restore system tftp:/10.10 .20.9/sysa_bak success: received 11908 bytes in 0.1 50 seconds [ 79386 bytes/sec] success: restore complete.
Upgrading the System Image 617 Upgrading an Individual Switch Using the CLI 1 Save the configurat ion, using the save config command. 2 Back up the switch, using t he backup system command. 3 Copy the new system im age onto a TF TP server . For example, log in to http://www .
618 C HAPTER 27: M ANAGING S YST EM F ILES Upgrade Scenario T o upgrade a WX1200 switch from MSS V ersion 4.0 to MSS V ersio n 4.1, type the following commands. This example copies the image file into boot partition 1. On your switch, copy the image file into the boot part ition that was not used the last time the switch was restarted.
A T R OUBLESHOOTING A WX S WITCH Some common problems that occur during WX installation and basic configuration are simple to solve. However , to “recover” the system password, you must delete the existing WX configuration. Fixing Common WX Setup Problems System logs provide a history of MS S events.
620 C HAPTER A: T ROUBLESHOOTING A WX S WITC H T able 51 WX Setup Problems and Remedies Symptom Diagnosis Remedy 3Com Wireless Switch Manager or a web brows er (if you are using Web Manager) warns that the WX switch’s certificate date is invalid.
Fixing Common WX Setup Problems 621 Client cannot access the network. This symptom has more than one possible cause: The client might be failing authentication or might not be authorized for a VLAN. 1 Type the displa y aaa command to ensure that the authentication rules on the WX switch allow the client to authenticate.
622 C HAPTER A: T ROUBLESHOOTING A WX S WITC H Recovering the System When the Enable Password is Lost Y ou can recover any model switch if y ou have lost or fo rgotten the enable password. Y ou also can recover a WXR100 even if you have lost or forgotten the login password.
Configuring and Managing the System Log 623 Configuring and Managing the System Log System logs provide information about system events that you can use to monitor and troubleshoot MSS.
624 C HAPTER A: T ROUBLESHOOTING A WX S WITC H System events and con ditions at differ ent severity levels can be logged to multiple destinations. By default, ev ents at the error level and higher are posted to the conso le and to the log buffer . Deb ug output is logged to the trace buffer by default.
Configuring and Managing the System Log 625 Using Log Commands T o enable, disable, or modify system logging to the WX switch’ s log buffer , console, current T elnet session, or trace buf fer , use.
626 C HAPTER A: T ROUBLESHOOTING A WX S WITC H Logging to the Log Buf fer The system log consists of rolling entries stored as a last-in first-out queue maintained by the WX. Logging to th e buffer is enabled by default for events at the error level and higher .
Configuring and Managing the System Log 627 T o filter the event log by MSS ar ea, use the facility facility-name keyword. For a list of facilities fo r which you can view event messages, type the fol.
628 C HAPTER A: T ROUBLESHOOTING A WX S WITC H If you type anything to the console, the typing disables log output to the console until you press the Enter key .
Configuring and Managing the System Log 629 T o disable session logging, use the fo llowing command: set log sessions disable Changing the Current T elnet Session Defaults By default, log information is not sent to yo ur curr ent T elnet session, and the log level is set to information (info) or higher .
630 C HAPTER A: T ROUBLESHOOTING A WX S WITC H Mark messages ar e disabled by default. When they ar e enabled, MSS generates a message at the notice level once every 300 seconds by default. T o enable mark messages, use the following command: WX4400# set log mark enable success: change accepted.
Running Traces 631 Running T races T race commands enable yo u to perf orm diagnostic routines. Y ou can set a trace command with a keyword, such as auth entication or sm , to trace activity for a particular feature, such as authentication or th e session manager .
632 C HAPTER A: T ROUBLESHOOTING A WX S WITC H T racing Authorization Activity T racing authorization acti vity can help diagnose author ization pr oblems. For example, to trace the authoriza tion of MAC addr ess 00:00:30:b8:72:b0, type th e following command: WX1200# set trace authorization mac- addr 00:00:30:b8:72:b0 success: change accepted.
Running Traces 633 About T race Results The trace commands use the un derlyi ng logging mechanism to deliver trace messages. T race me ssages are generated with the debug severity level. By default, the only log t arget that r eceiv es deb ug-level messages is the volatile trace buffer .
634 C HAPTER A: T ROUBLESHOOTING A WX S WITC H / number -of-messages — Disp lays the specified number of the most recent entries in the log, starting with the least r ecent. T o filt er trace output by MSS ar ea, use the facility facility-name keywor d.
Using displa y Commands 635 Using display Commands T o troubleshoot the WX switch, you can use display commands to display information about different ar eas of the MSS. The following commands can provide helpful inform ation if you are experiencing MSS performance issues.
636 C HAPTER A: T ROUBLESHOOTING A WX S WITC H (For more information about AAA, see Chapter 3, “Configuring AAA for Administrativ e and Loca l Access,” on page 51 and Chapter 2 1, “Configuring AAA for Networ k Users,” on page 433.
Port Mirroring 63 7 Port Mirroring Port mirr oring is a troubleshooting feat ur e that copies (mirrors) traf fic sent or received by a WX port (the source port) to another WX port (the observer). Y ou can attach a protocol analyzer to the observer port to examine the source port’ s traffic.
638 C HAPTER A: T ROUBLESHOOTING A WX S WITC H Remotely Monitoring T raffic Remote traffic monitoring enables yo u to snoop wireless traffic, by using a MAP as a snif fing devic e. The MAP copie s the snif fed 802.11 packets and sends the copies to an observer , which is typically a pr otocol analyzer such as Ether eal or T ethereal.
Remotely Monitoring Traffic 639 Best Practices for Remote T raf fic Monitoring Do not specify an observer that is associated with the MAP wher e the snoop filter is running.
640 C HAPTER A: T ROUBLESHOOTING A WX S WITC H src-mac { eq | neq | lt | gt } mac-addr dest-mac { eq | neq | lt | gt } mac-addr host-mac { eq | neq | lt | gt } mac-ad dr mac-pair mac-addr1 mac-addr2 direction { eq | neq } { transmit | receive } T o match on packets to or from a specific MAC addr ess, use the dest-mac or src-mac option.
Remotely Monitoring Traffic 641 Displaying Configur ed Snoop Filters T o display the snoop filt ers configur ed on the WX switch, use the following command: display snoop info [ filter-name ] The following command shows the snoop filters configured in the examples a bove: WX1200# display snoop info snoop1: observer 10.
642 C HAPTER A: T ROUBLESHOOTING A WX S WITC H The following command maps snoop filter snoop1 to radio 2 on MAP 3: WX1200# set snoop map snoop1 ap 3 ra dio 2 success: change accepted.
Remotely Monitoring Traffic 643 Enabling or Disabling a Snoop Filter A snoop filter does not take ef fect unti l you ena ble it. T o enable or disable a snoop filter , use the following command: set snoop { filter-name | all } mode { enable | disable } The filter operates unt il you manually disable it.
644 C HAPTER A: T ROUBLESHOOTING A WX S WITC H Use Netcat to listen to UDP packets on the TZSP port. This avoids a constant flow of ICMP destination unrea chable messages fr om the obse rver back to the radio. Y ou can obtain Netcat thr oug h the following link: http://www .
Capturing System Information and Sending it to Technical Support 645 Capturing System Information and Sending it to T echnical Support If you need help from 3Com T echnical Support to diagnose a syste.
646 C HAPTER A: T ROUBLESHOOTING A WX S WITC H Core Files If a WX switch restarts due to an error condition (crashes), the switch generates a core file in the temporary file area. The name of the file indicates the system are a where the problem occurred.
Capturing System Information and Sending it to Technical Support 647 If the switch’ s network interface s to the TF TP server have gone down, copy the core file to the nonvolatile file area before r estarting the switch. The following commands copy netsys.
648 C HAPTER A: T ROUBLESHOOTING A WX S WITC H Sending Information to 3Com T echnical Support After you save the display tech-support output, as well as core files and debug messages (if applicable), you can send them to 3Com.
B E NABLING AND L OGGING I NTO W EB V IEW Web View is a web-based manageme nt application available on WX switches. Y ou can use Web View for common configuration and management tasks. On most WX models (WX-2200, WX-4400, or WXR100), you also can use Web View to perform initial configuration of a new switch.
650 C HAPTER B: E NABLING AND L OGGING I NTO W EB V IEW The switch must have an IP interface that can be r eached by the PC where the br owser is installed. If you are configuring a new WX-2200, WX-4 400, or WXR100, you can access Web V iew without any preconfigur ation.
C S UPPORTED RADIUS A TTRIBUTES 3Com Mobility System Softwa re (M SS) supports the standard and extended RADIUS authenti cation and accounting att ributes listed in T able 55 on page 652. Also supported are 3Com vendor -specific attributes (VSAs), listed in T able 56 on page 659.
652 C HAPTER C: S UPPORTED RADIUS A TTRIB UTES Supported Standard and Extended Attributes The RADIUS attributes shown in T able 55 are sent by WX switches to RADIUS servers during authentication and accountin g.
Supported Standard and Extended Attributes 653 Service- Type 5 No Yes Yes Access type, which ca n be one of the following: 2—Framed; for network user access 6—Administrative; for administrative access to the WX switch, with authorization to access the enabled (configuration) mode.
654 C HAPTER C: S UPPORTED RADIUS A TTRIB UTES Filter-Id 11 Yes No Optional If configured in the WX switch’s local database, this attribute can be an access control list (ACL) to filter outbound or inbound traffic. Use the following format: filter -id inboundacl .
Supported Standard and Extended Attributes 655 Reply- Message 18 Yes No No String. Text that can be displayed to the user. Multiple Reply-Messages can be included. If any are displayed, they must appear in the order in which they ap pear in the packet.
656 C HAPTER C: S UPPORTED RADIUS A TTRIB UTES Called- Station-Id 30 No Yes Yes For IEEE 802.1X authenticators, stores the MAP MAC address in uppercase ASCII format, with octet values separated by hyphens (for example, 00-10-A4-23-19-C0). Calling- Station-Id 31 No Yes Yes For IEEE 802.
Supported Standard and Extended Attributes 657 Acct-Output- Octets 43 No No Yes Number of octets sent on the port in the course of this service being provided. Can be pr esent only in Accounting-Request records in which Acct-Status-Type is set to Acct-Stop or Acct-Interim-Update.
658 C HAPTER C: S UPPORTED RADIUS A TTRIB UTES Acct-Output- Packets 48 No No Yes Number of packets sent in the course of this service being provided. Can be present only in Accounting-Request records in which Acct-Status-Type is set to Acct-Stop or Acct-Interim-Update.
3Com Vendor-Specific Attributes 65 9 3Com V endor -Specific Attributes The vendor - specific attributes (VSA s) cr eated by 3Com are embedded according to the pr ocedure r ecommended in RFC 2865, with V endor -ID set to 43. T a ble 56 describes the 3Com VSAs, listed in or der by vendor type number .
660 C HAPTER C: S UPPORTED RADIUS A TTRIB UTES SSID 26, 43, 6 Yes No Yes Name of the SSID you want the user to use. The SSID must be configured in a service profile, and the service profile must be used by a radio profile assigned to 3Com radios in the Mobility Domain.
D T RAF FIC P ORTS U SED BY MSS When deploying a 3Com wireless network, you might attach 3Com equipment to subnets that have fi rewalls or access controls betwe en them.
662 C HAPTER D: T RAFFIC P ORTS U SED BY MSS Roaming traffic uses IP tunnels, en capsulated with IP protocol 4. T o list the TCP p ort numbers in use on a WX, including those for t he other end of a connection, use the display tcp command. IP/UDP (17) 5000 WX-MAP communication.
E DHCP S ERVER MSS has a DHCP serv er that the switch uses to al locate IP addr esses to the following: Directly connected MAPs Host connected to a new (unconfigured) WXR100, to configur e the switch using the W eb Quick Start DHCP service for these items is enabled by default.
664 C HAPTER E: DHCP S ER VER The MSS DHCP server is configur ab le on an individual VLAN basis only , and operates only on the subnets for which you configure it. Use of the MSS DHCP ser ver to allocate client addresses is intended for temporary , demonstration deployment s and not for production networks.
Configuring the DHCP Server 665 Option 3—Default Router . If this option is not set with the set interface dhcp-server command’ s default-router option, the MSS DHCP server can use the value set by the set ip route command. A default route configured by set ip r oute can be used if the route is in the DHCP client’ s subnet.
666 C HAPTER E: DHCP S ER VER Displaying DHCP Server Information T o display information about the MS S DHCP server , use the following command: display dhcp-server [ interface vlan-id ] [ verbose ] If you enter the command without the interface or verbose option, the command displays a table of all the IP addr esses leased by the server .
F O BTAINING S UPPORT FOR Y OUR 3C OM P R ODUCTS 3Com offers pr oduct r egistration, ca se management, and repair services through eSupport.3com.com . Y ou must have a user name and password to access these services, which ar e described in this appendix.
668 A PPENDIX F: O BTAINING S UPPORT FO R Y OUR 3C OM P RODUCTS Purchase Extended W arranty and Professional Services T o enhance r espon se times or extend you r warranty benefits, y ou can purchase value-added services such as 24x7 telephone technical support, software upgrades, onsite assistance, or advanced hardware replacement.
Contact Us 669 T elephone T echnical Support and Repair T o obtain telephone support as part of your warranty and other service benefits, you must first register your pr oduct at: http://eSupport.
670 A PPENDIX F: O BTAINING S UPPORT FO R Y OUR 3C OM P RODUCTS From the following countries, call the appropriate number: Austria Belgium Denmark Finland France Germany Hungary Ireland Israel Italy 0.
G LOSSARY 3Com Wir eless Switch Manager™ (3WXM)™ A tool suite for planning, configuring, deploying, and managing a 3Com Mobility System wireless LAN (WLAN).
672 G LOSSARY 802.2 An IEEE LAN specification that de fines the logical link contr ol (LLC) sublayer , the upper portion of the Data Link layer . LLC encapsulation can be used by any lower -layer LAN technology .
G LOSSARY 673 802.11g A supplement to the IEEE 802.11 wi reless LAN (WLAN) specification, describing transmission through th e Physical layer (P HY) based on orthogonal frequency division multip lexing (OFDM), at a frequency of 2.4 GHz and data rates of up to 54 Mbps.
674 G LOSSARY ad hoc network One of two IEEE 802.11 network framewo rks. In an ad hoc network, a set of wir eless stations communicate dire ctly with one another without using an access point (AP) o r any connection to a wir ed network.
G LOSSARY 675 authentication, authorization, and accounting See AAA . authentica tion mobility The ability of a user (client) authenticated via Extensible Au thentication Protocol (EAP) — plus an ap.
676 G LOSSARY BSSID Basic service set identifier . The 48-bit media access contr ol (MAC ) address of the radio in the access point (AP) that serv es the stations in a basic service set (BSS). CA See certificate authority (CA) . CBC-MAC See CCMP . CCI Co-channel interference.
G LOSSARY 677 CHAP Challenge Handshake Authenticati on Protocol. An authentication protocol that defines a thr ee-way handshake to authenticate a user (client). CHAP uses the MD5 hash algorithm to generate a response to a challenge that can be checked by the authenticator .
678 G LOSSARY cryptography The science of information security . Moder n cryptography is typically concerned with the pr ocesses of scrambling or dinary text (known as plain text or clear text ) into encrypted text at the sender’ s end of a connection, and decrypting the encryp ted text back into clear text at the re ceiver’ s end.
G LOSSARY 679 DES Data Encryption Stand ar d. A federa lly approved sy mmetric encryption algorithm in use for many years and replaced by the Advanced Encryption S tandar d (AES). See also 3DES . DHCP Dynamic Host Configuration Protocol. A protocol that dynamically assigns IP addresses to stations, fr om a centralized server .
680 G LOSSARY domain policy A collect ion of configuration settings that you can define once in 3Com Wi r eless Switch Manager (3WXM) and apply to many W ireless Switches (WXs). Each Mobility Domain group in the network has a default domain policy that applies to every WX switch in the Mobility Domain.
G LOSSARY 681 EAP Extensible Authentication Pr otocol . A general point-to-point protocol that supports multiple au thentication mechanisms. Defined in RFC 2284, EAP has been adopted by IEEE 802.1X in an encapsulated form for carrying authentication messages in a standard message exchange between a user (clie nt) and an authenticator .
682 G LOSSARY enabled access Permission to use all Mobility Syst em Software (MSS) command-line interface (CLI) commands requir ed for configuration and troubleshooting. Enabled access requ ires a separate enable passwor d. Compare restricted access .
G LOSSARY 683 FDB See forwarding d atabase (FDB) . Federal Communications Commission See FCC . FHSS Frequency-hopping spread-spectrum. One of two types of spread-spectrum radio technology used in wireless LAN (WLAN) transmissions.
684 G LOSSARY GMK Group master key . A cryptograp hic key used to derive a group transient key (GTK) for the T empor al Key Integrity Pr otocol (TKIP) and Advanced Encryption Stan dar d (AES). green field network An original deployment of a telecomm unicatio ns networ k.
G LOSSARY 685 Hewlett-Packard Open View See HPOV . homologation The process of certifying a product or specification to verify that it meets regulatory standar ds. HPOV Hewlett-Packard Open View . The umbrella network management system (NMS) family of products fr om Hewlett-Packard.
686 G LOSSARY IGMP snooping A feature that pr events the flow of m ulticast stream pac kets within a virtual LAN (VLAN) and forwards the multicast traf fic thr ough a path to only the clients that want to receiv e it.
G LOSSARY 687 Internet Authentication Service See IAS . Internet Group Management Protocol See IGMP . Interswitch Link See ISL . ISL Interswitch Link. A proprietary Ci sco pr otocol for inter connecting multiple switches and maintaining virtual LAN (VLAN) information as traffic travels between switches.
688 G LOSSARY location policy An order ed list of rules that overrides the virtual LAN (VLAN) assignment and security ACL filtering applied to users during normal authentication, authorization, and accounting (AAA) — or assigns a VLAN or security ACL to users wi thout these assignments.
G LOSSARY 689 Managed Access Point™ (MAP™) A small hardwar e unit that functions as a wireless access point (AP) in a 3Com Mobility System. Using one or more radio transmitters, a MAP transmits and receives information as radio f re quency (RF) signals to and from a wir eless user (client).
690 G LOSSARY message integrity code See MIC . MIC Message integrity code. The IEEE term for a message authentication code (MAC). See MAC . Microsoft Challenge Handshake Authentication Protocol See MS-CHAP-V2 . minimum data transmit rate The lowest rate at which a Mana ge d Access Point (MAP) can transmit data to its associated mobile clients.
G LOSSARY 691 MSDU MAC service data unit. In IEEE 802.11 communications, the data payload encapsulated within a MAC protocol data unit (MPDU). MSS See Mobility System Software™ (MSS™) . MTU Maximum transmission unit . The size of the l argest packet that can be transmitted over a particular medium.
692 G LOSSARY PEAP Protected Extensible Authentication Protocol. A draft extension to the Extensible Authentication Protocol with T ransport Layer Security (EAP-TLS), developed by Micr osoft C orporation, C isco Systems, a nd RSA Data Security , Inc.
G LOSSARY 693 The PKI uses the digital certificate to identify an individual or an organization. The private key is given only to the requesting party and is never shared, and the public key is made publicly available (as part of the digital certificate) in a directory tha t all parties ca n access.
694 G LOSSARY pre-master secr et A key generated during th e handshake pr ocess in T ransport Layer Security (TLS) protocol negotiatio ns and used to derive a master secret. preshar ed key See PSK . PRF Pseudorandom function. A functi on that pr oduces effectively unpredictable output.
G LOSSARY 695 PTK Pairwise t ransient key . A value derived from a pairwise master key (PMK) and split into multiple encr yption keys and message integrity code (MIC) keys for use by a client and se rver as temporal session keys for IEEE 802.11i robust security .
696 G LOSSARY RADIUS Remote Authentication Dial-In User Service. A client-server security protocol described in RFC 2865 and RFC 2866. RADIUS extensions , including RADIUS support for the Ex tensible Authentication Protocol (EAP), are described in RFC 2869.
G LOSSARY 697 roa mi ng The ability of a wireless user (clien t) to maintain network access when moving between access points (APs). robust security network See RSN . rogue access point An access point (AP) that is n ot authorized to operate within a wir eless network.
698 G LOSSARY seed (1) An input to a pseudorandom number generator (PRNG), that is generally the combination of two or more inputs. (2) The Wireless Switch (WX) that distributes information to all the WX switches in a Mobility Domain™ group.
G LOSSARY 699 SSL Secure Sockets L ayer protocol. A pr otocol developed by Netscape fo r managing the security of message tr ansmission over t he Internet.
700 G LOSSARY TLS T ransport Layer Security protocol. An authentication and encrypt ion protocol that is the successor to the Secure Sockets Layer (SSL) protocol for private transmission over the Inter net.
G LOSSARY 701 U-NII Unlicensed National Information Infrastructure. Thr ee unlicensed frequency bands of 100 MHz each in the 5 GHz band, designated by the U.S. Federal Communications Commission (FCC) to pr ovide high-speed wireless networking . The three fr equency bands — 5.
702 G LOSSARY VLAN glob A 3Com convention for appl ying the au thenticat ion, aut horizatio n, and accounting (AAA) attributes in the location policy on a WX switch t o one or more users, based on a virtual LAN (VLAN) attribute. T o specify all VLANs, use the double-asterisk (**) wildcard characters.
G LOSSARY 703 WEP Wired-Equivalent Privacy protocol. A sec urity pr otoc ol, specifi ed in the IEEE 802.11 standard, that attempts to pr ovide a wireless LAN (WLAN) with a minimal level of security a nd privacy comparable to a typical wired LAN.
704 G LOSSARY wir eless LAN See WLAN . Wireless Switch™ (WX™) A switch in a 3Com Mobility System. A WX provides forwar ding, queuing, tunneling, and some security services for the info rmation it recei ves from its dir ectly attached Managed Access Points (MAPs).
G LOSSARY 705 X.509 An Inter national T elecommunications Union T e lecommunication Standardization Sector (ITU-T) Recommendation and the most widely used standard for defining digital certificates.
706 G LOSSARY.
I NDEX Numbers 3Com Knowledgebase tool 667 3Com Professional Services 668 3Com resour ces, directory 669 3Com T e chnical Support 645 3WXM keys and certificates requirement 413 802.
708 I NDEX sessions, clearing 55 7 sessions, displaying 557 T elnet client sessions, disp laying and clearing 559 T elnet sessions, disp laying and clearing 559 AeroScout RFID tag support 323 affinity.
I NDEX 709 Calling-Station-Id attribute 656 case in user names and passwords 58 Catalyst sw itch, in terope rating with load-sharing port groups 87 CCMP 284 enabling 291, 297 certificate authority cer.
710 I NDEX logging system messages to 627 no authentication 57 passwords 59 sessions, clearing 55 8 sessions, displaying 558 target 624 conventions CLI 27 notice icons, About This G uide 23 text, Abou.
I NDEX 711 enabled mode. See enabled access encrypted SSID 207 encryption affects of authentication methods on 448 assigning a type locally 496 assigning a type on a RADIUS s erver 497 clearing types .
712 I NDEX other -querier -pr esent interval, configuring 37 1 proxy re porting 370 pseudo-querier 370 querier , dis playing 375 query interval 370 query interval, configuring 371 query response inter.
I NDEX 713 defined 499 disabling 503 displaying rules in 502 order of rules in 502 location policy rules clearing 503 configuring 501 defined 500 displaying 502 positioning 502 reassigning security AC.
714 I NDEX monitoring roaming use rs 162 names 154 roaming VLANs in 160 seed 153, 154 status 155 Mobility Points (MAPs) Wi -Fi Multimedia (WMM) 327 Mobility Profile 510, 511 authorization 510 defined 510 Mobility System Software CL I.
I NDEX 715 other -querier -present interval 370 configuring 371 OTP 423, 429 outbound authorization password 459 output filters, reassigning 502 override, local, scenario 64 P packets CoS handling 382.
716 I NDEX STP port cost, configuring 354 STP port cost, displaying 362 STP port priority 353 STP port priority , configuring 355, 356 Te l n e t 117 types. See port types VLANs, configuration scenari o 100 wired, authentication on 532 Power over Ethernet.
I NDEX 717 value characteristics 651 VLAN assignment 88 VSAs 659 RADIUS proxy 482 range operator in security ACLs 385 reauthentication 802.1X client 536 interval 537 number of attempts 537 reauthoriza.
718 I NDEX Network Domain 174 overriding VLAN assignment 516 PEAP-MS-CHAP-V2 configuration 514 PEAP-MS-CHAP-V2 offload aut hentication 515 PEAP-MS-CHAP-V2 with pass-through authentication 516 port and.
I NDEX 719 Simple Network Time Protocol. See NTP (Network Time Protocol) single asterisks (*) in MAC addr ess g lobs 31 in network session informatio n 560 in user glob s 30 in VLAN globs 32 wildcard .
720 I NDEX system logs configuring 625 destinations 623 disabling output to the console 628 displaying the configuration of 630 managing 623 message components 623 severity levels 624 system recovery .
I NDEX 721 incomplete boot load 621 invalid certificate 620 missing configuration 621 MSS debugging via trace 631 MSS logging 623 no network access 621 system trace files for 599 VLAN authorization fa.
722 I NDEX disconnected, troubleshooting 621 display ing 95 mapping security ACLs to 392 overriding assignmen t with the location policy 516 ports, configuration scenario 100 remo ving 93 roaming, dis.
C OMMAND I NDEX B backup system 613, 616 C clear ap 77, 227 clear ap radio 251 clear boot config 612 clear dot1x bonded-period 453 clear dot1x max-req 535 clear dot1x port-control 532 clear dot1x quie.
726 C OMMAND I NDEX clear snmp usm 141 clear snoop 641 clear snoop map 642 clear spantree portcost 354 clear spantree portpri 356 clear spantree portvlancos t 354 clear spantree portvlanpri 356 clear .
C OMMAND I NDEX 727 display security acl map 392, 393 display security l2-restrict 94 display service-profile 259, 294 display service-profile {name | ?} 346 display se ssions admin 115, 117, 558 disp.
728 C OMMAND I NDEX set boot configuration-file 611 set dot1x authcontrol 531 set dot1x bonded-peri od 453 set dot1x key-tx 533 set dot1x max-req 535 set dot1x port-control 532 set dot1x quiet-period .
C OMMAND I NDEX 729 set radio-profile service-profile 249, 295, 298 set radio-profile wmm-powe rsave 342 set radius 522 set radius proxy client 485 set radius proxy port 485 set radius server 523 set .
730 C OMMAND I NDEX set usergroup attr filter-id 494 set vlan name 91 set vlan port 92 set vlan tunnel-affinity 93 set vlan-profile 253 T telnet 132 traceroute 134 U uninstall s oda-agent 554.
Een belangrijk punt na aankoop van elk apparaat 3Com WX2200 3CRWX220095A (of zelfs voordat je het koopt) is om de handleiding te lezen. Dit moeten wij doen vanwege een paar simpele redenen:
Als u nog geen 3Com WX2200 3CRWX220095A heb gekocht dan nu is een goed moment om kennis te maken met de basisgegevens van het product. Eerst kijk dan naar de eerste pagina\'s van de handleiding, die je hierboven vindt. Je moet daar de belangrijkste technische gegevens 3Com WX2200 3CRWX220095A vinden. Op dit manier kan je controleren of het apparaat aan jouw behoeften voldoet. Op de volgende pagina's van de handleiding 3Com WX2200 3CRWX220095A leer je over alle kenmerken van het product en krijg je informatie over de werking. De informatie die je over 3Com WX2200 3CRWX220095A krijgt, zal je zeker helpen om een besluit over de aankoop te nemen.
In een situatie waarin je al een beziter van 3Com WX2200 3CRWX220095A bent, maar toch heb je de instructies niet gelezen, moet je het doen voor de hierboven beschreven redenen. Je zult dan weten of je goed de alle beschikbare functies heb gebruikt, en of je fouten heb gemaakt die het leven van de 3Com WX2200 3CRWX220095A kunnen verkorten.
Maar de belangrijkste taak van de handleiding is om de gebruiker bij het oplossen van problemen te helpen met 3Com WX2200 3CRWX220095A . Bijna altijd, zal je daar het vinden Troubleshooting met de meest voorkomende storingen en defecten #MANUAl# samen met de instructies over hun opplosinge. Zelfs als je zelf niet kan om het probleem op te lossen, zal de instructie je de weg wijzen naar verdere andere procedure, bijv. door contact met de klantenservice of het dichtstbijzijnde servicecentrum.
