Gebruiksaanwijzing /service van het product ecure Wireless Access Bridge van de fabrikant Fortress Technologies
Ga naar pagina of 144
Fortress Security System Secure Wireless Access Bridge User Guide www .fortresstech.com © 2006 Fortress T echnologies.
.
Fortress Bridge i Fortress Secure Wireless Access Bridge 2.6.1 Copyright © 2006 Fortress T echnologies, Inc. All rights reserved. This document con t ains proprie t ary informatio n pr ot ec ted by copyright.
Fortress Bridge ii DISCLAIMED. IN NO EVENT SHALL THE O penSSL PROJECT OR ITS CONTRIBUT ORS BE LIABLE FOR ANY DIRECT , INDIRECT , INCIDENT AL, SPECIAL, EXEMPLARY , OR CONSEQUENTIAL DAMAGES (INCLUDING ,.
Fortress B ridge: Ta ble of Cont ents iii Table of Contents 1 Introduction 1 Fortress Secure Wireless Access Bridge . . . . . . . . . . . . . . . . . . . . .1 Management Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Fortress B ridge: Ta ble of Cont ents iv Installation Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Outdoor Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Connecting the Bridge fo r Preconfiguration .
Fortress B ridge: Ta ble of Cont ents v 802.1X Server and LAN Port Settings . . . . . . . . . . . . . . . . . . . . . . 35 802.1X Authentication Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 LAN Port 802.1X S ettings .
Fortress B ridge: Ta ble of Cont ents vi Trusted Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Adding Trusted Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Editing Trusted Devices .
Fortress B ridge: Ta ble of Cont ents vii Getting Help in the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Command Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Configuration in the Bridge CL I .
Fortress B ridge: Ta ble of Cont ents viii Secure Automatic Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . .105 Preconfiguring a New Network Deployment with SAC . . . . . . . . . . . . . . . . 106 Connecting the Bridges for Preconfigur ation .
Fortress Bridge: Introduction 1 Chapter 1 Introduction 1.1 Fortress Secure Wireless Access Bridge The Fortress Secure Wireless Access Bridge is an all-in-one network access device with the most stringent security available today built in.
Fortress Bridge: Introduction 2 1.1.1.2 Bridge CLI The Bridge’ s command-line interface provides administration and monitoring functions via a comma nd line. It is accessed over the network via the Bridge’ s IP address or through a terminal connected directly to the Bridge’ s serial Console port.
Fortress Bridge: Introduction 3 3) User authentication requires the user of a connecting device to enter a recognize d user name and valid creden- tials, a password, for example , or a digital certificate. The Fortress Security System can authenticate users locally or through existing user-authentica tion provisions.
Fortress Bridge: Introduction 4 1.3.5 Deployment Options The Fortress Security System is flexible and exp andable. Figure 1.1 Example Point-to-Multipoint Deployment of the Fortress Secure Wireless Acc.
Fortress Bridge: Introduction 5 The Bridge can provide a secure edg e for a WLAN (or infrastructure-mode) deployment s, as shown in Figure 1.1 W ARNING: can cause physical in- jury or death to you and/or your equipment.
Fortress Wireless Acce ss Bridge: Installation 6 Chapter 2 Installation 2.1 Introduction NOTE: Only essen- tial configuration settings, as required for basic installation, are covered in this chapter . The full complement of Bridge configuration options is described in the following chapter , Bridge Administration.
Fortress Wireless Acce ss Bridge: Installation 7 2.1.2 Compatibility The Fortress Bridge is fully compatible with F ortress Secure Client versions 2.4 and higher .
Fortress Wireless Acce ss Bridge: Installation 8 2.2.2 Preparing the Network Any Ethernet device—including hubs, switches and access points—directly connected t o the Bridge must have auto- negotiation cap ability (and have the feature enabled), or link and/or packet loss cou ld result.
Fortress Wireless Acce ss Bridge: Installation 9 W ARNING: The Bridge contai ns a 3V (7 y ear) lithi um bat- tery for time-keeping purposes. It is not in- tended to be operator- or user-replaceable . T o avoid risk of personal injury (and v oiding of the Bridge’ s w arranty ), refer all hardw are ser- vicing to Fortress T ech- nical Support.
Fortress Wireless Acce ss Bridge: Installation 10 PoE powered from a remote 802.1 1af (13 W att) PoE midspan source. Circuit Overloading: The Bridge includes a 48 V main resettable fuse specified at 1.8 A. Lightning/Electrostatic Protection: The Bridge’s antenna ports conform to IEC1000-4-5 10 KV 8/20us waveform.
Fortress Wireless Acce ss Bridge: Installation 11 NOTE: The ES520 complies with UL60950-1 sa f e ty s p e ci - fications. It has a UL (NEMA) 3/3S/4 (and IEC60529) environmen- tal rating. The Front- panel Cover Plate of the ES520 W eatherizing Kit includes a “Rainti ght” label.
Fortress Wireless Acce ss Bridge: Installation 12 2.4.1 Connecting the Bridge for Preconfiguration W ARNING: To comply with FCC rules, antennas must be profes sionally installed . Improperly grounded outdoor antennas pose a particularly serious safety hazard .
Fortress Wireless Acce ss Bridge: Installation 13 1 Open a browser application on a compu ter on your LAN and, in the browser address field, enter the Bridge’ s default IP address: 192.168.254.254 . 2 Log on to the Bridge GUI, entering admin as both User ID and Password and then clicking Login .
Fortress Wireless Acce ss Bridge: Installation 14 5 From the main menu, select SECURITY SETTINGS , and on the SECURITY SETTIN GS screen, in the CHANGE ACCESS ID section: In Current Access ID enter 16 zeros or the word default . In New Access ID enter the 16-digit hexade cimal Access ID to be used by the Bridge and it s Secure Clients.
Fortress Wireless Acce ss Bridge: Installation 15 NOTE: If you are deploying multi- ple Fortress Bridges in a point-to-point/ multi- point network they must be correctly con- figured for their net- work roles, typically with one serving as the root node and the rest configured as non-root nodes (refer to Section 2.
Fortress Wireless Acce ss Bridge: Installation 16 NOTE: The Bridge CLI provides ac- cess to some configu- ration settings that cannot be acces sed from the Bridge GUI. 13 After the Bridge reboots, change the CLI p assword (according to the instructions in Section 6.
Fortress Wireless Acce ss Bridge: Installation 17 Slide the compression nut, with the thread ed opening facing toward the connector , over the connector and onto the cable. CAUTION: There are four differ ent possible alig nments be- tween the RJ-45 connec- tor and the connector boot.
Fortress Wireless Acce ss Bridge: Installation 18 2.4.4 Mast Mounting the Bridge The Mast-Mounting Kit accommodates mast s from 1. 5" to 3" in diameter .
Fortress Wireless Acce ss Bridge: Installation 19 omnidirectional or directional antenna. Th e antenna and cable must be waterproof. 4 Connect the Bridge's WAN port to an exte rnal 802.
Fortress Wireless Acce ss Bridge: Installation 20 CAUTION: The FCC requires co- located radio antennas to be at least 7.9" apart. The Bridge’ s antenna connectors are only 5" apart. A void dir ectly mounting two antennas to the Bridge’s r ear-panel connectors .
Fortress Bridge: Configuration 21 Chapter 3 Configuration 3.1 The Bridge GUI The Fortress Wireless Access Bridge’ s graphical user interface provides access to Bridg e administrative functions. Access Bridge GUI help screens by clicking Help , the last link on the main menu.
Fortress Bridge : Configuration 22 The Bridge GUI opens on the Welc om e screen. Configuration settings are accessed through the main menu links on the left of the screen. 3.1.3 Logging Off T o log off the Bridg e GUI, click Logout (below the main menu).
Fortress Bridge : Configuration 23 3.2.1 Spanning Tree Protocol NOTE: Bridging loops can occur on a WLAN only when multiple APs s hare the same ESS (extended ser- vice set). STP is a link management protocol that prevent s bridging loops on the ne twork while providing p ath redundancy .
Fortress Bridge : Configuration 24 NOTE: The IP ad- dress you ass ign m u s t b e u n i q u e o n t h e network. To reconfigure Bridge LAN settings: 1 Log on to the Bridge GUI ad min account and select LAN SETTINGS from the menu on the lef t. 2 On the LAN SETTINGS screen, make your change s to the relevant field(s).
Fortress Bridge : Configuration 25 NOTE: 802.11b de- vices are fully compatible with the 802.11g radio. Radio 1 is the tri-band 802.1 1a/b/g radio, which can be configured as an 802.1 1g or an 802.1 1a radio. Radio 2 always functions as an 802.1 1a radio.
Fortress Bridge : Configuration 26 Non-Root - Radios in Non-Root mode do initiate connect ions with other Fortress Bridges—either directly with a root Bridge or with other non-root Bridge s (as well as receiving connections from other non-root Bridges a nd wireless devices).
Fortress Bridge : Configuration 27 3.3.2.3 Di stance The Distance setting configures the maximum distance—from 1 to 35 miles, in increment s of 1 mile—for which the radio must adjust for the prop agation delay of its transmissions.
Fortress Bridge : Configuration 28 3.3.2.5 Beacon Interval The Bridge’ s radios transmit beacons at re gular intervals to announce their presence on the network. Y ou can configure the number of milliseconds between beaco ns in whole numbers between 25 and 1000 .
Fortress Bridge : Configuration 29 Enabled on the LAN SETTINGS screen. If you d isable STP on a non-root Bridge, the Multicast field for th e radio with a Radio Mode setting of Bridg e and a Bridge Mode setting of Non-Root will be configurable. Refer to Section 3.
Fortress Bridge : Configuration 30 unconfigured V APs for radios in AP radio mode on the V IRTUAL A CCESS P OINT S displa y fram e on th e INTERFACES screen. Y ou can view the settings that assign SSIDs (and associat ed settings) for the radio’ s V APs in the VIRTUAL ACCESS P OINTS frame on the INTERFACES scre en.
Fortress Bridge : Configuration 31 Radio 1 is preconfigured with a default SSID of Base-11g ; the default SSID for Radio 2 is Base-11a . 3.3.4.2 Hide SSID and Accept G Only Options T o the right of th.
Fortress Bridge : Configuration 32 NOTE: Certain Se- curity Suite options require that an 802.1X authentication server be configured for the Bridge. These include: 802.1X and those WP A and WP A2 settings that do not use PSK. Refer to Section 3.4.1. The security protocol(s) employed by th e Bridge’s virtual access point are configured pe r V AP .
Fortress Bridge : Configuration 33 WEP Key T ype - WEP keys can be composed of an ASCII (plaintext) passphr ase or hexadecimal string. Hex is the default.
Fortress Bridge : Configuration 34 WP A and WP A2 generate encryption keys dynamically and exchange keys automatically with co nnected devices at user- specified intervals. This interval is the only additio nal setting required for WP A security . S pecify the interval in seconds in the WP A Rekey Period field.
Fortress Bridge : Configuration 35 3.4 802.1X Server and LAN Port Settings NOTE: The RADI- US server internal to the Bridge cannot be used for 802.1X authen- tication. The Fortress Bridge can be used with an exte rnal 802.1X authentication server and its inte rnal switch ports can be individually configured to allow or block 802.
Fortress Bridge : Configuration 36 2 In the 801.1X AUTHENTICATION SER VER frame: NOTE: The server key you enter here should already be present in the 802.1X au- thentication se rvice con- figuration. In Server Address , enter the IP address of t he network 802.
Fortress Bridge : Configuration 37 NOTE: For security.
Fortress Bridge : Configuration 38 The viewable, default security settings a re shown below . 3.6.1 Operating Mode The Fortress Bridge can be operat ed in either of two modes: Normal (the default) or FIPS .
Fortress Bridge : Configuration 39 If the Bridge fails any self-test o n startup, it is rendered inoperable and must be returned t o the vendor for rep air or replacement.
Fortress Bridge : Configuration 40 Bridge. For information on setting encryption algorithms on Secure Clients, refer to your Fortress Secure Clie nt user guide. To change the Bridge encryption algorithm: 1 Log on to the Bridge GUI ad min account and select SECURITY SETTIN GS from the menu on the lef t.
Fortress Bridge : Configuration 41 on Secure Client s, refer to your Fortress Secure Client user guide. CAUTION: For se- curity reasons, the Access ID in effect on the Bridge cannot be displayed. Make a note of the new Access ID: you will need it to configure the Bridge’ s Secure Cli- ents, as well as to change the Access ID on the Bridge.
Fortress Bridge : Configuration 42 selected and, in the case of device authenticatio n, when it has been globally enabled in the AUTHENTICATION SETTINGS frame of the SECURITY SETTINGS screen. The se screens are described in Section 4.1 (Device Authentication) and Section 4 .
Fortress Bridge : Configuration 43 The default Auth Server Key is fortress , which yo u can optionally change. Selecting Local authentication enables the screens and fields that configure local authent ication settings for both users and devices. NOTE: The Bridge has not been test- ed with, and may not fully support, other common RADIUS serv- ers.
Fortress Bridge : Configuration 44 3.6.6.4 Enabling/Disabling Device Auth entication On a Fortress Bridge configured for Local au thentication, the settings in the AUTHENTICATION OPTIONS section o f t.
Fortress Bridge : Configuration 45 To configure maximum authentication attempts: 1 Log on to the Bridge GUI ad min account and select SECURITY SETTIN GS from the menu on the lef t. 2 In the AUTHENTICATION SETTINGS frame, in the Auth Mode field, ensure that Local authentication is enabled.
Fortress Bridge : Configuration 46 To enable/disable user session timeout login prompts : 1 Log on to the Bridge GUI ad min account and select SECURITY SETTIN GS from the menu on the lef t. 2 In the AUTHENTICATION SETTINGS frame: Check the box for Rest art Session Login Prompt to enable user session timeout promp ts (the default).
Fortress Bridge : Configuration 47 To configure the default user authentication and device state for authenticating devices: 1 Log on to the Bridge GUI ad min account and select SECURITY SETTIN GS from the menu on the lef t.
Fortress Bridge : Configuration 48 To enable/disable blackout mode: 1 Log on to the Bridge GUI admi n account and select SYSTEM OPTIONS from the menu on the lef t. 2 Under BLACKOUT MODE , in the Sta t u s field choose to Enable BLACKOUT MODE (turn the L EDs off) or Disable B LACKOUT MODE (turn the LEDs on).
Fortress Bridge : Configuration 49 3.10 Front-Panel Operation The Fortress Bridge front p anel is equipped with three, recessed buttons: two switches (labeled SW1 and SW2 ) and a Reset button. 3.10.1 Mode Selection from the Front Panel NOTE: Refer to Section 3.
Fortress Bridge : Configuration 50 indicated by the Stat2 LED, which flashes rapidly (gre en) when the new mode is selected . If you accidentally cycle p ast the Bridge Mode setting, continue pushing SW2 until Stat2 again begins flash ing. 3 When Stat2 is flashing, press SW1 and hold it down for two seconds to save the new Bridge Mode setting.
Fortress Bridge : Configuration 51 3.10.2 Rebooting the Bridge from the Front Panel T o reboot the Fortress Bridge from the front-p anel: NOTE: There are no LED indica- tions in a Bridge in blackout mode (refer to Section 3.
Fortress Bridge: Administration 52 Chapter 4 Administration 4.1 Device Authentication NOTE: The Bridge supports 802.1X authentication through separate and unrelated configuration settings. These are described in 802.1X Security (for wireless devices) and in Section 3.
Fortress Bridge: Admini str ation 53 authenticate on the network. (Refer to Se ction 3.6.6.5 for detailed instructions.) If a device exceeds the maximum allowable retry attempt s to connect to the Bridge-secured network, that de vice will be locked out until the device’ s Sta t e is set to Allow .
Fortress Bridge: Admini str ation 54 Access user configurable settings for an authenticating device by clicking its Edit button under AUTHORIZED DEVICES (Section 4.1.2.1). Configurable settings include: Device Name - accepts up to 64 alphanumeric characters by which you can identify the device.
Fortress Bridge: Admini str ation 55 2 On the DEVICE AUT HENTICATION screen, click the Edit button of the device for which y ou want to change settings. 3 In the EDIT DEVICE frame (above the device list) where the device’ s current settings are displayed, enter new values into the relevant fields (described in Section 4.
Fortress Bridge: Admini str ation 56 on the AUTHENTI CATION SETTINGS frame of the SECURITY SETTINGS screen. On a Fortress Bridge-secured network, user authentication can be used by itself or combined with device authentication.
Fortress Bridge: Admini str ation 57 NOTE: In point-to- point/multipoint deployments, Fortress recommends that you disable the Restart S es- sion Login Prompt for us- ers on all non-root Bridges on the network, so that, when users’ ses- sions time out, they are prompted for their cre- dentials by only the root Bridge.
Fortress Bridge: Admini str ation 58 2 On the USER AUTHENTICATION screen, click the Edit button of the user for which you want to change settin gs. 3 In the EDIT USER frame (above USER AC COUNTS ) where the account’ s current settings are displayed, enter new values into the relevant fields (described in Section 4.
Fortress Bridge: Admini str ation 59 4.3 Trusted Devices Some wireless devices—IP phones, digit al scales or printers, and APs, for example—are not equipped to run additional software such as the F ortress Secure Client.
Fortress Bridge: Admini str ation 60 The section of the frame under MANAGED TRUSTED DEVICES shows the T rusted Device you added, with the settings yo u specified. 4.3.1 Editing Trusted Devices Y ou can edit the IP and MAC addr esses of a n existing T rusted Device and change it s port settings, but you cannot ch ange its TD Identifier .
Fortress Bridge: Admini str ation 61 4.3.2 Deleting Trusted Devices Y ou can delete T rusted Devices one at a time, or by selecting multiple devices for deleti on. 1 Log on to the Bridge GUI ad min account and choose TRUSTED DEVICES from the menu on the lef t.
Fortress Bridge: Admini str ation 62 4.4.1 Configuring SNMP 1 Log on to the Bridge GUI ad min account and choose SNMP SETTINGS from the menu on the lef t. 2 In the SNMP OPTIONS frame, enter valid values into the relevant fields (described above). 3 Click Apply .
Fortress Bridge: Admini str ation 63 Table 4.1. User Configured Se ttings Backed Up for the Bridge function setting network STP enable/ disable W AN port encrypte d/un encrypted rad i o s radio state enable/disable radio band (Radio 1) 802.
Fortress Bridge: Admini str ation 64 4.5.1 Backing Up the Bridge Configuration 1 Log on to the Bridge GUI ad min account and choose SYSTEM OPTIONS from the menu on the left. NOTE: If y ou choose to pass- word- prot ect th e ba ck- up file, remember that the password will be re- quired in order to re- store from the file.
Fortress Bridge: Admini str ation 65 4.6 Software Versions and Upgrades Fortress T echnologies regularly re leases updated versions of the Bridge sof tware that add new features, improve functionality and/or fix known bugs.
Fortress Bridge: Admini str ation 66 Click Apply (or Cancel the operation). 4 Click OK on the system confirmation dialog. The frame displays Uploading file... (with crawling dot s to indicate system activity), then changes to the Performing upgrade.
Fortress Bridge: Admini str ation 67 4.7 Rebooting the Bridge The reboot option power cycles the Bridge , ending all sessions and forcing Secure Client devices (and any other Fortress Bridges) in communication with the Bridge to re-key in order to start a new session.
Fortress Bridge: Monitoring and Diagnostics 68 Chapter 5 Monitoring and Diagnostics 5.1 Statistics The statistics scree n displays statistics for overa ll encrypted- zone traffic, each of the Bridge.
Fortress Brid ge: Monitor ing and Diag nostics 69 5.1.1 Traffic Statistics The packet s that the Fortress Bridge has transmitted to a nd received from the encrypted zone since cryptographic processing.
Fortress Brid ge: Monitor ing and Diag nostics 70 BYTES - the tot al number of bytes received/t ransmitted on the interface PAC KE TS - the total number of packet s received/transmitted on the interface ERRORS - the tot al number of receive/transmit errors reported on the interface 5.
Fortress Brid ge: Monitor ing and Diag nostics 71 Idle Since - the number of hours, minutes and seconds since the device was last active on the network.
Fortress Brid ge: Monitor ing and Diag nostics 72 Each device entry on the TRACKING screen is preceded by a checkbox that, when checked, reset s the network session of that device when Reset Checked Sessions (at the bottom of the screen) is clicked. 5.
Fortress Brid ge: Monitor ing and Diag nostics 73 Channel - identifies the channel, by number , over which the Bridge and the associated device are communicating, a s selected for the radio being used (Section 3.
Fortress Brid ge: Monitor ing and Diag nostics 74 when Secure Client s contact and negotiate keys with the Fortress Bridge system configuration changes when cryptographic processing is res.
Fortress Brid ge: Monitor ing and Diag nostics 75 5.5 Diagnostics NOTE: Radio 1 uses antenna port 1 ( ANT1 ) ; Radio 2 uses antenna port 2 ( ANT2 ) . Access Fortress Bridge diagnostic utilities by logging into the Bridge GUI admin account and selecting DIA GNOSTICS from the menu on the left.
Fortress Brid ge: Monitor ing and Diag nostics 76 5.5.3 Flushing the Host MAC Database The Fortress Bridge maintains a database of the MAC addresses of devices in the unencrypted zo ne. Y ou can flush the HOST MAC DAT ABASE : 1 Log on to the Bridge GUI admin account and choose DIAGNOSTICS from the menu on the lef t.
Fortress Brid ge: Monitor ing and Diag nostics 77 5.6 Front-Panel Indicators NOTE: There are no LED indica- tions in a Bridge in blackout mode (refer to.
Fortress Brid ge: Monitor ing and Diag nostics 78 Stat2 can exhibit: solid green - The Bridge is operating in root mode. off - The Bridge is operating in non-root mode . Clr can exhibit: fast green flash - The Bridge is p assing cleartext (unencrypted dat a) in the encrypted zone.
Fortress Brid ge: Monitor ing and Diag nostics 79 Both upper and lower LEDs can exhibit: off - The associated radio is disabled (in the Bridge GUI or CLI). All four Radio LEDs can exhibit: solid amber - A firmware error has occurred. off - Both radios are disabled (in the Bridge GUI or CLI).
Fortress Bridge: Comma nd-Line Interface 80 Chapter 6 Command-Line Interface 6.1 Introduction NOTE: Fortre ss Bridge features and functions are de- scribed in greater detail in the precedi ng chap- ters describing the use of the Bridge GUI. The Fortress Bridge CLI provide s commands for managing the Fortress Bridge and the network it secures.
Fortress Bridge: Command- Line Interface 81 6.1.1 CLI Administrative Modes There are two administrative modes in the Bridge CLI. NOTE: Bridge CL I help output shows only those commands and argume nts that a re va lid in the current ad- ministr ative mode (ref er to Section 6.
Fortress Bridge: Command- Line Interface 82 WSG login: sysadm NOTE: The default CLI password is sysadm . P asswords should never be left at their defaults. Password: <password> Fortress Wireless Security G ateway [GW]> The login ID, sysadm , cannot be changed.
Fortress Bridge: Command- Line Interface 83 Note that only those optio ns available in the current administrative mode are d isplayed and that valid command options dif fer significantly between modes. [AP]> show Description: Displays Access Point information, configuration Usage: show [args].
Fortress Bridge: Command- Line Interface 84 Switch refers to the identifier , preceded by a dash (hyphen), for the argument to follow (ex., -ip , -n , etc.
Fortress Bridge: Command- Line Interface 85 The CLI displays the configurable fields for set network one at a time. Enter a new value for the field—or leave the field blank and the setting unchanged—and strike Enter ↵ , to displa y the next field.
Fortress Bridge: Command- Line Interface 86 [AP]> show radio [RADIO 1] Radio State: On Radio Band: 802.11g Radio Mode: AP Channel: 1 Tx Power: Auto Distance: 1 Beacon Interval: 100 Preamble: Short Multicast: On RSSI Monitor: Off [RADIO 2] State: On Radio Band: 802.
Fortress Bridge: Command- Line Interface 87 [AP]> set radio 1 Radio state [on|off] (on): Radio band [802.11g|802.11a] (802.11g): 802.11a [OK] Reboot is required when chan ging radio band Radio Mode [ap|bridge|ids] ( ap): bridge [OK] Bridge Mode [root|nonroot] ( nonroot): nonroot Radio is in nonroot mode.
Fortress Bridge: Command- Line Interface 88 The sample output for the show radio command (at the beginning of this section) shows the default radio se ttings. As shown in the example interactive se t radio output, reconfiguring radio settings requi res that you reboot the Bridge in order to eff ect your changes.
Fortress Bridge: Command- Line Interface 89 By default a single virt ual access point ( vap 1 ) is configured for each radio. The SSIDs associated with t hese two primary V APs should never be left at their defau lts (shown above). SSID strings can be up to 32 characters long.
Fortress Bridge: Command- Line Interface 90 [VAP]> set vap {1|2| 3|4} [-ssid <ssidstring> |.] [-dtim 1-2 55] [-hidessi d on|off] [-rts 1–2345|off ] [-frag 256–2345|of f] [-only11g on|off].
Fortress Bridge: Command- Line Interface 91 6.4.4.1 Changing Bridge GUI Passwords in the CLI NOTE: Pa s s wo r d s should be a mini- mum of eight charac- ters long and contain a mix of upper and lower- case letters and numer- als.
Fortress Bridge: Command- Line Interface 92 View the en cryption algorithm (and the re-keying interval) in effect on the Bridge with show crypto : [GW]> show crypto CryptoEngine:AES256 ReKeyInterval:4 The show crypto command is valid only in GW (gate way) mode (refer to Section 6.
Fortress Bridge: Command- Line Interface 93 6.4.5.4 Access ID in the CLI The Access ID is a 16-digit he xadecimal ID that provides network authentication for the For tress Security System. All of the Bridge’ s Secure Clients must be configured to use the same Access ID as the Bridge.
Fortress Bridge: Command- Line Interface 94 CAUTION: If you wa nt to be able to access the Bridge CLI af- ter outdoor installation, you must enable SSH (secur e shell) d uring pre-configuration of the Bridge. 6.4.5.7 SSH Access to the CLI Secure Shell (SSH) is disabled on the Fortress Bridge b y default.
Fortress Bridge: Command- Line Interface 95 6.4.6 System Date and Time in the CLI View Bridge date and time settings with the show clock command: [GW] > show clock Wkday Month DAY HR:MIN:SEC TimeZo.
Fortress Bridge: Command- Line Interface 96 Configure the Bridge interactively to authen ticate users through an external RADIUS server with set auth , as follows: [GW]> set auth ext ernal IPserver: 123.45.67.89 [OK] set Server IP AuthKey: s3cr4ts5r6v7r k8y [OK] set Authentication Key The default RADIUS shared key is fortress .
Fortress Bridge: Command- Line Interface 97 6.4.9 802.1X Authentication Settings in the CLI 6.4.9.1 802.1X Authentication Server Set tings Support for 802.1X authentication on the Fo rtress Bridge, whether for wired or wireless devices, requires the use of an external 802.
Fortress Bridge: Command- Line Interface 98 In GW mode, use the show command with the 8021X argument to view the server settings: [GW]> show 8021X Lan1:off Lan2:off Lan3:off Lan4:off Lan5:off Lan6:off Lan7:off Lan8:off AuthServer:127.0.0.1 AuthPort:1812 The last two lines of output display the current 80 2.
Fortress Bridge: Command- Line Interface 99 6.4.9.2 Internal LAN Switch Port 8 02 .1 X Settings Y ou can individually configure eac h of the ports of the Bridge’ s internal LAN switch to require that a connecte d device is an 802.1X supplicant successfully authe nticated by the 802.
Fortress Bridge: Command- Line Interface 100 The commands that configure and delete T rusted Devices are valid only in GW (gateway) mode (refer t o Section 6.1.1 for more detail). NOTE: Tr u s t e d D e - vices must be as- signed static IP addresses. 6.
Fortress Bridge: Command- Line Interface 101 [GW]> set snmp -c <contact@domain.com> -l <locationName> -ro <roCmntyName> -rw <rwCmntyName> Set Contact:OK Set Location:OK Set .
Fortress Bridge: Command- Line Interface 102 [GW]> show device Hostname:Fswab DeviceID:4389C1B376B1AFDD CryptoEngine:AES256 IP(Private):172.24.1.27 Ssh:Off Gui:On Auth:Off Fips:On The show device command is valid only in GW (gate way) mode (refer to Section 6.
Fortress Bridge: Command- Line Interface 103 Hosts (labeled Client ) are numbere d in the order they were added to the dat abase, following the Bridge’ s internal interfaces, and are listed by their MAC addresses. Below th e list, a count of the entries in the database is given.
Fortress Bridge: Command- Line Interface 104 6.6.7 Pinging a Device Y ou can ping devices from the Bridge’ s CLI. The Bridge pings three times and then displays the ping st atistics. [GW]> ping 123.45.6 .78 PING 123.45.6.78 (1 23.45.6.78) from 123.
Fortress Bridge: Command- Line Interface 105 [AP]> wlan wlanconfig -h usage: wlanconfig wlanX crea te wlandev wifiX wlanmode [sta|ad hoc|ap|monitor] [bssid | -bssid] [nosbeacon] usage: wlanconfig w.
Fortress Bridge: Command- Line Interface 106 6.8.1 Preconfiguring a New Network Deployment with SAC All of the Bridges to be in clu ded in the new networ k must be at their factory-default settings. (Section 6.4.7 describes restoring the Bridge’ s default settings from the Bridge CLI; Section 3.
Fortress Bridge: Command- Line Interface 107 Allow all of the Bridges to boot before pro ceeding with SAC: front-panel Sta t1 and Stat2 LEDs and the lower L EDs for both radios light solid green, while t he upper LEDs for both radios and the W AN port link/activity ( Lnk/Act ) LED flash green intermittently .
Fortress Bridge: Command- Line Interface 108 Bridges. Alternatively , you can specify on ly a subnet and allow SAC to automatically generate all member IP addresses within that subnet, including th at of the root/ master Bridge. The IP or subnet a ddress you en ter must fall within o ne of these reserved ranges: 10.
Fortress Bridge: Command- Line Interface 109 [GW]> set sac stop SAC Stop Initiated. May take some time to comple te... Stopped SAC process successfully Reboot_Of_Master(Sr lNum:24656196)_Required_F.
Fortress Bridge: Command- Line Interface 110 Similarly , the encryption algorithm and re-key interval in effect on the network can be viewed with show crypto (sections 6.4.5.1 and 6.4.5.2, respectively). The Access ID cannot be displayed for security purp oses (but it must match across all network Bridges).
Fortress Bridge: Command- Line Interface 111 SeriallNum|IpAddres s|CfgID|PeerNum|PeerSACStatus |PeerSACState|PeerSACVer 24773196|172.24.0.4 |19082|2|SAC_PEER_CONFIRMED| S AC_COMPLETE_4PEER |SAC_VER_PEGASUS_A RCH1 24743196|172.
Fortress Bridge: Command- Line Interface 112 [GW]> show sac SwabSerialNum:24743196 SwabConfigID:0 SwabSACRole:SAC_SLAVE SwabSACState:SAC_INIT4SWAB SwabSACVer:SAC_VER_PEGASUS_A RCH1 10 Log off the new Bridge’s CLI and disconnect the Console port cable.
Fortress Bridge: Command- Line Interface 113 16 Disconnect the W AN ports of the new and master Bridges. 17 Power cycle the new Bridge. The new Bridge is ready to be deployed on th e network.
Fortress Brid ge: Fortre ss Security System Overv iew 114 Chapter 7 Specifications 7.1 Hardware Specifications 7.1.1 Performance 7.1.2 Physical 7.1.3 Environmental unencrypted throughpu t: up to 23 Mbps encrypted throughput: up to 10 Mbps form factor: compact, rugged desktop chassis dimensions: 2.
Fortress Bridge: Fortress Security Syst em Overview 115 7.1.4 Compliance 7.1.5 Logical Interfaces The physical connections described in Sectio n 7.1.2 are identified as logical interfaces, as de fined by FIPS 140-2, in the table below: 7.
Fortress Bridge: Fortress Security Syst em Overview 116 the wide side up, pins are numbered from right to left, top to bottom. Figure 7.1 RJ-45 and DB9 Pin Numbering T able 7.
Fortress Bridge: Troub leshooting 117 Chapter 8 Troubleshooting Problem Solution You are unable to access the Bridge GUI. V erify th e Brid ge ’s physical connec tion : • from an Etherne t port on a computer or a n etwo rk switch to o ne of the Bridge’ s unencrypted intern al LAN ports.
Fortress Bridge: Tr oubleshooting 118 The Bridge is not allowing traffic to pass. V erify th e Brid ge ’s physical connec tion s: • from the Bridge’ s Unencrypted port to the LAN.
Fortress Bridge: Index 119 Numerics 802.11a/b/g see radio sett ings, rad io band; radios 802.1X authentication 33 , 35 – 36 for wired devices in Bridge CLI 99 in Bridge GUI 36 for wireless devices i.
Fortress Bridge: Index 120 Bridge CLI 80 – 105 about command 101 accessing 81 SSH 39 , 81 , 94 troublesho oting 117 add/del sp commands 112 , 113 add/del td commands 100 ap command 81 , 88 clear vap.
Fortress Bridge: Index 121 C cabling see ports, connections channel settings 26 configuring in Bridge CLI 86 – 88 in Bridge GUI 29 with SAC 106 – 111 defaults 26 clock see system date and time; Br.
Fortress Bridge: Index 122 encrypted zone Device IDs 70 IP addresses 70 MAC addresses 70 tracking ses sions 70 – 72 WAN port configurat ion 23 encryption algorithm 3 , 39 – 40 configuring in Bridg.
Fortress Bridge: Index 123 L LAN settings configuring at installation 13 in Bridge CLI 84 – 85 in Bridge GUI 22 – 24 with SAC 106 – 111 default IP address 13 , 21 , 84 LAN switch ( internal) 6 ,.
Fortress Bridge: Index 124 operator account see Bridge GUI, operator account outdoor installation 11 – 19 mast mounting 18 preconfiguration 12 – 16 requirements ii , 8 – 11 , 18 siting 9 weather.
Fortress Bridge: Index 125 S SAC see Secure Auto matic Configuration safety compliance 115 requirements 1 , 8 – 11 , 12 , 17 , 18 see also specifications Secure Automati c Configuration 105 – 113 .
Fortress Bridge: Index 126 T traceroute in Bridge CLI 104 in Bridge GUI 75 traffic statistics 68 – 69 see also interf ace statisti cs transmit power settings 26 troubleshooting 117 – 118 see also .
Fortress Bridge: Index 127 weatherizi ng 10 , 16 – 17 cover plate 17 requirements 8 – 11 , 18 RJ-45 connector bo ot 16 – 17 Weatherizing Kit 7 installation 16 – 17 WEP 32 – 33 WLAN command l.
Fortress : Glos sa ry 128 Glossary 3DES T riple Data Encryption Standard—a FIPS-app rov ed NIST standard for data encryption using 192-bits (168-bit en cryption, 24 p arit y bits) f or pr otecting se nsitive (unclassified) U.S. go vernment (and related) data.
129 Fortress : Glos sa ry Bridge GUI The browser -based graphical user interf ace through whi ch the Fortress Secu re Wirele ss Access Bridge is configured and managed, locally or remotely . CCITT Comite Consultatif Internationale de T elegr aphie et T elephonie, former name of the ITU- T .
130 Fortress : Glos sa ry failover A device or system configur ation in which two, identical comp onents ar e installe d f o r a given function so that if one of them f ail s the redundant component can carry on oper- ations without any substantia l interruption of service.
131 Fortress : Glos sa ry groups An association of network ob jects (users, devi ces, etc. ). Groups are typically used to allocate shared resources and apply a ccess policies. GUI Graphical User In terface guest In For tress T echnologies, a guest user as configured in MaPS.
132 Fortress : Glos sa ry MaPS Consol e In Fortress’s MaPS, a Java-based, configurat ion client interface for the F ortress M anage- ment and P olicy Server , through which all MaPS function s are accessed.
133 Fortress : Glos sa ry RSA SecurID® An authentication method crea ted and owned by RSA S ecurity . RADIUS Remote Authentication Dial-I n User Servic e—an authentication server design that issues.
134 Fortress : Glos sa ry UDP User Datagram Protocol—defines a method for “best eff ort” delivery of data packets over a network that, like T CP , runs on top of IP b u t, u nl i ke TC P , does not guarantee the order of delivery or provide integrity checking.
Een belangrijk punt na aankoop van elk apparaat Fortress Technologies ecure Wireless Access Bridge (of zelfs voordat je het koopt) is om de handleiding te lezen. Dit moeten wij doen vanwege een paar simpele redenen:
Als u nog geen Fortress Technologies ecure Wireless Access Bridge heb gekocht dan nu is een goed moment om kennis te maken met de basisgegevens van het product. Eerst kijk dan naar de eerste pagina\'s van de handleiding, die je hierboven vindt. Je moet daar de belangrijkste technische gegevens Fortress Technologies ecure Wireless Access Bridge vinden. Op dit manier kan je controleren of het apparaat aan jouw behoeften voldoet. Op de volgende pagina's van de handleiding Fortress Technologies ecure Wireless Access Bridge leer je over alle kenmerken van het product en krijg je informatie over de werking. De informatie die je over Fortress Technologies ecure Wireless Access Bridge krijgt, zal je zeker helpen om een besluit over de aankoop te nemen.
In een situatie waarin je al een beziter van Fortress Technologies ecure Wireless Access Bridge bent, maar toch heb je de instructies niet gelezen, moet je het doen voor de hierboven beschreven redenen. Je zult dan weten of je goed de alle beschikbare functies heb gebruikt, en of je fouten heb gemaakt die het leven van de Fortress Technologies ecure Wireless Access Bridge kunnen verkorten.
Maar de belangrijkste taak van de handleiding is om de gebruiker bij het oplossen van problemen te helpen met Fortress Technologies ecure Wireless Access Bridge . Bijna altijd, zal je daar het vinden Troubleshooting met de meest voorkomende storingen en defecten #MANUAl# samen met de instructies over hun opplosinge. Zelfs als je zelf niet kan om het probleem op te lossen, zal de instructie je de weg wijzen naar verdere andere procedure, bijv. door contact met de klantenservice of het dichtstbijzijnde servicecentrum.
