Part No. NN47250-500
November 2008
4655 Great America Parkway
Santa Clara, CA 95054
Nortel WLAN—Security
Switch 2300 Series
Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
3
In addition, the program and information contained herein are licensed only pursuant to a license agreement that contains
restrictions on use and disclosure (that may incorporate by reference certain limitations and notices imposed by third
parties).
Legal Information
This section includes the following legal information:
•
•
•
•
•
Limited Product Warranty
The following sections describe the Nortel standard Product Warranty for End Users.
Products
Nortel WLAN—Wireless Security Switch 2300 Series
Nortel WLAN—Access Points (2330/2330A/2330B and Series 2332)
Limited Warranty
Nortel standard warranty for hardware is one (1) year. Nortel warrants software materials to be defect free for
90 Days from time of purchase. Nortel requires purchasing the software subscription if a customer would like
to receive the new versions of WLAN—Wireless Security Switch 2300 Series and
Nortel WLAN — Management System software. This limited warranty extends only to you the original
purchaser of the Product.
Exclusive Remedy
Your sole remedy under the limited warranty described above is, at Nortel’s sole option and expense, the
repair or replacement of the non-conforming Product or refund of the purchase price of the non-conforming
Products. Nortel’s obligation under this limited warranty is subject to compliance with Nortel’s then-current
Return Material Authorization (“RMA”) procedures. All replaced Products will become the property of
Nortel. Exchange Products not returned to Nortel will be invoiced at full Product list prices. Replacement
Products may be new, reconditioned or contain refurbished materials. In connection with any warranty
services hereunder, Nortel may in its sole discretion modify the Product at no cost to you to improve its
reliability or performance.
Warranty Claim Procedures
Should a Product fail to conform to the limited warranty during the applicable warranty period as described
above, Nortel must be notified during the applicable warranty period in order to have any obligation under the
limited warranty.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
4
The End Customer or their designated reseller must obtain a Return Material Authorization number (RMA
number) from Nortel for the non-conforming Product and the non-conforming Product must be returned to
Nortel according to the then-current RMA procedures. The End Customer or their designated reseller is
responsible to ensure that the shipments are insured, with the transportation charges prepaid and that the RMA
number is clearly marked on the outside of the package. Nortel will not accept collect shipments or those
returned without an RMA number clearly visible on the outside of the package.
Exclusions and Restrictions
Nortel shall not be responsible for any software, firmware, information or memory data contained in, stored on
or integrated with any Product returned to Nortel pursuant to any warranty or repair.
Upon return of repaired or replaced Products by Nortel, the warranty with respect to such Products will
continue for the remaining unexpired warranty or sixty (60) days, whichever is longer. Nortel may provide
out-of-warranty repair for the Products at its then-prevailing repair rates.
The limited warranty for the Product does not apply if, in the judgment of Nortel, the Product fails due to
damage from shipment, handling, storage, accident, abuse or misuse, or it has been used or maintained in a
manner not conforming to Product manual instructions, has been modified in any way, or has had any Serial
Number removed or defaced. Repair by anyone other than Nortel or an approved agent will void this warranty.
EXCEPT FOR ANY EXPRESS LIMITED WARRANTIES FROM Nortel SET FORTH ABOVE, THE
PRODUCT IS PROVIDED “AS IS”, AND Nortel AND ITS SUPPLIERS MAKE NO WARRANTY,
EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, WITH RESPECT TO PRODUCT OR ANY PART
THEREOF, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTY OF TITLE,
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR THOSE
ARISING FROM COURSE OF PERFORMANCE, DEALING, USAGE OR TRADE. Nortel’S SUPPLIERS
MAKE NO DIRECT WARRANTY OF ANY KIND TO END CUSTOMER FOR THE LICENSED
MATERIALS. NEITHER Nortel NOR ANY OF ITS SUPPLIERS WARRANT THAT THE LICENSED
MATERIALS OR ANY PART THEREOF WILL MEET END CUSTOMER'S REQUIREMENTS OR BE
UNINTERRUPTED, OR ERROR-FREE, OR THAT ANY ERRORS IN THE PRODUCT WILL BE
CORRECTED. SOME STATES/JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED
WARRANTIES SO THE ABOVE EXCLUSIONS MAY NOT APPLY TO END CUSTOMER. THIS
LIMITED WARRANTY GIVES END CUSTOMER SPECIFIC LEGAL RIGHTS. END CUSTOMER MAY
ALSO HAVE OTHER RIGHTS, WHICH VARY FROM STATE/JURISDICTION TO STATE/
JURISDICTION.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL Nortel OR
ITS SUPPLIERS BE LIABLE FOR THE COST OF PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES, LOSS OF PROFITS, OR FOR ANY SPECIAL, CONSEQUENTIAL, INCIDENTAL,
PUNITIVE OR INDIRECT DAMAGES (OR DIRECT DAMAGES IN THE CASE OF Nortel’S
SUPPLIERS) ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, TORT (INCLUDING
WITHOUT LIMITATION NEGLIGENCE), STRICT LIABILITY OR OTHERWISE ARISING OUT OF OR
RELATED TO THE PRODUCT OR ANY USE OR INABILITY TO USE THE PRODUCT. Nortel’S
TOTAL LIABILITY ARISING OUT OF OR RELATED TO THE PRODUCT, OR USE OR INABILITY TO
USE THE PRODUCT, WHETHER IN CONTRACT, TORT (INCLUDING WITHOUT LIMITATION
NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, SHALL NOT EXCEED THE PRICE PAID FOR
THE PRODUCT. THE LIMITATIONS SET FORTH IN THIS SECTION SHALL APPLY EVEN IF Nortel
AND/OR ITS SUPPLIERS ARE ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, AND
NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. Nortel
NEITHER ASSUMES NOR AUTHORIZES ANY OTHER PERSON TO ASSUME FOR IT ANY OTHER
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
5
LIABILITY IN CONNECTION WITH THE SALE, INSTALLATION, MAINTENANCE OR USE OF ITS
PRODUCTS.
Nortel Networks software license agreement
This Software License Agreement (“License Agreement”) is between you, the end-user (“Customer”) and Nortel
Corporation and its subsidiaries and affiliates (“Nortel Networks”). PLEASE READ THE FOLLOWING CAREFULLY.
YOU MUST ACCEPT THESE LICENSE TERMS IN ORDER TO DOWNLOAD AND/OR USE THE SOFTWARE.
USE OF THE SOFTWARE CONSTITUTES YOUR ACCEPTANCE OF THIS LICENSE AGREEMENT. If you do not
accept these terms and conditions, return the Software, unused and in the original shipping container, within 30 days of
purchase to obtain a credit for the full purchase price.
“Software” is owned or licensed by Nortel, its parent or one of its subsidiaries or affiliates, and is copyrighted and
licensed, not sold. Software consists of machine-readable instructions, its components, data, audio-visual content (such
as images, text, recordings or pictures) and related licensed materials including all whole or partial copies. Nortel grants
you a license to use the Software only in the country where you acquired the Software. You obtain no rights other than
those granted to you under this License Agreement. You are responsible for the selection of the Software and for the
installation of, use of, and results obtained from the Software.
1.Licensed Use of Software. Nortel Networks grants Customer a nonexclusive license to use a copy of the Software on
only one machine at any one time or to the extent of the activation or authorized usage level, whichever is applicable. To
the extent Software is furnished for use with designated hardware or Customer furnished equipment (“CFE”), Customer
is granted a nonexclusive license to use Software only on such hardware or CFE, as applicable. Software contains trade
secrets and Customer agrees to treat Software as confidential information using the same care and discretion Customer
uses with its own similar information that it does not wish to disclose, publish or disseminate. Customer will ensure that
anyone who uses the Software does so only in compliance with the terms of this Agreement. Customer shall not a) use,
copy, modify, transfer or distribute the Software except as expressly authorized; b) reverse assemble, reverse compile,
reverse engineer or otherwise translate the Software; c) create derivative works or modifications unless expressly
authorized; or d) sublicense, rent or lease the Software. Licensors of intellectual property to Nortel are beneficiaries of
this provision. Upon termination or breach of the license by Customer or in the event designated hardware or CFE is no
longer in use, Customer will promptly return the Software to Nortel or certify its destruction. Nortel may audit by remote
polling or other reasonable means to determine Customer’s Software activation or usage levels. If suppliers of third
party software included in Software require Nortel to include additional or different terms, Customer agrees to abide by
such terms provided by Nortel with respect to such third party software.
2.Warranty. Except as may be otherwise expressly agreed to in writing between Nortel Networks and Customer,
Software is provided “AS IS” without any warranties (conditions) of any kind. NORTEL NETWORKS DISCLAIMS
ALL WARRANTIES (CONDITIONS) FOR THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING,
BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE AND ANY WARRANTY OF NON-INFRINGEMENT. Nortel Networks is not obligated to
provide support of any kind for the Software. Some jurisdictions do not allow exclusion of implied warranties, and, in
such event, the above exclusions may not apply.
3.Limitation of Remedies. IN NO EVENT SHALL Nortel OR ITS AGENTS OR SUPPLIERS BE LIABLE FOR ANY
OF THE FOLLOWING: a) DAMAGES BASED ON ANY THIRD PARTY CLAIM; b) LOSS OF, OR DAMAGE TO,
CUSTOMER’S RECORDS, FILES OR DATA; OR c) DIRECT, INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE,
OR CONSEQUENTIAL DAMAGES (INCLUDING LOST PROFITS OR SAVINGS), WHETHER IN CONTRACT,
TORT OR OTHERWISE (INCLUDING NEGLIGENCE) ARISING OUT OF YOUR USE OF THE SOFTWARE,
EVEN IF Nortel NETWORKS, ITS AGENTS OR SUPPLIERS HAVE BEEN ADVISED OF THEIR POSSIBILITY.
The forgoing limitations of remedies also apply to any developer and/or supplier of the Software. Such developer and/or
supplier is an intended beneficiary of this Section. Some jurisdictions do not allow these limitations or exclusions and, in
such event, they may not apply.
4.General
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
6
a)If Customer is the United States Government, the following paragraph shall apply: All Nortel Software available under
this License Agreement is commercial computer software and commercial computer software documentation and, in the
event Software is licensed for or on behalf of the United States Government, the respective rights to the software and
software documentation are governed by Nortel standard commercial license in accordance with U.S. Federal
Regulations at 48 C.F.R. Sections 12.212 (for non-DoD entities) and 48 C.F.R. 227.7202 (for DoD entities).
b)Customer may terminate the license at any time. Nortel may terminate the license if Customer fails to comply with the
terms and conditions of this license. In either event, upon termination, Customer must either return the Software to
Nortel or certify its destruction.
c)Customer is responsible for payment of any taxes, including personal property taxes, resulting from Customer’s use of
the Software. Customer agrees to comply with all applicable laws including all applicable export and import laws and
regulations.
d)Neither party may bring an action, regardless of form, more than two years after the cause of the action arose.
e)The terms and conditions of this License Agreement form the complete and exclusive agreement between Customer
and Nortel.
f)This License Agreement is governed by the laws of the country in which Customer acquires the Software. If the
Software is acquired in the United States, then this License Agreement is governed by the laws of the state of New York.
SSH Source Code Statement
C 1995 - 2004 SAFENET, Inc. This software is protected by international copyright laws. All rights reserved. SafeNet is a
registered trademark of SAFENET, Inc., in the United States and in certain other jurisdictions. SAFENET and the SAFENET
logo are trademarks of SAFENET, Inc., and may be registered in certain jurisdictions. All other names and marks are
property of their respective owners.
Copyright (c) 1983, 1990, 1992, 1993, 1995 The Regents of the University of California. All rights reserved.
THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEAPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Components of the software are provided under a standard 2-term BSD licence with the following names as copyright
holders:
o Markus Friedl
o Theo de Raadt
o Niels Provos
o Dug Song
o Aaron Campbell
o Damien Miller
o Kevin Steves
o Daniel Kouril
o Per Allansson
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT
NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEAPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
7
OpenSSL Project License Statements
Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEAPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com). All rights reserved.
THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT
NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEAPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
8
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 9
How to get help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Nortel WLAN 2300 system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Safety and advisory notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Command prompts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Syntax notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
MAC address notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
User wildcards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
MAC address wildcards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
VLAN wildcards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Port lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Command-line editing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Keyboard shortcuts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Tabs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Single-asterisk (*) wildcard character . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Understanding command descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
10 Contents
WSS setup methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Quick starts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Web View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
How a WSS gets its configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Web Quick Start (2350 and 2360/2361) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Web Quick Start parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Web Quick Start requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
CLI quickstart command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Quickstart example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Remote WSS configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Before you start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Types of Administrative Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Enabling an administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Setting the WSS enable password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Authenticating at the console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Configuring accounting for administrative users . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Saving the configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 11
Local authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Local authentication for console users and RADIUS authentication
for Telnet users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Configuring Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Setting passwords for local users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Enabling password restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Restoring access to a locked-out user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Displaying Password Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Configuring and managing ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Setting the port type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Configuring for a AP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Clearing a port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Clearing a AP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Configuring a port name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Setting a port name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Removing a port name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Configuring media type on a dual-interface gigabit
Resetting a port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
12 Contents
Displaying port information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Displaying port statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Configuring load-sharing port groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
Link redundancy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
Removing a port group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Configuring and managing VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Users and VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
VLAN names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Traffic forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
802.1Q tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Tunnel affinity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Configuring a VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Adding ports to a VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Changing tunneling affinity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Displaying VLAN information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Managing the layer 2 forwarding database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Types of forwarding database entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 13
Configuring the aging timeout period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Port and VLAN configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
MTU support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Configuring and managing IP interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Enabling the DHCP client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Disabling or reenabling an IP interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Removing an IP interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Displaying IP interface information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Configuring the system IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Clearing the system IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Displaying IP routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Adding a static route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Removing a static route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Managing SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Login timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Enabling SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Managing Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Telnet login timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Enabling Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Adding a Telnet user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Displaying Telnet status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
14 Contents
Managing HTTPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Configuring and managing DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Configuring DNS servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Adding a DNS server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Displaying DNS server information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Configuring and managing aliases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Adding an alias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Displaying aliases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Configuring and managing time parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Setting the time zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Displaying the time zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Clearing the time zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Configuring and managing NTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Removing an NTP server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
Changing the NTP update interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Resetting the update interval to the default . . . . . . . . . . . . . . . . . . . . . . . . . . 184
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 15
Managing the ARP table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Changing the aging timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Pinging another device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Logging in to a remote device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
IP interfaces and services configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . 191
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Enabling SNMP versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Command examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
Setting SNMP security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Configuring a notification profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Command examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Configuring a notification target . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Command examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Enabling the SNMP service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Displaying SNMP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Displaying USM settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Displaying notification targets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
About the Mobility Domain feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Smart Mobile Virtual Controller Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
16 Contents
Displaying Mobility Domain status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Displaying roaming stations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Displaying tunnel information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Effects of timers on roaming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Monitoring roaming sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Mobility Domain scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Network domain seed affinity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Configuring network domain seeds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 17
Clearing network domain seed or member configuration
Network domain scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
RF load balancing overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Configuring RF load balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Setting strictness for RF load balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Displaying RF load balancing information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Country of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
AP parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Contacting a WSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
AP boot examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Service profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
Public and private SSIDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Radio profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Auto-RF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
18 Contents
Default radio profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
Configuring AP port parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296
Configuring AP-WSS security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
Encryption options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
MP-432 and 802.11n configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
PoE Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
Configuring a service profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
Creating a service profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
Removing a service profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Changing transmit rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 19
Enforcing the Data Rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Disabling idle-client probing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
External antenna selector guides for the AP-2330,
Antenna selection decision trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
Enabling or disabling individual radios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338
Displaying AP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Displaying service profile information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346
Displaying AP status information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
Displaying AP statistics counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
20 Contents
Configuring the Mesh AP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
Configuring Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356
Configuring Wireless Bridging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
Configuring WPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
TKIP countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368
WPA authentication methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
WPA information element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
Client support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371
Displaying RSN settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
Setting static WEP key values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
Assigning static WEP keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 21
Encryption configuration scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382
Configuring encryption for MAC clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387
Auto-RF overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
Initial channel and power assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392
Channel and power tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
Channel tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
Auto-RF parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395
Changing Auto-RF settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396
Changing power tuning settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Enabling power tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Locking down tuned settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Displaying Auto-RF settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400
Displaying RF attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
Using an AeroScout engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
Using WMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
22 Contents
Converting an AP into an AirDefense sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . 408
Specifying the AirDefense server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412
Configuring quality of service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415
End-to-End QoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420
QoS Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420
WMM QoS mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422
SVP QoS mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431
U-APSD support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
Broadcast control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
Static CoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
Overriding CoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
Changing QoS settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
Configuring call admission control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434
Configuring static CoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435
Changing CoS mappings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435
Enabling broadcast control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 23
Displaying the DSCP table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Enabling the spanning tree protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442
Changing the bridge priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445
Changing STP port parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446
Changing spanning tree timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448
Configuring port fast convergence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451
Displaying blocked STP ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
Displaying spanning tree statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460
Clearing STP statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462
Spanning tree configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
24 Contents
Disabling or reenabling IGMP snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
Enabling the pseudo-querier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
Changing IGMP timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
Changing the query interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467
Changing robustness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471
Enabling router solicitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471
Changing the router solicitation interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472
Displaying multicast information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474
Clearing multicast statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476
Displaying multicast queriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477
Displaying multicast routers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478
Security ACL filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483
Order in which ACLs are applied to traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
Traffic direction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
Creating and committing a security ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
Setting a source IP ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485
Wildcard masks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
Class of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
Setting an ICMP ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
Setting TCP and UDP ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
Setting a TCP ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 25
Viewing security ACL information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494
Viewing the edit buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494
Displaying security ACL hits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
Clearing security ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
Mapping security ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
Mapping security ACLs to ports, VLANs, virtual ports,
or distributed APs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499
Modifying an existing security ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503
Filtering based on DSCP values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507
Enabling prioritization for legacy voice over IP . . . . . . . . . . . . . . . . . . . . . . . . . . 508
General guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509
Known limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
Configuring a radio profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 512
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
26 Contents
Security ACL configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516
Managing keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 517
Wireless security through TLS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 518
PEAP-MS-CHAP-V2 security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 519
About keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 519
Public key infrastructures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
Public and private keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522
Digital certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523
Creating keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525
Choosing the appropriate certificate installation method
for your network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526
Generating self-signed certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529
Creating a CSR and installing a certificate from a PKCS #7
Displaying certificate and key information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532
Creating self-signed certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 534
Installing CA-signed certificates using a PKCS #10
SSID name “Any” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539
Last-resort processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539
About AAA for network users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 27
Authentication types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542
SSID name “Any” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 546
Last-resort processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 546
Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 548
AAA tools for network users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
AAA rollover process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
Ways a WSS can use EAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555
Configuring 802.1X authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556
Configuring Web portal Web-based AAA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
Display of the login page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 568
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
28 Contents
WSS requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 570
External Captive Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577
Displaying session information for Web portal
Using a custom login page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578
Using an ACL other than portalacl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583
Configuring AAA for users of third-party APs . . . . . . . . . . . . . . . . . . . . . . . . . . . 588
Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590
WSS requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590
Configuring authentication for 802.1X users of a third-party AP
Configuring authentication for non-802.1X users of a third-party AP
Assigning authorization attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594
Simultaneous login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 29
About the location policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610
Setting the location policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612
Viewing local accounting records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618
Displaying the AAA configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 620
Avoiding AAA problems in configuration order . . . . . . . . . . . . . . . . . . . . . . . . . . 621
Network user configuration scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
RADIUS overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
30 Contents
Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
Configuring global RADIUS defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636
Deleting RADIUS servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639
Creating server groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 640
Configuring load balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 640
Configuring the RADIUS Ping Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 643
Dynamic RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645
Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645
Setting 802.1X port control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651
Managing 802.1X encryption keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651
Enabling 802.1X key transmission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652
Setting EAP retransmission attempts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655
Managing 802.1X client reauthentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 31
Setting the 802.1X timeout for a client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662
Viewing 802.1X clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 663
Viewing the 802.1X configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 664
Viewing 802.1X statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665
About SODA endpoint security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
Displaying and clearing administrative sessions . . . . . . . . . . . . . . . . . . . . . . . . . 685
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
32 Contents
Disabling keepalive probes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 698
Rogue classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 702
Rogue detection lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703
RF detection scans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705
Countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707
Mobility Domain requirement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708
Summary of rogue detection features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708
Configuring rogue detection lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709
Configuring a permitted vendor list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 710
Configuring a permitted SSID list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711
Configuring an ignore list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 714
Enabling countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 715
Enabling AP signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 716
Disabling or reenabling logging of rogues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717
IDS and DoS alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717
Wireless bridge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 721
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 33
Weak WEP key used by client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723
Disallowed devices or SSIDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724
Displaying statistics counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725
IDS log message examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726
Displaying RF detection information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 728
Displaying rogue clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 730
Testing the RFPing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 737
About system files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739
Displaying a list of files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 743
Copying a file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 745
Deleting a file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748
Removing a subdirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 750
Managing configuration files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 750
Loading a configuration file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755
Backing up and restoring the system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757
Managing configuration changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
34 Contents
Upgrade scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762
Fixing common WSS setup problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 766
2350 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 768
2382, 2380 or 2360/2361 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 768
Configuring and managing the system log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769
Log message components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 770
Logging destinations and levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 770
Logging to the console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773
Logging to the trace buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 774
Running traces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776
Using the trace command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776
Tracing authorization activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777
Displaying a trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777
Stopping a trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777
About trace results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777
Copying trace results to a server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 778
Clearing the trace log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780
List of trace areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Contents 35
Using show commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780
Viewing AAA session statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780
Viewing ARP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 781
Configuring port mirroring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 782
Remotely monitoring traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 783
Best practices for remote traffic monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . 783
Configuring a snoop filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784
Enabling or disabling a snoop filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787
Debug messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 790
Sending information to NETS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 791
WSS requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 793
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
36 Contents
Supported RADIUS attributes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795
Supported standard and extended attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . 795
Nortel vendor-specific attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 799
DHCP server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803
Configuring the DHCP server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804
Command Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 849
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
How to get help 37
How to get help
This section explains how to get help for Nortel products and services.
Getting help from the Nortel web site
The best way to get technical support for Nortel products is from the Nortel Technical
Support Web site:
This site provides quick access to software, documentation, bulletins, and tools to address
issues with Nortel products. More specifically, the site enables you to:
• download software, documentation, and product bulletins
• search the Technical Support Web site and the Nortel Knowledge Base for answers to
technical issues
• sign up for automatic notification of new software and documentation for Nortel
equipment
• open and manage technical support cases
Getting help over the phone from a Nortel solutions center
If you don’t find the information you require on the Nortel Technical Support Web site, and
have a Nortel support contract, you can also get help over the phone from a Nortel Solutions
Center.
In North America, call 1-800-4NORTEL (1-800-466-7835).
Outside North America, go to the following Web site to obtain the phone number for your
region:
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
38 How to get help
Getting help from a specialist by using an Express Routing Code
To access some Nortel Technical Solutions Centers, you can use an Express Routing Code
(ERC) to quickly route your call to a specialist in your Nortel product or service. To locate
the ERC for your product or service, go to:
Getting help through a Nortel distributor or reseller
If you purchased a service contract for your Nortel product from a distributor or authorized
reseller, contact the technical support staff for that distributor or reseller.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
39
Introducing the Nortel WLAN 2300
system
Nortel WLAN 2300 system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
This guide explains how to configure and manage a Nortel WLAN 2300 system wireless LAN (WLAN) using the
WLAN Security Switch 2300 Series command line interface (CLI) commands that you enter on a WLAN—Security
Switch (WSS).
Read this guide if you are a network administrator or other person configuring and managing one or more switches and
Access Points (APs) in a network.
Nortel WLAN 2300 system
The Nortel WLAN 2300 system is an enterprise-class WLAN solution that seamlessly integrates with an existing wired
enterprise network. The Nortel system provides secure connectivity to both wireless and wired users in large environ-
ments such as office buildings, hospitals, and university campuses and in small environments such as branch offices.
The Nortel WLAN 2300 system fulfills the three fundamental requirements of an enterprise WLAN: It eliminates the
distinction between wired and wireless networks, allows users to work safely from anywhere (secure mobility), and
provides a comprehensive suite of intuitive tools for planning and managing the network before and after deployment,
greatly easing the operational burden on IT resources.
The Nortel WLAN 2300 system consists of the following components:
•
WLAN Management Software tool suite—A full-featured graphical user interface (GUI) application used to
plan, configure, deploy, and manage a WLAN and its users
•
One or more WLAN—Security Switches (WSSs) —Distributed, intelligent machines for managing user
connectivity, connecting and powering Access Points (APs), and connecting the WLAN to the wired network
backbone
•
•
Multiple Access Points (APs) —Wireless APs that transmit and receive radio frequency (RF) signals to and from
wireless users and connect them to a WSS
WLAN Security Switch 2300 Series (WSS Software)—The operating system that runs all WSSs and APs in a
WLAN, and is accessible through a command-line interface (CLI), the Web View interface, or the WLAN
Management Software GUI
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
40 Introducing the Nortel WLAN 2300 system
Documentation
Consult the following documents to plan, install, configure, and manage a Nortel WLAN 2300 system.
Planning, Configuration, and Deployment
•
•
Nortel WLAN Management Software 2300 Series User Guide. Instructions for planning, configuring, deploying,
and managing the entire WLAN with the WLAN Management Software tool suite. Read this guide to learn how to
plan wireless services, how to configure and deploy Nortel equipment to provide those services, and how to
optimize and manage your WLAN.
Nortel WLAN Management Software 2300 Series Reference Guide. Detailed instructions and information for all
WLAN Management Software planning, configuration, and management features.
Installation
•
•
•
•
Nortel WLAN—Security Switch 2300 Series Installation and Basic Configuration Guide. Instructions and
specifications for installing a WSS
Nortel WLAN—Security Switch 2300 Series Quick Start Guide. Instructions for performing basic setup of secure
(802.1X) and guest (Web-based AAA) access, and for configuring a Mobility Domain for roaming
Nortel WLAN—Access Point 2330/2330A/2330B/2332 Installation Guide. Instructions and specifications for
installing an AP and connecting it to a WSS
Nortel WLAN—Series 2332 Access Point Installation Guide. Instructions and specifications for installing a Series
2332 AP and connecting it to a WSS
Configuration and Management
•
•
•
Nortel WLAN Management Software 2300 Series Reference Guide. Instructions for planning, configuring,
deploying, and managing the entire WLAN with the WLAN Management Software tool suite
Nortel WLAN Security Switch 2300 Series Configuration Guide (this document). Instructions for configuring and
managing the system through the WSS Software CLI
Nortel WLAN Security Switch 2300 Series Command Line Reference. Functional and alphabetic reference to all
WSS Software commands supported on WSSs and APs
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Introducing the Nortel WLAN 2300 system 41
Safety and advisory notices
The following kinds of safety and advisory notices appear in this manual. Text and syntax conventions
Caution! This situation or condition can lead to data loss or damage to the product or
other property.
Note. This information is of special interest.
Nortel manuals use the following text and syntax conventions:
Convention
Use
Monospace text
Sets off command syntax or sample commands and system
responses.
Bold text
Highlights commands that you enter or items you select.
Italic text
Designates command variables that you replace with
appropriate values, or highlights publication titles or words
requiring special emphasis.
Menu Name > Command
Indicates a menu item that you select. For example, File > New
indicates that you select New from the File menu.
[ ] (square brackets)
{ } (curly brackets)
| (vertical bar)
Enclose optional parameters in command syntax.
Enclose mandatory parameters in command syntax.
Separates mutually exclusive options in command syntax.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
42 Introducing the Nortel WLAN 2300 system
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
43
Using the command-line interface
CLI conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Command-line editing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Using CLI help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Understanding command descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
WLAN Security Switch 2300 Series (WSS Software) operates a Nortel WLAN 2300 system wireless LAN (WLAN)
consisting of WLAN Management Software software, WLAN—Security Switches (WSSs), and Access Points (APs).
WSS Software has a command-line interface (CLI) on the WSS that you can use to configure and manage the switch and
its attached APs.
You configure the WSS and AP primarily with set, clear, and show commands. Use set commands to change parame-
ters. Use clear commands to reset parameters to their defaults. In many cases, you can overwrite a parameter with
another set command. Use show commands to display the current configuration and monitor the status of network
operations.
The WSS supports two connection modes:
•
Administrative access mode, which enables the network administrator to connect to the WSS and configure the
network
•
Network access mode, which enables network users to connect through the WSS to access the network
CLI conventions
Be aware of the following WSS Software CLI conventions for command entry:
•
•
•
•
•
•
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
44 Using the command-line interface
Command prompts
By default, the WSS Software CLI provides the following prompt for restricted users. The mmmm portion shows the
WSS model number (for example, 2360) and the nnnnnn portion shows the last 6 digits of the switch’s media access
control (MAC) address.
WSS-mmmm-nnnnnn>
After you become enabled as an administrative user by typing enable and supplying a suitable password, WSS Software
displays the following prompt:
WSS-mmmm-nnnnnn#
For ease of presentation, this manual shows the restricted and enabled prompts as follows:
WSS>
WSS#
For information about changing the CLI prompt on a WSS, see the set prompt command description in the Nortel
WLAN Security Switch 2300 Series Command Line Reference.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Using the command-line interface 45
Syntax notation
The WSS Software CLI uses standard syntax notation:
•
Bold monospace font identifies the command and keywords you must type. For example:
set enablepass
•
Italic monospace font indicates a placeholder for a value. For example, you replace vlan-id in the following
command with a virtual LAN (VLAN) ID:
clear interface vlan-id ip
•
•
Curly brackets ({ }) indicate a mandatory parameter, and square brackets ([ ]) indicate an optional parameter. For
example, you must enter dynamic or port and a port list in the following command, but a VLAN ID is optional:
clear fdb {dynamic | port port-list} [vlan vlan-id]
A vertical bar (|) separates mutually exclusive options within a list of possibilities. For example, you enter either
enable or disable, not both, in the following command:
set port {enable | disable} port-list
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
46 Using the command-line interface
Text entry conventions and allowed characters
Unless otherwise indicated, the WSS Software CLI accepts standard ASCII alphanumeric characters, except for tabs and
spaces, and is case-insensitive.
The CLI has specific notation requirements for MAC addresses, IP addresses, and masks, and allows you to group user-
names, MAC addresses, virtual LAN (VLAN) names, and ports in a single command.
Nortel recommends that you do not use the same name with different capitalizations for VLANs or access control lists
(ACLs). For example, do not configure two separate VLANs with the names red and RED.
The CLI does not support the use of special characters including the following in any named elements such as SSIDs and
VLANs: ampersand (&), angle brackets (< >), number sign (#), question mark (?), or quotation marks (“”).
In addition, the CLI does not support the use of international characters such as the accented É in DÉCOR.
MAC address notation
WSS Software displays MAC addresses in hexadecimal numbers with a colon (:) delimiter between bytes—for example,
00:01:02:1a:00:01. You can enter MAC addresses with either hyphen (-) or colon (:) delimiters, but colons are preferred.
For shortcuts:
•
You can exclude leading zeros when typing a MAC address. WSS Software displays of MAC addresses include all
leading zeros.
•
In some specified commands, you can use the single-asterisk (*) wildcard character to represent an entire MAC
address or from 1 byte to 5 bytes of the address. (For more information, see “MAC address wildcards” on page 47.)
IP address and mask notation
WSS Software displays IP addresses in dotted decimal notation—for example, 192.168.1.111. WSS Software makes use
of both subnet masks and wildcard masks.
Subnet masks
Unless otherwise noted, use classless interdomain routing (CIDR) format to express subnet masks—for example,
192.168.1.112/24. You indicate the subnet mask with a forward slash (/) and specify the number of bits in the mask.
Wildcard masks
Security access control lists (ACLs) use source and destination IP addresses and wildcard masks to determine whether
the WSS filters or forwards IP packets. Matching packets are either permitted or denied network access. The ACL
checks the bits in IP addresses that correspond to any 0s (zeros) in the mask, but does not check the bits that correspond
to 1s (ones) in the mask. You specify the wildcard mask in dotted decimal notation.
For example, the address 10.0.0.0 and mask 0.255.255.255 match all IP addresses that begin with 10 in the first octet.
The ACL mask must be a contiguous set of zeroes starting from the first bit. For example, 0.255.255.255, 0.0.255.255,
and 0.0.0.255 are valid ACL masks. However, 0.255.0.255 is not a valid ACL mask.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Using the command-line interface 47
User wildcards, MAC address wildcards, and VLAN wildcards
Name “wildcarding” is a way of using a wildcard pattern to expand a single element into a list of elements that
match the pattern. WSS Software accepts user wildcards, MAC address wildcards, and VLAN wildcards. The
order in which wildcards appear in the configuration is important, because once a wildcard is matched,
processing stops on the list of wildcards
User wildcards
A user wildcard is shorthand method for matching an authentication, authorization, and accounting (AAA)
command to either a single user or a set of users.
A user wildcard can be upto 80 characters long and cannot contain spaces or tabs. The double-asterisk (**)
wildcard characters with no delimiter characters match all usernames. The single-asterisk (*) wildcard
character matches any number of characters up to, but not including, a delimiter character in the wildcard.
Valid user wildcard delimiter characters are the at (@) sign and the period (.).
For example, the following wildcards identify the following users:
User wildcard
User(s) designated
jose@example.com
*@example.com
User jose at example.com
All users at example.com whose usernames do not contain
periods—for example, jose@example.com and
tamara@example.com, but not nin.wong@example.com,
because nin.wong contains a period
*@marketing.example.com
*.*@marketing.example.com
All marketing users at example.com whose usernames do
not contain periods
All marketing users at example.com whose usernames
contain a period
*
All users with usernames that have no delimiters
EXAMPLE\*
All users in the Windows Domain EXAMPLE with
usernames that have no delimiters
EXAMPLE\*.*
**
All users in the Windows Domain EXAMPLE whose
usernames contain a period
All users
MAC address wildcards
A media access control (MAC) address wildcard is a similar method for matching some authentication, autho-
rization, and accounting (AAA) and forwarding database (FDB) commands to one or more 6-byte MAC
addresses. In a MAC address wildcard, you can use a single asterisk (*) as a wildcard to match all MAC
addresses, or as follows to match from 1 byte to 5 bytes of the MAC address:
00:*
00:01:*
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
48 Using the command-line interface
00:01:02:*
00:01:02:03:*
00:01:02:03:04:*
00:1*
00:01:2*
00:01:02:3*
00:01:02:03:4*
For example, the MAC address wildcard 02:06:8c* represents all MAC addresses starting with 02:06:8c. Specifying
only the first 3 bytes of a MAC address allows you to apply commands to MAC addresses based on an organizationally
unique identity (OUI).
VLAN wildcards
A VLAN wildcard is a method for matching one of a set of local rules on a WSS, known as the location policy, to one or
more users. WSS Software compares the VLAN wildcard, which can optionally contain wildcard characters, against the
VLAN-Name attribute returned by AAA, to determine whether to apply the rule.
To match all VLANs, use the double-asterisk (**) wildcard characters with no delimiters. To match any number of char-
acters up to, but not including, a delimiter character in the wildcard, use the single-asterisk (*) wildcard. Valid VLAN
wildcard delimiter characters are the at (@) sign and the period (.).
For example, the VLAN wildcard bldg4.* matches bldg4.security and bldg4.hr and all other VLAN names with bldg4.
at the beginning.
Matching order for wildcards
In general, the order in which you enter AAA commands determines the order in which WSS Software matches the user,
MAC address, or VLAN to a wildcard. To verify the order, view the output of the show aaa or show config command.
WSS Software checks wildcards that appear higher in the list before items lower in the list and uses the first successful
match.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Using the command-line interface 49
Port lists
The physical Ethernet ports on a WSS can be set for connection to APs, authenticated wired users, or the network
backbone. You can include a single port or multiple ports in one WSS Software CLI command by using the appropriate
list format.
The ports on a WSS are numbered 1 through 22. No port 0 exists on the switch. You can include a single port or multiple
ports in a command that includes port port-list. Use one of the following formats for port-list:
•
•
•
•
A single port number. For example:
WSS# set port enable 16
A comma-separated list of port numbers, with no spaces. For example:
WSS# show port poe 1,2,4,13
A hyphen-separated range of port numbers, with no spaces. For example:
WSS# reset port 12-16
Any combination of single numbers, lists, and ranges. Hyphens take precedence over commas. For example:
WSS# show port status 1-3,14
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
50 Using the command-line interface
Virtual LAN identification
The names of virtual LANs (VLANs), which are used in Mobility Domain™ communications, are set by you and can be
changed. In contrast, VLAN ID numbers, which the WSS uses locally, are determined when the VLAN is first config-
ured and cannot be changed. Unless otherwise indicated, you can refer to a VLAN by either its VLAN name or its
VLAN number. CLI set and show commands use a VLAN’s name or number to uniquely identify the VLAN within the
WSS.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Using the command-line interface 51
Command-line editing
WSS Software editing functions are similar to those of many other network operating systems.
Keyboard shortcuts
The following keyboard shortcuts are available for entering and editing CLI commands:
Keyboard Shortcut(s)
Function
Ctrl+A
Jumps to the first character of the command line.
Moves the cursor back one character.
Ctrl+B or Left Arrow key
Ctrl+C
Escapes and terminates prompts and tasks.
Deletes the character at the cursor.
Ctrl+D
Ctrl+E
Jumps to the end of the current command line.
Moves the cursor forward one character.
Ctrl+F or Right Arrow key
Ctrl+K
Deletes from the cursor to the end of the command line.
Repeats the current command line on a new line.
Enters the next command line in the history buffer.
Enters the previous command line in the history buffer.
Ctrl+L or Ctrl+R
Ctrl+N or Down Arrow key
Ctrl+P or Up Arrow key
Ctrl+U or Ctrl+X
Deletes characters from the cursor to the beginning of the
command line.
Ctrl+W
Esc B
Deletes the last word typed.
Moves the cursor back one word.
Esc D
Deletes characters from the cursor forward to the end of the
word.
Delete key or Backspace key
Erases mistake made during command entry. Reenter the
command after using this key.
History buffer
The history buffer stores the last 63 commands you entered during a terminal session. You can use the Up Arrow and
Down Arrow keys to select a command that you want to repeat from the history buffer.
Tabs
The WSS Software CLI uses the Tab key for command completion. You can type the first few characters of a command
and press the Tab key to display the command(s) that begin with those characters. For example:
WSS# show i <Tab>
ifm
Show interfaces maintained by the interface manager
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
52 Using the command-line interface
igmp
interface Show interfaces
ip Show ip information
Show igmp information
Single-asterisk (*) wildcard character
You can use the single-asterisk (*) wildcard character in wildcards. (For details, see “User wildcards, MAC
Double-asterisk (**) wildcard characters
The double-asterisk (**) wildcard character matches all usernames. For details, see “User wildcards” on
Using CLI help
The CLI provides online help. To see the full range of commands available at your access level, type the
following command:
WSS# help
Commands:
-----------------------------------------------------------------------
clear
Clear, use 'clear help' for more information
Commit the content of the ACL table
Copy from filename (or url) to filename (or url)
Crypto, use 'crypto help' for more information
Delete url
commit
copy
crypto
delete
dir
disable
exit
help
history
load
logout
monitor
ping
quit
reset
rollback
save
set
Show list of files on flash device
Disable privileged mode
Exit from the Admin session
Show this help screen
Show contents of history substitution buffer
Load, use 'load help' for more information
Exit from the Admin session
Monitor, use 'monitor help' for more information
Send echo packets to hosts
Exit from the Admin session
Reset, use 'reset help' for more information
Remove changes to the edited ACL table
Save the running configuration to persistent storage
Set, use 'set help' for more information
Show, use 'show help' for more information
telnet IP address [server port]
show
telnet
traceroute
Print the route packets take to network host
For more information on help, see the help command description in the Nortel WLAN Security Switch 2300
Series Command Line Reference.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Using the command-line interface 53
To see a subset of the online help, type the command for which you want more information. For example, the following
command displays all the commands that begin with the letter i:
WSS# show i?
ifm
Show interfaces maintained by the interface manager
Show igmp information
igmp
interface
ip
Show interfaces
Show ip information
To see all the variations, type one of the commands followed by a question mark (?). For example:
WSS# show ip ?
alias
dns
https
route
telnet
Show ip aliases
show DNS status
show ip https
Show ip route table
show ip telnet
To determine the port on which Telnet is running, type the following command:
WSS# show ip telnet
Server Status
----------------------------------
Enabled 23
Port
Understanding command descriptions
Each command description in the Nortel WLAN Security Switch 2300 Series Command Line Reference contains the
following elements:
•
A command name, which shows the keywords but not the variables. For example, the following command name
appears at the top of a command description and in the index:
set ap name
The set ap name command has the following complete syntax:
set {ap port-list | ap ap-num} name name
A brief description of the command’s functions.
The full command syntax.
•
•
•
•
Any command defaults.
The command access, which is either enabled or all. All indicates that anyone can access this command. Enabled
indicates that you must enter the enable password before entering the command.
•
The command history, which identifies the WSS Software version in which the command was introduced and the
version numbers of any subsequent updates.
•
•
•
Special tips for command usage. These are omitted if the command requires no special usage.
One or more examples of the command in context, with the appropriate system prompt and response.
One or more related commands.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
54 Using the command-line interface
You can fully operate the WLE2340 only if the following commands are set:
To set static ip address for AP at WSS:
#set ap <ap_number> boot-configuration switch mode enable
#set ap <ap_number> boot-configuration switch switch <switch IP address>
#set ap <ap_number> boot-configuration ip <ap_static_ip_address> netmask <netmask>
gateway <gateway IP address> mode enable
To set snoop mapping (recommend snap-length is 100):
#set snoop <snoop name> observer <WLE-2340_ip_address> snap-length <snap-length>
#set snoop map <snoop name> ap <ap_number> radio <1 or 2>
#set snoop <snoop name> mode enable
Once you finish the above setup, the WLE2340 will detect location APs.
To check snoop settings:
#show snoop stats
#show snoop info
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
55
WSS setup methods
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
How a WSS gets its configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Web Quick Start (2350 and 2360/2361) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
CLI quickstart command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Remote WSS configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
This chapter describes the methods you can use to configure a WSS, and refers you to information for each method.
Depending on your configuration needs, you can use one or a combination of these methods.
Note. For easy installation, use one of the quick-start methods described in this chapter
instead of using the CLI instructions in later chapters in the manual.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
56 WSS setup methods
Overview
WSS Software provides the following quick-start methods for new (unconfigured) switches:
•
•
Web Quick Start (2350 and 2360/2361 only)
CLI quickstart command
You can use either quick-start method to configure a switch to provide wireless service. You also can use any
of the following management applications to configure a new switch or to continue configuration of a partially
configured switch:
•
•
•
WLAN Management Software
CLI
Web View
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
WSS setup methods 57
Quick starts
The Web Quick Start enables you to easily configure a 2350 or 2360/2361 switch to provide wireless access to up to 10
users. The Web Quick Start is accessible only on unconfigured 2350 and 2360/2361 switches. The interface is not
available on other switch models or on any switch that is already configured.
The quickstart command enables you to configure a switch to provide wireless access to any number of users.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
58 WSS setup methods
WLAN Management Software
You can use WLAN Management Software to remotely configure a switch using one of the following
techniques:
•
Drop ship—On model 2350 only, you can press the factory reset switch during power on until the right
LED above port 1 flashes for 3 seconds. Activating the factory reset causes the 2350 to bypass the Web
Quick Start and request its configuration from WLAN Management Software instead.
•
Staged WSS—On any switch model, you can stage the switch to request its configuration from WLAN
Management Software, by preconfiguring IP parameters and enabling the auto-config option.
You also can use WLAN Management Software to plan your network, create WSSs in the plan, then deploy
the switch configurations to the real switches. For information, see the following:
•
•
Nortel WLAN Management Software 2300 Series User Guide
Nortel WLAN Management Software 2300 Series Reference Guide
To open a sample network plan, see “Opening the QuickStart network plan in WLAN Management Software”
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
WSS setup methods 59
CLI
You can configure a switch using the CLI by attaching a PC to the switch’s Console port.
After you configure the switch for SSH or Telnet access, you also can use these protocols to access the CLI.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
60 WSS setup methods
Web View
You can use a switch’s web management interface, Web View, to configure the switch. For access information, see
Note. Web View is different from the Web Quick Start application. Web View is a
web-based management application that is available at any time on a switch that already
has IP connectivity. (Web View access also requires the switch’s HTTPS server to be
enabled.) The Web Quick Start application is accessible only on unconfigured switches.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
WSS setup methods 61
How a WSS gets its configuration
Figure 1 shows how a WSS gets a configuration when you power it on.
Figure 1. WSS Startup Algorithm
Switch is powered on.
Switch boots
Does switch have
Switch
displays
CLI prompt.
Is auto-config
enabled?
using its
a configuration?
No
Yes
configuration file.
Yes
No
Switch contacts
WMS
to request
Was factory reset
pressed during
power on?
Model 2350?
No
Yes
Yes
configuration.
No
Web Quick Start
is enabled.
Model 2360/2361?
Yes
No
Boots with no configuration.
You must use the CLI to
start configuring the switch.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
62 WSS setup methods
Web Quick Start (2350 and 2360/2361)
You can use the Web Quick Start to configure the switch to provide wireless access to up to ten network users.
To access the Web Quick Start, attach a PC directly to port 1 or port 2 on the switch and use a web browser on the PC to
access IP address 192.168.100.1. (For more detailed instructions, see “Accessing the Web Quick Start” on page 65.)
Note. The Web Quick Start application is different from Web View. Web View is a
web-based management application that is available at any time on a switch that already
has IP connectivity. (Web View access also requires the switch’s HTTPS server to be
enabled.) The Web Quick Start application is accessible only on unconfigured switches.
Note. The Web Quick Start application is supported only on switch models 2350 and
2360/2361. After you finish the Web Quick Start, it will not be available again unless you
clear (erase) the switch’s configuration.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
WSS setup methods 63
Web Quick Start parameters
The Web Quick Start enables you to configure basic wireless access for a small office. You can use the Web Quick Start
to configure the following parameters:
•
•
•
•
•
•
System name of the switch
Country code (the country where wireless access will be provided)
Administrator username and password
Management IP address and default router (gateway)
Time and date (statically configured or provided by an NTP server)
Management access
You can individually select Telnet, SSH, and Web View. You also can secure the Console port. Access
requires the administrator username and password.
•
•
Power over Ethernet (PoE), for ports directly connected to APs
SSIDs and authentication types. The Web Quick Start enables you to configure one secure SSID and one clear
SSID. You can configure additional SSIDs using the CLI or WLAN Management Software.
•
Usernames and passwords for your wireless users. You can configure up to ten users with the Web Quick Start. To
configure additional users, use the CLI or WLAN Management Software.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
64 WSS setup methods
Web Quick Start requirements
To use the Web Quick Start, you need the following:
•
•
•
AC power source for the switch
PC with an Ethernet port that you can connect directly to the switch
Category 5 (Cat 5) or higher Ethernet cable
If the PC is connected to the network, power down the PC or disable its network interface card (NIC), then
unplug the PC from the network.
Note. You can use a Layer 2 device between the switch and the PC. However, do not
attach the switch to your network yet. The switch requires the PC you attach to it for
configuration to be in the 192.168.100.x subnet, and uses the WSS Software DHCP server
to assign the PC an address from this subnet. If you attach the unconfigured switch to your
network, the switch disables the WSS Software DHCP server, if the switch detects another
DHCP server on the network. If the network does not have a DCHP server, the switch’s
DHCP server remains enabled and will offer IP addresses in the 192.168.100.x subnet in
response to DHCP Requests.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
WSS setup methods 65
Accessing the Web Quick Start
To access the Web Quick Start:
1
2
Use a Category 5 (Cat 5) or higher Ethernet cable to connect the switch directly to a PC that has a web
browser.
Connect the switch to an AC power source.
If the green power LED is lit, the switch is receiving power.
Note. If you are configuring a 2350, do not press the factory reset switch during
power on. Pressing this switch on an unconfigured switch causes the switch to
attempt to contact a WLAN Management Software server instead of displaying the
Web Quick Start. (Other switch models also have reset switches, but the reset
switch simply restarts these other models without clearing the configuration.)
3
4
Enable the PC’s NIC that is connected to the switch, if not already enabled.
Verify that the NIC is configured to use DHCP to obtain its IP address.
You will not be able to access the Web Quick Start if the IP address of the NIC is statically configured.
Use a web browser to access IP address 192.168.100.1.
5
This is a temporary, well-known address assigned to the unconfigured switch when you power it on. The
Web Quick Start enables you to change this address.
The first page of the Quick Start Wizard appears.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
66 WSS setup methods
6 Click Next to begin. The wizard screens guide you through the configuration steps.
Caution! Use the wizard’s Next and Back buttons to navigate among the
wizard pages. Using the browser’s navigation buttons, such as Back and
Forward, can result in loss of information. Do not click the browser’s Refresh or
Reload button at any time while using the wizard. If you do click Refresh or
Reload, all the information you have entered in the wizard will be cleared.
7
After guiding you through the configuration, the wizard displays a summary of the configuration values
you selected. Here is an example:
8
Review the configuration settings, then click Finish to save the changes or click Back to change settings.
If you want to quit for now and start over later, click Cancel.
If you click Finish, the wizard saves the configuration settings into the switch’s configuration file. If the
switch is rebooted, the configuration settings are restored when the reboot is finished.
The switch is ready for operation. You do not need to restart the switch.
Caution! On a 2350, do not press the factory reset switch for more than four
seconds! On a 2350 that is fully booted, the factory reset switch erases the configuration
if held for five seconds or more. If you do accidentally erase the configuration, you can use
the Web Quick Start to reconfigure the switch.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
WSS setup methods 67
CLI quickstart command
The quickstart command runs a script that interactively helps you configure the following items:
•
•
•
•
•
•
•
•
•
•
•
•
System name
Country code (regulatory domain)
System IP address
Default route
802.1Q tagging for ports in the default VLAN
Administrative users and passwords
Enable password
System time, date, and timezone
Unencrypted (clear) SSID names
Usernames and passwords for guest access using Web-based AAA
Encrypted (crypto) SSID names and dynamic WEP encryption for encrypted SSIDs’ wireless traffic
Usernames and passwords for secure access using 802.1X authentication using PEAP-MSCHAP-V2 and secure
wireless data encryption using dynamic Wired Equivalent Privacy (WEP)
•
•
Directly connected APs
Distributed APs
The quickstart command displays a prompt for each of these items, and lists the default if applicable. You can advance
to the next item, and accept the default if applicable, by pressing Enter.
The command also automatically generates a key pair for SSH.
The command automatically places all ports that are not used for directly connected APs into the default VLAN (VLAN
1).
Caution! The quickstart command is for configuration of a new switch only. After
prompting you for verification, the command erases the switch’s configuration before
continuing. If you run this command on a switch that already has a configuration, the
configuration will be erased. In addition, error messages such as Critical AP Notice for
directly connected APs can appear.
To run the quickstart command:
1
2
Attach a PC to the WSS’s serial console port. (Use these modem settings: 9600 bps, 8 bits, 1 stop, no
parity, hardware flow control disabled.)
Press Enter three times, to display a username prompt (Username:), a password prompt (Password:), and
then a command prompt such as the following:
2350-aabbcc>
(Each switch has a unique system name that contains the model number and the last half of the switch’s
MAC address.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
68 WSS setup methods
3
Access the enabled level (the configuration level) of the CLI:
2350-aabbcc> enable
4
5
Press Enter at the Enter password prompt.
Type quickstart. The command asks you a series of questions. You can type ? for more help.
To quit, press Ctrl+C.
One of the questions the script asks is the country code. For a list of valid country codes, see
Note. For Series 2332 access points, be sure the system country code is supported for the
selected access point model. The Series 2332 access point has been region-locked to meet
geographic regulatory restrictions. Each model is associated to a specific regulatory domain and
subsequent country of operation. During installation, the access point model and wireless security
switch regulatory domain must match or the access point will not operate.
Another question the script asks is, “Do you wish to configure wireless?” If you answer y, the
script goes on to ask you for SSID and user information, for unencrypted and encrypted SSIDs.
If you answer n, the script generates a key pair for SSH and then ends.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
WSS setup methods 69
Quickstart example
This example configures the following parameters:
•
•
•
System name: 2350-mrktg
Country code (regulatory domain): US
System IP address: 172.16.0.21, on IP interface 172.16.0.21 255.255.255.0
Note. The quickstart script asks for an IP address and subnet mask for the
system IP address, and converts the input into an IP interface with a subnet mask,
and a system IP address that uses that interface. Likewise, if you configure this
information manually instead of using the quickstart command, you must
configure the interface and system IP address separately.
•
•
Default route: 172.16.0.20
Administrative user wssadmin, with password letmein. The only management access the switch allows by default is
CLI access through the serial connection.
•
System Time and date parameters:
●
●
●
Date: 31st of March, 2006
Time: 4:36 PM
Timezone: PST (Pacific Standard Time), with an offset of -8 hours from Universal Coordinated Time
(UTC)
•
•
•
•
•
Unencrypted SSID name: public
Username user1 and password pass1 for Web-based AAA
Encrypted SSID name: corporate
Username bob and password bobpass for 802.1X authentication
Directly connected AP on port 2, model 2330
The IP addresses, usernames, and passwords in this document are examples. Use values that are appropriate for your
organization.
If you configure time and date parameters, you will be required to enter a name for the timezone, and then enter the value
of the timezone (the offset from UTC) separately. You can use a string of up to 32 alphabetic characters as the timezone
name.
Figure 2 shows an example. Users bob and alice can access encrypted SSID corporate on either of the APs. Users user1
and user2 can use the same APs to access unencrypted SSID public. Although the same hardware supports both SSIDs
and sets of users, AAA ensures that only the users who are authorized to access an SSID can access that SSID. Users of
separate SSIDs can even be in the same VLAN, as they are in this example.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
70 WSS setup methods
Figure 2. Single-switch deployment
2350-Corp
Backbone
Internet
10.10.10.4
Console
Port
3
Port
2
Corporate resources
alice
bob
user2
user1
2350-aabbcc# quickstart
This will erase any existing config. Continue? [n]: y
Answer the following questions. Enter '?' for help. ^C to break
out
System Name [2350]: 2350-mrktg
Country Code [US]: US
System IP address []: 172.16.0.21
System IP address netmask []: 255.255.255.0
Default route []: 172.16.0.20
Do you need to use 802.1Q tagged default VLAN [Y/N]? Y: y
Specify the port number that needs to be tagged [1-2, <CR> ends
config]: 2
Specify the tagged value for port [2] [<CR> ends config:] 100
Specify the port number that needs to be tagged [1-2, <CR> ends
config]:
Admin username [admin]: wssadmin
Admin password [optional]: letmein
Enable password [optional]: enable
Do you wish to set the time? [y]: y
Enter the date (dd/mm/yy) []: 31/03/06
Is daylight saving time (DST) in effect [n]: n
Enter the time (hh:mm:ss) []: 04:36:20
Enter the timezone []: PST
Enter the offset (without DST) from GMT for 'PST' in hh:mm
[0:0]: -8:0
Do you wish to configure wireless? [y]: y
Enter a clear SSID to use: public
Do you want Web Portal authentication? [y]: y
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
WSS setup methods 71
Enter a username to be used with Web Portal, <cr> to exit: user1
Enter a password for user1: user1pass
Enter a username to be used with Web Portal, <cr> to exit:
Do you want to do 802.1x and PEAP-MSCHAPv2? [y]: y
Enter a crypto SSID to use: corporate
Enter a username with which to do PEAP-MSCHAPv2, <cr> to exit:
bob
Enter a password for bob: bobpass
Enter a username with which to do PEAP-MSCHAPv2, <cr> to exit:
Do you wish to configure access points? [y]: y
Enter a port number [1-2] on which an AP resides, <cr> to exit:
2
Enter AP model on port 2: 2330
Enter a port number [1-2] on which an AP resides, <cr> to exit:
Do you wish to configure distributed access points? [y]: y
Enter a AP serial number, <cr> to exit: 0422700351
Enter model of AP with S/N 0422700351: 2330
Enter a AP serial number, <cr> to exit:
success: created keypair for ssh
success: Type "save config" to save the configuration
2350-aabbcc# save config
6
7
8
Optionally, enable Telnet.
2350-aabbcc# set ip telnet server enable
Verify the configuration changes.
2350-aabbcc# show config
Save the configuration changes.
2350-aabbcc# save config
Remote WSS configuration
You can use WMS Services running in your corporate network to configure WSSs in remote offices. The following
remote configuration scenarios are supported:
•
Drop ship—WMS Services running in the corporate network can configure a 2350 switch shipped directly to a
remote office. This option does not require any preconfiguration of the switch.
•
Staged—You can stage any model of switch by preconfiguring IP connectivity and enabling auto-config, then
sending the switch to the remote office. The switch contacts WMS Services in the corporate network to complete its
configuration.
The drop ship option is supported only for the 2350. The staged option is supported for all switch models. Both options
require WMS Services.
(For more information, see the “Configuring WSSs Remotely” chapter in the Nortel WLAN Management Software 2300
Series Reference Guide.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
72 WSS setup methods
Opening the QuickStart network plan in WLAN
Management Software
WLAN Management Software comes with two sample network plans:
•
QuickStart—Contains a two-floor building with two WSSs and two APs on each switch. Each switch and its APs
provide coverage for a floor. The Nortel equipment is configured to provide both clear (unencrypted) and secure
(802.1X) wireless access.
•
StarterKit—Contains a simple rectangle as a floor plan, but with one WSS and four APs. You can modify this plan
to deploy the Nortel starter kit.
The QuickStart network plan contains a configuration similar to the one created by the CLI quicktstart example in
“Quickstart example” on page 69. The plan differs from the sample configuration by using separate VLANs for WSS
management traffic, corporate users, and guest users. Otherwise, the configuration is the same.
To open the network plan:
1
Install WMS, if not already installed. (See the “Getting Started” chapter of the Nortel WLAN
Management Software 2300 Series User Guide or the “Installing WMS” chapter of the Nortel WLAN
Management Software 2300 Series Reference Guide.)
2
Start WMS by doing one of the following:
●
On Windows systems, select Start > Programs > Nortel > WMS > WMS, or double-click the
WMS icon on the desktop.
●
On Linux systems, change directories to WMS_installation_directory/bin, and enter ./wms.
If you are starting WLAN Management Software for the first time, or you have not entered license
information previously, the License Information dialog box appears. Enter the serial number and License,
then click OK.
3
When the WLAN Management Software Services Connection dialog appears, enter the IP address and
UDP port of WLAN Management Software Services (if installed on a different machine than the client),
and click Next.
4
5
6
If the Certificate Check dialog appears, click Accept to complete the connection to WMS Services.
Select File > Switch Network Plan.
Click Yes to close the plan that is currently open.
The Switch Network Plan dialog appears, listing the available network plans.
Select QuickStart and click Next.
7
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
73
Configuring Web-based AAA for
administrative and local access
Before you start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
About Administrative Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
First-time configuration via the console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Configuring accounting for administrative users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Displaying the Web-based AAA configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Saving the configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Overview of Web-based AAA for administrative and
local access
Nortel WLAN Security Switch 2300 Series (WSS Software) supports authentication, authorization, and accounting
(AAA) for secure network connections. As administrator, you must establish administrative access for yourself and
optionally other local users before you can configure the WSS for operation.
Here is an overview of configuration topics:
1
Console connection. By default, any administrator can connect to the console port and manage the
switch, because no authentication is enforced. (Nortel recommends that you enforce authentication on the
console port after initial connection.)
2
Telnet or SSH connection. Administrators cannot establish a Telnet or Secure Shell (SSH) connection to
the WSS by default. To provide Telnet or SSH access, you must add a username and password entry to the
local database or, optionally, set the authentication method for Telnet users to a Remote Authentication
Dial-In User Service (RADIUS) server.
Note. A CLI Telnet connection to the WSS is not secure, unlike SSH, WLAN
Management Software and Web View connections. (For details, see “Managing
3
Restricted mode. When you initially connect to the WSS, your mode of operation is restricted. In this
mode, only a small subset of status and monitoring commands is available. Restricted mode is useful for
administrators with basic monitoring privileges who are not allowed to change the configuration or run
traces.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
74 Configuring Web-based AAA for administrative and local access
4
5
Enabled mode. To enter the enabled mode of operation, you type the enable command at the
command prompt. In enabled mode, you can use all CLI commands. Although WSS Software
does not require an enable password, Nortel highly recommends that you set one.
Customized authentication. You can require authentication for all users or for only a subset of
users. Username wildcards (see “User wildcards, MAC address wildcards, and VLAN
wildcards” on page 47) allows different users or classes of user to be given different
authentication treatments. You can configure console authentication and Telnet authentication
separately, and you can apply different authentication methods to each.
For any user, authorization uses the same method(s) as authentication for that user.
6
7
Local override. A special authentication technique called local override lets you attempt
authentication via the local database before attempting authentication via a RADIUS server.
The WSS attempts administrative authentication in the local database first. If it finds no match,
the WSS attempts administrative authentication on the RADIUS server. (For information about
setting a WSS to use RADIUS servers, see “Configuring communication with RADIUS” on
page 633.)
Accounting for administrative access sessions. Accounting records can be stored and
displayed locally or sent to a RADIUS server. Accounting records provide an audit trail of the
time an administrative user logged in, the administrator’s username, the number of bytes
transferred, and the time the session started and ended.
Figure 3 illustrates a typical WSS, APs, and network administrator in an enterprise network. As network
administrator, you initially access the WSS via the console. You can then optionally configure authentication,
authorization, and accounting for administrative access mode.
Nortel recommends enforcing authentication for administrative access using usernames and passwords stored
either locally or on RADIUS servers.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Web-based AAA for administrative and local access 75
Figure 3. Typical Nortel WLAN 2300 system
Building 1
AP
Floor 3
AP
AP
Layer 2 switches
WSSs
Floor 2
AP
WSSs
WSS
AP
AP
Core router
Floor 1
Data center
Layer 2 or Layer 3 switches
RADIUS or AAA
Servers
Before you start
Before reading more of this chapter, use the Nortel WLAN Security Switch 2300 Series Quick Start Guide to set up a
WSS and the attached APs for basic service.
About Administrative Access
The authentication, authorization, and accounting (AAA) framework helps secure network connections by identifying
who the user is, what the user can access, and the amount of network resources the user can consume.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
76 Configuring Web-based AAA for administrative and local access
Access modes
WSS Software provides Web-based AAA either locally or via remote servers to authenticate valid users. WSS Software
provides two modes of access:
•
Administrative access mode—Allows a network administrator to access the WSS and configure it.
•
Network access mode—Allows network users to connect through the WSS. For information about configuring
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Web-based AAA for administrative and local access 77
Types of Administrative Access
WSS Software allows you access to the WSS with the following types of administrative access:
•
•
•
•
Console—Access via only the console port. For more information, see “First-time configuration via the console” on
Telnet—Users who access WSS Software via the Telnet protocol. For information about setting up a WSS for
Secure Shell (SSH)—Users who access WSS Software via the SSH protocol. For information about setting up a
WLAN Management Software (WMS)—After you configure the WSS as described in the Nortel WLAN—Security
Switch Installation and Basic Configuration Guide, you can further configure the WSS using the WMS tool suite.
For more information, see the Nortel WLAN Management Software Reference Manual.
•
Web View—A Web-based application for configuring and managing a single WSS through a Web browser. Web
View uses a secure connection via Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS).
First-time configuration via the console
Administrators must initially configure the WSS with a computer or terminal connected to the WSS console port through
a serial cable. Telnet access is not initially enabled.
To configure a previously unconfigured WSS via the console, you must complete the following tasks:
•
•
•
•
Optionally, configure accounting. (see “Configuring accounting for administrative users” on page 84.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
78 Configuring Web-based AAA for administrative and local access
Enabling an administrator
To enable yourself as an administrator, you must log in to the WSS from the console. Until you set the enable
password and configure authentication, the default username and password are blank. Press Enter when
prompted for them.
To enable an administrator:
1
Log in to the WSS from the serial console, and press Enter when the WSS displays a username
prompt:
Username:
2
3
4
Press Enter when the WSS displays a password prompt.
Password:
Type enable to go into enabled mode.
WSS> enable
Press Enter to display an enabled-mode command prompt:
WSS#
Once you see this prompt after you have typed the enable command, you have administrative
privileges, which allow you to further configure the WSS.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Web-based AAA for administrative and local access 79
Setting the WSS enable password
There is one enable password for the entire WSS. You can optionally change the enable password from the
default.
Caution! Nortel recommends that you change the enable password from the default
(no password) to prevent unauthorized users from entering configuration commands.
Setting the WSS enable password for the first time
To set the enable password for the first time:
1
2
3
At the enabled prompt, type set enablepass.
At the “Enter old password” prompt, press Enter.
At the “Enter new password” prompt, enter an enable password of up to 32 alphanumeric
characters with no spaces. The password is not displayed as you type it.
Note. The enable password is case-sensitive.
4
Type the password again to confirm it.
WSS Software lets you know the password is set.
WSS# set enablepass
Enter old password:
Enter new password:
Retype new password:
Password changed
Caution! Be sure to use a password that you will remember. If you lose the
enable password, the only way to restore it causes the system to return to its
default settings and wipes out any saved configuration. (For details, see
5
Store the configuration into nonvolatile memory by typing the following command:
WSS# save config
success: configuration saved.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
80 Configuring Web-based AAA for administrative and local access
WMS enable password
If you use WLAN Management Software to continue configuring the switch, you will need to enter the switch’s enable
password when you upload the switch’s configuration into WLAN Management Software. (For WMS information, see
the Nortel WLAN Management Software Reference Manual.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Web-based AAA for administrative and local access 81
Authenticating at the console
You can configure the console so that authentication is required, or so that no authentication is required. Nortel recom-
mends that you enforce authentication on the console port.
To enforce console authentication, take the following steps:
1
Add a user in the local database by typing the following command with a username and password:
WSS#set user username password password
success: change accepted.
2
To enforce the use of console authentication via the local database, type the following command:
Caution! If you type this command before you have created a local username
and password, you can lock yourself out of the WSS. Before entering this
command, you must configure a local username and password.
WSS# set authentication console * local
3
To store this configuration into nonvolatile memory, type the following command:
WSS# save config
success: configuration saved.
By default, no authentication is required at the console. If you have previously required authentication and have decided
not to require it (during testing, for example), type the following command to configure the console so that it does not
require username and password authentication:
WSS# set authentication console * none
Note. The authentication method none you can specify for administrative access is
different from the fallthru authentication type None, which applies only to network access.
The authentication method none allows access to the WSS by an administrator. The
fallthru authentication type None denies access to a network user. (For information about
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
82 Configuring Web-based AAA for administrative and local access
Customizing Web-based AAA with “wildcards” and groups
“Wildcarding” lets you classify users by username or media access control (MAC) address for different Web-based
AAA treatments. A user wildcard is a string, possibly containing wildcards, for matching Web-based AAA and IEEE
802.1X authentication methods to a user or set of users. The WSS supports the following wildcard characters for user
wildcards:
•
Single asterisk (*) matches the characters in a username up to but not including a separator character, which can be
an at (@) sign or a period (.).
•
Double asterisk (**) matches all usernames.
In a similar fashion, MAC address wildcards match authentication methods to a MAC address or set of MAC addresses.
A user group is a named collection of users or MAC addresses sharing a common authorization policy. For example, you
might group all users on the first floor of building 17 into the group bldg-17-1st-floor, or group all users in the IT group
into the group infotech-people. Individual user entries override group entries if they both configure the same attribute.
(For information about configuring users and user groups, see “Adding and clearing local users for Administrative
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Web-based AAA for administrative and local access 83
Setting user passwords
Like usernames, passwords are not case-sensitive. To make passwords secure, make sure they contain uppercase and
lowercase letters and numbers. Nortel recommends that all users create passwords that are memorable to themselves,
difficult for others to guess, and not subject to a dictionary attack.
User passwords are automatically encrypted when entered in the local database. However, the encryption is not strong. It
is designed only to discourage someone looking over your shoulder from memorizing your password as you display the
configuration. To maintain security, WSS Software displays only the encrypted form of the password in show
commands.
Note. Although WSS Software allows you to configure a user password for the special
“last-resort” guest user, the password has no effect. Last-resort users can never access a
WSS in administrative mode and never require a password.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
84 Configuring Web-based AAA for administrative and local access
Adding and clearing local users for Administrative Access
Usernames and passwords can be stored locally on the WSS. Nortel recommends that you enforce console authentication
after the initial configuration to prevent anyone with unauthorized access to the console from logging in. The local
database on the WSS is the simplest way to store user information in a Nortel system.
To configure a user in the local database, type the following command:
set user username password [encrypted] password
For example, to configure user Jose with the password spRin9 in the local database on the WSS, type the following
command:
WSS# set user Jose password spRin9
success: User Jose created
The encrypted option indicates that the password string you are entering is the encrypted form of the password. Use this
option only if you do not want WSS Software to encrypt the password for you.
To clear a user from the local database, type the following command:
clear user username
Configuring accounting for administrative users
Accounting allows you to track network resources. Accounting records can be updated for three important events: when
the user is first connected, when the user roams from one AP to another, and when the user terminates his or her session.
The default for accounting is off.
To configure accounting for administrative logins, use the following command:
set accounting {admin | console} {user-wildcard} {start-stop | stop-only} method1 [method2]
[method3] [method4]
To configure accounting for administrative logins over the network at EXAMPLE, enter the following command:
set accounting admin EXAMPLE\* start-stop | stop-only aaa-method
You can select either start-stop or stop-only accounting modes. The stop-only mode sends only stop records, whereas
start-stop sends both start and stop records, effectively doubling the number of accounting records. In most cases,
stop-only is entirely adequate for administrative accounting, because a stop record contains all the information you
might need about a session.
In the set accounting command, you must include Web-based AAA methods that specify whether to use the local
database or RADIUS server to receive the accounting records. Specify local, which causes the processing to be done on
the WSS, or specify a RADIUS server group. For information about configuring a RADIUS server group, see “Config-
For example, you can set accounting for administrative users using the start-stop mode via the local database:
WSS# set accounting admin EXAMPLE\* start-stop local
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Web-based AAA for administrative and local access 85
The accounting records show the date and time of activity, the user’s status and name, and other attributes. The show
accounting statistics command displays accounting records for administrative users after they have logged in to the
WSS.
(For information about network user accounting, see “Configuring accounting for wireless network users” on page 614.
For information and an output example for the show accounting statistics command, see the Nortel WLAN Security
Switch 2300 Series Command Line Reference.)
Displaying the Web-based AAA configuration
To display your Web-based AAA configuration, type the following command:
WSS# show aaa
Default Values
authport=1812 acctport=1813 timeout=5 acct-timeout=5
retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server
-------------------------------------------------------------------
r1 192.168.253.1 1812 1813 5 UP
Addr
Ports T/o Tries Dead State
3
0
Server groups
sg1: r1
Web Portal:
enabled
set authentication console * local
set authentication admin * local
set accounting admin Geetha stop-only local
set accounting admin * start-stop local
user Geetha
Password = 1214253d1d19 (encrypted)
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Saving the configuration
You must save the configuration for all commands that you enter and want to use for future sessions. After you enter the
administrator’s Web-based AAA configuration, type the following command to maintain these commands in WSS
nonvolatile memory:
WSS# save config
success: configuration saved.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
86 Configuring Web-based AAA for administrative and local access
You can also specify a filename for the configuration—for example, configday. To do this, type the following command:
WSS# save config configday
Configuration saved to configday.
You must type the save config command to save all configuration changes since the last time you rebooted the WSS or
saved the configuration. If the WSS is rebooted before you have saved the configuration, all changes are lost.
You can also type the load config command, which reloads the WSS to the last saved configuration or loads a particular
Administrative Web-based AAA configuration scenarios
The following scenarios illustrate typical configurations for administrative and local authentication. For all scenarios,
the administrator is Natasha with the password m@Jor. (For RADIUS server configuration details, see “Configuring
•
•
•
•
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Web-based AAA for administrative and local access 87
Local authentication
The first time you access a WSS, it requires no authentication. (For more information, see “First-time configuration via
the console” on page 77.) In this scenario, after the initial configuration of the WSS, Natasha is connected through the
console and has enabled access.
To enable local authentication for a console user, you must configure a local username. Natasha types the following
commands in this order:
WSS# set user natasha password m@Jor
User natasha created
WSS# set authentication console * local
success: change accepted.
WSS# save config
success: configuration saved.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
88 Configuring Web-based AAA for administrative and local access
Local authentication for console users and RADIUS authentication for
Telnet users
This scenario illustrates how to enable local authentication for console users and RADIUS authentication for Telnet
administrative users. To do so, you configure at least one local username for console authentication and set up a
RADIUS server for Telnet administrators. Natasha types the following commands in this order:
WSS# set user natasha password m@Jor
User natasha created
WSS# set authentication console * local
success: change accepted.
WSS# set radius server r1 address 192.168.253.1 key sunFLOW#$
success: change accepted.
Natasha also adds the RADIUS server (r1) to the RADIUS server group sg1, and configures Telnet administrative users
for authentication through the group. She types the following commands in this order:
WSS# set server group sg1 members r1
success: change accepted.
WSS# set authentication admin * sg1
success: change accepted.
WSS# save config
success: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Web-based AAA for administrative and local access 89
Local override and backup local authentication
This scenario illustrates how to enable local override authentication for console users. Local override means that WSS
Software attempts authentication first via the local database. If it finds no match for the user in the local database, WSS
Software then tries a RADIUS server—in this case, server r1 in server group sg1. Natasha types the following
commands in this order:
WSS# set user natasha password m@Jor
User natasha created
WSS# set radius server r1 address 192.168.253.1 key sunFLOW#$
success: change accepted.
WSS# set server group sg1 members r1
success: change accepted.
WSS# set authentication console * local sg1
success: change accepted.
WSS# save config
success: configuration saved.
Natasha also enables backup RADIUS authentication for Telnet administrative users. If the RADIUS server does not
respond, the user is authenticated by the local database in the WSS. Natasha types the following commands:
WSS# set authentication admin * sg1 local
success: change accepted.
WSS# save config
success: configuration saved.
The order in which Natasha enters authentication methods in the set authentication command determines the method
WSS Software attempts first. The local database is the first method attempted for console users and the last method
attempted for Telnet administrators.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
90 Configuring Web-based AAA for administrative and local access
Authentication when RADIUS servers do not respond
This scenario illustrates how to enable RADIUS authentication for both console and administrative users, but to uncon-
ditionally allow access for administrative and console users if the RADIUS server (in this case, server r1 in server group
sg1) does not respond. To configure unconditional authentication, Natasha sets the authentication method to none. She
types the following commands in this order:
WSS# set user natasha password m@Jor
User natasha created
WSS# set radius server r1 address 192.168.253.1 key sunFLOW#$
success: change accepted.
WSS# set server group sg1 members r1
success: change accepted.
WSS# set authentication console * sg1 none
success: change accepted.
WSS# set authentication admin * sg1 none
success: change accepted.
WSS# save config
success: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing User Passwords 91
Managing User Passwords
Passwords Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Configuring Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Displaying Password Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Passwords Overview
Nortel recommends that all users create passwords that are easily remembered, difficult for others to guess, and not
subject to a dictionary attack.
By default, user passwords are automatically encrypted when entered in the local database. However, the encryption
type is not very strong. It is designed to discourage someone from memorizing your password as you display the config-
uration. To maintain security, WSS displays only the encrypted form of the password in show commands.
You can configure WSS so that the following additional restrictions apply to user passwords:
•
Passwords must be a minimum of 10 characters in length. It should be a mix of uppercase letters, lowercase letters,
numbers, and special characters, including at least two of each (for example, Nor%Pag32!).
•
•
•
•
Local users cannot reuse any of their 10 previous passwords.
When a user changes password, at least 4 characters must be different from the previous password.
A user password expires after a configurable amount of time.
A user is locked out of the system after a configurable number of failed login attempts. When this happens, a trap is
generated and an alert is logged. (Administrative users can gain access to the system through the console, even
when the account is locked.)
•
•
Only one unsuccessful login attempt is allowed in a 10-second period for a user or session.
All administrative logins, logouts, logouts due to idle timeout, and disconnects are logged.
•
The audit log file on the WSS (command_audit.cur) cannot be deleted, and attempts to delete log files are recorded.
Note. The above restrictions are optional.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
92 Managing User Passwords
Configuring Passwords
To configure passwords, you can perform the following tasks:
•
•
•
•
•
•
Set a password for a user in the local database.
Enable restrictions on password usage.
Set the maximum number of failed login attempts
Specify the minimum password length allowed.
Set the time duration, before password expiration.
Restore access to a user, that is locked out of the system.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing User Passwords 93
Setting passwords for local users
To configure a user password in the local database, type the following command:
set user username password [encrypted] password
For example, to configure user Jose with the password spRin9 in the local database on the WSS, type the following
command:
WSS# set user Jose password spRin9
success: User Jose created
The encrypted option indicates that the password string is the encrypted form of the password. Use this option only if
you do not want WSS to encrypt the password for you.
By default, usernames and passwords in the local database are not case-sensitive. Passwords can be case-sensitive by
activating password restrictions.
To clear a user from the local database, type the following command:
clear user username
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
94 Managing User Passwords
Enabling password restrictions
To activate password restrictions for network and administrative users, use the following command:
set authentication password-restrict {enable | disable}
When the above command is enabled, the following password restrictions takes effect:
•
Passwords must be a minimum of 10 characters in length. It should be a mix of uppercase letters, lowercase letters,
numbers, and special characters, including at least two of each (for example, Tre%Pag32!).
•
•
A user cannot reuse any of his or her 10 previous passwords (not applicable to network users).
When a user changes his or her password, at least 4 characters must be different from the previous password.
The password restrictions are disabled by default. When you enable them, WSS evaluates the passwords configured on
the WSS and a list of users with passwords appears, that does not meet the restriction on length and character types.
For example, to enable password restrictions on the WSS, type the following command:
WSS# set authentication password-restrict enable
warning: the following users have passwords that do not have atleast 2 each of upper-case letters,
lower-case letters, numbers and special characters -
administrator
admin
user1
user2
admin2
jsmith
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing User Passwords 95
Setting the maximum number of login attempts
To specify the maximum number of login attempts before a user is locked out of the system, use the following
command:
set authentication max-attempts number
By default,
•
•
for Telnet or SSH sessions, a maximum of 4 failed login attempts are allowed.
for console or network sessions, an unlimited number of failed login attempts are allowed.
Specify a number between 0 – 2147483647. Specifying 0 causes the number of allowable login attempts to reset the
default values.
If a user is locked out of the system, you can restore the user access with the clear user lockout command.
For example, to allow users a maximum of 3 attempts to log into the system, type the following command:
WSS# set authentication max-attempts 3
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
96 Managing User Passwords
Specifying minimum password length
To specify the minimum allowable length for user passwords, use the following command:
set authentication minimum-password-length length
The minimum password length has to be between 0 – 32 characters. Specifying 0 removes the restriction on password
length. By default, there is no minimum length for user passwords. When this command is configured, you cannot
configure a password shorter than the specified length.
When you enable this command, WSS evaluates the passwords configured on the WSS and a list of users whose
password does not meet the minimum length restriction appears.
For example, to set the minimum length for user passwords at 7 characters, type the following command:
WSS# set authentication minimum-password-length 7
warning: the following users have passwords that are shorter than the minimum password length -
administrator
admin
user2
admin2
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing User Passwords 97
Configuring password expiration time
To specify how long a user password is valid before it must be reset, use the following command:
set user username expire-password-in time
To specify how long the passwords are valid for users in a user group, use the following command:
set usergroup group-name expire-password-in time
By default, user passwords do not expire. This command specifies the time duration, that a user password is valid. After
this, the user password expires, and a new password is required. The amount of time can be specified in days (for
example, 30 or 30d), hours (720h), or a combination of days and hours (30d12h)
For example, the following command sets user Student1’s password to be valid for 30 days:
WSS# set user Student1 expire-password-in 30
success: change accepted.
The following command sets user Student1 password to be valid for 30 days and 15 hours:
WSS# set user Student1 expire-password-in 30d15h
success: change accepted.
The following command sets user Student1 password to be valid for 720 hours:
WSS# set user Student1 expire-password-in 720h
success: change accepted.
The following command sets the passwords for the users in user group cardiology to be valid for 30 days:
WSS# set usergroup cardiology expire-password-in 30
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
98 Managing User Passwords
Restoring access to a locked-out user
If a user password has expired, or the user cannot login within the configured limit for login attempts, then the user is
locked out of the system, and cannot gain access without the intervention of an administrator.
To restore access to a user locked out of the system, use the following command:
clear user username lockout
If a user is locked out of the system due to an expired password, then first assign the user a new password before you can
restore access.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing User Passwords 99
The following command restores access to user Nin, who is locked out of the system:
WSS# clear user Nin lockout
success: change accepted.
Displaying Password Information
User password information appears with the show web-based aaa command.
For example:
WSS# show web-based aaa
set authentication password-restrict enable
set authentication minimum-password-length 10
user bob
Password = 00121a08015e1f (encrypted)
Password-expires-in = 59 hours (2 days 11 hours)
status = disabled
vlan-name = default
service-type = 7
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
100 Managing User Passwords
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
101
Configuring and managing ports and
VLANs
Configuring and managing ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Configuring and managing VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Managing the layer 2 forwarding database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Port and VLAN configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Configuring and managing ports
You can configure and display information for the following port parameters:
•
•
•
•
•
•
Port type
Name
Speed and autonegotiation
Port state
Power over Ethernet (PoE) state
Load sharing
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
102 Configuring and managing ports and VLANs
Setting the port type
A WSS port can be one of the following types:
•
Network port. A network port is a Layer 2 switch port that connects the WSS to other networking devices such as
switches and routers.
•
AP access port. An AP access port connects the WSS to an AP. The port also can provide power to the AP. Wireless
users are authenticated to the network through an AP access port.
Note. A Distributed AP, which is connected to WSSs through intermediate
Layer 2 or Layer 3 networks, does not use an AP access port. To configure for a
•
Wired authentication port. A wired authentication port connects the WSS to user devices, such as workstations, that
must be authenticated to access the network.
All WSS ports are network ports by default. You must set the port type for ports directly connected to AP access ports
and to wired user stations that must be authenticated to access the network. When you change port type, WSS Software
applies default settings appropriate for the port type. Table 1 lists the default settings applied for each port type. For
example, the AP column lists default settings that WSS Software applies when you change a port type to ap (access
point).
Table 1: Port Defaults set by port type change
Port type
Parameter
AP Access
Wired Authentication
Network
VLAN
membership
Removed from all
Removed from all VLANs. You None
cannot assign a wired
VLANs. You cannot
assign an AP access
port to a VLAN. WSS
authentication port to a VLAN.
Note: If you clear a
WSS Software automatically
port, WSS Software
resets the port as a
network port but does
not add the port back to
any VLANs. You must
explicitly add the port
to the desired
Software automatically assigns wired authentication
assigns AP access ports ports to VLANs based on user
to VLANs based on
user traffic.
traffic.
VLAN(s).
Spanning Tree
Protocol (STP)
Not applicable
Not applicable
Based on the STP states of
the VLANs the port is in.
802.1X
Uses authentication
Uses authentication parameters No authentication.
parameters configured configured for users.
for users.
Port groups
Not applicable
Not applicable
None
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 103
Table 1: Port Defaults set by port type change (continued)
Port type
Parameter
AP Access
Wired Authentication
Network
IGMP snooping Enabled as users are
authenticated and join
VLANs.
Enabled as users are
Enabled as the port is added
authenticated and join VLANs. to VLANs.
Maximum user
sessions
Not applicable
1 (one)
Not applicable
Table 2 lists how many APs you can configure on a WSS, and how many APs a switch can boot. The numbers are for
directly connected and Distributed APs combined.
Table 2: Maximum APs supported per switch
Maximum That Can Be Maximum That Can Be
WSS Model
Configured
Booted
MX-2800
2382
2048
512, depending on the
license level
320
300
32, 64, 96 or 128,
depending on the license
level
2380
40, 80, or 120, depending
on the license level
2360/2361
2350
30
8
12
3
Setting a port for a directly connected AP
Note. Before configuring a port as an AP access port, you must use the set system
countrycode command to set the IEEE 802.11 country-specific regulations on the WSS.
To set a port for an AP, use the following command:
set port type ap port-list
model {2330 | 2330A | 2330B | 2332-A1 | 2332-A2 | 2332-A3 | 2332-A4 | 2332-A5 | 2332-A6
| 2332-E1 | 2332-E2 | 2332-E3 | 2332-E4 | 2332-E5 |2332-E6 | 2332-E7 | 2332-E8 | 2332-E9 |
2332-J1}
poe {enable | disable}
[radiotype {11a | 11b| 11g}]
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
104 Configuring and managing ports and VLANs
You must specify a port list of one or more port numbers, the AP model number, and the PoE state. (For
On two-radio AP models, one radio is always 802.11a. The other radio is 802.11b/g, but can be configured for
802.11b or 802.11g exclusively. If the country of operation specified by the set system countrycode
command does not allow 802.11g, the default is 802.11b.
Note. You cannot configure any gigabit Ethernet port, or port 7 or 8 on a 2360/2361
switch, or port 1 on a 2350, or port 3 on an 2382 as an AP port. To manage an AP on a
switch model that does not have 10/100 Ethernet ports, configure a Distributed AP
The following models have internal antennas but also have connectors for optional use of external antennas
2330, 2330A, 2330B, and Series 2332. (Antenna support on a specific model is limited to the antennas
certified for use with that model.) To specify the antenna model, use the set ap radio antennatype command.
To set ports 4 through 6 for AP model 2330 and enable PoE on the ports, type the following command:
WSS# set ap <apnum> port 4- 6 model 2330 poe {enable|disable}
This may affect the power applied on the configured ports. Would you like to continue?
(y/n) [n]y
success: change accepted.
Note. Additional configuration is required to place an AP into operation. For information,
Configuring for a AP
To configure a connection for a AP (referred to as a AP in the CLI), use the following command:
set ap ap-num serial-id serial-ID
model {2330 | 2330A | 2330B | 2332-A1 | 2332-A2 | 2332-A3 | 2332-A4 | 2332-A5 |
2332-A6 | 2332-E1 | 2332-E2 | 2332-E3 | 2332-E4 | 2332-E5 |2332-E6 | 2332-E7 |
2332-E8 | 2332-E9 | 2332-J1}
[radiotype {11a | 11b| 11g}]
Note. The variable, apnum, can have a value from 1 to 9999 on the network.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 105
The ap-num parameter identifies the AP connection for the AP. The range of valid connection ID numbers depends on
Table 3: Valid ap-num Values
Switch Model
Valid Range
MX-2800
2382
1 to 2048
1 to 320
1 to 300
1 to 30
2380
2360/2361
2350
1 to 8
For the serial-id parameter, specify the serial ID of the AP. The serial ID is listed on the AP case. To display the serial
ID using the CLI, use the show version details command.
The model and radiotype parameters have the same options as they do with the set port type ap command. Because the
WSS does not supply power to an indirectly connected AP, the set ap command does not use the poe parameter.
To configure AP connection 1 for AP model 2330 with serial-ID 0322199999, type the following command:
WSS# set ap 1 serial-id 0322199999 model 2330
success: change accepted.
Setting a port for a wired authentication user
To set a port for a wired authentication user, use the following command:
set port type wired-auth port-list [tag tag-list] [max-sessions num]
[auth-fall-thru {last-resort | none | web-portal}]
You must specify a port list. Optionally, you also can specify a tag-list to subdivide the port into virtual ports, set the
maximum number of simultaneous user sessions that can be active on the port, and change the fallthru authentication
type.
By default, one user session can be active on the port at a time.
The fallthru authentication type is used if the user does not support 802.1X and is not authenticated by MAC authentica-
tion. The default is none, which means the user is automatically denied access if neither 802.1X authentication or MAC
authentication is successful.
To set port 17 as a wired authentication port, type the following command:
WSS# set port type wired-auth 17
success: change accepted
This command configures port 17 as a wired authentication port supporting one interface and one simultaneous user
session.
For 802.1X clients, wired authentication works only if the clients are directly attached to the wired authentication port,
or are attached through a hub that does not block forwarding of packets from the client to the PAE group address
(01:80:c2:00:00:03). Wired authentication works in accordance with the 802.1X specification, which prohibits a client
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
106 Configuring and managing ports and VLANs
from sending traffic directly to an authenticator’s MAC address until the client is authenticated. Instead of
sending traffic to the authenticator’s MAC address, the client sends packets to the PAE group address. The
802.1X specification prohibits networking devices from forwarding PAE group address packets, because this
would make it possible for multiple authenticators to acquire the same client.
For non-802.1X clients, who use MAC authentication, Web-based AAA, or last-resort authentication, wired
authentication works if the clients are directly attached or indirectly attached.
Note. If clients are connected to a wired authentication port through a downstream
third-party switch, the WSS attempts to authenticate based on any traffic coming from the
switch, such as Spanning Tree Protocol (STP) BPDUs. In this case, disable repetitive traffic
emissions such as STP BPDUs from downstream switches. If you want to provide a
management path to a downstream switch, use MAC authentication.
Clearing a port
Caution! When you clear a port, WSS Software ends user sessions that are using the
port.
To change a port’s type from AP access port or wired authentication port, you must first clear the port, then set
the port type.
Clearing a port removes all the port’s configuration settings and resets the port as a network port.
•
•
•
If the port is an AP access port, clearing the port disables PoE and 802.1X authentication.
If the port is a wired authenticated port, clearing the port disables 802.1X authentication.
If the port is a network port, the port must first be removed from all VLANs, which removes the port from
all spanning trees, load-sharing port groups, and so on.
Note. A cleared port is not placed in any VLANs, not even the default VLAN (VLAN 1).
To clear a port, use the following command:
clear port type port-list
For example, to clear the port-related settings from port 5 and reset the port as a network port, type the
following command:
WSS# clear port type 5
This may disrupt currently authenticated users. Are you sure? (y/n) [n]y
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 107
Clearing a AP
Caution! When you clear a AP, WSS Software ends user sessions that are using the
AP.
To clear a AP, use the following command:
clear ap ap-num
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
108 Configuring and managing ports and VLANs
Configuring a port name
Each WSS port has a number but does not have a name by default.
Setting a port name
To set a port name, use the following command:
set port port name name
You can specify only a single port number with the command.
To set the name of port 14 to adminpool, type the following command:
WSS# set port 14 name adminpool
success: change accepted.
Note. To avoid confusion, Nortel recommends that you do not use numbers as port
names.
Removing a port name
To remove a port name, use the following command:
clear port port-list name
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 109
Configuring media type on a dual-interface gigabit ethernet port (2380
only)
The gigabit Ethernet ports on a 2380 switch have two physical interfaces: a 1000BASE-TX copper interface and a
1000BASE-SX or 1000BASE-LX fiber interface. The copper interface is provided by a built-in RJ-45 connector. The
fiber interface is optional and requires insertion of a Gigabit interface converter (GBIC).
Only one interface can be active on a port. By default, the GBIC (fiber) interface is active. You can configure a port to
use its the RJ-45 (copper) interface instead.
If you set the port interface to RJ-45 on a port that already has an active fiber link, WSS Software immediately changes
the link to the copper interface.
To disable the fiber interface and enable the copper interface on a 2380 port, use the following command:
set port media-type port-list rj45
To disable the copper interface and reenable the fiber interface on a 2380 port, use the following command:
clear port media-type port-list
To display the enabled interface type for each port, use the following command:
show port media-type [port-list]
To disable the fiber interface and enable the copper interface of port 2 on a 2380 switch and verify the change, type the
following commands:
2380# set port media-type 2 rj45
2380# show port media-type
Port Media Type
===========================================================
1 GBIC
2 RJ45
3 GBIC
4 GBIC
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
110 Configuring and managing ports and VLANs
Configuring port operating parameters
Autonegotiation is enabled by default on a WSS’s 10/100 Ethernet ports and gigabit Ethernet ports.
Note. All ports on the 2380 switches support full-duplex operating mode only. They do
not support half-duplex operation. The 10/100 ports on the 2360/2361 or 2382 switches
support half-duplex and full-duplex operation.
Note. Nortel recommends that you do not configure the mode of a WSS port so that one
side of the link is set to autonegotiation while the other side is set to full-duplex. Although
WSS Software allows this configuration, it can result in slow throughput on the link. The
slow throughput occurs because the side that is configured for autonegotiation falls back to
half-duplex. A stream of large packets sent to a WSS port in such a configuration can cause
forwarding on the link to stop.
You can configure the following port operating parameters:
•
•
•
•
Speed
Autonegotiation
Port state
PoE state
You also can toggle a port’s administrative state and PoE setting off and back on to reset the port.
10/100 Ports—autonegotiation and port speed
WSS 10/100 Ethernet ports use autonegotiation by default to determine the appropriate port speed.
To explicitly set the port speed of a 10/100 port, use the following command:
set port speed port-list {10 | 100 | auto}
Note. If you explicitly set the port speed (by selecting an option other than auto) of a 10/
100 Ethernet port, the operating mode is set to full-duplex.
Note. WSS Software allows the port speed of a gigabit port to be set to auto. However,
this setting is invalid. If you set the port speed of a gigabit port to auto, the link will stop
working.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 111
To set the port speed on ports 1 and 5 to 10 Mbps, type the following command:
WSS# set port speed 1, 5 10
Gigabit Ports—autonegotiation and flow control
WSS gigabit ports use autonegotiation by default to determine capabilities for 802.3z flow control parameters. The
gigabit ports can respond to IEEE 802.3z flow control packets. Some devices use this capability to prevent packet loss
by temporarily pausing data transmission.
To disable flow control negotiation on a WSS gigabit port, use the following command:
set port negotiation port-list {enable | disable}
Note. The gigabit Ethernet ports operate at 1000 Mbps only. They do not change speed
to match 10-Mbps or 100-Mbps links.
Disabling a port
All ports are enabled by default. To administratively disable a port, use the following command:
set port {enable | disable} port-list
A port that is administratively disabled cannot send or receive packets. This command does not affect the link state of
the port.
Disabling power over ethernet
Power over Ethernet (PoE) supplies DC power to a device connected to an AP access port. The PoE state depends on
whether you enable or disable PoE when you set the port type. (See “Setting the port type” on page 102.)
Caution! Use the WSS’s PoE only to power Nortel APs. If you enable PoE on ports
connected to other devices, damage can result.
Note. PoE is supported only on 10/100 Ethernet ports. PoE is not supported on any
gigabit Ethernet ports, or on ports 7 and 8 on a 2360/2361 switch, or port 1 on a 2350, or
port 3 on an 2382.
To change the PoE state on a port, use the following command:
set port poe port-list enable | disable
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
112 Configuring and managing ports and VLANs
Resetting a port
You can reset a port by toggling its link state and PoE state. WSS Software disables the port’s link and PoE (if
applicable) for at least one second, then reenables them. This feature is useful for forcing an AP that is
connected to two WSS switches to reboot using the port connected to the other switch.
To reset a port, use the following command:
reset port port-list
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 113
Displaying port information
You can use CLI commands to display the following port information:
•
•
•
Port configuration and status
PoE state
Port statistics
You also can configure WSS Software to display and regularly update port statistics in a separate window.
Displaying port configuration and status
To display port configuration and status information, use the following command:
show port status [port-list]
To display information for all ports, type the following command:
# show port status
Port Name Admin Oper
Config Actual
Type
Media
1 1
up
up
up
up
up
up
up
up
up
auto
auto
auto
auto
auto
auto
auto
100/full
network
network
network
network
ap
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
no connector
no connector
2 2
3 3
4 4
5 5
6 6
7 7
8 8
down
down
down
up
100/full
100/full
up
network
network
network
down
down auto
In this example, three of the switch’s ports, 1, 5, and 6, have an operational status of up, indicating the links on
the ports are available. Ports 1 and 6 are network ports. Port 5 is an AP access port.
(For more information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series
Command Line Reference.)
Displaying PoE state
To display the PoE state of a port, use the following command:
show port poe [port-list]
To display PoE information for ports 2 and 4, type the following command:
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
114 Configuring and managing ports and VLANs
WSS# show port poe 2,4
P o r t N a m e L i n k S t a t u s P o r t Ty p e
P o E c o n f i g
disabled
P o E D r a w
off
2 2
down
AP
4 4
up
AP
enabled
1.44
In this example, PoE is disabled on port 2 and enabled on port 4. The AP connected to port 4 is drawing 1.44 W of power
from the WSS.
(For more information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Displaying port statistics
To display port statistics, use the following command:
show port counters [octets | packets | receive-errors | transmit-errors | collisions |
receive-etherstats | transmit-etherstats] [port port-list]
You can specify one statistic type with the command. For example, to display octet statistics for port 3, type the
following command:
WSS# show port counters octets port 3
Port Status
Rx Octets Tx Octets
==============================================================================
3 Up 27965420 34886544
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Note. To display all types of statistics with the same command, use the monitor port
Clearing statistics counters
To clear all port statistics counters, use the following command:
clear port counters
The counters begin incrementing again, starting from 0.
Monitoring port statistics
You can display port statistics in a format that continually updates the counters. When you enable monitoring of port
statistics, WSS Software clears the CLI session window and displays the statistics at the top of the window. WSS
Software refreshes the statistics every 5 seconds. This interval cannot be configured.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 115
To monitor port statistics, use the following command:
monitor port counters [octets | packets | receive-errors | transmit-errors | collisions |
receive-etherstats | transmit-etherstats]
Statistics types are displayed in the following order by default:
•
•
•
•
•
•
•
Octets
Packets
Receive errors
Transmit errors
Collisions
Receive Ethernet statistics
Transmit Ethernet statistics
Each type of statistic is displayed separately. Press the Spacebar to cycle through the displays for each type.
If you use an option to specify a statistic type, the display begins with that statistic type. You can use one
statistic option with the command.
Table 4: Key controls for monitor port counters display
Key
Effect on monitor display
Spacebar
Esc
Advances to the next statistics type.
Exits the monitor. WSS Software stops displaying the statistics
and displays a new command prompt.
c
Clears the statistics counters for the currently displayed statistics
type. The counters begin incrementing again.
To monitor port statistics beginning with octet statistics (the default), type the following command:
WSS# monitor port counters
As soon as you press Enter, WSS Software clears the window and displays statistics at the top of the window.
In this example, the octet statistics are displayed first.
P o r t S t a t u s R x O c t e t s
Up 27965420
T x O c t e t s
34886544
1
To cycle the display to the next set of statistics, press the Spacebar. In this example, packet statistics are
displayed next:
Port Status Rx Unicast
Up 54620
Rx NonUnicast
62144
Tx Unicast
68318
Tx NonUnicast
62556
1
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
116 Configuring and managing ports and VLANs
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 117
Configuring load-sharing port groups
A port group is a set of physical ports that function together as a single link and provide load sharing and link redun-
dancy. Only network ports can participate in a port group.
You can configure up to 16 ports in a port group, in any combination of ports. The port numbers do not need to be
contiguous and you can use 10/100 Ethernet ports and gigabit Ethernet ports in the same port group.
Load sharing
A WSS balances the port group traffic among the group’s physical ports by assigning traffic flows to ports based on the
traffic’s source and destination MAC addresses. The switch assigns a traffic flow to an individual port and uses the same
port for all subsequent traffic for that flow.
Link redundancy
A port group ensures link stability by providing redundant connections for the same link. If an individual port in a group
fails, the WSS reassigns traffic to the remaining ports. When the failed port starts operating again, the WSS begins using
it for new traffic flows. Traffic that belonged to the port before it failed continues to be assigned to other ports.
Configuring a port group
To configure a port group, use the following command:
set port-group name group-name port-list mode {on | off}
Enter a name for the group and the ports contained in the group.
Note. Do not use dashes or hyphens in a port group name. WSS Software will not
display or save the port group.
The mode parameter adds or removes ports for a group that is already configured. To modify a group:
•
•
Adding ports—Enter the ports you want to add, then enter mode on.
Removing ports—Enter the ports you want to remove, then enter mode off.
To configure a port group named server1 containing ports 1 through 5 and enable the link, type the following command:
WSS# set port-group name server1 1-5 mode on
success: change accepted.
After you configure a port group, you can use the port group name with commands that change Layer 2 configuration
parameters to apply configuration changes to all ports in the port group. For example, Spanning Tree Protocol (STP) and
VLAN membership changes affect the entire port group instead of individual ports. When you make Layer 2 configura-
tion changes, you can use a port group name in place of the port list. Ethernet port statistics continue to apply to
individual ports, not to port groups.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
118 Configuring and managing ports and VLANs
To configure a port group named server2 containing ports 15 and 17 and add the ports to the default VLAN,
type the following commands:
WSS# set port-group name server2 15,17 mode on
success: change accepted.
WSS# set vlan default port server2
success: change accepted.
To verify the configuration change, type the following command:
WSS# show vlan config
VLAN
Name
Admin
default
VLAN
Status
Up
State Affin Port
server2
Tag
State
Up
Tunl Port
1
Up
5
none
To indicate that the ports are configured as a port group, the show vlan config output lists the port group name
instead of the individual port numbers.
Removing a port group
To remove a port group, use the following command:
clear port-group name name
Displaying port group information
To display port group information, use the following command:
show port-group [name group-name]
To display the configuration and status of port group server2, type the following command:
WSS# show port-group name server2
Port group: server2 is up
Ports: 15, 17
Interoperating with Cisco Systems EtherChannel
Load-sharing port groups are interoperable with Cisco Systems EtherChannel capabilities. To configure a
Cisco Catalyst switch to interoperate with a Nortel WSS, use the following command on the Catalyst switch:
set port channel port-list mode on
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 119
Configuring and managing VLANs
Note. The CLI commands in this chapter configure VLANs on WSS network ports. The
commands do not configure VLAN membership for wireless or wired authentication users.
To assign a user to a VLAN, configure the RADIUS Tunnel-Private-Group-ID attribute or the
VLAN-Name vendor specific attribute (VSA) for that user. (For more information, see
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
120 Configuring and managing ports and VLANs
Understanding VLANs in Nortel WSS software
A virtual LAN (VLAN) is a Layer 2 broadcast domain that can span multiple wired or wireless LAN
segments. Each VLAN is a separate logical network and, if you configure IP interfaces on the VLANs, WSS
Software treats each VLAN as a separate IP subnet.
Only network ports can be preconfigured to be members of one or more VLAN(s). You configure VLANs on
a WSS’s network ports by configuring them on the switch itself. You configure a VLAN by assigning a name
and network ports to the VLAN. Optionally, you can assign VLAN tag values on individual network ports.
You can configure multiple VLANs on a WSS’s network ports. Optionally, each VLAN can have an IP
address.
VLANs are not configured on AP access ports or wired authentication ports, because the VLAN membership
of these types of ports is determined dynamically through the authentication and authorization process. Users
who require authentication connect through WSS ports that are configured for APs or wired authentication
access. Users are assigned to VLANs automatically through authentication and authorization mechanisms
such as 802.1X.
By default, none of a WSS’s ports are in VLANs. A switch cannot forward traffic on the network until you
configure VLANs and add network ports to those VLANs.
Note. A wireless client cannot join a VLAN if the physical network ports on the WSS in
the VLAN are down. However, a wireless client that is already in a VLAN whose physical
network ports go down remains in the VLAN even though the VLAN is down.
VLANs, IP subnets, and IP addressing
Generally, VLANs are equivalent to IP subnets. If a WSS is connected to the network by only one IP subnet,
the switch must have at least one VLAN configured. Optionally, each VLAN can have its own IP address.
However, no two IP addresses on the switch can belong to the same IP subnet.
You must assign the system IP address to one of the VLANs, for communications between WSSs and for
unsolicited communications such as SNMP traps and RADIUS accounting messages. Any IP address config-
ured on a WSS can be used for management access unless explicitly restricted. (For more information about
Users and VLANs
When a user successfully authenticates to the network, the user is assigned to a specific VLAN. A user
remains associated with the same VLAN throughout the user’s session on the network, even when roaming
from one WSS to another within the Mobility Domain.
You assign a user to a VLAN by setting one of the following attributes on the RADIUS servers or in the local
user database:
•
Tunnel-Private-Group-ID—This attribute is described in RFC 2868, RADIUS Attributes for Tunnel
Protocol Support.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 121
VLAN Name—This attribute is a Nortel vendor-specific attribute (VSA).
•
Note. You cannot configure the Tunnel-Private-Group-ID attribute in the local user
database.
Specify the VLAN name, not the VLAN number. The examples in this chapter assume the VLAN is assigned on a
RADIUS server with either of the valid attributes. (For more information, see “Configuring AAA for network users” on
page 541.)
VLAN names
To create a VLAN, you must assign a name to it. VLAN names must be globally unique across a Mobility Domain to
ensure the intended user connectivity as determined through authentication and authorization.
Every VLAN on a WSS has both a VLAN name, used for authorization purposes, and a VLAN number. VLAN numbers
can vary uniquely for each WSS and are not related to 802.1Q tag values.
You cannot use a number as the first character in a VLAN name.
Roaming and VLANs
WSSs in a Mobility Domain contain a user’s traffic within the VLAN that the user is assigned to. For example, if you
assign a user to VLAN red, the WSSs in the Mobility Domain contain the user’s traffic within VLAN red configured on
the switches.
The WSS through which a user is authenticated is not required to be a member of the VLAN the user is assigned to. You
are not required to configure the VLAN on all WSSs in the Mobility Domain. When a user roams to a switch that is not
a member of the VLAN the user is assigned to, the switch can tunnel traffic for the user through another switch that is a
member of the VLAN. The traffic can be of any protocol type. (For more information about Mobility Domains, see
Note. Because the default VLAN (VLAN 1) might not be in the same subnet on each
switch, Nortel recommends that you do not rename the default VLAN or use it for user
traffic. Instead, configure other VLANs for user traffic.
Traffic forwarding
A WSS switches traffic at Layer 2 among ports in the same VLAN. For example, suppose you configure ports 4 and 5 to
belong to VLAN 2 and ports 6 and 7 to belong to VLAN 3. As a result, traffic between port 4 and port 5 is switched, but
traffic between port 4 and port 6 is not switched and needs to be routed by an external router.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
122 Configuring and managing ports and VLANs
802.1Q tagging
The tagging capabilities of the WSS are very flexible. You can assign 802.1Q tag values on a per-VLAN,
per-port basis. The same VLAN can have different tag values on different ports. In addition, the same tag
value can be used by different VLANs but on different network ports.
If you use a tag value, Nortel recommends that you use the same value as the VLAN number. WSS Software
does not require the VLAN number and tag value to be the same, but some other vendors’ devices do.
Note. Do not assign the same VLAN multiple times using different tag values to the
same network port. Although WSS Software does not prohibit you from doing so, the
configuration is not supported.
WSS Software automatically assigns tag values to Distributed APs. Each of these tag values represents a
unique combination of radio, encryption type, and VLAN. These tag values do not necessarily correspond to
tag values you configure on the VLAN ports through which the Distributed AP is connected to the WSS.
Tunnel affinity
WSSs configured as a Mobility Domain allow users to roam seamlessly across APs and even across WSSs.
Although a switch that is not a member of a user’s VLAN cannot directly forward traffic for the user, the
switch can tunnel the traffic to another WSS that is a member of the user’s VLAN.
If the WSS that is not in the user’s VLAN has a choice of more than one other WSS through which to tunnel
the user’s traffic, the switch selects the other switch based on an affinity value. This is a numeric value that
each WSS within a Mobility Domain advertises, for each of its VLANs, to all other switches in the Mobility
Domain. A switch outside the user’s VLAN selects the other operational switch that has the highest affinity
value for the user’s VLAN to forward traffic for the user.
If more than one WSS has the highest affinity value, WSS Software randomly selects one of the switches for
the tunnel.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 123
Configuring a VLAN
You can configure the following VLAN parameters:
•
•
•
•
•
•
VLAN number
VLAN name
Port list (the ports in the VLAN)
Per-port tag value (an 802.1Q value representing a virtual port in the VLAN)
Tunnel affinity (a value that influences tunneling connections for roaming)
MAC restriction list (if you want to prevent clients from communicating with one another directly at
Layer 2)
Creating a VLAN
To create a VLAN, use the following command:
set vlan vlan-num name name
Specify a VLAN number from 2 to 3583, and specify a name up to 16 alphabetic characters long.
You cannot use a number as the first character in a VLAN name. Nortel recommends that you do not use the
same name with different capitalizations for VLANs or ACLs. For example, do not configure two separate
VLANs with the names red and RED.
Note. Nortel recommends that you do not use the name default. This name is already
used for VLAN 1. Nortel also recommends that you do not rename the default VLAN.
You must assign a name to a VLAN before you can add ports to the VLAN. You can configure the name and
add ports with a single set vlan command or separate set vlan commands.
Once you assign a VLAN number to a VLAN, you cannot change the number. However, you can change a
VLAN’s name.
For example, to assign the name red to VLAN 2, type the following command:
WSS# set vlan 2 name red
After you create a VLAN, you can use the VLAN number or the VLAN name in commands. In addition, the
VLAN name appears in CLI and WLAN Management Software displays.
Adding ports to a VLAN
To add a port to a VLAN, use the following command:
set vlan vlan-id port port-list [tag tag-value]
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
124 Configuring and managing ports and VLANs
You can specify a tag value from 1 through 3583.
Note. WSS Software does not remove a port from other VLANs when you add the port
to a new VLAN. If a new VLAN causes a configuration conflict with an older VLAN, remove
the port from the older VLAN before adding the port to the new VLAN.
For example, to add ports 2 through 4 and port 8 to VLAN red, type the following command:
WSS# set vlan red port 2-4,8
success: change accepted.
Optionally, you also can specify a tag value to be used on trunked 802.1Q ports.
To assign the name marigold to VLAN 4, add ports 4 through 6 and port 7, and assign tag value 11 to port 7,
type the following commands:
WSS# set vlan 4 name marigold port 4-6
success: change accepted.
WSS# set vlan 4 name marigold port 7 tag 11
success: change accepted.
Removing an entire VLAN or a VLAN port
To remove an entire VLAN or a specific port and tag value from a VLAN, use the following command:
clear vlan vlan-id [port port-list [tag tag-value]]
Caution! When you remove a VLAN, WSS Software completely removes the VLAN
from the configuration and also removes all configuration information that uses the VLAN.
If you want to remove only a specific port from the VLAN, make sure you specify the port
number in the command.
The clear vlan command with a VLAN ID but without a port list or tag value clears all ports and tag values
from the VLAN.
To remove port 8 from VLAN red, type the following command:
WSS# clear vlan red port 8
This may disrupt user connectivity. Do you wish to continue? (y/n) [n]y
success: change accepted.
To clear port 3, which uses tag value 11, from VLAN marigold, type the following command:
WSS# clear vlan marigold port 3 tag 11
This may disrupt user connectivity. Do you wish to continue? (y/n) [n]y
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 125
To completely remove VLAN ecru, type the following command:
WSS# clear vlan ecru
This may disrupt user connectivity. Do you wish to continue? (y/n) [n]y
success: change accepted.
Note. You cannot remove the default VLAN (VLAN 1). However, you can add and
remove ports. You can also rename the default VLAN, but Nortel recommends against it.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
126 Configuring and managing ports and VLANs
Changing tunneling affinity
To change the tunneling affinity, use the following command:
set vlan vlan-id tunnel-affinity num
Specify a value from 1 through 10. The default is 5.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 127
Restricting layer 2 forwarding among clients
By default, clients within a VLAN are able to communicate with one another directly at Layer 2. You can enhance
network security by restricting Layer 2 forwarding among clients in the same VLAN. When you restrict Layer 2
forwarding in a VLAN, WSS Software allows Layer 2 forwarding only between a client and a set of MAC addresses,
generally the VLAN’s default routers. Clients within the VLAN are not permitted to communicate among themselves
directly. To communicate with another client, the client must use one of the specified default routers.
Note. For networks with IP-only clients, you can restrict client-to-client forwarding using
To restrict Layer 2 forwarding in a VLAN, use the following command:
set security l2-restrict vlan vlan-id
[mode {enable | disable}] [permit-mac mac-addr [mac-addr]]
You can specify multiple addresses by listing them on the same command line or by entering multiple commands.
Restriction of client traffic does not begin until you enable the permitted MAC list. Use the mode enable option with
this command.
To change a MAC address, use the clear security l2-restrict command to remove it, then use the set security l2-restrict
command to add the correct address.
clear security l2-restrict vlan vlan-id
[permit-mac mac-addr [mac-addr] | all]
Note. There can be a slight delay before functions such as pinging between clients
become available again after Layer 2 restrictions are lifted. Even though packets are
passed immediately once Layer 2 restrictions are gone, it can take 10 seconds or more for
upper-layer protocols to update their ARP caches and regain their functionality.
To display configuration information and statistics for Layer 2 forwarding restriction, use the following command:
show security l2-restrict [vlan vlan-id | all]
The following commands restrict Layer 2 forwarding of client data in VLAN abc_air to the default routers with MAC
address aa:bb:cc:dd:ee:ff and 11:22:33:44:55:66, and display restriction information and statistics:
WSS# set security l2-restrict vlan abc_air mode enable permit-mac aa:bb:cc:dd:ee:ff
11:22:33:44:55:66
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
128 Configuring and managing ports and VLANs
success: change accepted.
WSS# show security l2-restrict
V L A N N a m e E n D r o p s
1 abc_air
P e r m i t M A C
H i t s
Y
0 aa:bb:cc:dd:ee:ff
5947
11:22:33:44:55:66
9
The En field indicates whether restriction is enabled. The Drops field indicates how many packets were
addressed directly from one client to another and dropped by WSS Software. The Hits field indicates how
many packets the permitted default router has received from clients.
To reset the statistics counters, use the following command:
clear security l2-restrict counters [vlan vlan-id | all]
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 129
Displaying VLAN information
To display VLAN configuration information, use the following command:
show vlan config [vlan-id]
To display information for VLAN burgundy, type the following command:
WSS# show vlan config burgundy
VLAN Admin
Name
VLAN
Status
Tunl State
Up
Affin Port
Port Tag
State
2
burgundy
Up
5
2
3
4
6
n o n e
n o n e
n o n e
n o n e
U p
U p
U p
U p
Note. The display can include AP access ports and wired authentication ports, because
WSS Software dynamically adds these ports to a VLAN when handling user traffic for the
VLAN.
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
130 Configuring and managing ports and VLANs
Managing the layer 2 forwarding database
A WSS uses a Layer 2 forwarding database (FDB) to forward traffic within a VLAN. The entries in the forwarding
database map MAC addresses to the physical or virtual ports connected to those MAC addresses within a particular
VLAN. To forward a packet to another device in a VLAN, the WSS searches the forwarding database for the packet’s
destination MAC address, then forwards the packet out the port associated with the MAC address.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 131
Types of forwarding database entries
The forwarding database can contain the following types of entries:
•
Dynamic—A dynamic entry is a temporary entry that remains in the database only until the entry is no longer used.
By default, a dynamic entry ages out if it remains unused for 300 seconds (5 minutes). All dynamic entries are
removed if the WSS is powered down or rebooted.
•
•
Static—A static entry does not age out, regardless of how often the entry is used. However, like dynamic entries,
static entries are removed if the WSS is powered down or rebooted.
Permanent—A permanent entry does not age out, regardless of how often the entry is used. In addition, a permanent
entry remains in the forwarding database even following a reboot or power cycle.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
132 Configuring and managing ports and VLANs
How entries enter the forwarding database
An entry enters the forwarding database in one of the following ways:
•
•
•
Learned from traffic received by the WSS —When the WSS receives a packet, the switch adds the
packet’s source MAC address to the forwarding database if the database does not already contain an entry
for that MAC address.
Added by the system administrator—You can add static and permanent unicast entries to the forwarding
database. (You cannot add a multicast or broadcast address as a permanent or static forwarding database
entry.)
Added by the WSS itself—For example, the authentication protocols can add entries for wired and
wireless authentication users. The WSS also adds any static entries added by the system administrator and
saved in the configuration file.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 133
Displaying forwarding database information
You can display the forwarding database size and the entries contained in the database.
Displaying the size of the forwarding database
To display the number of entries contained in the forwarding database, use the following command:
show fdb count {perm | static | dynamic} [vlan vlan-id]
For example, to display the number of dynamic entries that the forwarding database contains, type the following
command:
WSS# show fdb count dynamic
Total Matching Entries = 2
Displaying forwarding database entries
To display the entries in the forwarding database, use either of the following commands:
show fdb [mac-addr-wildcard [vlan vlan-id]]
show fdb {perm | static | dynamic | system | all} [port port-list | vlan vlan-id]
The mac-addr-wildcard parameter can be an individual address, or a portion of an address with the asterisk (*) wildcard
character representing from 1 to 5 bytes. The wildcard allows the parameter to indicate a list of MAC addresses that
match all the characters except the asterisk.
Use a colon between each byte in the address (for example, 11:22:33:aa:bb:cc or 11:22:33:*). You can enter the
asterisk (*) at the beginning or end of the address as a wildcard, on any byte boundary.
To display all entries in the forwarding database, type the following command:
WSS# show fdb all
* = Static Entry. + = Permanent Entry. # = System Entry.
VLAN Dest MAC/ Des [CoS]
Destination
Ports
[Protocol Type]
[ALL]
TAG
Route
1
00:01:97:13
:0b:1f
1
3
1
1
1
aa:bb:cc:dd:
ee:ff
*
[ALL]
00:0b:0e:02
:76:f5
[ALL]
Total Matching FDB Entries Displayed = 3
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
134 Configuring and managing ports and VLANs
To display all entries that begin with 00, type the following command:
WSS# show fdb 00:*
* = Static Entry. + = Permanent Entry. # = System Entry.
VLAN
TAG
Dest MAC/Route Des [CoS]
Destination Ports
[Protocol Type]
1
1
00:01:97:13:0b:1f
00:0b:0e:02:76:f5
1
1
[ALL]
[ALL]
Total Matching FDB Entries Displayed = 2
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 135
Adding an entry to the forwarding database
To add an entry to the forwarding database, use the following command:
set fdb {perm | static} mac-addr port port-list vlan vlan-id [tag tag-value]
To add a permanent entry for MAC address 00:bb:cc:dd:ee:ff on ports 3 and 5 in VLAN blue, type the following
command:
WSS# set fdb perm 00:bb:cc:dd:ee:ff port 3,5 vlan blue
success: change accepted.
To add a static entry for MAC address 00:2b:3c:4d:5e:6f on port 1 in the default VLAN, type the following command:
WSS# set fdb static 00:2b:3c:4d:5e:6f port 1 vlan default
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
136 Configuring and managing ports and VLANs
Removing entries from the forwarding database
To remove an entry from the forwarding database, use the following command:
clear fdb {perm | static | dynamic | port port-list} [vlan vlan-id] [tag tag-value]
To clear all dynamic forwarding database entries that match all VLANs, type the following command:
WSS# clear fdb dynamic
success: change accepted.
To clear all dynamic forwarding database entries that match ports 3 and 5, type the following command:
WSS# clear fdb port 3,5
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 137
Configuring the aging timeout period
The aging timeout period specifies how long a dynamic entry can remain unused before the software removes the entry
from the database.
You can change the aging timeout period on an individual VLAN basis. You can change the timeout period to a value
from 0 through 1,000,000 seconds. The default aging timeout period is 300 seconds (5 minutes). If you change the
timeout period to 0, aging is disabled.
Displaying the aging timeout period
To display the current setting of the aging timeout period, use the following command:
show fdb agingtime [vlan vlan-id]
For example, to display the aging timeout period for all configured VLANs, type the following command:
WSS# show fdb agingtime
VLAN 2 aging time = 300 sec
VLAN 1 aging time = 300 sec
Changing the aging timeout period
To change the aging timeout period, use the following command:
set fdb agingtime vlan-id age seconds
For example, to set the aging timeout period for VLAN 2 to 600 seconds, type the following command:
WSS# set fdb agingtime 2 age 600
success: change accepted.
Port and VLAN configuration scenario
This scenario assigns names to ports, and configures AP access ports, wired authentication ports, a load-sharing port
group, and VLANs.
1
Assign names to ports to identify their functions, and verify the configuration change. Type the following
commands:
WSS# set port 1 name wss_mgmt
success: change accepted.
WSS# set port 2 name finance
success: change accepted.
WSS# set port 3 name accounting
success: change accepted.
WSS# set port 4 name shipping
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
138 Configuring and managing ports and VLANs
WSS# set port 5 name lobby
success: change accepted.
WSS# set port 6 name conf_room1
success: change accepted.
WSS# set port 7 name conf_room2
success: change accepted.
WSS# set port 8-13 name manufacturing
success: change accepted.
WSS# set port 14-18 name rsrch_dev
success: change accepted.
WSS# set port 19-20 name mobility
success: change accepted.
WSS# set port 21,22 name backbone
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 139
WSS# show port status
Port Name
1 wss_mgmt
2 finance
Admin Oper
Config
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
Actual
Type
Media
up
up
up
up
up
up
up
up
100/full
network
network
network
network
network
network
network
network
network
network
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
down
down
down
down
down
down
down
down
down
3 accounting
4 shipping
5 lobby
6 conf_room1
7 conf_room2
8 manufacturing up
9 manufacturing up
10
up
up
up
up
manufacturing
11
down
down
down
auto
auto
auto
network
network
network
10/100BaseTx
10/100BaseTx
10/100BaseTx
manufacturing
12
manufacturing
13
manufacturing
14 rsrch_dev
15 rsrch_dev
16 rsrch_dev
17 rsrch_dev
18 rsrch_dev
19 mobility
20 mobility
21 backbone
22 backbone
up
up
up
up
up
up
up
up
up
down
down
down
down
down
up
auto
auto
auto
auto
auto
auto
auto
auto
auto
network
network
network
network
network
network
network
network
network
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
100/full
100/full
up
down
down
2
Configure the country code for operation in the US and verify the configuration change. Type the
following commands:
WSS# set system countrycode US
success: change accepted.
WSS# show system
===============================================================================
Product Name:
System Name:
WSS
WSS
System Countrycode: US
System Location:
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
140 Configuring and managing ports and VLANs
System Contact:
System IP:
0.0.0.0
System idle timeout:3600
System MAC:
00:0B:0E:00:04:0C
===============================================================================
Boot Time:
Uptime:
2000-03-18 22:59:19
0 days 00:13:45
===============================================================================
Fan status: fan1 OK fan2 OK fan3 OK
Temperature: temp1 ok temp2 ok temp3 ok
PSU Status: Lower Power Supply DC ok AC ok Upper Power Supply missing
Memory: 156.08/496.04 (31%)
Total Power Over Ethernet : 0.000
===============================================================================
3
Configure ports 2 through 16 for connection to AP model 2330 and verify the configuration changes.
Type the following commands:
WSS# set port type ap 2-16 model 2330 poe enable
This may affect the power applied on the configured ports. Would you like to continue? (y/n) [n]y
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 141
WSS# show port status
Port Name
1 wss_mgmt
2 finance
Admin Oper
Config
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
Actual
Type
Media
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
100/full
network
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
3 accounting
4 shipping
5 lobby
6 conf_room1
7 conf_room2
8 manufacturing up
9 manufacturing up
10
up
up
up
up
manufacturing
11
up
up
up
auto
auto
auto
100/full ap
100/full ap
100/full ap
10/100BaseTx
10/100BaseTx
10/100BaseTx
manufacturing
12
manufacturing
13
manufacturing
14 rsrch_dev
15 rsrch_dev
16 rsrch_dev
17 rsrch_dev
18 rsrch_dev
19 mobility
20 mobility
21 backbone
22 backbone
up
up
up
up
up
up
up
up
up
up
auto
auto
auto
auto
auto
auto
auto
auto
auto
100/full ap
100/full ap
100/full ap
10/100BaseTx
10/100BaseTx
10/100BaseTx
up
up
down
down
up
network
network
network
network
network
10/100BaseTx
10/100BaseTx
10/100BaseTx
100/full
100/full
up
down
down
WSS# show port poe
Link
Port
Port Name
PoE Status
PoE Type
config
Draw(Watts)
1
2
3
4
wss_mgmt
finance
up
up
up
up
-
disabled
enabled
enabled
enabled
off
AP
AP
AP
7.04
7.04
7.04
accounting
shipping
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
142 Configuring and managing ports and VLANs
Link
Port
Port Name
PoE Status
PoE Type
config
Draw(Watts)
5
6
7
8
9
lobby
up
up
up
AP
AP
AP
AP
AP
enabled
enabled
enabled
enabled
enabled
7.04
7.04
7.04
7.04
7.04
conf_room1
conf_room2
manufacturing up
up
manufacturing
10
11
12
13
14
15
16
17
18
19
20
21
22
manufacturing up
manufacturing up
manufacturing up
manufacturing up
AP
AP
AP
AP
AP
AP
AP
-
enabled
enabled
enabled
enabled
enabled
enabled
enabled
disabled
disabled
disabled
disabled
-
7.04
7.04
7.04
7.04
7.04
7.04
7.04
off
rsrch_dev
rsrch_dev
rsrch_dev
rsrch_dev
rsrch_dev
mobility
up
up
up
down
down
down
down
down
down
-
off
-
off
mobility
-
off
backbone
backbone
-
invalid
invalid
-
-
4
Configure ports 17 and 18 as wired authentication ports and verify the configuration change. Type the
following commands:
WSS# set port type wired-auth 17,18
success: change accepted
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing ports and VLANs 143
WSS# show port status
Port Name
Admin Oper
Config
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
auto
Actual
Type
Media
1 wss_mgmt
2 finance
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
up
100/full
network
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
10/100BaseTx
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
100/full ap
3 accounting
4 shipping
5 lobby
6 conf_room1
7 conf_room2
8 manufacturing
9 manufacturing
10 manufacturing up
11 manufacturing up
12 manufacturing up
13 manufacturing up
14 rsrch_dev
15 rsrch_dev
16 rsrch_dev
17 rsrch_dev
up
up
up
up
100/full
wired auth
18 rsrch_dev
up
up
auto
100/full
wired auth
10/100BaseTx
19 mobility
20 mobility
21 backbone
22 backbone
up
up
up
up
up
auto
auto
auto
auto
100/full
100/full
network
network
network
network
10/100BaseTx
10/100BaseTx
up
down
down
5
Configure ports 21 and 22 as a load-sharing port group to provide a redundant link to the backbone, and
verify the configuration change. Type the following commands:
WSS# set port-group name backbonelink port 21,22 mode on
success: change accepted.
WSS# show port-group
Port group: backbonelink is up
Ports: 22, 21
6
Add port 1 to the default VLAN (VLAN 1), configure a VLAN named roaming on ports 19 and 20, and
verify the configuration changes. Type the following commands:
WSS# set vlan default port 1
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
144 Configuring and managing ports and VLANs
success: change accepted.
WSS# set vlan 2 name roaming port 19-20
success: change accepted.
WSS# show vlan config
VLAN
Name
Admin
Up
VLAN Status
Up
TunlStateAffinPort
Port Tag
none
State
Up
1 default
5
1
2 ro a m i n g
U p
U p
5
19
20
none
none
Up
Up
7
Save the configuration. Type the following command:
WSS# save config
success: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
145
Configuring and managing IP
interfaces and services
MTU support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Configuring and managing IP interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Configuring the system IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Configuring and managing IP routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Managing the management services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Configuring and managing DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Configuring and managing aliases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Configuring and managing time parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Managing the ARP table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Pinging another device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Logging in to a remote device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Tracing a route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
IP interfaces and services configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
146 Configuring and managing IP interfaces and services
MTU support
WLAN Security Switch 2300 Series (WSS Software) supports standard maximum transmission units (MTUs) of 1514
bytes for standard Ethernet packets and 1518 bytes for Ethernet packets with an 802.1Q tag. WSS Software does not
support changing of the MTU through software configuration, and WSS Software does not do path MTU discovery.
Communication between WSSs is supported over any path MTU, and the Mobility Domain itself can run over the
minimum IP path MTU (PMTU). However, tunnels between two WSSs require a path MTU of at least 1384 bytes.
This minimum MTU path is required because Nortel devices use IP tunnels to transport user traffic between WSSs and
to transport user traffic and control traffic between switches and APs. Encapsulation of the packets for tunneling adds an
additional 44 bytes to the packet headers, so WSS Software does fragment and reassemble the packets if necessary to fit
within the supported MTUs. However, WSS Software does not support defragmentation except at the receiving end of
an IP tunnel, and only to reassemble fragments created by another Nortel device for tunneling.
If the path MTU between Nortel devices is less than 1384 bytes, a device in the path might further fragment or drop a
tunneled packet. If the packet is further fragmented, the receiving WSS will not be able to reassemble the fragments, and
the packet is dropped.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 147
Configuring and managing IP interfaces
Many features, including the following, require an IP interface on the WSS:
•
•
•
Management access through Telnet
Access by WLAN Management Software
Exchanging information and user data with other WSS switches in a Mobility Domain
IP interfaces are associated with VLANs. At least one VLAN on a WSS must have an IP interface to provide manage-
ment access. Optionally, the other VLANs configured on the switch also can each have an IP interface. Each IP interface
must belong to a unique, nonoverlapping IP subnet.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
148 Configuring and managing IP interfaces and services
Adding an IP interface
You can add an IP interface to a VLAN by statically configuring an IP address or by enabling the Dynamic
Host Configuration Protocol (DHCP) client on the VLAN.
Statically configuring an IP interface
To add an IP interface to a VLAN, use the following command:
set interface vlan-id ip {ip-addr mask | ip-addr/mask-length}
Enabling the DHCP client
The WSS Software DHCP client enables a WSS to obtain its IP configuration from a DHCP server. A switch
can use the DHCP client to obtain the following configuration information:
•
•
•
•
IP address
Default router (gateway)
DNS domain name
DNS server IP address
The DHCP client is implemented according to “RFC 2131: Dynamic Host Configuration Protocol” and “RFC
2132: DHCP Options and BOOTP Vendor Extensions”. The client supports the following options:
•
•
(12) Host Name (the WSS system name)
(55) Parameter request list, consisting of (1) Subnet Mask, (3) Router, (15) Domain Name, and (6)
Domain Name Server
•
(60) Vendor Class Identifier, set to NRTL x.x.x, where x.x.x is the WSS Software version
The DHCP client is enabled by default on an unconfigured 2350 when the factory reset switch is pressed and
held during power on. The DHCP client is disabled by default on all other switch models, and is disabled on an
2350 if the switch is already configured or the factory reset switch is not pressed and held during power on.
You can enable the DHCP client on one VLAN only.
WSS Software also has a configurable DHCP server. (See “DHCP server” on page 803.) You can configure a
DHCP client and DHCP server on the same VLAN, but only the client or the server can be enabled. The
DHCP client and DHCP server cannot both be enabled on the same VLAN at the same time.
How WSS software resolves conflicts with statically configured IP
parameters
WSS Software compares the IP parameter values already configured on the switch with the values received
from the DHCP server, and resolves any conflicts as follows:
•
IP address—If the VLAN also has a statically configured IP address, WSS Software uses an address from
the DHCP server instead of the statically configured address.
WSS Software sends an ARP for the IP address offered by the DHCP server to verify that the
address is not already in use.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 149
●
If the address is not in use, WSS Software configures the VLAN that has the DHCP client enabled
with the IP address received from the DHCP server. WSS Software then configures the other values
as follows:
❍
❍
Default router—WSS Software adds a default route for the gateway, with a metric of 10.
DNS domain name and DNS server IP address—If the default domain name and DNS server IP
address are already configured on the switch, and DNS is enabled, the configured values are
used. Otherwise, the values received from the DHCP server are used.
●
●
If the address offered by the DHCP server is already in use, WSS Software sends a DHCP Decline
message to the server and generates a log message.
If the address is in a subnet that is already configured on another VLAN on the switch, WSS
Software sends a DHCP Decline message to the server and generates a log message.
If the switch is powered down or restarted, WSS Software does not retain the values received from the DHCP server.
However, if the IP interface goes down but WSS Software is still running, WSS Software attempts to reuse the address
when the interface comes back up.
Configuring the DHCP client
To configure the DHCP client on a VLAN, use the following command:
set interface vlan-id ip dhcp-client {enable | disable}
The vlan-id can be the VLAN name or number.
The following command enables the DHCP client on VLAN corpvlan:
WSS# set interface corpvlan ip dhcp-client enable
success: change accepted.
You can configure the DHCP client on more than one VLAN, but the client can be active on only one VLAN.
To remove all IP information from a VLAN, including the DHCP client and user-configured DHCP server, use the
following command:
clear interface vlan-id ip
Note. This command clears all IP configuration information from the interface.
The IP interface table flags the address assigned by a DHCP server with an asterisk ( * ). In the following example,
VLAN corpvlan received IP address 10.3.1.110 from a DHCP server.
WSS# show interface
* = From DHCP
VLAN Name
Address
Mask
Enabled State RIB
---- --------------- --------------- --------------- ------- ----- --------
4 corpvlan *10.3.1.110 255.255.255.0 YES Up ipv4
Displaying DHCP client information
To display DHCP client information, type the following command:
WSS# show dhcp-client
Interface:
corpvlan(4)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
150 Configuring and managing IP interfaces and services
Configuration Status: Enabled
DHCP State:
IF_UP
Lease Allocation: 65535 seconds
Lease Remaining:
IP Address:
65532 seconds
10.3.1.110
Subnet Mask:
Default Gateway:
DHCP Server:
DNS Servers:
255.255.255.0
10.3.1.1
10.3.1.4
10.3.1.29
DNS Domain Name:
mycorp.com
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 151
Disabling or reenabling an IP interface
IP interfaces are enabled by default. To administratively disable or reenable an IP interface, use the following command:
set interface vlan-id status {up | down}
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
152 Configuring and managing IP interfaces and services
Removing an IP interface
To remove an IP interface, use the following command:
clear interface vlan-id ip
Caution! If you remove the IP interface that is being used as the system IP address,
features that require the system IP address will not work correctly.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 153
Displaying IP interface information
To display IP interface information, use the following command:
show interface [vlan-id]
Configuring the system IP address
You can designate one of the IP addresses configured on a WSS to be the system IP address of the switch. The system IP
address determines the interface or source IP address WSS Software uses for system tasks, including the following:
•
•
•
Mobility Domain operations
Topology reporting for dual-homed APs
Default source IP address used in unsolicited communications such as AAA accounting reports and SNMP traps
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
156 Configuring and managing IP interfaces and services
Clearing the system IP address
Caution! Clearing the system IP address disrupts the features that use the address.
To clear the system IP address, use the following command:
clear system ip-address
Configuring and managing IP routes
The IP route table contains routes that WSS Software uses for determining the interfaces for a WSS’s external communi-
cations. When you add an IP interface to a VLAN that is up, WSS Software automatically adds corresponding entries to
the IP route table.
For destination routes that are not directly attached, you can add static routes. A static route specifies the destination and
the default router through which to forward traffic.You can add the following types of static routes:
•
•
Explicit route—Forwarding path for traffic to a specific destination
Default route—Forwarding path for traffic to a destination without an explicit route in the route table
A destination can be a subnet or network. If two static routes specify a destination, the more specific route is always
chosen (longest prefix match). For example, if you have a static route with a destination of 10.10.1.0/24, and another
static route with a destination of 10.10.0.0/16, the first static route is chosen to reach 10.10.1.15, because it has the
longer prefix match.
If the IP route table contains an explicit route for a given destination, WSS Software uses the route. Otherwise, WSS
Software uses a default route. For example, if the route table does not have a route to host 192.168.1.10, the WSS uses
the default route to forward a packet addressed to that host. Nortel recommends that you configure at least one default
route.
You can configure a maximum of four routes per destination. This includes default routes, which have destination
0.0.0.0/0. Each route to a given destination must have a unique gateway address. When the route table contains multiple
default routes or multiple explicit routes to the same destination, WSS Software uses the route with the lowest metric
(cost for using the route). If two or more routes to the same destination have the lowest cost, WSS Software selects the
first route in the route table.
WSS Software can use a route only if the route is resolved by a direct route on one of the WSS switch’s VLANs.
Note. Before you add a static route, use the show interface command to verify that the
switch has an IP interface in the same subnet as the route’s default router (gateway). WSS
Software requires the routes for the interface to resolve the static route. If the switch does
not have an interface in the default router’s subnet, the static route cannot be resolved and
the VLAN:Interface field of the show ip route command output shows that the static route
is down.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 157
Displaying IP routes
To display IP routes, use the following command:
show ip route [destination]
The destination parameter specifies a destination IP address.
To display the IP route table, type the following command:
WSS# show ip route
Router table for IPv4
Destination/
Mask
Proto
Metric
NH-Type
Gateway
VLAN:Interface
0.0.0.0/ 0
0.0.0.0/ 0
Static
Static
1 Router
2 Router
0 Direct
0 Local
0 Local
0 Direct
0 Local
0 Local
0 Local
10.0.1.17
10.0.2.17
vlan:1:ip
vlan:2:ip
10.0.1.1/24 IP
vlan:1:ip
10.0.1.1/32 IP
10.0.1.255/32 IP
10.0.2.1/24 IP
10.0.2.1/32 IP
10.0.2.255/32 IP
224.0.0.0/ 4 IP
vlan:1:ip:10.0.1.1/24
vlan:1:ip:10.0.1.1/24
vlan:2:ip
vlan:2:ip:10.0.1.1/24
vlan:2:ip:10.0.1.1/24
MULTICAST
This example shows dynamic routes added by WSS Software for two VLAN interfaces, 10.0.1.1/24 on VLAN
1 and 10.0.2.1/24 on VLAN 2.
This example also shows two static routes, which have a next-hop type (NH-Type) value of Router. Static
routes have a default router, listed in the Gateway field. The 0.0.0.0 destination represents a default route.
Here, default router 10.0.1.17 is reachable through the subnet on VLAN 1. Route 10.0.1.1/24 resolves the
static route that uses the default router. Default router 10.0.2.17 is reachable through the subnet on VLAN 2
and route 10.0.2.1/24 resolves the static route to that gateway.
WSS Software adds routes with next-hop types Direct and Local when you add an IP interface to a VLAN,
when the VLAN is up. Direct routes are for the locally attached subnets that the switch’s IP addresses are in.
Local routes are for destination interfaces configured on the WSS itself.
WSS Software automatically adds the 224.0.0.0 route to support the IGMP snooping feature.
If a VLAN is administratively disabled or all of the links in the VLAN go down or are disabled, WSS Software
removes the VLAN’s routes from the route table. If the direct route required by a static route goes down, WSS
Software changes the static route state to Down. If the route table contains other static routes to the same desti-
nation, WSS Software selects the resolved route that has the lowest cost. In the following example, the default
route to 10.0.1.17 is down, so WSS Software selects the default route to 10.0.2.17.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
158 Configuring and managing IP interfaces and services
WSS# show ip route
Router table for IPv4
Destination/
Mask
Proto
Metric
NH-Type
Gateway
VLAN:Interface
0.0.0.0/ 0
0.0.0.0/ 0
Static
Static
1 Router
2 Router
0 Direct
0 Direct
0 Direct
0 Local
10.0.1.17
10.0.2.17
Down
vlan:2:ip
10.0.2.1/24 IP
vlan:2:ip
10.0.2.1/32 IP
10.0.2.255/32 IP
224.0.0.0/ 4 IP
vlan:2:ip:10.0.1.1/24
vlan:2:ipp:10.0.1.1/24
MULTICAST
(For more information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 159
Adding a static route
To add a static route, use the following command:
set ip route {default | ip-addr mask | ip-addr/mask-length} default-router metric
The metric (cost) can be any number between 0 and 2,147,483,647. Lower-cost routes are preferred over higher-cost
routes. When you add multiple routes to the same destination, WSS Software groups the routes together and orders them
from lowest cost at the top of the group to highest cost at the bottom of the group. If you add a new route that has the
same destination and cost as a route already in the table, WSS Software places the new route at the top of the group of
routes with the same cost.
To add a default route that uses default router 10.5.4.1 and has a cost of 1, type the following command:
WSS# set ip route default 10.5.4.1 1
success: change accepted.
To add two default routes and configure WSS Software to always use the route through 10.2.4.69 when the WSS
interface to that default router is up, type the following commands:
WSS# set ip route default 10.2.4.69 1
success: change accepted.
WSS# set ip route default 10.2.4.17 2
success: change accepted.
To add an explicit route from a WSS to any host on the 192.168.4.x subnet through the local router 10.5.4.2, and give the
route a cost of 1, type the following command:
WSS# set ip route 192.168.4.0 255.255.255.0 10.5.4.2 1
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
160 Configuring and managing IP interfaces and services
Removing a static route
To remove a static route, use the following command:
clear ip route {default | ip-addr mask | ip-addr/mask-length} default-router
Note. After you remove a route, traffic that uses the route can no longer reach its
destination. For example, if you are managing the WSS with a Telnet session and the
session needs the static route, removing the route also removes the Telnet connection to
the switch.
The following command removes the route to 192.168.4.69/24 that uses defaultgateway router 10.2.4.1:
WSS# clear ip route 192.168.4.69/24 10.2.4.1
success: change accepted.
The following command removes the default route that uses default router 10.5.5.5:
WSS# clear ip route default 10.5.5.5
success: change accepted.
Managing the management services
WSS Software provides the following services for managing a WSS over the network:
Secure Shell (SSH)
Telnet
SSH provides a secure connection to the CLI through TCP port
22.
Telnet provides a nonsecure connection to the CLI through TCP
port 23.
HTTPS
HTTPS provides a secure connection to the Web management
application through TCP port 443.
SSH is enabled by default. Telnet and HTTPS are disabled by default.
A 2380 can have up to eight Telnet or SSH sessions, in any combination, and one Console session. A 2360/2361-8 or
2350 can have up to four Telnet or SSH sessions, in any combination, and one Console session.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 161
Managing SSH
WSS Software supports Secure Shell (SSH) Version 2. SSH provides secure management access to the CLI
over the network. SSH requires a valid username and password for access to the switch. When a user enters a
valid username and password, SSH establishes a management session and encrypts the session data.
Login timeouts
When you access the SSH server on a WSS, WSS Software allows you 10 seconds to press Enter for the
username prompt. After the username prompt is displayed, WSS Software allows 30 seconds to enter a valid
username and password to complete the login. If you do not press Enter or complete the login before the timer
expires, WSS Software ends the session. These timers are not configurable.
Note. To ensure that all CLI management sessions are encrypted, after you configure
SSH, disable Telnet.
Enabling SSH
SSH is enabled by default. To disable or reenable it, use the following command:
set ip ssh server {enable | disable}
SSH requires an SSH authentication key. You can generate one or allow WSS Software to generate one. The
first time an SSH client attempts to access the SSH server on a WSS, the switch automatically generates a
1024-byte SSH key. If you want to use a 2048-byte key instead, use the following command to generate one:
WSS# crypto generate key ssh 2048
key pair generated
If a key has already been generated, the command replaces the old key with a new one. The new key takes
affect for all new SSH sessions.
You can verify the key using the following command:
show crypto key ssh
For example:
WSS# show crypto key ssh
ec:6f:56:7f:d1:fd:c0:28:93:ae:a4:f9:7c:f5:13:04
This command displays the checksum (also called a fingerprint) of the public key. When you initially connect
to the WSS with an SSH client, you can compare the SSH key checksum displayed by the WSS with the one
displayed by the client to verify that you really are connected to the WSS and not another device. Generally,
SSH clients remember the encryption key after the first connection, so you need to check the key only once.
The WSS stores the key in nonvolatile storage where the key remains even after software reboots.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
162 Configuring and managing IP interfaces and services
Adding an SSH user
To log in with SSH, a user must supply a valid username and password. To add a username and password to the local
database, use the following command:
set user username password password
Optionally, you also can configure WSS Software either to locally authenticate the user or to use a RADIUS server to
authenticate the user. Use the following command:
set authentication admin {user-wildcard} method1 [method2] [method3] [method4]
To add administrative user mxadmin with password letmein, and use RADIUS server group sg1 to authenticate the user,
type the following commands:
WSS# set user wssadmin password letmein
success: User wssadmin created
WSS# set authentication admin wssadmin sg1
success: change accepted
Changing the SSH service port number
To change the SSH port the WSS listens on for SSH connections, use the following command:
set ip ssh port port-num
Caution! If you change the SSH port number from an SSH session, WSS Software
immediately ends the session. To open a new management session, you must configure
the SSH client to use the new SSH port number.
Managing SSH server sessions
Use the following commands to manage SSH server sessions:
show sessions admin
clear sessions admin ssh [session-id]
These commands display and clear SSH server sessions.
Note. If you type the clear sessions admin ssh command from within an SSH session,
the session ends as soon as you press Enter.
To display the SSH server sessions on a WSS, type the following command:
WSS# show sessions admin
Tty
Username
Time (s) Type
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 163
------- -------------------- -------- ----
tty0
tty2
tty3
3644
6
Console
Telnet
SSH
tech
sshadmin
381
3 admin sessions
To clear all SSH server sessions, type the following command:
WSS# clear sessions admin ssh
This will terminate manager sessions, do you wish to continue? (y|n) [n]y
Cleared ssh session on tty3
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
164 Configuring and managing IP interfaces and services
Managing Telnet
Telnet requires a valid username and password for access to the switch.
Telnet login timers
After the username prompt is displayed, WSS Software allows 30 seconds to enter a valid username and
password to complete the login. If you do not press Enter or complete the login before the timer expires, WSS
Software ends the session. This timer is not configurable.
Enabling Telnet
Telnet is disabled by default. To enable Telnet, use the following command:
set ip telnet server {enable | disable}
Adding a Telnet user
To log in with Telnet, a user must supply a valid username and password. To add a username and password to
the local database, use the following command:
set user username password password
Optionally, you also can configure WSS Software either to locally authenticate the user or to use a RADIUS
server to authenticate the user. Use the following command:
set authentication admin {user-wildcard} method1 [method2] [method3] [method4]
You can use the same username and password for SSH or create a new one. For a CLI example, see “Adding
Displaying Telnet status
To display the status of the Telnet server, use the following command:
show ip telnet
To display the Telnet server status and the TCP port number on which a WSS listens for Telnet traffic, type the
following command:
WSS> show ip telnet
Server Status
----------------------------------
Enabled 23
Port
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 165
Changing the Telnet service port number
To change the TCP port the WSS listens on for Telnet connections, use the following command:
set ip telnet port-num
Caution! If you change the Telnet port number from a Telnet session, WSS Software
immediately ends the session. To open a new management session, you must Telnet to
the switch with the new Telnet port number.
Resetting the Telnet service port number to its default
To reset the Telnet management service to its default TCP port, use the following command:
clear ip telnet
Managing Telnet server sessions
Use the following commands to manage Telnet server sessions:
show sessions admin
clear sessions admin telnet [session-id]
These commands display and clear management sessions from a remote client to the WSS’s Telnet server.
Note. If you type the clear sessions admin telnet command from within a Telnet
session, the session ends as soon as you press Enter.
To display the Telnet server sessions on a WSS, type the following command:
WSS# show sessions admin
Tty
tty0
tty2
tty3
Username
Time (s)
3644
6
Type
Console
Telnet
SSH
tech
sshadmin
381
3 admin sessions
To clear all Telnet server sessions, type the following command:
WSS# clear sessions telnet
This will terminate manager sessions, do you wish to continue? (y|n) [n]y
Cleared telnet session on tty2
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
166 Configuring and managing IP interfaces and services
Managing HTTPS
Enabling HTTPS
HTTPS is disabled by default. To enable HTTPS, use the following command:
set ip https server {enable | disable}
Caution! If you disable the HTTPS server, Web View access to the switch is also
disabled.
Displaying HTTPS information
To display HTTPS service information, use the following command:
show ip https
To display information for a WSS’s HTTPS server, type the following command:
WSS> show ip https
HTTPS is enabled
HTTPS is set to use port 443
Last 10 Connections:
IP Address Last Connected
Time Ago (s)
------------ ----------------------- ------------
10.10.10.56 2003/05/09 15:51:26 pst
349
The command lists the TCP port number on which the switch listens for HTTPS connections. The command
also lists the last 10 devices to establish HTTPS connections with the switch and when the connections were
established.
If a browser connects to a WSS from behind a proxy, then only the proxy IP address is shown. If multiple
browsers connect using the same proxy, the proxy address appears only once in the output.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 167
Changing the idle timeout for CLI management sessions
By default, WSS Software automatically terminates a console or Telnet session that is idle for more than one hour. To
change the idle timeout for CLI management sessions, use the following command:
set system idle-timeout seconds
You can specify from 0 to 86400 seconds (one day). The default is 3600 (one hour). If you specify 0, the idle timeout is
disabled. The timeout interval is in 30-second increments. For example, the interval can be 0, or 30 seconds, or 60
seconds, or 90 seconds, and so on. If you enter an interval that is not divisible by 30, the CLI rounds up to the next
30-second increment. For example, if you enter 31, the CLI rounds up to 60.
This command applies to all types of CLI management sessions: console, Telnet, and SSH. The timeout change applies
to existing sessions only, not to new sessions.
The following command sets the idle timeout to 1800 seconds (one half hour):
WSS# set system idle-timeout 1800
success: change accepted.
To reset the idle timeout to its default value, use the following command:
clear system idle-timeout
To display the current setting (if the timeout has been changed from the default), use the show config area system
command. If you are not certain whether the timeout has been changed, use the show config all command.
Configuring and managing DNS
You can configure a WSS to use a Domain Name Service (DNS) server to resolve hostnames into their IP addresses.
This capability is useful in cases where you specify a hostname instead of an IP address in a command.
For example, as an alternative to the command ping 192.168.9.1, you can enter the command ping chris.example.com.
When you enter ping chris.example.com, the WSS's DNS client queries a DNS server for the IP address that corre-
sponds to the hostname chris.example.com, then sends the ping request to that IP address.
The WSS switch’s DNS client is disabled by default. To configure DNS:
•
•
•
Enable the DNS client.
Specify the IP addresses of the DNS servers.
Configure a default domain name for DNS queries.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
168 Configuring and managing IP interfaces and services
Enabling or disabling the DNS client
The DNS client is disabled by default. To enable or disable the DNS client, use the following command:
set ip dns {enable | disable}
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 169
Configuring DNS servers
You can configure a WSS to use one primary DNS server and up to five secondary DNS servers to resolve DNS queries.
The WSS always sends a request to the primary DNS server first. The WSS sends a request to a secondary DNS server
only if the primary DNS server does not respond.
Adding a DNS server
To add a DNS server, use the following command:
set ip dns server ip-addr {primary | secondary}
Removing a DNS server
To remove a DNS server, use the following command:
clear ip dns server ip-addr
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
170 Configuring and managing IP interfaces and services
Configuring a default domain name
You can configure a single default domain name for DNS queries. The WSS appends the default domain name
to hostnames you enter in commands. For example, you can configure the WSS to automatically append the
domain name example.com to any hostname that does not have a domain name. In this case, you can enter
ping chris instead of ping chris.example.com, and the WSS automatically requests the DNS server to send
the IP address for chris.example.com.
To override the default domain name when entering a hostname in a CLI command, enter a period at the end
of the hostname. For example, if the default domain name is example.com, enter chris. if the hostname is chris
and not chris.example.com.
Aliases take precedence over DNS. When you enter a hostname, WSS Software checks for an alias with that
name first, before using DNS to resolve the name. (For information about aliases, see “Configuring and
Adding the default domain name
To add the default domain name, use the following command:
set ip dns domain name
Specify a domain name of up to 64 alphanumeric characters.
Removing the default domain name
To remove the default domain name, use the following command:
clear ip dns domain
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 171
Displaying DNS server information
To display DNS server information, use the following command:
show ip dns
The following example shows DNS server information on a WSS configured to use three DNS servers.
WSS# show ip dns
Domain Name: example.com
DNS Status: enabled
IP Address
Type
-----------------------------------
10.1.1.1
10.1.1.2
10.1.2.1
PRIMARY
SECONDARY
SECONDARY
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command
Line Reference.)
Configuring and managing aliases
An alias is a string that represents an IP address. You can use aliases as shortcuts in CLI commands. For
example, you can configure alias pubs1 for IP address 10.10.10.20, and enter ping pubs1 as a shortcut for
ping 10.10.10.20.
Aliases take precedence over DNS. When you enter a hostname, WSS Software checks for an alias with that
name first, before using DNS to resolve the name.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
172 Configuring and managing IP interfaces and services
Adding an alias
To add an alias, use the following command:
set ip alias name ip-addr
Specify an alias of up to 32 alphanumeric characters.
To add an alias HR1 for IP address 192.168.1.2, type the following command:
WSS# set ip alias HR1 192.168.1.2
success: change accepted.
After configuring the alias, you can use HR1 in commands in place of the IP address. For example, to ping
192.168.1.2, you can type the command ping HR1.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
174 Configuring and managing IP interfaces and services
Displaying aliases
To display aliases, use the following command:
show ip alias [name]
Here is an example:
WSS# show ip alias
Name
IP Address
-------------------- --------------------
HR1
payroll
radius1
192.168.1.2
192.168.1.3
192.168.7.2
Configuring and managing time parameters
You can configure the system time and date statically or by using Network Time Protocol (NTP) servers. In
each case, you can specify the offset from Coordinated Universal Time (UTC) by setting the time zone. You
also can configure WSS Software to offset the time by an additional hour for daylight savings time or similar
summertime period.
Note. Nortel recommends that you set the time and date parameters before you install
certificates on the WSS. If the switch’s time and date are incorrect, the certificate might not
be valid.
Generally, CA-generated certificates are valid for one year beginning with the system time
and date that are in effect when you generate the certificate request. Self-signed
certificates generated when running WSS Software Version 4.2.3 or later are valid for three
years, beginning one week before the time and date on the switch when the certificate is
generated.
If you do not install certificates, the switch automatically generates them the first time you
boot the switch with WSS Software Version 5.0 or later. The automatically generated
certificates are dated based on the time and date information present on the switch when it
was first booted with WSS Software Version 5.0.
To statically set the time and date:
•
•
Set the time zone (set timezone command)
Set the summertime period (set summertime command)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 175
Set the time and date (set timedate command)
•
Note. Configure summertime before you set the time and date. Otherwise,
summertime’s adjustment of the time will make the time incorrect, if the date is within the
summertime period.
To use NTP servers to set the time and date:
•
•
•
Set the time zone (set timezone command)
Set the summertime period (set summertime command)
Configure NTP server information (set ntp commands)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
176 Configuring and managing IP interfaces and services
Setting the time zone
The time zone parameter adjusts the system date, and optionally the time, by applying an offset to UTC.
To set the time zone, use the following command:
set timezone zone-name {-hours [minutes]}
The zone name can be up to 32 alphanumeric characters long, with no spaces. The hours parameter specifies the number
of hours to add to or subtract from UTC. Use a minus sign (-) in front of the hour value to subtract the hours from UTC.
To set the time zone to PST (Pacific Standard Time), type the following command:
WSS# set timezone PST -8
Timezone is set to 'PST', offset from UTC is -8:0 hours.
Displaying the time zone
To display the time zone, use the following command:
show timezone
For example, to display the time zone, type the following command:
WSS# show timezone
Timezone set to 'PST', offset from UTC is -8 hours
Clearing the time zone
To clear the time zone, use the following command:
clear timezone
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 177
Configuring the summertime period
The summertime period offsets the system time +1 hour and returns it to standard time for daylight savings time or a
similar summertime period that you set.
Note. Configure summertime before you set the time and date. Otherwise,
summertime’s adjustment of the time will make the time incorrect, if the date is within the
summertime period.
To configure the summertime period, use the following command:
set summertime summer-name [start week weekday month hour min end week weekday month
hour min]
The summer-name can be up to 32 alphanumeric characters long, with no spaces. The start and end dates and times are
optional. If you do not specify a start and end time, WSS Software implements the time change starting at 2:00 a.m. on
the first Sunday in April and ending at 2:00 a.m. on the last Sunday in October, according to the North American
standard.
To set the summertime period to PDT (Pacific Daylight Time) and use the default start and end dates and times, type the
following command:
WSS# set summertime PDT
success: change accepted.
Displaying the summertime period
To display the summertime period, use the following command:
show summertime
For example, to display the summertime period, type the following command:
WSS# show summertime
Summertime is enabled, and set to 'PDT'.
Start : Sun Apr 04 2004, 02:00:00
End : Sun Oct 31 2004, 02:00:00
Offset : 60 minutes
Recurring : yes, starting at 2:00 am of first Sunday of April
and ending at 2:00 am on last Sunday of October.
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Clearing the summertime period
To clear the summertime period, use the following command:
clear summertime
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
178 Configuring and managing IP interfaces and services
Statically configuring the system time and date
To statically configure the system time and date, use the following command:
set timedate {date mmm dd yyyy [time hh:mm:ss]}
The day of week is automatically calculated from the day you set.
To set the date to February 29, 2004 and time to 23:58:
WSS# set timedate date feb 29 2004 time 23:58:00
Time now is:
Sun Feb 29 2004, 23:58:02 PST
The CLI makes the time change, then displays the current system time based on the change. (The time displayed might
be slightly later than the time you enter due to the interval between when you press Enter and when the CLI reads and
displays the new time and date.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 179
Displaying the time and date
To display the time and date, use the following command:
show timedate
WSS# show timedate
Sun Feb 29 2004, 23:58:02 PST
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
180 Configuring and managing IP interfaces and services
Configuring and managing NTP
The Network Time Protocol (NTP) allows a networking device to synchronize its system time and date with the time and
date on an NTP server. When used on multiple devices, NTP ensures that the time and date are consistent among those
devices.
The NTP implementation in WSS Software is based on RFC 1305, Network Time Protocol (Version 3) Specification,
Implementation and Analysis.
You can configure a WSS to consult up to three NTP servers. The switch compares the results from the servers and
selects the best response. (For information, see RFC 1305.)
After you enable the NTP client and configure NTP servers, WSS Software queries the NTP servers for an update every
64 seconds and waits 15 seconds for a reply. If the switch does not receive a reply to an NTP query within 15 seconds,
the switch tries again up to 16 times. You can change the update interval but not the timeout or number of retries.
WSS Software adjusts the NTP reply according to the following time parameters configured on the WSS:
•
•
Daylight savings time (configured with the set summertime command; see “Configuring the summertime period”
The NTP client is disabled by default.
Note. If NTP is configured on a system whose current time differs from the NTP server
time by more than 10 minutes, convergence of the WSS time may take many NTP update
intervals. Nortel recommends that you set the time manually to the NTP server time before
enabling NTP to avoid a significant delay in convergence.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 181
Adding an NTP server
To add an NTP server to the list of NTP servers, use the following command:
set ntp server ip-addr
To configure a WSS to use NTP server 192.168.1.5, type the following command:
WSS# set ntp server 192.168.1.5
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
182 Configuring and managing IP interfaces and services
Removing an NTP server
To remove an NTP server, use the following command:
clear ntp server {ip-addr | all}
If you use the all option, WSS Software clears all NTP servers configured on the switch.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 183
Changing the NTP update interval
The default update interval is 64 seconds. To change the update interval, use the following command:
set ntp update-interval seconds
You can specify an interval from 16 through 1024 seconds.
For example, to change the NTP update interval to 128 seconds, type the following command:
WSS# set ntp update-interval 128
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 185
Enabling the NTP client
The NTP client is disabled by default. To enable the NTP client, use the following command:
set ntp {enable | disable}
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
186 Configuring and managing IP interfaces and services
Displaying NTP information
To display NTP information, use the following command:
show ntp
Here is an example:
WSS> show ntp
NTP client: enabled
Current update-interval: 20(secs)
Current time: Sun Feb 29 2004, 23:58:12
Timezone is set to 'PST', offset from UTC is -8:0 hours.
Summertime is enabled.
Last NTP update: Sun Feb 29 2004, 23:58:00
NTP Server
---------------------------------------------------
192.168.1.5 SYSPEER SYNCED
Peer state
Local State
The Timezone and Summertime fields are displayed only if you change the timezone or enable summertime.
(For more information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Managing the ARP table
The Address Resolution Protocol (ARP) table maps IP addresses to MAC addresses. An ARP entry enters the table in
one of the following ways:
•
Added automatically by the WSS. A switch adds an entry for its own MAC address and adds entries for addresses
learned from traffic received by the WSS. When the WSS receives an IP packet, the switch adds the packet’s source
MAC address and source IP address to the ARP table.
•
Added by the system administrator. You can add dynamic, static, and permanent entries to the ARP table.
ARP is enabled by default on a WSS and cannot be disabled.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 187
Displaying ARP table entries
To display ARP table entries, use the following command:
show arp [ip-addr]
Here is an example:
WSS# show arp
ARP aging time: 1200 seconds
Host
HW Address
VLAN Type State
------------------------------ ----------------- ----- ------- --------
10.5.4.51
10.5.4.53
00:0b:0e:02:76:f5 1 DYNAMIC RESOLVED
00:0b:0e:02:76:f7 1 LOCAL RESOLVED
This example shows two entries. The local entry (with LOCAL in the Type field) is for the WSS itself. The MAC
address of the local entry is the switch’s MAC address. The ARP table contains one local entry for each VLAN config-
ured on the switch. The dynamic entry is learned from traffic received by the switch. The ARP table can also contain
static and permanent entries, which are added by an administrator. The State field indicates whether an entry is resolved
(RESOLVED) or whether WSS Software has sent an ARP request for the entry and is waiting for the reply
(RESOLVING).
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
188 Configuring and managing IP interfaces and services
Adding an ARP entry
WSS Software automatically adds a local entry for a WSS and dynamic entries for addresses learned from traffic
received by the switch. You can add the following types of entries:
•
•
•
Dynamic—Ages out based on the aging timeout.
Static—Does not age out but is removed by a software reboot.
Permanent—Does not age out and remains in the ARP table following a software reboot.
To add an ARP entry, use the following command:
set arp {permanent | static | dynamic} ip-addr mac-addr
To add a static ARP entry that maps IP address 10.10.10.1 to MAC address 00:bb:cc:dd:ee:ff, type the following
command:
WSS# set arp static 10.10.10.1 00:bb:cc:dd:ee:ff
success: added arp 10.10.10.1 at 00:bb:cc:dd:ee:ff on VLAN 1
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 189
Changing the aging timeout
The aging timeout specifies how long a dynamic entry can remain unused before the software removes the entry from
the ARP table. The default aging timeout is 1200 seconds (20 minutes). The aging timeout does not affect the local
entry, static entries, or permanent entries.
To change the aging timeout, use the following command:
set arp agingtime seconds
You can specify from 0 to 1,000,000 seconds. To disable aging, specify 0.
For example, to disable aging of dynamic ARP entries, type the following command:
WSS# set arp agingtime 0
success: set arp aging time to 0 seconds
Note. To reset the ARP aging timeout to its default value, use the set arp agingtime
1200 command.
Pinging another device
To verify that another device in the network can receive IP packets sent by the WSS, use the following command:
ping host [count num-packets] [dnf] [flood] [interval time] [size size] [source-ip ip-addr |
vlan-name]
To ping a device that has IP address 10.1.1.1, type the following command:
WSS# ping 10.1.1.1
PING 10.1.1.1 (10.1.1.1) from 10.9.4.34 : 56(84) bytes of data.
64 bytes from 10.1.1.1: icmp_seq=1 ttl=255 time=0.769 ms
64 bytes from 10.1.1.1: icmp_seq=2 ttl=255 time=0.628 ms
64 bytes from 10.1.1.1: icmp_seq=3 ttl=255 time=0.676 ms
64 bytes from 10.1.1.1: icmp_seq=4 ttl=255 time=0.619 ms
64 bytes from 10.1.1.1: icmp_seq=5 ttl=255 time=0.608 ms
--- 10.1.1.1 ping statistics ---
5 packets transmitted, 5 packets received, 0 errors, 0% packet loss
In this example, the ping is successful, indicating that the WSS has IP connectivity with the other device.
Note. A WSS cannot ping itself. WSS Software does not support this.
(For information about the command options, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
190 Configuring and managing IP interfaces and services
Logging in to a remote device
From within a WSS Software console session or Telnet session, you can use the Telnet client to establish a Telnet client
session from a WSS’s CLI to another device. To establish a Telnet client session with another device, use the following
command:
telnet {ip-addr | hostname} [port port-num]
To establish a Telnet session from WSS WSS to 10.10.10.90, type the following command:
WSS# telnet 10.10.10.90
Session 0 pty tty2.d Trying 10.10.10.90...
Connected to 10.10.10.90
Disconnect character is '^t'
Copyright (c) 2002, 2003
Nortel, Inc.
Username:
When you press Ctrl+t or type exit to end the client session, the management session returns to the local WSS prompt:.
WSS-remote> Session 0 pty tty2.d terminated tt name tty2.d
WSS#
Use the following commands to manage Telnet client sessions:
show sessions telnet client
clear sessions telnet client [session-id]
These commands display and clear Telnet sessions from a WSS’s Telnet client to another device.
To display the Telnet client sessions on a WSS, type the following command:
WSS# show sessions telnet client
Session Server Address Server Port Client Port
------- -------------- ------------ -----------
0
1
192.168.1.81 23
10.10.1.22 23
48000
48001
To clear Telnet client session 0, type the following command:
WSS# clear sessions telnet client 0
You also can clear a Telnet client session by typing exit from within the client session.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 191
Tracing a route
You can trace the router hops necessary to reach an IP host.
The traceroute facility uses the TTL (Time to Live) field in the IP header to cause routers and servers to generate specific
return messages. Traceroute starts by sending a UDP datagram to the destination host with the TTL field set to 1. If a
router finds a TTL value of 1 or 0, it drops the datagram and sends back an ICMP Time Exceeded message to the sender.
The traceroute facility determines the address of the first hop by examining the source address field of the ICMP
time-exceeded message.
To identify the next hop, traceroute again sends a UDP packet, but this time with a TTL value of 2. The first router
decrements the TTL field by 1 and sends the datagram to the next router. The second router sees a TTL value of 1,
discards the datagram, and returns the Time Exceeded message to the source. This process continues until the TTL is
incremented to a value large enough for the datagram to reach the destination host (or until the maximum TTL is
reached).
To determine when a datagram has reached its destination, traceroute sets the UDP destination port in the datagram to a
very large value, one that the destination host is unlikely to be using. In addition, when a host receives a datagram with
an unrecognized port number, it sends an ICMP Port Unreachable error to the source. This message indicates to the
traceroute facility that it has reached the destination.
To trace a route to a destination subnet, use the following command:
traceroute host [dnf] [no-dns] [port port-num] [queries num] [size size] [ttl hops] [wait ms]
To trace the route to host server1, type the following command:
WSS# traceroute server1
traceroute to server1.example.com (192.168.22.7), 30 hops max, 38 byte packets
1 engineering-1.example.com (192.168.192.206) 2 ms 1 ms 1 ms
2 engineering-2.example.com (192.168.196.204) 2 ms 3 ms 2 ms
3 gateway_a.example.com (192.168.1.201) 6 ms 3 ms 3 ms
4 server1.example.com (192.168.22.7) 3 ms * 2 ms
In this example, server1 is four hops away. The hops are listed in order, beginning with the hop that is closest to the
WSS and ending with the route’s destination. (For information about the command options, see the Nortel WLAN
Security Switch 2300 Series Command Line Reference.)
IP interfaces and services configuration scenario
This scenario configures IP interfaces, assigns one of the interfaces to be the system IP address, and configures a default
route, DNS parameters, and time and date parameters.
1
Configure IP interfaces on the wss_mgmt and roaming VLANs, and verify the configuration changes.
Type the following commands:
WSS# set interface wss_mgmt ip 10.10.10.10/24
success: change accepted.
WSS# set interface roaming ip 10.20.10.10/24
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
192 Configuring and managing IP interfaces and services
WSS# show interface
* = From DHCP
VLAN Name
Address
Mask
Enabled State RIB
---- --------------- --------------- --------------- ------- ----- --------
1 default
2 roaming
10.10.10.10 255.255.255.0 YES Up ipv4
10.20.10.10 255.255.255.0 YES Up ipv4
2
Configure the IP interface on the roaming VLAN to be the system IP address and verify the configuration
change. Type the following commands:
WSS# set system ip-address 10.20.10.10
success: change accepted.
WSS# show system
===============================================================================
Product Name:
System Name:
WSS
WSS
System Countrycode: US
System Location:
System Contact:
System IP:
10.02.10.10
System idle timeout:3600
System MAC:
00:0B:0E:00:04:0C
===============================================================================
Boot Time:
Uptime:
2000-03-18 22:59:19
0 days 01:12:02
===============================================================================
Fan status: fan1 OK fan2 OK fan3 OK
Temperature: temp1 ok temp2 ok temp3 ok
PSU Status: Lower Power Supply DC ok AC ok Upper Power Supply missing
Memory: 156.08/496.04 (31%)
Total Power Over Ethernet : 105.6
===============================================================================
3
Configure a default route through a defaultgateway router attached to the WSS and verify the
configuration change. Type the following commands:
WSS# set ip route default 10.20.10.1 1
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IP interfaces and services 193
WSS# show ip route
Router table for IPv4
Destination/
Mask
Proto
Static
Metric
NH-Type
Gateway
VLAN:Interface
0.0.0.0/ 0
1 Router
0 Direct
0 Local
0 Direct
0 Local
10.20.10.17
10.10.10.10/24 IP
10.10.10.10/32 IP
10.20.10.10/24 IP
10.20.10.10/32 IP
vlan:1:ip
vlan:1:ip:10.10.10.10/24
vlan:1:ip
vlan:1:ip:10.20.10.10/24
224.0.0.0/ 4 IP
0 Local
MULTICAST
4
Configure the DNS domain name and DNS server entries, enable the DNS service, and verify the
configuration changes. Type the following commands:
WSS# set ip dns domain example.com
success: change accepted.
WSS# set ip dns server 10.10.10.69 PRIMARY
success: change accepted.
WSS# set ip dns server 10.20.10.69 SECONDARY
success: change accepted.
WSS# set ip dns enable
success: change accepted.
WSS# show ip dns
Domain Name: example.com
DNS Status: enabled
IP Address
Type
-----------------------------------
10.10.10.69
10.20.10.69
PRIMARY
SECONDARY
5
Configure time zone, summertime, and NTP parameters and verify the configuration changes. Type the
following commands:
WSS# set timezone PST -8
success: change accepted.
WSS# show timezone
Timezone is set to 'PST', offset from UTC is -8:0 hours.
WSS# set summertime PDT
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
194 Configuring and managing IP interfaces and services
WSS# show summertime
Summertime is enabled, and set to 'PDT'.
Start : Sun Apr 04 2004, 02:00:00
End
: Sun Oct 31 2004, 02:00:00
Offset : 60 minutes
Recurring : yes, starting at 2:00 am of first Sunday of April
and ending at 2:00 am on last Sunday of October.
WSS# set ntp server 192.168.1.5
WSS# set ntp enable
success: NTP Client enabled
WSS# show ntp
NTP client: enabled
Current update-interval: 20(secs)
Current time: Sun Feb 29 2004, 23:58:12
Timezone is set to 'PST', offset from UTC is -8:0 hours.
Summertime is enabled.
Last NTP update: Sun Feb 29 2004, 23:58:00
NTP Server
Peer state
Local State
---------------------------------------------------
192.168.1.5
SYSPEER
SYNCED
WSS# show timedate
Sun Feb 29 2004, 23:59:02 PST
6
Save the configuration. Type the following command:
WSS# save config
success: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
195
Configuring SNMP
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Configuring SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Displaying SNMP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
WSS Software supports Simple Network Management Protocol (SNMP) versions 1, 2c, and 3.
Overview
The WSS Software SNMP engine (also called the SNMP server or agent) can run any combination of the following
SNMP versions:
•
SNMPv1—SNMPv1 is the simplest and least secure SNMP version. Community strings are used for
authentication. Communications are in the clear (not encrypted). Notifications are traps, which are not
acknowledged by the notification target (also called a trap receiver).
•
•
SNMPv2c—SNMPv2 is similar to SNMPv1, but supports informs. An inform is a notification that is acknowledged
by the notification target.
SNMPv3—SNMPv3 adds authentication and encryption options. Instead of community strings, SNMPv3 supports
user security model (USM) users, with individually configurable access levels, authentication options, and
encryption options.
All SNMP versions are disabled by default.
Configuring SNMP
To configure SNMP, perform the following tasks:
•
Set the switch’s system IP address, if it is not already set. SNMP will not work without the system IP address. (See
•
•
•
•
•
Optionally, set the system location and contact strings.
Enable the SNMP version(s) you want to use. WSS Software can run one or more versions, in any combination.
Configure community strings (for SNMPv1 or SNMPv2c) or USM users (for SNMPv3).
Set the minimum level of security allowed for SNMP message exchanges.
Configure a notification profile or modify the default one, to enable sending of notifications to notification targets.
By default, notifications of all types are dropped (not sent).
•
•
Configure notification targets.
Enable the WSS Software SNMP engine.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
196 Configuring SNMP
Setting the system location and contact strings
To set the location and contact strings for a switch, use the following commands:
set system location string
set system contact string
Each string can be up to 256 characters long and blank spaces are accepted.
The following commands set a WSS’s location to 3rd_floor_closet and set the contact to sysadmin1:
WSS# set system location 3rd_floor_closet
success: change accepted.
WSS# set system contact sysadmin1
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SNMP 197
Enabling SNMP versions
To enable an SNMP protocol, use the following command:
set snmp protocol {v1 | v2c | usm | all} {enable | disable}
The usm option enables SNMPv3. The all option enables all three versions of SNMP.
The following command enables all SNMP versions:
WSS# set snmp protocol all enable
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
198 Configuring SNMP
Configuring community strings (SNMPv1 and SNMPv2c only)
To configure a community string for SNMPv1 or SNMPv2c, use the following command:
set snmp community name comm-string
access {read-only | read-notify | notify-only | read-write | notify-read-write}
The comm-string can be up to 32 alphanumeric characters long, with no spaces. You can configure up to 10
community strings.
The access level specifies the read-write privileges of the community string:
•
read-only—An SNMP management application using the string can get (read) object values on the
switch but cannot set (write) them. This is the default.
•
read-notify—An SNMP management application using the string can get object values on the switch but
cannot set them. The switch can use the string to send notifications.
•
•
notify-only—The switch can use the string to send notifications.
read-write—An SNMP management application using the string can get and set object values on the
switch.
•
notify-read-write—An SNMP management application using the string can get and set object values on
the switch. The switch can use the string to send notifications.
To clear an SNMP community string, use the following command:
clear snmp community name comm-string
The following command configures community string switchmgr1 with access level notify-read-write:
WSS# set snmp community name switchmgr1 notify-read-write
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SNMP 199
Creating a USM user for SNMPv3
To create a USM user for SNMPv3, use the following command:
set snmp usm usm-username
snmp-engine-id {ip ip-addr | local | hex hex-string}
access {read-only | read-notify | notify-only | read-write | notify-read-write}
auth-type {none | md5 | sha} {auth-pass-phrase string | auth-key hex-string}
encrypt-type {none | des | 3des | aes} {encrypt-pass-phrase string | encrypt-key hex-string}
To clear a USM user, use the following command:
clear snmp usm usm-username
The usm-username can be up to 32 alphanumeric characters long, with no spaces. You can configure up to 20 SNMPv3
users.
The snmp-engine-id option specifies a unique identifier for an instance of an SNMP engine. To send informs, you must
specify the engine ID of the inform receiver. To send traps and to allow get and set operations and so on, specify local as
the engine ID.
•
•
hex hex-string—ID is a hexadecimal string.
ip ip-addr—ID is based on the IP address of the station running the management application. Enter the IP address
of the station. WSS Software calculates the engine ID based on the address.
•
local—Uses the value computed from the switch’s system IP address.
The access option specifies the access level of the user. The options are the same as the access options for community
strings. (See “Configuring community strings (SNMPv1 and SNMPv2c only)” on page 198.) The default is read-only.
The auth-type option specifies the authentication type used to authenticate communications with the remote SNMP
engine. You can specify one of the following:
•
•
•
none—No authentication is used. This is the default.
md5—Message-digest algorithm 5 is used.
sha—Secure Hashing Algorithm (SHA) is used.
If the authentication type is md5 or sha, you can specify a passphrase or a hexadecimal key.
•
To specify a passphrase, use the auth-pass-phrase string option. The string can be from 8 to 32 alphanumeric
characters long, with no spaces.
•
To specify a key, use the auth-key hex-string option. Type a 16-byte hexadecimal string for MD5 or a 20-byte
hexadecimal string for SHA.
The encrypt-type option specifies the encryption type used for SNMP traffic. You can specify one of the following:
•
•
•
•
none—No encryption is used. This is the default.
des—Data Encryption Standard (DES) encryption is used.
3des—Triple DES encryption is used.
aes—Advanced Encryption Standard (AES) encryption is used.
If the encryption type is des, 3des, or aes, you can specify a passphrase or a hexadecimal key.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
200 Configuring SNMP
•
•
To specify a passphrase, use the encrypt-pass-phrase string option. The string can be from 8 to 32 alphanumeric
characters long, with no spaces. Type a string at least 8 characters long for DES or 3DES, or at least 12 characters
long for AES.
To specify a key, use the encrypt-key hex-string option. Type a 16-byte hexadecimal string.
Command examples
The following command creates USM user snmpmgr1, associated with the local SNMP engine ID. This user can send
traps to notification receivers.
WSS# set snmp usm snmpmgr1 snmp-engine-id local
success: change accepted.
The following command creates USM user securesnmpmgr1, which uses SHA authentication and 3DES encryption with
passphrases. This user can send informs to the notification receiver that has engine ID 192.168.40.2.
WSS# set snmp usm securesnmpmgr1 snmp-engine-id ip 192.168.40.2 auth-type sha
auth-pass-phrase myauthpword encrypt-type 3des encrypt-pass-phrase mycryptpword
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SNMP 201
Setting SNMP security
By default, WSS Software allows nonsecure SNMP message exchanges. You can configure WSS Software to require
secure SNMP exchanges instead.
Depending on the level of security you want WSS Software to enforce, you can require authentication of message
exchanges only, or of message exchanges and notifications. You also can require encryption in addition to
authentication.
SNMPv1 and SNMPv2c do not support authentication or encryption. If you plan to use SNMPv1 or SNMPv2c, leave the
minimum level of SNMP security set to unsecured.
To set the minimum level of security WSS Software requires for SNMP, use the following command:
set snmp security {unsecured | authenticated | encrypted | auth-req-unsec-notify}
You can specify one of the following options:
•
•
•
•
unsecured—SNMP message exchanges are not secure. This is the default, and is the only value supported for
SNMPv1 and SNMPv2c. (This security level is the same as the noAuthNoPriv level described in SNMPv3 RFCs.)
authenticated—SNMP message exchanges are authenticated but are not encrypted. (This security level is the same
as the authNoPriv level described in SNMPv3 RFCs.)
encrypted—SNMP message exchanges are authenticated and encrypted. (This security level is the same as the
authPriv level described in SNMPv3 RFCs.)
auth-req-unsec-notify—SNMP message exchanges are authenticated but are not encrypted, and notifications are
neither authenticated nor encrypted.
Command Example
The following command sets the minimum level of SNMP security allowed to authentication and encryption:
WSS# set snmp security encrypted
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
202 Configuring SNMP
Configuring a notification profile
A notification profile is a named list of all the notification types that can be generated by a switch, and for each notifica-
tion type, the action to take (drop or send) when an event occurs.
A default notification profile (named default) is already configured in WSS Software. All notifications in the default
profile are dropped by default. You can configure up to 10 notification profiles.
To modify the default notification profile or create a new one, use the following command:
set snmp notify profile {default | profile-name} {drop | send} {notification-type | all}
To clear a notification profile, use the following command:
clear snmp notify profile profile-name
The profile-name can be up to 32 alphanumeric characters long, with no spaces. To modify the default notification
profile, specify default.
The notification-type can be one of the following:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
APBootTraps—Generated when an AP boots.
ApNonOperStatusTraps—Generated to indicate an AP radio is nonoperational.
ApOperRadioStatusTraps—Generated when the status of an AP radio changes.
APTimeoutTraps—Generated when an AP fails to respond to the WSS.
AuthenTraps—Generated when the WSS’s SNMP engine receives a bad community string.
AutoTuneRadioChannelChangeTraps—Generated when the Auto-RF feature changes the channel on a radio.
AutoTuneRadioPowerChangeTraps—Generated when the Auto-RF feature changes the power setting on a radio.
ClientAssociationFailureTraps—Generated when a client’s attempt to associate with a radio fails.
ClientAuthorizationSuccessTraps—Generated when a client is successfully authorized.
ClientAuthenticationFailureTraps—Generated when authentication fails for a client.
ClientAuthorizationFailureTraps—Generated when authorization fails for a client.
ClientClearedTraps—Generated when a client’s session is cleared.
ClientDeAssociationTraps—Generated when a client is dissociated from a radio.
ClientDot1xFailureTraps—Generated when a client experiences an 802.1X failure.
ClientRoamingTraps—Generated when a client roams.
CounterMeasureStartTraps—Generated when WSS Software begins countermeasures against a rogue access
point.
•
•
CounterMeasureStopTraps—Generated when WSS Software stops countermeasures against a rogue access point.
APConnectWarningTraps—generated when a Distributed AP whose fingerprint has not been configured in WSS
Software establishes a management session with the switch.
•
•
•
•
DeviceFailTraps—Generated when an event with an Alert severity occurs.
DeviceOkayTraps—Generated when a device returns to its normal state.
LinkDownTraps—Generated when the link is lost on a port.
LinkUpTraps—Generated when the link is detected on a port.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SNMP 203
•
•
•
MichaelMICFailureTraps—Generated when two Michael message integrity code (MIC) failures occur within 60
seconds, triggering Wi-Fi Protected Access (WPA) countermeasures.
MobilityDomainJoinTraps—Generated when the WSS is initially able to contact a mobility domain seed member,
or can contact the seed member after a timeout.
MobilityDomainTimeoutTraps—Generated when a timeout occurs after a WSS has unsuccessfully tried to
communicate with a seed member.
•
•
•
•
•
PoEFailTraps—Generated when a serious PoE problem, such as a short circuit, occurs.
RFDetectAdhocUserTraps—Generated when WSS Software detects an ad-hoc user.
RFDetectRogueAPTraps—Generated when MS detects a rogue access point.
RFDetectRogueDisappearTraps—Generated when a rogue access point is no longer being detected.
RFDetectClientViaRogueWireapTraps—Generated when WSS Software detects, on the wired part of the
network, the MAC address of a wireless client associated with a third-party AP.
•
•
RFDetectDoSPortTraps—Generated when WSS Software detects an associate request flood, reassociate request
flood, or disassociate request flood.
RFDetectDoSTraps—Generated when WSS Software detects a DoS attack other than an associate request flood,
reassociate request flood, or disassociate request flood.
•
•
•
RFDetectInterferingRogueAPTraps—Generated when an interfering device is detected.
RFDetectInterferingRogueDisappearTraps—Generated when an interfering device is no longer detected.
RFDetectSpoofedMacAPTraps—Generated when WSS Software detects a wireless packet with the source MAC
address of a Nortel AP, but without the spoofed AP’s signature (fingerprint).
•
•
•
•
RFDetectSpoofedSsidAPTraps—Generated when WSS Software detects beacon frames for a valid SSID, but sent
by a rogue AP.
RFDetectUnAuthorizedAPTraps—Generated when WSS Software detects the MAC address of an AP that is on
the attack list.
RFDetectUnAuthorizedOuiTraps—Generated when a wireless device that is not on the list of permitted vendors
is detected.
RFDetectUnAuthorizedSsidTraps—Generated when an SSID that is not on the permitted SSID list is detected.
To apply the configuration change to all notification types, specify all.
The drop or send option specifies the action that the SNMP engine takes with regard to notifications.
Command examples
The following command changes the action in the default notification profile from drop to send for all notification
types:
WSS# set snmp notify profile default send all
success: change accepted.
The following commands create notification profile snmpprof_rfdetect, and change the action to send for all RF
detection notification types:
WSS# set snmp notify profile snmpprof_rfdetect send RFDetectAdhocUserTraps
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
204 Configuring SNMP
WSS# set snmp notify profile snmpprof_rfdetect send
RFDetectClientViaRogueWiredAPTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send RFDetectDoSTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send RFDetectAdhocUserTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send
RFDetectInterferingRogueAPTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send
RFDetectInterferingRogueDisappearTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send RFDetectRogueAPTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send
RFDetectRogueDisappearTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send RFDetectSpoofedMacAPTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send RFDetectSpoofedSsidAPTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send
RFDetectUnAuthorizedAPTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send
RFDetectUnAuthorizedOuiTraps
success: change accepted.
WSS# set snmp notify profile snmpprof_rfdetect send
RFDetectUnAuthorizedSsidTraps
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SNMP 205
Configuring a notification target
A notification target is a remote device to which WSS Software sends SNMP notifications. You can configure the WSS
Software SNMP engine to send confirmed notifications (informs) or unconfirmed notifications (traps). Some of the
command options differ depending on the SNMP version and the type of notification you specify. You can configure up
to 10 notification targets.
To configure a notification target for informs from SNMPv3, use the following command:
set snmp notify target target-num ip-addr[:udp-port-number]
usm inform user username
snmp-engine-id {ip | hex hex-string}
[profile profile-name]
[security {unsecured | authenticated | encrypted}]
[retries num]
[timeout num]
To configure a notification target for traps from SNMPv3, use the following command:
set snmp notify target target-num ip-addr[:udp-port-number]
usm trap user username
[profile profile-name]
[security {unsecured | authenticated | encrypted}]
To configure a notification target for informs from SNMPv2c, use the following command:
set snmp notify target target-num ip-addr[:udp-port-number]
v2c community-string inform
[profile profile-name]
[retries num]
[timeout num]
To configure a notification target for traps from SNMPv2c, use the following command:
set snmp notify target target-num ip-addr[:udp-port-number]
v2c community-string trap
[profile profile-name]
To configure a notification target for traps from SNMPv1, use the following command:
set snmp notify target target-num ip-addr[:udp-port-number]
v1 community-string
[profile profile-name]
To clear a notification target, use the following command:
clear snmp notify target target-num
The target-num is an ID for the target. This ID is local to the WSS and does not need to correspond to a value on the
target itself. You can specify a number from 1 to 10.
The ip-addr[:udp-port-number] is the IP address of the server. You also can specify the UDP port number to send notifi-
cations to. The default is 162.
Use v1, v2c, or usm to specify the SNMP version.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
206 Configuring SNMP
The inform or trap option specifies whether the WSS Software SNMP engine expects the target to acknowledge notifi-
cations sent to the target by the WSS. Use inform if you want acknowledgements. Use trap if you do not want
acknowledgements. The inform option is applicable to SNMP version v2c or usm only.
The username is a USM username, and is applicable only when the SNMP version is usm. If the user will send informs
rather than traps, you also must specify the snmp-engine-id of the target. Specify ip if the target’s SNMP engine ID is
based on its IP address. If the target’s SNMP engine ID is a hexadecimal value, use hex hex-string to specify the value.
The community-string is applicable only when the SNMP version is v1 or v2c.
The profile-name is the notification profile. The default is default.
The security option specifies the security level, and is applicable only when the SNMP version is usm:
•
•
•
unsecured—Message exchanges are not authenticated, nor are they encrypted. This is the default.
authenticated—Message exchanges are authenticated, but are not encrypted.
encrypted—Message exchanges are authenticated and encrypted.
The retries and timeout options are applicable only when the SNMP version is v2c or usm and the notification type is
inform. The retries option specifies the number of times the WSS Software SNMP engine will resend a notification that
has not been acknowledged by the target. You can specify from 0 to 3 retries. The default is 0. The timeout option
specifies the number of seconds WSS Software waits for acknowledgement of a notification. You can specify from 1 to
5 seconds. The default is 2.
Command examples
The following command configures a notification target for acknowledged notifications:
WSS# set snmp notify target 1 10.10.40.9 usm inform user securesnmpmgr1 snmp-engine-id ip
success: change accepted.
This command configures target 1 at IP address 10.10.40.9. The target’s SNMP engine ID is based on its address. The
WSS Software SNMP engine will send notifications based on the default profile, and will require the target to acknowl-
edge receiving them.
The following command configures a notification target for unacknowledged notifications:
WSS# set snmp notify target 2 10.10.40.10 v1 trap
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SNMP 207
Enabling the SNMP service
To enable the WSS Software SNMP service, use the following command:
set ip snmp server {enable | disable}
The following command enables the SNMP service:
WSS# set ip snmp server enable
success: change accepted.
Displaying SNMP information
You can display the following SNMP information:
•
•
•
•
•
Version and status information
Configured community strings
User-based security model (USM) settings
Notification targets
SNMP statistics counters
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SNMP 211
Displaying notification profiles
To display notification profiles, use the following command:
show snmp notify profile
The command lists settings separately for each notification profile. The use count indicates how many notification
targets use the profile. For each notification type, the command lists whether WSS Software sends notifications of that
type to the targets that use the notification profile.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
214 Configuring SNMP
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
215
Configuring and managing Mobility
Domain roaming
About the Mobility Domain feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Configuring a Mobility Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Configuring secure WSS to WSS communications . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Understanding the sessions of roaming users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Mobility Domain scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
A Mobility Domain is a system of WSSs and APs working together to support roaming wireless users (clients). Tunnels
and virtual ports between the WSSs in a Mobility Domain allow users to roam without any disruption to network
connectivity.
(If your Mobility Domain uses firewalls or access controls between WSSs or AAA servers, see “Traffic ports used by
WSS software” on page 801 for the ports typically used in a Mobility Domain.)
Note. Nortel recommends that you run the same WSS Software version on all the WSSs
in a Mobility Domain.
Note. If the connection between the WSS in a mobility-domain is down and is brought up
later on, it can take upto 5 minutes for the WSS to connect back again due to exponential
backoff by the WSS.
About the Mobility Domain feature
A Mobility Domain enables users to roam geographically across the system while maintaining their data sessions and
VLAN or subnet membership, including IP address, regardless of how the WSSs are attached to the network backbone.
As users move from one area of a building or campus to another, their association with servers or other resources
appears the same.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
216 Configuring and managing Mobility Domain roaming
When users access a WSS in a Mobility Domain, they become members of the VLAN designated through their autho-
rized identity. If a user’s native VLAN is not present on the WSS that he or she accesses, the accessed WSS forms a
tunnel to a WSS in the Mobility Domain that includes the native VLAN.
In a Mobility Domain, one WSS acts as a seed device, which distributes information to the WSSs defined in the Mobility
Domain. Otherwise, the seed WSS operates like any other Mobility Domain member.
Smart Mobile Virtual Controller Cluster
Nortel uses innovative clustering technology between WSS switches to ensure mobility across an entire wireless
network. With clustering, you can effortlessly create logical groups of WSS switches and APs which proactively share
network and user information for “Hitless” failover support. You can also create a single point of configuration for small
and large WLAN deployments to reduce the cost of installation and network management. You can add WSSs and APs
seamlessly and do not require any connectivity interruption in your existing network.
Smart Mobile Virtual Controller Clustering provides distributed network intelligence that enables fast, transparent
failover to overcome network and device interruptions. It provides a means of central configuration and distribution for
WSSs and APs on the network.
The features of cluster configuration includes the following:
•
•
•
•
Centralized configuration of WSSs and APs.
Autodistribution of configuration parameters to APs.
“Hitless” failover on the network if an WSS is unavailable.
Automatic load balancing of APs across any WSSs in the cluster.
Note. The number of APs supported on a cluster member is limited to the number supported
on an WSS. It is recommended to use larger capacity WSSs in your configuration to obtain the maximum
benefits of cluster configuration.
Configuring a Mobility Domain
The WSSs in a Mobility Domain use their system IP address for Mobility Domain communication. To support the
services of the Mobility Domain, the system IP address of every WSS requires basic IP connectivity to the system IP
address of every other WSS. (For information about setting the system IP address for the WSS, see “Configuring the
To create a Mobility Domain:
1
2
3
You can view the status and configuration of a Mobility Domain, clear members, and clear all Mobility Domain config-
uration from a WSS.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing Mobility Domain roaming 217
Configuring the seed
You must explicitly configure only one WSS per domain as the seed. All other WSSs in the domain receive their
Mobility Domain information from the seed.
Use the following command to set the current WSS as the seed device and name the Mobility Domain:
set mobility-domain mode seed domain-name mob-domain-name
For example, the following command sets the current WSS as the seed and names the Mobility Domain Pleasanton:
WSS# set mobility-domain mode seed domain-name Santa Clara
success: change accepted.
The Mobility Domain name is assigned to the seed WSS only. The WSS system IP address is used as the source IP
address for all Mobility Domain communications. If the system IP address is not set, WSS Software issues a warning
when you enter the set mobility-domain mode seed domain-name command, to inform you that the Mobility Domain is
not operational until the system IP is set.
Configuring member WSSs on the seed
To configure the list of members on the Mobility Domain seed for distribution to other member WSSs, use the following
command on the seed WSS:
set mobility-domain member ip-addr
For example, the following commands add two members with IP addresses 192.168.12.7 and 192.168.15.5 to a Mobility
Domain whose seed is the current WSS:
WSS# set mobility-domain member 192.168.12.7
success: change accepted.
WSS# set mobility-domain member 192.168.15.5
success: change accepted.
Each command adds a member identified by its IP address to the list of Mobility Domain members. If the WSS from
which you enter the command is not configured as a seed, the command is rejected.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
218 Configuring and managing Mobility Domain roaming
Configuring a member
To configure a member WSS in the Mobility Domain, you enter the following command when logged in to the nonseed
member WSS:
set mobility-domain mode member seed-ip ip-addr
This command configures the IP destination address that the member WSS uses when communicating with the seed
WSS.
For example, the following command configures the current WSS as a member of the Mobility Domain whose seed is
192.168.253.6:
WSS# set mobility-domain mode member seed-ip 192.168.253.6
success: change accepted.
This command sets the WSS as a member of the Mobility Domain defined on the seed device at the identified address. If
the WSS is currently part of another Mobility Domain or using another seed, this command overwrites that configura-
tion. After you enter this command, the member WSS obtains a new list of members from its new seed’s IP address.
Configuring mobility domain seed redundancy
Specify a secondary seed in a Mobility Domain. The secondary seed provides redundancy for the primary seed switch in
the Mobility Domain. If the primary seed becomes unavailable, then the secondary seed assumes the role of the seed
switch. This allows the Mobility Domain to continue functioning, if the primary seed becomes unavailable.
Specifying a secondary seed for a Mobility Domain is useful. Because, it eliminates the single point of failure, if connec-
tivity to the seed switch is lost.
If the primary seed switch fails, then the remaining members form a Mobility Domain. Also, the secondary seed takes
over as the primary seed switch.
•
If countermeasures were in effect on the primary seed, they are stopped while the secondary seed gathers RF
data from the member switches. Once the secondary seed rebuilds the RF database, countermeasures can be
restored.
•
•
VLAN tunnels (other than those between the member switches and the primary seed) continues to operate
normally.
Roaming and session statistics continues to gather, provided the primary seed is uninvolved with roaming.
When the primary seed is restored, it resumes its role as the primary seed switch in the Mobility Domain. The secondary
seed returns to the role of a regular Mobility Domain member.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing Mobility Domain roaming 219
Use the following commands to configure a Mobility Domain consisting of a primary seed, secondary seed, and one or
more member switches:
On the primary seed:
set mobility-domain mode seed domain-name mob-domain-name
set mobility-domain member ip-addr (for each member switch)
On the secondary seed:
set mobility-domain mode secondary-seed domain-name mob-domain-name seed-ip
primary-seed-ip-addr
set mobility-domain member ip-addr (for each member switch)
On the other member switches in the Mobility Domain:
set mobility-domain mode member seed-ip primary-seed-ip-addr
set mobility-domain mode member secondary-seed-ip secondary-seed-ip-addr
When removing a secondary-seed switch from a mobility domain make sure that the secondary-seed member informa-
tion is removed from all members of the mobility domain. The primary seed has the secondary seed listed as a mobility
domain member, which has to be removed. The other members of the mobility domain which will have the secondary
seed information has to be removed.
On the primary seed issue type the following command to remove the secondary-seed from the mobility domain:
Syntax clear mobility-domain member <ip address of secondary-seed>
On the other members of the mobility domain issue type the following command to remove the secondary-seed from the
mobility domain:
Syntax clear mobility-domain secondary-seed
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
220 Configuring and managing Mobility Domain roaming
Displaying Mobility Domain status
To view the status of the Mobility Domain for the WSS, use the show mobility-domain command. For example:
WSS# show mobility-domain
Mobility Domain name: pleasanton
Member
State
Type (*:active)
Model
Version
--------------- ------------- --------------- -------- ---------- -------------- ---------
10.8.121.101
10.8.121.102
10.8.121.103
10.8.121.104
STATE_DOWN
STATE_UP
STATE_UP
STATE_UP
SEED
SECONDARY-SEED*
MEMBER
MEMBER
2382
2382
2382
2382
6.0.0.0
6.0.0.0
6.0.0.0
6.0.0.0
Displaying the Mobility Domain configuration
To view the configuration of the Mobility Domain, use the show mobility-domain config command on either the seed
or a nonseed member.
•
To view Mobility Domain configuration on the seed:
WSS# show mobility-domain config
This WSS is the seed for domain Santa Clara.
192.168.12.7 is a member
192.168.15.5 is a member
•
To view Mobility Domain configuration on a member:
WSS# show mobility-domain config
This WSS is a member, with seed 192.168.14.6
Clearing a Mobility Domain from a WSS
You can clear all Mobility Domain configuration from a WSS, regardless of whether the WSS is a seed or a member of
a Mobility Domain.
You might want to clear the Mobility Domain to change a WSS from one Mobility Domain to another, or to remove a
WSS from the Mobility Domain. To clear the Mobility Domain, type the following command:
WSS# clear mobility-domain
success: change accepted
This command has no effect if the WSS is not configured as part of a Mobility Domain.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing Mobility Domain roaming 221
Clearing a Mobility Domain member from a seed
You can remove individual members from the Mobility Domain on the seed WSS. To remove a specific member of the
Mobility Domain, type the following command:
clear mobility-domain member ip-addr
This command has no effect if the WSS member is not configured as part of a Mobility Domain or the current WSS is
not the seed.
Smart Mobile Virtual Controller Cluster configuration
Virtual Controller Cluster configuration terminology
•
Domain configuration – Wireless parameters in the configuration file, include the following:
•
•
•
radio profiles
service profiles
AP configuration
The Domain configuration is typically duplicated among more than one WSS in a cluster.
•
•
Configuration Cluster – The cluster subset of WSSs in a Mobility Domain that share a domain configuration.
Primary AP Manager (PAM) – The WSS in the cluster responsible for actively managing APs that receive
configuration information from the PAM.
•
Secondary AP Manager (SAM) – The WSS in the cluster acting as the hot standby for an AP.
Centralized configuration using Virtual Controller Cluster Mode
•
•
Cluster mode is a subset of a Mobility Domain.
After the predetermined set of configuration parameters are distributed from the primary seed to members of the
cluster in a load balanced manner, the AP parameters are distributed to the APs on each WSS.
•
A member of a configuration cluster does not have a local copy of the domain configuration unless it is the primary
or secondary seed.
•
•
•
•
An WSS cannot boot an AP without network connectivity to the primary or secondary seed.
The domain configuration is created and managed by the active seed.
The secondary seed provides redundancy for configuration management to the primary seed.
The primary seed takes precedence over the secondary seed if there are conflicting configurations between
them. The only exception is if you explicitly override the configuration.
•
Changes to the secondary seed are not allowed while the primary seed is active on the network.
•
You can add more WSSs to the cluster to increase AP booting capacity seamlessly. This do not require any
configuration changes to more than one WSS in the cluster.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
222 Configuring and managing Mobility Domain roaming
•
If primary seed of the Mobility Domain or the secondary seed is configured and the primary seed is unavailable
then the configuration changes for WSSs can only be performed on the primary seed of the Mobility Domain or the
secondary seed.
Autodistribution of APs on the Virtual Controller Cluster
The following are the Autodistribution of APs on the Virtual Controller Cluster:
•
•
Load balancing of APs are supported across the cluster without any explicit configuration.
The maximum number of configured APs on the primary or secondary seed restrict the maximum number of
configured APs on the cluster. Use larger capacity WSSs for larger deployment of APs.
•
Client session states are shared among WSSs in the cluster configuration.
“Hitless” failover with Virtual Controller Cluster configuration
The following are the “Hitless” failover with Virtual Controller Cluster configuration:
•
Failure of an WSS has no adverse impact on the current installation. Existing clients and APs remain active on the
network and there is no impact on the ability to make cluster configuration changes while the WSS is in a “Failure”
state.
•
•
•
APs connected to a WSS failover to another WSS in the cluster without resetting on the network.
Existing client sessions on an AP are not disconnected if the WSS is in the process of failing.
Client session states are shared between WSSs with a configuration profile for an AP. This ensures proper network
resiliency capability.
Keepalive packets are sent between the primary seed and the cluster members to ensure that all members are available.
Configuring Smart Mobile Cluster on a Mobility Domain
On the primary seed for the Mobility Domain, enter the following commands:
WSS_PS# set cluster mode enable
success:change accepted
On the secondary seed for the Mobility Domain, enter the following command to provide cluster redundancy on the
network:
WSS_SS# set cluster mode preempt enable
On each Mobility Domain member, enter the following command:
WSS# set cluster mode enable
success:change accepted
WSS# set cluster mode enable
success:change accepted
WSS# set cluster mode enablesyn
success:change accepted
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing Mobility Domain roaming 223
The command “set cluster preempt enable” can be configured on the secondary seed WSS, if you have configured one as
part of the Mobility Domain, to override the primary seed configuration if the primary and secondary seed become
disconnected. Once the primary seed WSS is available, the primary seed manages the cluster configuration again. This
command is not persistent and you have to set preempt again if the WSS resets.
Virtual Controller Cluster Configuration Parameters
The following configuration parameters are also shared as part of the cluster configuration:
•
ACLs - are implemented as follows:
•
•
•
•
ACLs that refer to an AP must be configured on the seed WSS.
ACLs defined on a seed WSS are shared with members.
ACL mapping to ports, VLANs, and vports can be defined on the member WSSs for locally defined ACLs.
If there are conflicting ACL names, the local ACL takes precedence and the incident is logged to the event log.
Mobility profiles - have the following configuration constraints:
Mobility profiles must be configured on the Primary seed.
Mobility profiles with reference ports are not accepted by the configuration.
Location policies - can be configured as follows:
•
•
•
•
•
•
•
On the seed WSS.
Profiles with port references are not allowed.
QoS profiles
Configuring secure WSS to WSS communications
You can enhance security on your network by enabling Secure WSS to WSS communications. Secure WSS to WSS
communications encrypts management traffic exchanged by WSSs in a Mobility Domain.
When Secure WSS to WSS communications is enabled, management traffic among WSSs in the Mobility Domain is
encrypted using AES. The keying material is dynamically generated for each session and passed among switches using
public keys that you configure. The public keys used on the seed and member switches for the Mobility Domain security
mode are generated by the crypto generate key domain 128 command.
•
On the Mobility Domain seed switch, when you specify the IP addresses and public keys for each member switch,
the member switches’ public keys need to be obtained from each member switch by issuing the show crypto domain
key command on each member switch.
•
On the Mobility Domain member switches, when you specify the IP address and public key for the seed switch, the
public key used is obtained from the seed switch by issuing the show crypto domain key command on the Mobility
Domain seed switch.
To configure Secure WSS to WSS communications:
•
Set Mobility Domain security on each switch to required. The default setting is none. Secure WSS to WSS
communications can be disabled or enabled on a Mobility Domain basis. The feature must have the same setting
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
224 Configuring and managing Mobility Domain roaming
(required or none) on all switches in the Mobility Domain. Use the following command on the seed and on each
member switch to enable Secure WSS to WSS communications:
set domain security required
Note. This command also creates a certificate.
•
Generate the public keys on the Mobility Domain seed a member switches by issuing the crypto generate key
domain 128 command.
Seed Switch Example:
WSS-1# crypto generate key domain 128
key pair generated
Member 1 Switch Example:
WSS-2# crypto generate key domain 128
key pair generated
Member 2 Switch Example:
WSS-3# crypto generate key domain 128
key pair generated
•
Obtain the public keys from the Mobility Domain seed and member switches by issuing the show crypto domain
key command.
Seed Switch Example:
WSS-1# show crypto key domain
Domain public key:
ae:03:ca:0c:19:ac:af:f5:8e:10:cf:df:02:7a:00:d5
Member Switch 1 Example:
WSS-2# show crypto key domain
Domain public key:
c6:9b:d0:07:e7:61:9a:40:24:b0:02:4c:fd:d6:1b:9b
Member Switch 2 Example:
WSS-3# show crypto key domain
Domain public key:
93:b6:d2:70:f6:ff:b7:b0:fe:a3:df:4b:66:e0:53:6f:ab
•
On the Mobility Domain seed switch, set the Mobility Domain mode and domain-name.
Seed Switch Example:
WSS-1# set mobility-domain mode seed domain-name NORTEL
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing Mobility Domain roaming 225
•
On the Mobility Domain seed switch, specify the IP addresses and public keys for each member switch. The unique
public key for each member switch is obtained from the show crypto domain key command.
Note. The unique public key for each member switch will need to be set to the key obtained on
each member switch using the show crypto domain key command.
Seed Switch Example:
WSS-1# set mobility-domain member 192.168.110.16 key
c6:9b:d0:07:e7:61:9a:40:24:b0:02:4c:fd:d6:1b:9b
WSS-1# set mobility-domain member 192.168.110.17 key
93:b6:d2:70:f6:ff:b7:b0:fe:a3:df:4b:66:e0:53:6f:ab
•
On each Mobility Domain member switch, specify the IP address and public key for the seed switch. The unique
public key for each member switch is obtained from the show crypto domain key command.
Note. The public key for the seed switch will need to be set to the key obtained on the seed
switch using the show crypto domain key command.
Member Switch 1 Example:
WSS-1# set mobility-domain mode member seed-ip 192.168.110.15 key
ae:03:ca:0c:19:ac:af:f5:8e:10:cf:df:02:7a:00:d5
Member Switch 2 Example:
WSS-1# set mobility-domain mode member seed-ip 192.168.110.15 key
ae:03:ca:0c:19:ac:af:f5:8e:10:cf:df:02:7a:00:d5
•
•
On the Mobility Domain seed switch set the Mobility Domain security mode to required.
Seed Switch Example:
WSS-1# set domain security required
On each Mobility Domain member switch set the Mobility Domain security mode to required.
Member 1 Switch Example:
WSS-2# set domain security required
Member 2 Switch Example:
WSS-3# set domain security required
•
Verify operations on the seed and member switches by issuing the show mobility-domain command.
Example:
WSS-1# show mobility-domain
Mobility Domain name: NORTEL (security required)
Member
--------------- ------------- --------------
192.168.110.15 STATE_UP SEED
State
Status
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
226 Configuring and managing Mobility Domain roaming
192.168.110.16
192.168.110.17
STATE_UP
STATE_UP
MEMBER
MEMBER
Monitoring the VLANs and tunnels in a Mobility Domain
Tunnels connect WSSs. Tunnels are formed automatically in a Mobility Domain to extend a VLAN to the WSS that a
roaming station is associated with. A single tunnel can carry traffic for many users and many VLANs. The tunnel port
can carry traffic for multiple VLANs by means of multiple virtual ports.
WSS Software automatically adds virtual ports to VLANs as needed to preserve the associations of users to the correct
subnet or broadcast domain as they roam across the Mobility Domain. Although tunnels are formed by IP between WSS
switches, the tunnels can carry user traffic of any protocol type.
WSS Software provides the following commands to display the roaming and tunneling of users within their Mobility
Domain groups:
•
•
•
Displaying roaming stations
The command show roaming station displays a list of the stations roaming to the WSS through a VLAN tunnel. To
display roaming stations (clients), type the following command:
WSS# show roaming station
User Name
Station Address
192.168.15.104
192.168.15.1990
192.168.11.200
192.168.14.200
192.168.15.194
VLAN
State
Up
example\geetha
nh@example.com
example\tamara
example\jose
vlan-am
vlan-am
vlan-ds
vlan-et
vlan-am
Up
Up
Up
hh@example.com
Up
(For more information about this command and the fields in the output, see the Nortel WLAN Security Switch 2300
Series Command Line Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing Mobility Domain roaming 227
Displaying roaming VLANs and their affinities
The command show roaming vlan displays all VLANs in the Mobility Domain, the WSSs servicing the VLANs, and
their tunnel affinity values configured on each switch for the VLANs.
The member WSS that offers the requested VLAN reports the affinity number. If multiple WSSs have native attach-
ments to the VLAN, the affinity values they advertise are a way to attract tunneled traffic to a particular WSS for that
VLAN. A higher value represents preferred connection to the VLAN. (For more information, see “Changing tunneling
To display roaming VLANs, type the following command:
WSS# show roaming vlan
VLAN
WSS
Affinity
---------------- --------------- --------
vlan-eng
vlan-fin
192.168.12.7
192.168.15.5
192.168.15.5
192.168.12.7
192.168.15.5
5
5
vlan-pm
vlan-wep
vlan-wep
5
5
5
(For more information about this command and the fields in the output, see the Nortel WLAN Security Switch 2300
Series Command Line Reference.)
Displaying tunnel information
The command show tunnel displays the tunnels that the WSS is hosting to distribute to a locally attached VLAN. To
display tunnel information, type the following command:
WSS# show tunnel
VLAN
Local Address Remote Address
State
UP
Port
LVID
130
RVID
4103
4097
160
vlan-eng 192.168.12.7
vlan-eng 192.168.12.7
vlan-pm 192.168.12.7
192.168.15.5
192.168.14.6
192.168.15.5
1024
DORMANT 1026
UP 1024
130
4096
(For more information about this command and the fields in the output, see the Nortel WLAN Security Switch 2300
Series Command Line Reference.)
Understanding the sessions of roaming users
When a wireless client successfully roams from one AP to another, its sessions are affected in the following ways:
•
•
•
The WSS treats this client session as a roaming session and not a new session.
RADIUS accounting is handled as a continuation of an existing session, rather than a new one.
The session with the roamed-from AP is cleared from the WSS, even if the client does not explicitly disassociate
from the AP and the IEEE 802.1X reauthentication period has not expired.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
228 Configuring and managing Mobility Domain roaming
Roaming requires certain conditions and can be affected by some of the WSS switch’s timers. You can monitor a
wireless client’s roaming sessions with the show sessions network verbose command.
Requirements for roaming to succeed
For roaming to take place, the roaming client must associate or reassociate with an AP in the Mobility Domain after
leaving an existing session on a different AP in the Mobility Domain in one of the following states:
ACTIVE
The normal state for a client that has left radio range without sending a
request to disassociate.
DEASSOCIATED
The state of a client that has sent an 802.11 disassociate message, but has
not roamed or aged out yet.
In addition, the following conditions must exist for roaming to succeed:
•
•
•
Mobility Domain communications must be stable.
Generally, the communications required for roaming are the same as those required for VLAN tunneling.
A client can also roam among ports on a WSS when a Mobility Domain is inaccessible or not configured.
Client authentication and authorization on the roamed-to AP must be successful on the first attempt.
If authentication or authorization fails, WSS Software clears the client session. Depending on when the
failure occurs, roaming can be disqualified or delayed.
The client must use the same authorization parameters for the roamed-to AP as for the roamed-from AP.
If the client changes its encryption type or VLAN name, WSS Software might record a new session rather
than a roamed session.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing Mobility Domain roaming 229
Effects of timers on roaming
An unsuccessful roaming attempt might be caused by the following timers. You cannot configure either timer.
•
Grace period. A disassociated session has a grace period of 5 seconds during which WSS Software can retrieve
and forward the session history. After 5 seconds, WSS Software clears the session, and its accounting is stopped.
•
MAC address search. If WSS Software cannot find the client’s MAC address in a Mobility Domain within
5 seconds, it treats the session as a new session rather than a roaming session.
In contrast, the 802.1X reauthentication timeout period has little effect on roaming. If the timeout expires, WSS
Software performs 802.1X processing on the existing association. Accounting and roaming history are unaffected when
reauthentication is successful, because the client is still associated with the same AP. If reauthentication fails, WSS
Software clears the session so it is not eligible for roaming.
If the client associates with the same AP, the session is recorded as a new session.
(To change the reauthentication timeout, see “Setting the 802.1X reauthentication period” on page 658.)
Monitoring roaming sessions
To monitor the state of roaming clients, use the show sessions network verbose command. For example, the following
command displays information about the sessions of a wireless client who roamed between the ports on a WSS.
The output shows that the client SHUTTLE\2\exmpl roamed from the AP connected to port 3 to the AP connected to
port 6 on the same WSS, and then roamed back to the AP connected to port 3.
WSS> show sessions network verbose
U s e r N a m e S e s s I D
I P o r M A C A d d r e s s
10.3.8.55
V L A N N a m e
default
P o r t / R a d i o
3/1
SHUTTLE 6*
2 \ e x m p l
Client MAC: 00:06:25:13:08:33 GID: SESS-4-000404-98441-c807c14b
State: ACTIVE (prev AUTHORIZED)
now on: WSS 10.3.8.103, AP/radio 3/1, AP 00:0b:0e:ff:00:3a, as of 00:00:24 ago
from: WSS 10.3.8.103, AP/radio 6/1, AP 00:0b:0e:00:05:d7, as of 00:01:07 ago
from: WSS 10.3.8.103, AP/radio 3/1, AP 00:0b:0e:ff:00:3a, as of 00:01:53 ago
1 sessions total
(For more information about this command and the fields in the output, see the Nortel WLAN Security Switch 2300
Series Command Line Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
230 Configuring and managing Mobility Domain roaming
Mobility Domain scenario
The following scenario illustrates how to create a Mobility Domain named sunflower consisting of three members from
a seed WSS at 192.168.253.21:
1
2
Make the current WSS the Mobility Domain seed. Type the following command:
WSS# set mobility-domain mode seed domain-name sunflower
success: change accepted.
On the seed, add the members of the Mobility Domain. Type the following commands:
WSS# set mobility-domain member 192.168.253.11
success: change accepted.
WSS# set mobility-domain member 192.168.111.112
success: change accepted.
3
4
For each member WSS, configure the IP address used to reach the seed WSS. Type the following
commands:
WSS# set mobility-domain member seed-ip 192.168.253.21
Display the Mobility Domain status. Type the following command:
WSS# show mobility-domain
Mobility Domain name: sunflower
Member
State
Status
---------------
192.168.111.112
192.168.253.11
192.168.253.21
-------------
STATE_UP
STATE_UP
STATE_UP
--------------
MEMBER
MEMBER
SEED
5
6
To display the Mobility Domain configuration, type the following command:
WSS# show mobility-domain config
This WSS is the seed for domain sunflower.
192.168.253.11 is a member
192.168.111.112 is a member
To display the WSSs that are hosting VLANs for roaming, type the following command:
WSS# show roaming vlan
VLAN
WSS
Affinity
---------------- --------------- --------
vlan-eng
vlan-fin
vlan-pm
vlan-wep
vlan-wep
192.168.12.7
192.168.15.5
192.168.15.5
192.168.12.7
192.168.15.5
5
5
5
5
5
7
To display active roaming tunnels, type the following command:
WSS# show tunnel
VLAN Local Address Remote Address State Port LVID RVID
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing Mobility Domain roaming 231
-------------- --------------- --------------- ------- ----- ----- -----
vlan-eng
vlan-eng
192.168.12.7 192.168.15.5 UP
192.168.12.7 192.168.14.6 UP
1025 130 4096
1024 130 4096
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
232 Configuring and managing Mobility Domain roaming
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
233
Configuring network domains
About the network domain feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Configuring a network domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Network domain scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
A Network Domain is a group of geographically dispersed Mobility Domains that share information over a WAN link.
This shared information allows a user configured in one Mobility Domain to establish connectivity on a WSS in a
remote Mobility Domain. The WSS forwards the user traffic by creating a VLAN tunnel to a WSS in the remote
Mobility Domain.
About the network domain feature
A Network Domain allows functionality found in Mobility Domains to be extended over a multiple-site installation. A
user configured to be on a VLAN at his or her home site can travel to a remote site, connect to the network, and be
placed in his or her native VLAN. To do this, the WSS that the user accesses forms a tunnel to a WSS at the user’s home
site.
Figure 4 illustrates a sample Network Domain configuration consisting of Mobility Domains at six sites connected over
a WAN link.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
234 Configuring network domains
Figure 4. Network domain
Corporate Office
ND Seed
Peer
Layer 2-3
ND Seed
Peer
ND Seed
Peer
Layer 2-3
Layer 2-3
WAN Link
Branch Office 1
Branch Office 2
ND Seed
Peer
ND Seed
Peer
ND Seed
Peer
Sales Office A
Sales Office B
Sales Office C
In a Network Domain, one or more WSSs acts as a seed device. A Network Domain seed stores information about all of
the VLANs on the Network Domain members. The Network Domain seeds share this information among themselves, so
that every seed has an identical database. In the example above, one WSS at each site is a Network Domain seed.
Each Network Domain member maintains a TCP connection to one of the seeds. When a Network Domain member
needs information about a VLAN in a remote Mobility Domain, it consults the Network Domain seed to which it is
connected. If the seed has information about the remote VLAN, it responds with the IP address of a WSS where the
VLAN exists. A VLAN tunnel is then created between the WSS and the remote WSS.
Figure 5 illustrates how user Bob, who is based at Sales Office C gets connectivity and is placed in a VLAN when he
visits the Corporate Office.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring network domains 235
Figure 5. How a user connects to a remote VLAN in a network domain
User Bob connects
to WSS at
Corporate Office
1
Corporate Office
ND Seed
Peer
WSS
queries ND Seed
2
Layer 2-3
ND Seed replies
about VLAN Red
pointing to WSS at Sales Office
3
Bob
User Bob
is connected
on VLAN Red
5
ND Seed
Peer
ND Seed
Peer
Layer 2-3
Layer 2-3
WAN Link
Branch Office 1
Branch Office 2
Tunnel is created between
WSS at Corporate Office
and WSS at Sales Office
4
ND Seed
Peer
ND Seed
Peer
ND Seed
Peer
VLAN Red
Configured
Sales Office A
Sales Office B
Sales Office C
In this example, Bob establishes connectivity as follows:
1
Bob connects to the wireless network at the Corporate Office. The WSS contacts the local Mobility
Domain seed and finds that the VLAN that Bob is configured to be on, VLAN Red, does not exist in the
Corporate Office Mobility Domain.
2
Unable to find VLAN Red in the local Mobility Domain, the WSS then contacts the local Network
Domain seed. The Network Domain seed contains a database of all the VLANs configured on all the
members of the Network Domain. (The Network Domain seed may or may not be the same WSS as the
Mobility Domain seed.)
3
The Network Domain seed looks in its database and finds that VLAN Red exists in the Mobility Domain
at Sales Office C. The Network Domain seed then responds with the IP address of the remote WSS where
VLAN Red is configured.
4
5
A VLAN tunnel is created between the WSS at the Corporate Office and the WSS at Sales Office C.
Bob establishes connectivity on the network at the corporate office and is placed in VLAN Red.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
236 Configuring network domains
Network domain seed affinity
When there are multiple Network Domain seeds in an installation, a Network Domain member connects to the seed with
which it has the highest configured affinity. If that seed is unavailable, the Network Domain member connects to the seed
with which it has the next-highest affinity.
Figure 6 illustrates how a WSS connects to a Network Domain seed based on its configured affinity for the seed.
Figure 6. Configuring aWSS’s affinity for a network domain seed
Corporate Office
Local
ND Seed
ND Affinity configuration on WSS:
For Local ND Seed = 10
For ND Peer at Branch 1 = 7
For all other ND Peers = 5
Layer 2-3
When Local ND Seed goes down,
then ND Peer at Branch 1 is used.
Bob
ND Seed
Peer
ND Seed
Peer
Layer 2-3
Layer 2-3
WAN Link
Branch Office 1
Branch Office 2
ND Seed
Peer
ND Seed
Peer
ND Seed
Peer
Sales Office A
Sales Office B
Sales Office C
In the example above, a WSS in the Mobility Domain at the corporate office is configured as a member of a Network
Domain that has a local seed, as well as seeds at the two branch offices and the three sales offices. The WSS has an
affinity value of 10 (highest) for the local seed, and an affinity value of 7 for the seed at Branch Office 1. The WSS has
an affinity of 5 (the default) for the other seeds in the Network Domain.
In the event that the local Network Domain seed becomes unavailable, the WSS then attempts to connect to the seed at
Branch Office 1, its next-highest-affinity seed. Once connected to this seed, the WSS then periodically attempts to
connect to the local seed. When the WSS is able to connect to the local seed again, it drops the connection to the seed at
Branch Office 1.
When you configure a WSS to be a member of a Network Domain, you specify the seed(s) to which it can connect. As
part of this configuration, you can also specify the affinity the WSS has for each seed.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring network domains 237
Configuring a network domain
To configure a Network Domain:
1
Designate one or more Network Domain seed WSSs. (See “Configuring network domain seeds” on
page 238.)
2
3
Configure WSSs to be part of the Network Domain. (See “Configuring network domain members” on
page 240.)
You can view the status of a Network Domain, clear members, and clear all Network Domain configuration from a
WSS.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
238 Configuring network domains
Configuring network domain seeds
In a Network Domain, a member WSS consults a seed WSS to determine a user’s VLAN membership in a remote
Mobility Domain.
Use the following command to set the current WSS as a seed device within a specified Network Domain:
set network-domain mode seed domain-name net-domain-name
For example, the following command sets the current WSS as a seed with the Network Domain California:
WSS# set network-domain mode seed domain-name California
success: change accepted.
If the seed in a Network Domain is also intended to be a member of the Network Domain, you must enter the following
command on the seed, with the specified IP address pointing to the seed itself.
set network-domain mode member seed-ip ip-addr [affinity num]
For example, the following command sets the current WSS as a member of a Network Domain where the WSS with IP
address 192.168.9.254 is a seed:
WSS# set network-domain mode member seed-ip 192.168.9.254
success: change accepted.
You can configure multiple seeds in a Network Domain. When multiple Network Domain seeds are configured, a
member consults the seed with which it has the highest configured affinity.
If you are configuring multiple seeds in the same Network Domain (for example, a seed on each physical site in the
Network Domain), you must establish a peer relationship among the seeds. See the following section.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring network domains 239
Specifying network domain seed peers
When multiple WSSs are configured as seed devices in a Network Domain, they establish a peer relationship to share
information about the VLANs configured on the member devices, so that all of the Network Domain seed peers have the
same database of VLAN information. Sharing information in this way provides redundancy in case one of the seed peers
becomes unavailable.
Use the following command on a Network Domain seed to specify another seed as a peer:
set network-domain peer ip-addr
You enter this command on all of the seed devices in the Network Domain, specifying each seed to every other seed, so
that all of the Network Domain seeds are aware of each other.
For example, the following command sets the current WSS as a peer of the Network Domain seed with IP address
192.168.9.254:
WSS# set network-domain peer 192.168.9.254
success: change accepted.
This command is valid on Network Domain seeds only.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
240 Configuring network domains
Configuring network domain members
In a Network Domain, at least one seed device must be aware of each member device. The seed maintains an active TCP
connection with the member. To configure a WSS as a member of a Network Domain, you specify one or more Network
Domain seeds for it to use.
If you specify multiple Network Domain seeds, you can also specify the affinity the WSS has for each seed. The
Network Domain member initially attempts to connect to the seed with which it has the highest affinity. If that seed is
unavailable, then the WSS attempts to connect to the seed with which it has the next-highest affinity. If the member
connects to a seed with which it does not have the highest configured affinity, then it periodically attempts to connect to
its highest-affinity seed. When the WSS reconnects to the highest-affinity seed, its communication with the
next-highest-affinity seed stops.
Use the following command to set the current WSS as a member of a Network Domain where a specified WSS is a seed:
set network-domain mode member seed-ip ip-addr [affinity num]
You can enter this command multiple times on a WSS, specifying different Network Domain seeds with different
affinity values. The affinity value can range from 1 – 10, with 10 being the highest affinity. The default affinity value is
5.
Note. If the Network Domain seed is also intended to be a member of the
Network Domain, you must also enter this command on the Network Domain seed
itself.
For example, the following command sets the current WSS as a member of a Network Domain where the WSS with IP
address 192.168.9.254 is a seed:
WSS# set network-domain mode member seed-ip 192.168.9.254
success: change accepted.
To specify 10.8.107.1 as an additional Network Domain seed for the WSS to connect to if the 192.168.9.254 seed is
unavailable, enter the following command:
WSS# set network-domain mode member seed-ip 10.8.107.1 affinity 2
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring network domains 241
Displaying network domain information
To view the status of Network Domains configured on the WSS, use the show network-domain command. The output
of the command differs based on whether the WSS is a member of a Network Domain or a Network Domain seed.
For example, a WSS that is a Network Domain member only, output such as the following is displayed:
WSS# show network-domain
Member Network Domain name: California
Member
--------------- ------------- ------ ---------------
10.8.107.1 UP SEED default
State
Mode
Mobility-Domain
On a WSS that is a Network Domain seed, information is displayed about the Network Domain seeds with which the
WSS has a peer relationship, as well as the Network Domains of which the WSS is a member. For example:
WSS# show network-domain
Network Domain name: California
Peer
State
--------------- -------------
10.8.107.1
Member
UP
State
Mode
Mobility-Domain
--------------- ------------- ------ ---------------
10.1.0.0 DOWN SEED
Member Network Domain name:
Member State Mode
--------------- ------------- ------ ---------------
Mobility-Domain
10.8.107.1
10.1.0.0
UP
DOWN
MEMBER default
SEED
(For more information about this command and the fields in the output, see the Nortel WLAN Security Switch 2300
Series Command Line Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
242 Configuring network domains
Clearing network domain configuration from a WSS
You can clear all Network Domain configuration from a WSS, regardless of whether the WSS is a seed or a member of
a Network Domain. You may want to do this in order to change a WSS from one Network Domain to another, or to
remove a WSS entirely from a Network Domain.
To clear the Network Domain configuration from the WSS, type the following command:
clear network-domain
This command has no effect if the WSS is not configured as part of a Network Domain.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring network domains 243
Clearing a network domain seed from a WSS
You can remove individual Network Domain seeds from a WSS’s configuration. To remove a specific Network Domain
seed, type the following command:
clear network-domain seed-ip ip-addr
When you enter this command, the Network Domain TCP connections between the WSS and the specified Network
Domain seed are closed.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
244 Configuring network domains
Clearing a network domain peer from a network domain seed
On a WSS configured as a Network Domain seed, you can clear the configuration of individual Network Domain peers.
To remove a specific Network Domain peer from a Network Domain seed, type the following command:
clear network-domain peer ip-addr
This command has no effect if the WSS is not configured as a Network Domain seed.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring network domains 245
Clearing network domain seed or member configuration from a WSS
You can remove the Network Domain seed or member configuration from the WSS. To do this, enter the following
command:
clear network-domain mode {seed | member}
Use the seed parameter to clear Network Domain seed configuration from the WSS. Use the member parameter to clear
Network Domain member configuration from the WSS.
Network domain scenario
The following scenario illustrates how to create a Network Domain named globaldom consisting of three Mobility
Figure 7. Network domain scenario
Mobility Domain A
Net. Domain Seed 1
Mob. Domain A Seed
10.10.10.1
Site 1
Layer 2-3
10.10.10.2
10.10.10.3
Mob. Domain A
Member
Mob. Domain A
Member
Mobility Domain B
Net. Domain Seed 2
Mob. Domain B Member
20.20.20.1
Layer 2-3
20.20.20.2
20.20.20.3
Site 2
WAN Link
Mob. Domain B
Seed
Mob. Domain B
Member
30.30.30.1
30.30.30.2
Layer 2-3
Mob. Domain C
Seed
Mob. Domain C
Member
Mobility Domain C
In this scenario, there are three Mobility Domains: A, B, and C. Mobility Domain A is located at Site 1, and Mobility
Domains B and C are located at Site 2. There are two Network Domain seeds, one at each site, that share information
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
246 Configuring network domains
about the VLANs in the three Mobility Domains. The Network Domain seed at Site 1 is also the seed for Mobility
Domain A. The Network Domain seed at Site 2 is used by both Mobility Domains B and C. At least one Network
Domain seed is aware of each WSS in the installation and maintains an active TCP connection with it.
The following is the Network Domain configuration for this scenario:
1
Make the WSS with IP address 10.10.10.1 a seed of a Network Domain called globaldom and establish a
peer relationship with the WSS with IP address 20.20.20.1. Type the following commands:
WSS# set network-domain mode seed domain-name globaldom
success: change accepted.
WSS# set network-domain peer 20.20.20.1
success: change accepted.
2
Make the WSS with IP address 20.20.20.1 a seed of a Network Domain called globaldom and establish a
peer relationship with the WSS with IP address 10.10.10.1. Type the following commands:
WSS# set network-domain mode seed domain-name globaldom
success: change accepted.
WSS# set network-domain peer 10.10.10.1
success: change accepted.
3
4
Make the three WSSs in Mobility Domain A members of the Network Domain, specifying WSS
10.10.10.1 as their Network Domain seed. Type the following command on all three WSSs:
WSS# set mobility-domain mode member seed-ip 10.10.10.1
success: change accepted.
Make the WSSs in Mobility Domains B and C members of the Network Domain, specifying WSS
20.20.20.1 as their Network Domain seed. Type the following command on all of the WSSs in both
Mobility Domains:
WSS# set mobility-domain mode member seed-ip 20.20.20.1
success: change accepted.
5
Display the Network Domain status. Type the following command on the WSS with IP address
10.10.10.1:
WSS# show network-domain
Network Domain name: globaldom
Peer
State
---------------
20.20.20.1
-------------
UP
Member
State
-------------
Mode
------
SEED
MEMBER
MEMBER
SEED
MEMBER
MEMBER
MEMBER
MEMBER
Mobility-Domain
---------------
Modo A
Modo A
Modo A
Modo B
Modo B
Modo B
Modo C
---------------
10.10.10.1
10.10.10.2
10.10.10.3
20.20.20.1
20.20.20.2
20.20.20.3
30.30.30.1
30.30.30.2
UP
UP
UP
UP
UP
UP
UP
UP
Modo C
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring network domains 247
Member Network Domain name: globaldom
Member
State
-------------
Mode
------
SEED
MEMBER
MEMBER
SEED
MEMBER
MEMBER
MEMBER
MEMBER
Mobility-Domain
---------------
Modo A
Modo A
Modo A
Modo B
Modo B
Modo B
Modo C
---------------
10.10.10.1
10.10.10.2
10.10.10.3
20.20.20.1
20.20.20.2
20.20.20.3
30.30.30.1
30.30.30.2
UP
UP
UP
UP
UP
UP
UP
UP
Modo C
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
248 Configuring network domains
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring RF load balancing for APs 249
Configuring RF load balancing for
APs
RF load balancing overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Configuring RF load balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Displaying RF load balancing information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
RF load balancing overview
RF load balancing is the ability to reduce network congestion over an area by distributing client sessions across the AP
(access points) with overlapping coverage in the area. When the total demand of nearby wireless clients exceeds the
capacity of a single AP, there is no interruption of wireless services on the network.
For example, in an auditorium or lecture hall there may be a substantial number of clients in a relatively small amount of
space. While a single AP may be sufficient for providing an RF signal to the entire area, more APs are required to deliver
enough aggregate bandwidth for all of the clients. When additional APs are installed in the room, RF load balancing
allows the client sessions to be spread evenly across the APs, increasing the available aggregate bandwidth by increasing
the number of APs.
RF load balancing is enabled by default. In addition, RF load balancing is done on a per-radio basis, rather than a per-AP
basis. For radios managed by a given radio profile, WSS automatically assesses radios with overlapping coverage in an
area and balances the client load across them.
WSS balances the client load by adjusting and it depends on how APs are perceived by clients. As the capacity of an AP
handling new clients is relative to other APs in the area, WSS makes the AP more difficult for potential new clients to
detect, which causes a client to associate with an AP with more capacity. An AP becomes more difficult to detect and
clients then associate with an AP with higher capacity for client sessions. By default, WSS only prevents clients from
associating with an AP (if there are other APs with available capacity). Clients are not prevented from associating with a
AP if it is the only one available.
You can optionally place AP radios into load balancing groups. When two or more AP radios are placed in the same load
balancing group, WSS assumes that they have exactly the same coverage area, and attempts to distribute the client load
across them equally. The AP radios do not have to be on the same WSS switch. A balanced set of AP radios can span
multiple WSS switches in a Mobility Domain.
Configuring RF load balancing
This section describes the following configuration tasks:
•
Disabling or re-enabling RF load balancing
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
250 Configuring RF load balancing for APs
•
•
•
•
Assigning radios to load balancing groups
Specifying band preference for RF load balancing
Setting strictness for RF load balancing
Exempting an SSID from RF load balancing
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring RF load balancing for APs 251
Disabling or re-enabling RF load balancing
RF load balancing is enabled by default globally on the WSS switch and for individual radios. To disable or re-enable
RF load balancing globally, use the following command:
set load-balancing mode {enable | disable}
To disable or re-enable RF load balancing for an individual radio, use the following command:
set ap ap-num radio radio-num load-balancing {enable | disable}
If RF load balancing has been enabled or disabled for a specific AP radio, then the setting for the individual radio takes
precedence over the global setting.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
252 Configuring RF load balancing for APs
Assigning radios to load balancing groups
Assigning radios to specific load balancing groups is optional. When configured, WSS considers the radios to have
exactly overlapping coverage areas, rather than using signal strength calculations to determine their overlapping
coverage. WSS attempts to distribute client sessions across radios in the load balancing group evenly. A radio can be
assigned to only one group.
To assign radios to load balancing groups, use the following command:
set ap ap-num radio radio-num load-balancing group name [rebalance]
Use the rebalance parameter to configure the radio to disassociate its client sessions and rebalance them whenever a
new radio is added to the load balancing group.
To remove a radio from its specified load balancing group, use the following command:
clear ap ap-num radio radio-num load-balancing group
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring RF load balancing for APs 253
Specifying band preference for RF load balancing
If a client supports both the 802.11a and 802.11b/g bands, you can configure WSS to steer the client to a less-busy radio
on an AP for the purpose of load balancing. A global “band-preference” option controls the degree of concealment that
an AP with two radios attempts to hide one of the radios from a client with the purpose of steering the client to the other
radio.
To cause clients that support both the 802.11a and 802.11b/g radio bands to be steered to a specific radio on the AP for
the purpose of load balancing, use the following command:
set band-preference {none | 11bg | 11a}
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
254 Configuring RF load balancing for APs
Setting strictness for RF load balancing
To perform RF load balancing, AP radios with heavy client loads are less visible to new clients, and causes the new
client to associate with AP radios with a lighter load.
You can specify how strictly WSS attempts to load balanced across the AP radios in the load-balancing group. When
low strictness is specified (the default), heavily loaded AP radios are less visible and steer clients to less-busy AP radios,
while ensuring that clients are not denied service even if all the AP radios in the group are heavily loaded.
When maximum strictness is specified and if an AP radio has reached the maximum client load, the AP radio is invisible
to new clients and clients attempt to connect to other AP radios. In the event that all the AP radios in the group reach
maximum client load, then no new clients can connect to the network.
To specify load balancing strictness across the AP radios in a load-balancing group, use the following command:
set load-balancing strictness {low | med | high | max}
•
•
•
•
When the low option is set, no clients are denied service. New clients can be steered to other APs, but only to
the extent that service can be provided to all clients. This is the default.
When the med option is set, overloaded radios steer new clients to other APs and clients attempting to connect
to overloaded radios may be delayed several seconds.
When the high option is set, overloaded radios steer new clients to other APs and clients attempting to connect
to overloaded radios may be delayed up to a minute.
When the max option is set, RF load balancing is strictly enforced. Overloaded radios do not respond to new
clients at all, and a client cannot connect during times that all of the detectable AP radios are overloaded.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring RF load balancing for APs 255
Exempting an SSID from RF load balancing
By default, RF load balancing is applied to client sessions for all SSIDs. To specifically exempt an SSID from load
balancing, use the following command:
set service-profile service-profile-name load-balancing-exempt {enable | disable}
When you exempt a service profile from RF load balancing, an AP radio attempting to steer clients a way does not
reduce or conceal the availability of the SSID in the profile. If a radio withholds probe responses to manage the client
load, the radio does respond to probes for an exempt SSID. Also, if an AP radio is withholding probe responses, and a
client probes for any SSID, and the radio has at least one exempt SSID, the radio responds to the probe, but the response
reveals only the exempt SSID(s).
Displaying RF load balancing information
The show load-balancing group command displays a load balancing group member radios and current load for each
radio. For example:
WSS# show load-balancing group ap 2 radio 1
Radios in the same load-balancing group as: ap2/radio1
--------------------------------------------------
WSS IP address
Port Radio Overlap
------------------ ---- ----- -------
WSS# show load-balancing group all
Load-balancing group: G1
IP address
------------------ ---- ----- -------
10.1.0.188 30
AP Radio Clients
1
0
---------------------------------------
WSS# show configuration area load-balancing all
# Configuration nvgen'd at 2007-6-27 03:17:38
# Image 6.0.3.2.0
# Model 2360
# Last change occurred at 2007-6-27 03:13:56
set load-balancing mode enable
set load-balancing strictness low
set band-preference none
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
256 Configuring RF load balancing for APs
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
257
Configuring APs
AP overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Configuring global AP parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
Disabling or reenabling radios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
Displaying AP information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
APs contain radios that provide networking between your wired network and IEEE 802.11 wireless users. An AP
connects to the wired network through a 10/100 Ethernet link and connects to wireless users through radio signals.
AP overview
Figure 8 shows an example of a Nortel network containing APs and WSSs. An AP can be directly connected to a WSS
port or indirectly connected to a WSS through a Layer 2 or IPv4 Layer 3 network. For redundancy, an AP can have one
of the following combinations of multiple connections:
•
•
•
Two direct connections to a single WSS or two WSSs
Up to four indirect connections to WSSs through intermediate Layer 2 or Layer 3 networks
One direct connection to a WSS and up to three indirect connections to WSSs through intermediate Layer 2 or
Layer 3 networks
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
258 Configuring APs
Figure 8. Example Nortel network
serial-id 0322199997
2330
serial-id 0322199996
2330
serial-id 0322199999
2330
WSS2
System IP address
10.10.40.4
external antenna
model 5303
RADIUS
servers
Port
2
Port
1
10.10.40.19/24
Router
10.10.70.20
WSS1
10.10.20.19/24
10.10.30.19/24
Port
Layer 2
System IP address
10.10.10.4
5
10.10.60.19/24
10.10.70.40
Port
4
Port
3
Layer 2
2330
serial-id 0322199998
10.10.10.19/24
10.10.60.18/24
Router
Wired
authentication
client
2330
serial-id 0322199995
10.10.50.19/24
VLANs on WSS1
WMS
VLAN 2 mgmt, port 5, 10.10.10.4/24
VLAN 4 blue, port 5, tag 20, 10.10.20.2/24
VLAN 3 red, port 5, tag 30
Layer 2
WSS3
System IP address
10.10.50.4
To configure APs, perform the following tasks, in this order:
•
•
•
Specify the country of operation.
Configure AP access ports, AP connections, and dual homing.
If required, configure radio-specific parameters, which include the channel number, transmit power, and
external antenna model.
Note. You do not need to set channels and power if you use Auto-RF to set
these values. You do not need to specify an external antenna model unless a radio
uses an external antenna.
However, if you do install an external antenna, you must ensure that the external
antenna model parameter you specify exactly matches the external antenna that is
attached to the AP’s external antenna port, in order to meet regulatory
requirements.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 259
Note. Intentional radiators, such as the Nortel WLAN 2330/2330A/2330B and Series 2332
access points, are not intended to be operated with any antenna(s) other than those furnished by
Nortel. An intentional radiator may only be operated with the antenna(s) with which it is authorized.
•
•
Configure SSID and encryption settings in a service profile.
Map the service profile to a radio profile, assign the radio profile to radios, and enable the radios.
Country of operation
Before you can configure APs and radio parameters, you must specify the country in which you plan to operate the
radios. Since each country has different regulatory environments, the country code determines the transmit power levels
and channels you can configure on the radios. WSS Software ensures that the values you can configure are valid for the
country you specify.
You must specify the country in which you plan to operate the WSS and its APs. WSS Software does not allow you to
configure or enable the AP radios until you specify the country of operation
The country code determines the valid radio types as well as channel numbers and power settings for AP radios. The
country code is one of the parameters you set when you create a network plan. Be sure to select the country code for the
country in which the AP will be operated. It is a violation of regulatory laws to set the country code to a country that is
different than the actual country in which the AP is operating.
For a complete listing of the approved two-letter country codes, refer to the "Approved Countries for the WLAN 2300
Series Components" at http://www.nortel.com/support.
Note. The 2332 access point has been region-locked to meet geographic regulatory restrictions.
Each model is associated to a specific regulatory domain and subsequent country of operation.
During installation, the access point model and wireless security switch regulatory domain must
match or the access point will not operate.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
260 Configuring APs
Directly connected APs and distributed APs
To configure the WSS to support an AP, you must first determine how the AP will connect to the switch.
There are two types of AP to WSS connection: direct and distributed.
•
In direct connection, an AP connects to one or two 10/100 ports on a WSS. The WSS port is then
configured specifically for a direct attachment to an AP. There is no intermediate networking equipment
between the WSS and AP and only one AP is connected to the WSS port. The WSS 10/100 port provides
PoE to the AP. The WSS also forwards data only to and from the configured AP on that port. The port
numbers on the WSS configured for directly attached APs reference a particular AP.
•
An AP that is not directly connected to a WSS is considered a Distributed AP. There may be intermediate
Layer 2 switches or Layer 3 IP routers between the WSS and AP. The WSS may communicate to the
Distributed AP through any network port. (A network port is any port connecting the switch to other
networking devices, such as switches and routers, and it can also be configured for 802.1Q VLAN
tagging.) The WSS contains a configuration for a Distributed AP based on the AP’s serial number.
Similar to ports configured for directly connected APs, Distributed AP configurations are numbered and
can reference a particular AP. These numbered configurations do not, however, reference any physical
port.
Distributed AP network requirements
Because Distributed APs are not directly attached to a WSS, they require additional support from the network
in order to function. Information on the booting and operation sequence for Distributed APs is covered in the
•
Power—PoE must be provided on one of the Ethernet connections to the AP. Be sure to use a PoE
injection device that has been tested by Nortel. (Contact Nortel for information.) Providing PoE on both
of the Ethernet connections (on models that have two Ethernet ports) allows redundant PoE.
•
DHCP—By default, a Distributed AP uses TCP/IP for communication, and relies on DHCP to obtain IP
parameters. Therefore, DHCP services must be available on the subnet that the AP is connected to. DHCP
must provide the following parameters to the AP:
●
●
●
●
IP address
Domain name
DNS server address
Default router address
•
•
Static IP configuration—If DHCP is not available in the network, a Distributed AP can be configured
with static IP information that specifies its IP address, as well as the WSS uses as its boot device.
DNS—If the intermediate network between the WSS and Distributed AP includes one or more IP routers,
create a wlan-switch.mynetwork.com entry on the DNS server. The entry needs to map one of these
names to the system IP address of the switch. If the subnet contains more than one WSS in the same
Mobility Domain, you can use the system IP address of any of the switches. (For redundancy, you can
create more than one DNS entry, and map each entry to a different WSS in the subnet.)
The DNS entry allows the AP to communicate with a WSS that is not on the AP’s subnet. If the
AP is unable to locate a WSS on the subnet it is connected to, the AP sends DNS requests to the
wlan-switch, where the DNS suffix for mynetwork.com is learned through DHCP.
●
If only wlan-switch is defined in DNS, the AP contacts the WSS whose IP address is
returned for wlan-switch.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 261
Distributed APs and STP
A Distributed AP is a leaf device. You do not need to enable STP on the port that is directly connected to the AP.
If Spanning Tree Protocol (STP) is enabled on the port that is directly connected to a AP, you might need to change the
STP configuration on the port, to allow the AP to boot.
Note. STP on a port directly connected to a Distributed AP can prevent the AP from
booting.
As part of the boot process, an AP disables and reenables the link on the port over which the AP is attempting to boot. If
STP is enabled on the device that is directly connected to the port, the link state change can cause the port on the other
device to leave the forwarding state and stop forwarding traffic. The port remains unable to forward traffic for the
duration of the STP forwarding delay.
An AP waits 30 seconds to receive a reply to its DHCP Discover message, then tries to boot using the other AP port. If
the boot attempt fails on the other port also, the AP then reattempts to boot on the first port. The process continues until
a boot attempt is successful. If STP prevents the other device’s port from forwarding traffic during each boot attempt, the
AP repeatedly disables and reenables the link, causing STP to repeatedly stop the other device’s port from forwarding
traffic. As a result, the boot attempt is never successful.
To allow an AP to boot over a link that has STP enabled, do one of the following on the other device:
•
•
Disable STP on the other device’s port.
Enable the port fast convergence feature, if supported, on the other device’s port. (On some vendors’ devices, this
feature is called PortFast.)
•
If the other device is running Rapid Spanning Tree or Multiple Spanning Tree, set the port into edge port mode.
Distributed APs and DHCP option 43
The option 43 field in a DHCP Offer message can provide a simple and effective way for APs to find WSSs across an
intermediate Layer 3 network, and is especially useful in networks that are geographically distributed or have a flat
domain name space. You can use the DHCP option 43 field to provide a list of WSS IP addresses, without the need to
configure DNS servers.
To use DHCP option 43, configure the option to contain a comma-separated list of WSS IP addresses or hostnames, in
the following format:
ip:ip-addr1,ip-addr2,...
or
host:hostname1.mynetwork.com, hostname2.mynetwork.com,...
You can use an IP address list or a hostname list, but not both. If the list contains both types of values, the AP does not
attempt to use the list.
The ip and host keywords can be in lowercase, uppercase (IP or HOST), or mixed case (example: Ip, Host, and so on.)
You can use spaces after the colon or commas, but spaces are not supported within IP addresses or hostnames. Leading
zeroes are supported in IP addresses. For example, 100.130.001.1 is valid.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
262 Configuring APs
Valid characters in hostnames are uppercase and lowercase letters, numbers, periods ( . ), and hyphens ( - ).
Other characters are not supported.
If you use the host option, you must configure the network’s DNS server with address records that map the
hostnames in the list to the WSS IP addresses.
After receiving a DHCP Offer containing a valid string for option 43, a Distributed AP sends a unicast Find
WSS message to each WSS in the list. See “How a distributed AP contacts a WSS (DHCP-obtained address)”
on page 269 for a description of this process.
No configuration is required on the WSS itself.
AP parameters
Table 5 summarizes parameters that apply to individual APs, including dual-homing parameters. (For infor-
Table 5: Global AP parameters
Parameter
Default Value
Description
name
Based on the port or AP name.
Distributed AP
connection number.
For example:
•
AP01
bias
high
Setting an AP’s bias on a WSS to high causes the
switch to be preferred over switches with low bias,
for booting and managing the AP.
Note: Bias applies only to WSSs that are
indirectly attached to the AP through an
intermediate Layer 2 or Layer 3 network.
An AP always attempts to boot on AP
port 1 first, and if a WSS is directly
attached on AP port 1, the AP boots from
it regardless of the bias settings.
group
None
Named set of APs. WSS Software load-balances
user sessions among the access points in the group.
upgrade-firmware
blink
enable
disable
Automatic upgrade of boot firmware.
LED blink mode—blinking LEDs on an AP make
the AP visually easy to identify.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 263
Resiliency and dual-homing options for APs
APs can support a wide variety of resiliency options. Redundancy for PoE, for data link connections and for WSS
services can be provided to the AP.
•
PoE redundancy—On AP models that have two Ethernet ports, you can provide PoE redundancy by connecting
both ports to PoE sources. PoE can come from a directly connected WSS or a PoE injector. Dual-homing support
for PoE is automatically enabled when you connect both AP Ethernet ports.
•
Data link redundancy—You can provide data link redundancy by connecting both Ethernet ports directly to one
WSS, two WSSs, an intermediate Ethernet switch, or a combination of WSS and Ethernet switch. If an intermediate
Ethernet connection is used, you also need a Distributed AP configuration on a WSS somewhere in the network.
Dual-homing support for data link redundancy is automatically enabled when you connect both AP Ethernet ports.
•
WSS redundancy—You can provide redundancy of WSS services by dual-homing the AP to two directly connected
WSSs; or by configuring a Distributed AP configuration either on two or more indirectly connected WSSs, or on a
combination of a directly connected WSS and one or more indirectly connected WSSs. To provide WSS
redundancy on an AP model that has only one AP port, configure a Distributed AP connection on two or more
indirectly connected WSSs.
Bias
On a WSS, configurations for APs have a bias (low or high) associated with them. The default is high. A WSS with high
bias for an AP is preferred over a WSS with low bias for the AP.
If more than one switch has high bias, or the bias for all connections is the same, the switch that has the greatest capacity
to add more active APs is preferred. For example, if one switch has 50 active APs while another switch has 60 active
APs, and both switches are capable of managing 80 active APs, the new AP uses the switch that has only 50 active APs.
Note. Bias applies only to WSSs that are indirectly attached to the AP through an
intermediate Layer 2 or Layer 3 network. An AP always attempts to boot on AP port 1 first,
and if a WSS is directly attached on AP port 1, the AP boots from it regardless of the bias
settings.
Dual-homed configuration examples
The following sections show examples of dual-homed configurations. You can use any of these configurations to dual
home an AP model that has two Ethernet ports. AP models with one Ethernet port support only the dual-homing config-
Dual-homed direct connections to a single WSS
Figure 9 shows an example of a dual-homed direct connection to one WSS. In this configuration, if the AP’s active data
link with the WSS fails, the AP detects the link failure and restarts using the other link on the same switch.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
264 Configuring APs
Figure 9. Dual-homed direct connections to a single WSS
WSS
AP
Dual-homed direct connections to two WSSs
Figure 10 shows an example of a dual-homed direct connection to two separate WSSs. In this configuration, if the active
data link fails, the AP detects the link failure and restarts using a link to the other switch.
Figure 10. Dual-homed direct connections to two WSS Switches
Network
backbone
WSS
WSS
AP
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 265
Dual-homed direct and distributed connections to WSSs
Figure 11 shows an example of a dual-homed configuration in which one AP connection is direct and the other
is distributed over the network.
Figure 11. Dual-homed direct and distributed connections to WSSs
WSS
WSS
WSS
Network
backbone
WSS
AP port 1
AP port 2
In this example, the AP’s port 1 is directly connected to a WSS. The AP always attempts to boot first from the
directly connected WSS. The AP attempts to boot using AP port 2 only if the boot attempt on port 1 fails. If the
active data link fails, the WSS reboots using the other link.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
266 Configuring APs
Dual-homed distributed connections to WSSs on both AP ports
Figure 12 shows an example of a dual-homed configuration in which both AP connections are distributed over
the network.
Figure 12. Dual-homed distributed connections to WSSs on both AP
ports
WSS
WSS
Network
Network
backbone
backbone
WSS
AP port 1
AP port 2
In this configuration, the AP first attempts to boot on its port 1. If more than one WSS has high bias or if all
WSSs have the same bias, the AP uses the WSS that has the greatest capacity for new active AP connections.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 267
Dual-homed distributed connections to WSSs on one AP port
Figure 13 shows an example of an AP with a single physical link to a network containing three WSSs.
Figure 13. Single-homed connection to multiple WSSs on one AP port
WSS
WSS
WSS
Network
backbone
In this configuration, the AP sends a boot request on its connected port. WSSs that are in the same subnet respond to the
AP. Switches with high bias for the AP respond immediately, whereas switches with low bias for the AP respond after a
brief delay.
If the switches are in another subnet, the AP uses DNS to locate one of the switches, and asks the switch to send the IP
address of the best WSS to use, based on the bias settings on each switch and the capacity of each switch to add new
active AP connections. The AP then requests its image and configuration files from the best WSS.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
268 Configuring APs
Boot process for distributed APs
When a distributed AP boots on the network, it uses the process described in this section. Note that this
process applies only to distributed APs; it does not apply to a directly connected AP. The boot process for a
directly connected AP occurs strictly between the AP and WSS and makes no use of the network’s DHCP or
DNS services.
The boot process for a distributed AP consists of the following steps:
1
2
3
4
Establishing connectivity on the network
Contacting a WSS
Loading and activating an operational image
Obtaining configuration information from the WSS
These steps are described in more detail in the following sections.
Establishing connectivity on the network
When an AP is first powered on, its bootloader obtains an IP address for the AP. The IP address is either
obtained through DHCP (the default) or can be statically configured on the AP.
How a distributed AP obtains an IP address through DHCP
By default, a distributed AP obtains its IP address through DHCP. The AP brings up the link on the AP’s port
1 and attempts the boot process outlined below.
1
2
The AP sends a DHCP Discover message from the AP’s port 1 to the broadcast address.
If a DHCP server is present on the subnet or through a router configured to relay DHCP, the
server replies with a unicast DHCP Offer message. The Offer message must contain the
following parameters:
●
●
●
●
IP address for the AP
Domain name of the network
IP address of the network’s DNS server
IP address of the subnet’s default router (gateway)
Optionally, the DHCP Offer message can also contain a list of WSS IP addresses or hostnames,
in the Option 43 field.
3
The AP broadcasts a DHCP Request to the DHCP servers, and receives an Ack from a DHCP
server. The AP then configures its network connection with the information contained in the
Ack message from that server.
Static IP address configuration for distributed APs
In cases where DHCP is not available, you can manually assign IP address information to a Distributed AP.
This information is configured through the CLI.
You can configure the following information for a Distributed AP:
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 269
A
IP address, subnet mask, default router, and whether the configured static IP address information is
enabled for the AP.
B
C
The IP address of a suitable WSS for the AP to use as a boot device.
The fully qualified domain name of a WSS to use as a boot device, and the IP address of a DNS server
used to resolve the WSS’s name.
These items are referred to by letter in the description of how the AP contacts a WSS in “How a distributed AP contacts
a WSS (statically configured address)” on page 270. If the AP does not have static IP address information configured, or
its static IP configuration is disabled, then the AP obtains its IP address through DHCP.
Contacting a WSS
After the AP has an IP address, it attempts to contact a WSS on the network. The method used for contacting a WSS
depends on whether the AP’s IP address was obtained through DHCP or was configured statically.
How a distributed AP contacts a WSS (DHCP-obtained address)
1
If the DHCP Offer message contained WSS IP addresses or hostnames in the Option 43 field, the AP
proceeds as follows:
●
If the DHCP Offer message contained one or more IP addresses in the Option 43 field, the AP sends
●
If the DHCP Offer message contained one or more hostnames in the Option 43 field, the AP sends
DNS Requests to the DNS server for the IP addresses of the hosts, then sends a unicast Find WSS
Note. This method requires DNS address records on the DNS server that map
the hostnames to the WSS IP addresses.
●
If no WSSs reply, the AP repeatedly resends the Find WSS messages. If no WSSs reply, the process
2
If no IP addresses or hostnames were specified in the Option 43 field of the DHCP Offer message, the AP
sends a Find WSS message to UDP port 5000 on the subnet broadcast address.
●
WSSs in the same IP subnet as the AP receive the message and respond with a Find WSS Reply
message.
❍
If the AP is configured as a Distributed AP on a switch and the connection bias is high, the
WSS immediately sends a Find WSS Reply message.
❍
If the AP is configured as a Distributed AP on a switch but the connection bias is low, that WSS
waits one second, then sends a Find WSS Reply message. The delay allows switches with high
bias for the AP to respond first.
❍
If a WSS that receives the Find WSS message does not have the Distributed AP in its
configuration but another WSS in the same Mobility Domain does, the switch waits two
seconds, then sends a Find WSS Reply message with the IP address of the best switch to use.
The determination of best switch is based on the bias settings for the AP on each switch and on
the capacity of each switch to add new active AP connections.
●
If no WSSs reply, the AP repeatedly resends the Find WSS broadcast. If still no WSSs reply, the
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
270 Configuring APs
3
If the AP is unable to locate a WSS on the subnet it is connected to, and is unable to find a WSS based on
information in the DHCP option 43 field, the AP sends DNS requests for the wlan-switch, where the DNS
suffix for mynetwork.com is learned through DHCP.
Note. You must configure a DNS address record on your DNS server for the
WSS IP address. Otherwise, the DNS server cannot provide the WSS’s address to
the AP.
4
5
The DNS server replies with the system IP address of a WSS.
●
If only wlan-switch is defined in DNS, the AP sends a unicast Find WSS message to the WSS whose
IP address is returned for wlan-switch.
The AP sends Find WSS requests to the WSS IP addresses given by the DNS reply. If a WSS receives the
However, if no WSSs reply, the AP repeatedly retries this method:
●
If still no WSSs reply, the AP begins the process again, starting with the procedure under “How a
distributed AP contacts a WSS (DHCP-obtained address)” on page 269, on the other AP port.
●
If the other AP port does not have a link or the AP has only one port, the AP instead restarts, and
begins the process again on the same AP port.
6
The WSS that receives the Find WSS request determines the best WSS for the AP to use, based on the
bias settings for the AP on each switch. If more than one switch has high bias for the AP or all switches
have the same bias, the WSS suggests the switch that has the highest capacity to add new active AP
connections.
7
8
The WSS sends a unicast Find WSS Reply message to the AP containing the system IP address of the
best WSS to use.
The AP sends a unicast message to the suggested WSS, to request an operational image. If the AP does
not receive a reply after 10 seconds, the AP reboots and starts the boot process over.
If an AP does not receive a reply to a DNS request or a request for an operational image after one minute, the AP starts
the boot process over with a new DHCP Discover message, this time from AP port 2.
How a distributed AP contacts a WSS (statically configured address)
When configuring a distributed AP with static IP information, you can specify the following information:
A
IP address, subnet mask, default router, and whether the configured static IP address information is
enabled for the AP.
B
C
The IP address of a suitable WSS for the AP to use as a boot device.
The fully qualified domain name of a WSS to use as a boot device, and the IP address of a DNS server
used to resolve the WSS’s name.
This information is used in the following way when the AP attempts to contact a WSS:
1
If Items A and B (but not Item C) are specified, and the WSS’s IP address is part of the local subnet, then
the AP sends an ARP request for its configured static IP address, to ensure that it is not already in use in
the network. The AP then sends a Find WSS message to UDP port 5000 at the WSS’s IP address.
●
If the AP receives a response from that address, it sends a unicast message to the WSS, to request an
operational image.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 271
●
If the AP does not get a response, then it sends a Find WSS message to UDP port 5000 on the subnet
broadcast address.
❍
If the AP receives a response to the broadcast Find WSS message, then the process continues
using the procedure described under “How a distributed AP contacts a WSS (DHCP-obtained
❍
If there is no response to the broadcast Find WSS message, then the process skips to step 4 on
●
If the WSS is not part of the local subnet, then the AP uses the default router address to contact the
WSS.
2
3
broadcasts a Find WSS message to the subnet.
●
If the AP receives a response to the broadcast Find WSS message, then the process continues using
●
If there is no response to the broadcast Find WSS message, the WSS continues broadcasting the
Find WSS message for a period of time. If still no response is received, then the process skips to
If Items A and C are specified, the AP sends a DNS request to resolve the fully qualified domain name of
the WSS. If the DNS server is not on the local subnet, the AP uses the default router address to contact the
DNS server.
●
●
If there is no response from the DNS server, then the process skips to step 4 on page 271
If there is a response from the DNS server, then the AP sends a Find WSS message to the WSS.
❍
If a response is received from the WSS, then the AP sends a unicast message to the WSS, to
request an operational image.
❍
4
If the AP cannot reach the WSS using the static IP address information, then the AP attempts to boot
using the default boot process; that is, by contacting a DHCP server, as described in “How a distributed
AP obtains an IP address through DHCP” on page 268. If the default AP boot process does not succeed,
then the AP again attempts to boot using its statically configured IP information. The AP alternates
between the two boot processes until the WSS is contacted.
If the default AP boot process is successful, but the DHCP response does not include a DNS server
Loading and activating an operational image
An AP’s operational image is the software that allows it to function on the network as a wireless access point. As part of
the AP boot process, an operational image is loaded into the AP’s RAM and activated. The AP stores copies of its oper-
ational image locally, in its internal flash memory. The AP can either load the locally stored image, or it can download
an operational image from the WSS to which it has connected.
After the AP establishes a connection to a WSS, the AP’s bootloader determines if the WSS permits the AP to load a
local image or if the image should be downloaded from the WSS.
The AP loads its local image only if the WSS is running WSS Software Version 5.0 or later, and the WSS does not have
a newer AP image than the one stored locally on the AP. If the WSS is not running WSS Software Version 5.0 or later,
or the WSS has a newer version of the AP image than the version in the AP’s local storage, the AP downloads the oper-
ational image from the WSS.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
272 Configuring APs
The bootloader also compares the version of the local image to the version available from the WSS. If the two
versions do not match, the image is downloaded from the WSS, so that the AP’s local image matches the
version from the WSS.
After an operational image is downloaded from the WSS, it is copied into the AP’s flash memory. The AP then
reboots, copying the downloaded operational image from its flash memory into RAM.
Obtaining configuration information from the WSS
Once the AP loads an operational image, either from local storage or downloaded from a WSS, the AP
receives configuration information from the WSS to which it has connected. This information includes
commands that activate the radios on the AP, regulate power levels, assign SSIDs, and so on.
After the AP receives the configuration information from the WSS, it is then operational on the network as a
wireless access point.
AP boot examples
The following figures show AP boot examples:
•
•
•
•
Figure 14 on page 273 shows an example of the boot process for an AP connected through a Layer 2
network.
Figure 15 on page 275 shows an example of the boot process for an AP connected through a Layer 3
network.
Figure 16 on page 277 shows an example of the boot process for a dual-homed AP that has one direct
connection to a WSS and an indirect connection through a Layer 2 network.
Figure 17 on page 278 shows an example of the boot process for an AP that has been configured with
static IP information.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 273
Example AP boot over layer 2 network
Figure 14 shows an example of the boot process for an AP connected through a Layer 2 network. MX1, MX2,
and MX3 each have a Distributed AP configuration for the AP.
Figure 14. AP booting over layer 2 network
WSS2
System IP address
4
10.10.40.4
active APs = 34
DAP 1
serial_id 0322199999
model 2330bias = low
WSS1
Layer 2
System IP address
Router
Layer 2
10.10.10.4
active APs = 49
DAP 1
serial_id 0322199999
model 2330
bias = high
5
Router
Layer 2
3
1
serial_id 0322199999
model 2330
2
DHCP Server
WSS3
System IP address
10.10.50.4
active APs = 62
DAP 1
serial_id 0322199999
model 2330
bias = high
1
2
The AP sends a DHCP Discover message from the AP’s port 1.
DHCP server receives the Discover message (through a relay agent) and replies with a DHCP
Offer message containing IP address for the AP, the router IP address for the AP’s IP subnet,
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
274 Configuring APs
the DNS server address, and the domain name. AP then sends a DHCP Request message to the
server and receives an Ack from the server.
3
4
5
The AP sends a broadcast Find WSS message to IP subnet broadcast address.
WSS1 and WSS3 have high priority for the AP and reply immediately.
The AP contacts WSS1 and determines whether it should use a locally stored operational image
or download it from the WSS.
WSS1 is contacted because it has fewer active AP connections than WSS3. Once the
operational image is loaded, the AP requests configuration information from WSS1.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 275
Example AP Boot over Layer 3 Network
Figure 15 shows an example of the boot process for an AP connected through a Layer 3 network.
Figure 15. AP booting over layer 3 network
WSS2
System IP address
10.10.40.4
active APs = 34
DAP 1
serial_id 0322199998
model 2330
bias = low
WSS1
System IP address
Layer 2
Router
Layer 2
10.10.10.4
6
active APs = 49
3
1
DAP 1
serial_id 0322199998
model 2330
serial_id 0322199998
model 2330
7
bias = high
4
8
Router
DHCP Server
2
Layer 2
DNS Server
wlan-switch.example.com =
10.10.10.4
5
WSS3
System IP address
10.10.50.4
active APs = 62
DAP 1
serial_id 0322199998
model 2330
bias = high
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
276 Configuring APs
1
2
The AP sends DHCP Discover message from the AP’s port 1.
The DHCP server replies with a DHCP Offer message containing an IP address for the AP, the default
router IP address for the AP’s IP subnet, the DNS server address, and the domain name. AP then sends a
DHCP Request message to the server and receives an Ack from the server.
3
4
The AP sends a broadcast Find WSS message to the IP subnet broadcast address.
When the AP is unable to locate a WSS on the subnet it is connected to, the AP then sends a DNS request
for wlan-switch.example.com.
5
The DNS server sends the system IP address of the WSS mapped to wlan-switch.example.com. In this
example, the address is for WSS1.
6
7
The AP sends a unicast Find WSS message to WSS1.
WSS1 receives the Find WSS message and compares the bias settings on each WSS for the AP. More
than one WSS has a high bias for the AP, so WSS1 selects the WSS that has the greatest capacity to add
new active AP connections. In this example, WSS1 has more capacity. WSS1 sends its own IP address in
the Find WSS Reply message to the AP.
8
The AP contacts WSS1 and determines whether it should use a locally stored operational image or
download it from the WSS. Once the operational image is loaded, the AP requests configuration
information from WSS1.
Example boot of dual-homed AP
Figure 16 shows an example of the boot process for an AP that is dual homed with a direct connection to WSS1 and an
indirect connection to WSS2 and WSS3. In this configuration, since the AP is directly connected to a WSS, the AP boots
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 277
using the directly connected WSS regardless of the bias set on any of the WSSs configured for the AP. Only in
the event of a physical port failure would the AP attempt to boot from its port 2.
Figure 16. Dual-homed AP booting
WSS2
System IP address
10.10.40.4
active APs = 34
DAP 1
serial_id 0322199999
model 2330
WSS1
System IP address
10.10.10.4
Layer 2
Router
Router
active APs = 49
AP port 4
2
model 2330
PoE enabled
Port
4
1
Layer 2
serial_id 0322199999
model 2330
DHCP Server
WSS3
System IP address
10.10.50.4
active APs = 62
DAP 1
serial_id 0322199999
model 2330
1
2
AP sends a DHCP Discover message from the AP’s port 1.
Because WSS1 is configured for direct attachment, WSS1 responds privately to the AP and
provides the AP with its operational image (or indicates that the AP should use a locally stored
image) and configuration from WSS1. Only in the event of a physical port failure would the AP
attempt to boot from its port 2, in which case both WSS1 and WSS2 would respond to the
broadcast Find WSS message.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
278 Configuring APs
Example boot of AP with static IP configuration
Figure 17 shows an example of the boot process for an AP configured with static IP information. In the example, the AP
has been configured to use the following:
•
•
Static IP address: 172.16.0.42, netmask: 255.255.255.0, default router 172.16.0.20
Boot WSS: 2350, DNS server: 172.16.0.1
Figure 17. AP booting with a static IP address
DAP 1
static IP: 172.16.0.42
DNS Server
172.16.0.1
1
2
5
Layer 2
4
6
WSS
System FQDN:
2350
After the AP is configured with the above information, the next time the AP boots, the following takes place
1
2
3
4
5
The AP sends an ARP request for its own address, to ensure it is not in use elsewhere in the network.
The DNS server resolves the fully qualified domain name of the WSS, 2350.
The AP sends a Find WSS message to the WSS 2350.
The WSS 2350 responds to the Find WSS message
The AP sends a unicast message to WSS 2350 and determines whether it should use a locally stored
operational image or download it from the WSS.
6
Once the operational image is loaded, WSS 2350 sends configuration information to the AP.
Session load balancing
You can assign APs to a load-balancing group. A load-balancing group helps reduce congestion by distributing client
sessions among the APs in the group. For example, if an 802.11b/g radio operating on channel 1 is supporting more
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 279
sessions than a neighboring 802.11b/g radio operating on channel 6, the load-balancing feature can reject association
requests to the radio on channel 1.
To balance the sessions, WSS Software rejects an association request for an access point’s radio if that radio has at least
four more active sessions than the radio of the same type with the least number of active sessions within the group. If the
rejected client associates with another access point in the same group, the session load among the access points in the
group becomes more balanced.
Load balancing is based only on association requests for new sessions. Adding an AP to a group does not affect sessions
that are already active on the access point. In addition, WSS Software does not attempt to rebalance sessions when a
client disassociates from an access point. If WSS Software rejects an association request for load-balancing reasons but
not for authentication reasons, the rejection does not count as an authentication failure.
Nortel recommends that you configure small groups and ensure that all the radios in the group provide comparable
coverage within the same service area.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
280 Configuring APs
Service profiles
A service profile controls advertisement and encryption for an SSID. You can specify the following:
•
•
•
•
Whether SSIDs that use the service profile are beaconed
Whether the SSIDs are encrypted or clear (unencrypted)
For encrypted SSIDs, the encryption settings to use
The fallthru authentication type for users that are not authenticated with 802.1X or MAC authentication
Table 6 lists the parameters controlled by a service profile and their default values.
Table 6: Defaults for service profile parameters
Radio Behavior When Parameter Set
To Default Value
Parameter
Default Value
attr
No attributes
configured
Does not assign the SSID’s authorization
attribute values to SSID users, even if
attributes are not otherwise assigned.
auth-dot1x
enable
none
When the Wi-Fi Protected Access (WPA)
information element (IE) is enabled, uses
802.1X to authenticate WPA clients.
auth-fallthru
Denies access to users who do not match
an 802.1X or MAC authentication rule for
the SSID requested by the user.
auth-psk
beacon
disable
enable
none
Does not support using a preshared key
(PSK) to authenticate WPA clients.
Sends beacons to advertise the SSID
managed by the service profile.
cac-mode
Does not limit the number of active user
sessions based on Call Admission Control
(CAC).
cac-session
14
If session-based CAC is enabled
(cac-mode is set to session), limits the
number of active user sessions on a radio
to 14.
cipher-ccmp
disable
Does not use Counter with Cipher Block
Chaining Message Authentication Code
Protocol (CCMP) to encrypt traffic sent to
WPA clients.
cipher-tkip
enable
disable
disable
When the WPA IE is enabled, uses
Temporal Key Integrity Protocol (TKIP) to
encrypt traffic sent to WPA clients.
cipher-wep104
cipher-wep40
Does not use Wired Equivalent Privacy
(WEP) with 104-bit keys to encrypt traffic
sent to WPA clients.
Does not use WEP with 40-bit keys to
encrypt traffic sent to WPA clients.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 281
Table 6: Defaults for service profile parameters (continued)
Radio Behavior When Parameter Set
To Default Value
Parameter
Default Value
cos
0
If static CoS is enabled (static-cos is set to
enable), assigns CoS 0 to all data traffic to
or from clients.
dhcp-restrict
disable
Does not restrict a client’s traffic to only
DHCP traffic while the client is being
authenticated and authorized.
idle-client-probing
keep-initial-vlan
enable
disable
Sends a keepalive packet (a null-data
frame) to each client every 10 seconds.
Reassigns the user to a VLAN after
roaming, instead of leaving the roamed
user on the VLAN assigned by the switch
where the user logged on.
Note: Enabling this option does
not retain the user’s initial VLAN
assignment in all cases.
long-retry-count
no-broadcast
5
Sends a long unicast frame up to five times
without acknowledgment.
disable
Does not reduce wireless broadcast traffic
by sending unicasts to clients for ARP
requests and DHCP Offers and Acks
instead of forwarding them as multicasts.
proxy-arp
disable
Does not reply on behalf of wireless clients
to ARP requests for client IP addresses.
Instead, the radio forwards the ARP
Requests as wireless broadcasts.
psk-phrase
psk-raw
No passphrase
defined
Uses dynamically generated keys rather
than statically configured keys to
authenticate WPA clients.
No preshared key
defined
Uses dynamically generated keys rather
than statically configured keys to
authenticate WPA clients.
rsn-ie
disable
disable
Does not use the RSN IE in transmitted
frames.
shared-key-auth
Does not use shared-key authentication.
This parameter does not enable PSK
authentication for WPA. To enable PSK
encryption for WPA, use the
set radio-profile auth-psk command.
short-retry-count
5
Sends a short unicast frame up to five
times without acknowledgment.
soda
disable
Sygate On Demand Agent (SODA) files
are not downloaded to connecting clients.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
282 Configuring APs
Table 6: Defaults for service profile parameters (continued)
Radio Behavior When Parameter Set
To Default Value
Parameter
Default Value
ssid-name
ssid-type
static-cos
Nortel
crypto
disable
Uses the SSID name Nortel.
Encrypts wireless traffic for the SSID.
Assigns CoS based on the QoS mode
(wmm or svp) or based on ACLs.
tkip-mc-time
60000
Uses Michael countermeasures for 60,000
ms (60 seconds) following detection of a
second MIC failure within 60 seconds.
transmit-rates
802.11a:
Accepts associations only from clients that
support one of the mandatory rates.
Sends beacons at the specified rate
(6 Mbps for 802.11a, 2 Mbps for 802.11b/
g).
Sends multicast data at the highest rate that
can reach all clients connected to the radio.
Accepts frames from clients at all valid
data rates. (No rates are disabled by
default.)
•
mandatory:
6.0,12.0,24.0
•
•
beacon-rate: 6.0
multicast-rate:
auto
•
disabled: none
802.11b:
•
mandatory:
1.0,2.0
•
•
beacon-rate: 2.0
multicast-rate:
auto
•
disabled: none
802.11g:
•
mandatory:
1.0,2.0,5.5,11.0
•
•
beacon-rate: 2.0
multicast-rate:
auto
•
disabled: none
user-idle-timeout
180
Allows a client to remain idle for 180
seconds (3 minutes) before WSS Software
changes the client’s session to the
Disassociated state.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 283
Table 6: Defaults for service profile parameters (continued)
Radio Behavior When Parameter Set
To Default Value
Parameter
Default Value
web-portal-acl
portalacl
If set to portalacl and the service profile
fallthru is set to web-portal, radios use the
portalacl ACL to filter traffic for Web
Portal users during authentication.
If the fallthru type is web-portal but
web-portal-acl is set to an ACL other than
portalacl, the other ACL is used.
If the fallthru type is not web-portal,
radios do not use the web-portal-acl
setting.
Note: This is the
default only if the
fallthru type on
the service profile
has been set to
web-portal.
Otherwise, the
value is
unconfigured.
web-portal-form
Not configured
For Web Portal Web-based AAA users,
serves the default login web page or, if
configured, the SSID-specific login web
page.
web-portal-session-
timeout
5
Allows a Web Portal Web-based AAA
session to remain in the Deassociated state
5 seconds before being terminated
automatically.
wep key-index
No keys defined
Uses dynamic WEP rather than static
WEP.
Note: If you configure a WEP key
for static WEP, WSS Software
continues to also support dynamic
WEP.
wep active-multicast-index
wep active-unicast-index
wpa-ie
1
Uses WEP key 1 for static WEP encryption
of multicast traffic if WEP encryption is
enabled and keys are defined.
1
Uses WEP key 1 for static WEP encryption
of unicast traffic if WEP encryption is
enabled and keys are defined.
disable
Does not use the WPA IE in transmitted
frames.
(To configure a service profile, see “For more information about MP-432 and 802.11n, see Nortel WLAN -
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
284 Configuring APs
Public and private SSIDs
Each radio can support the following types of SSIDs:
•
Encrypted SSID—Clients using this SSID must use encryption. Use the encrypted SSID for secured
access to your enterprise network.
•
Clear SSID—Clients using this SSID do not use encryption. Use the clear SSID for public access to
nonsecure portions of your network.
All supported AP models can support up to 32 SSIDs per radio. Each SSID can be encrypted or clear, and
beaconing can be enabled or disabled on an individual SSID basis.
Each radio has 32 MAC addresses and can therefore support up to 32 SSIDs, with one MAC address assigned
to each SSID as its BSSID. An AP's MAC address block is listed on a label on the back of the access point. If
the AP is already deployed and running on the network, you can display the MAC address assignments by
using the show ap status command.
All MAC addresses on an AP are assigned based on the AP’s base MAC address, as described in Table 7.
Table 7: MAC address allocations on APs
•
The AP has a base MAC address. All the other addresses are
assigned based on this address.
AP
All models
All models
•
•
Ethernet port 1 equals the AP base MAC address.
Ethernet port 2 (if the AP model has one) equals the AP base
MAC address + 1.
Ethernet Ports
•
•
The 802.11b/g radio equals the AP base MAC address.
The BSSIDs for the SSIDs configured on the 802.11b/g radio
end in even numbers. The first BSSID is equal to the AP’s
base MAC address. The next BSSID is equal to the AP’s base
MAC address + 2, and so on.
Radios and SSIDs
2330/2330A/2330B
and Series 2332
•
•
The 802.11a radio equals the AP base MAC address + 1.
The BSSIDs for the SSIDs configured on the 802.11a radio
end in odd numbers. The first BSSID is equal to the AP’s base
MAC address + 1. The next BSSID is equal to the AP’s base
MAC address + 3, and so on.
Encryption
Encrypted SSIDs can use the following encryption methods:
•
•
•
Wi-Fi Protected Access (WPA)
Non-WPA dynamic Wired Equivalent Privacy (WEP)
Non-WPA static WEP
Dynamic WEP is enabled by default.
(For more information, including configuration instructions, see “Configuring user encryption” on page 361.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 285
Radio profiles
You can easily assign radio configuration parameters to many radios by configuring a radio profile and
assigning the profile to the radios. To use a radio, you must assign a profile to the radio. You can enable the
radio when you assign the profile.
Table 8 summarizes the parameters controlled by radio profiles. Generally, the only radio parameters
controlled by the profile that you need to modify are the SSIDs and, if applicable, Wi-Fi Protected Access
(WPA) settings. The other parameter settings are standard.
Table 8: Defaults for radio profile parameters
Radio Behavior When Parameter
Set To Default Value
Parameter
Default Value
active-scan
enable
Sends probe any requests (probe requests
with a null SSID name) to solicit probe
responses from other access points.
beacon-interval
countermeasures
100
Waits 100 ms between beacons.
Not configured Does not issue countermeasures against
any device.
dtim-interval
frag-threshold
1
Sends the delivery traffic indication map
(DTIM) after every beacon.
2346
Uses the short-retry-count for frames
shorter than 2346 bytes and uses the
long-retry-count for frames that are
2346 bytes or longer.
max-rx-lifetime
max-tx-lifetime
2000
2000
Allows a received frame to stay in the
buffer for up to 2000 ms (2 seconds).
Allows a frame that is scheduled for
transmission to stay in the buffer for up to
2000 ms (2 seconds).
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
286 Configuring APs
Table 8: Defaults for radio profile parameters (continued)
Radio Behavior When Parameter
Set To Default Value
Parameter
Default Value
preamble-length
short
Advertises support for short 802.11b
preambles, accepts either short or long
802.11b preambles, and generates unicast
frames with the preamble length specified
by the client.
Note: This parameter applies only
to 802.11b/g radios.
qos-mode
wmm
Classifies and marks traffic based on
802.1p and DSCP, and optimizes
forwarding prioritization of AP radios for
Wi-Fi Multimedia (WMM).
rfid-mode
disable
2346
Radio does not function as a location
receiver in an AeroScout Visibility
System.
rts-threshold
service-profile
wmm-powersave
Transmits frames longer than 2346 bytes
by means of the Request-to-Send/
Clear-to-Send (RTS/CTS) method.
No service
You must configure a service profile. The
profiles defined service profile sets the SSID name and
other parameters.
disable
Requires clients to send a separate PSpoll
to retrieve each unicast packet buffered by
the AP radio.
Auto-RF
The Auto-RF feature dynamically assigns channel and power settings to AP radios, and adjusts those settings when
needed. Auto-RF can perform the following tasks:
•
•
•
Assign initial channel and power settings when an AP radio is started.
Periodically assess the RF environment and change the channel or power setting if needed.
Change the transmit data rate or power to maintain at least the minimum data rate with all associated clients.
By default, Auto-RF is enabled for channel configuration but disabled for power configuration.
Default radio profile
WSS Software contains one default radio profile, named default. To apply common parameters to radios, you can
modify the default profile or create a new one. When you create a new profile, the radio parameters in the profile are set
to their factory default values.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 287
Radio-specific parameters
The channel number, transmit power, and external antenna parameters are unique to each radio and are not
Table 9: Radio-specific parameters
Parameter
Default Value
Description
antenna-
location
indoor/outdoor
Location of the radio’s antenna.
Note: This parameter applies only to
APs that support external antennas.
antennatype
For most AP models, the default is Nortel external antenna model
internal.
Note: This parameter is configurable
only on APs that support external
antennas.
auto-tune
max-power
Highest setting allowed for the
country of operation or highest
Maximum percentage of client retransmissions a
radio can experience before Auto-RF considers
setting supported on the hardware, changing the channel on the radio
whichever is lower
(To configure Auto-RF, see “Configuring
channel
•
•
802.11b/g—6
Number of the channel in which a radio
transmits and receives traffic
802.11a—Lowest valid
channel number for the country
of operation
mode
disable
Operational state of the radio.
radio-profile
None. You must add the radios to a 802.11 settings
radio profile.
tx-power
Highest setting allowed for the
country of operation or highest
setting supported on the hardware,
whichever is lower.
Transmit power of a radio, in decibels referred to
1 milliwatt (dBm)
Although these parameters have default values, Nortel recommends that you change the values for each radio
for optimal performance. For example, leaving the channel number on each radio set to its default value can
result in high interference among the radios.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
288 Configuring APs
Configuring global AP parameters
To configure APs, perform the following tasks, in this order:
•
•
Configure an Auto-AP profile for automatic configuration of Distributed APs. (See “Configuring an
•
•
•
Configure a service profile to set SSID and encryption parameters. (See “For more information about
•
•
If required, configure the channel, transmit power, and external antenna type on each radio. (See
•
•
Map the radio profile to a service profile. (See “Mapping the radio profile to service profiles” on
page 336.)
Assign the radio profile to radios and enable the radios. (See “Assigning a radio profile and enabling
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 289
Specifying the country of operation
You must specify the country in which you plan to operate the WSS and its APs. WSS Software does not allow you to
configure or enable the AP radios until you specify the country of operation.
Note. In countries where Dynamic Frequency Selection (DFS) is required, WSS
Software performs the appropriate check for radar. If radar is detected on a channel, the AP
radio stops using the channel for the amount of time specified in the specified country’s
regulations. WSS Software also generates a log message to notify you when this occurs.
Note. For a complete listing of the models in the WLAN Series 2332 and their respective
countries of operation, please visit the Nortel Support website
The Series 2332 access point has been region-locked to meet geographic regulatory
restrictions. Each model is associated to a specific regulatory domain and subsequent
country of operation. During installation, the access point model and wireless security
switch regulatory domain must match or the access point will not operate.
To specify the country, use the following command:
set system countrycode code
For a complete listing of the approved two-letter country codes, refer to the "Approved Countries for the WLAN 2300
To verify the configuration change, use the following command:
show system
The following commands set the country code to US (United States) and verify the setting:
WSS# set system countrycode US
success: change accepted.
WSS# show system
===============================================================================
Product Name:
System Name:
WSS
WSS
System Countrycode: US
System Location:
System Contact:
System IP:
30.30.30.2
System idle timeout:3600
System MAC:
00:0B:0E:02:76:F6
===============================================================================
Boot Time:
Uptime:
2003-05-07 08:28:39
0 days 04:00:07
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
290 Configuring APs
==============================================================================
=
Fan status: fan1 OK fan2 OK fan3 OK
Temperature: temp1 ok temp2 ok temp3 ok
PSU Status: Lower Power Supply DC ok AC ok Upper Power Supply missing
Memory: 115.09/496.04 (23%)
Total Power Over Ethernet : 32.000
==============================================================================
=
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 291
Configuring an auto-AP profile for automatic AP configuration
You can use an Auto-AP profile to deploy unconfigured Distributed APs. A Distributed AP that does not have
a configuration on a WSS can receive its configuration from the Auto-AP profile instead.
The Auto-AP profile assigns a Distributed AP number and name to the AP, from among the unused valid AP
numbers available on the switch. The Auto-AP profile also configures the AP with the AP and radio parameter
settings in the profile. The AP and radio parameter settings in the Auto-AP profile are configurable. (See
The Auto-AP profile does not control SSIDs, encryption parameters, or any other parameters managed by
service profiles. You still need to configure a service profile separately for each SSID.
A WSS can have one Auto-AP profile.
How an unconfigured AP finds a WSS to configure it
The boot process for a Distributed AP that does not have a configuration on a WSS is similar to the process for
configured Distributed APs. After the AP starts up, it uses DHCP to configure its IP connection with the
network. The AP then uses the IP connection to contact a WSS.
The WSS contacted by the AP determines the best switch to use for configuring the AP, and sends the AP the
IP address of that switch. The best switch to use for configuring the AP is the switch that has an Auto-AP
profile with a high bias setting. If more than one WSS has an Auto-AP profile with a high bias setting, the
switch that has the greatest capacity to add new unconfigured APs is selected.
A WSS’s capacity to add new unconfigured Distributed AP’s is the lesser of the following:
•
•
Maximum number of APs that can be configured on the switch, minus the number that are configured
Maximum number of APs that can be active on the switch, minus the number that are active
For example, suppose the Mobility Domain has two WSSs, with the capacities and loads listed in Table 10.
Table 10: Example 2360/2361 AP capacities and loads
2360/2361 A
30
2360/2361 B
30
Maximum Configured
Maximum Active
12
25
8
12
20
12
Number Currently Configured
Number Currently Active
For 2360/2361 A:
•
The Number of APs that can be configured on the switch, minus the number that are configured, is
30 - 25 = 5.
•
•
The Number of APs that can be active on the switch, minus the number that are active, is 12 - 8 = 4.
The lesser of the two values is 4. The switch can have up to 4 more APs.
For 2360/2361 B:
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
292 Configuring APs
•
The Number of APs that can be configured on the switch, minus the number that are configured, is
30 - 20 = 10.
•
•
The Number of APs that can be active on the switch, minus the number that are active, is 12 - 12 = 0.
The lesser of the two values is 0. The switch can have no more APs.
2360/2361 A has the capacity to add 4 more APs, whereas 2360/2361 B cannot add any more APs. Therefore,
the WSS contacted by the AP sends 2360/2361 A’s IP address to the AP. The AP then requests a software
image file and configuration from 2360/2361 A. 2360/2361 A sends the software image and sends configura-
tion parameters based on the Auto-AP profile.
Configured APs have precedence over unconfigured APs
When a WSS determines the WSS IP address to send to a booting AP, the switch gives preference to APs that
are already configured, over unconfigured APs that require an Auto-AP profile. The WSS can direct a config-
ured AP to a switch that has active APs configured using the Auto-AP profile, even if the switch does not have
capacity for more active APs. In this case, the WSS randomly selects an AP using the Auto-AP profile to
disconnect, and accepts a connection from the configured AP in its place.
The disconnected AP can then begin the boot process again to find another WSS that has an Auto-AP profile.
When the AP is disconnected, the AP’s clients experience a service disruption, and will attempt to associate
with another AP if available to reconnect to the SSID they were using. If another AP is not available to a
client, the client can still reconnect after the disconnected AP is connected to a new WSS and finishes the boot
and configuration process.
Configuring an auto-AP profile
The Auto-AP profile for Distributed AP configuration is like an individual AP configuration, except the
configuration has the name auto instead of a Distributed AP number.
To create an Auto-AP profile for automatic Distributed AP configuration, type the following command:
WSS# set ap auto
success: change accepted.
To display the AP settings in the Auto-AP profile, type the following command:
WSS# show ap config auto
AP auto: mode: disabled bias: high
fingerprint
boot-download-enable: YES
force-image-download: NO
Radio 1: type: 802.11g, mode: enabled, channel: dynamic
tx pwr: 15, profile: default
auto-tune max-power: default
Radio 2: type: 802.11a, mode: enabled, channel: dynamic
tx pwr: 11, profile: default
auto-tune max-power: default
This example shows the defaults for the AP parameters you can configure in the Auto-AP profile. Table 11
lists the configurable Auto-AP profile parameters and their defaults. The only parameter that requires configu-
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 293
ration is the Auto-AP profile mode. The Auto-AP profile is disabled by default. To use the Auto-AP profile to
configure Distributed APs, you must enable the profile. (See “Enabling the auto-AP profile” on page 294.)
Table 11: Configurable profile parameters for distributed APs
Parameter
Default Value
AP Parameters
bias
high
blink
disable
(Not shown in show ap config output)
force-image-download
group (load balancing group)
mode
disable (NO)
none
disabled
none
persistent
upgrade-firmware
(boot-download-enable)
enable (YES)
Radio Parameters
radio num auto-tune max-power
radio num mode
default
enabled
default
11g
radio num radio-profile
radiotype
(or 11b for country codes where
802.11g is not allowed)
APs that receive their configurations from the Auto-AP profile also receive the radio settings from the radio
profile used by the Auto-AP profile. Likewise, the SSIDs and encryption settings come from the service
profiles mapped to the radio profile. To use a radio profile other than default, you must specify the radio
profile you want to use. (See “Specifying the radio profile used by the auto-AP profile” on page 294.)
Changing AP parameter values
The commands for configuring AP and radio parameters for the Auto-AP profile are the same as the
commands for configuring an individual Distributed AP. Instead of specifying a Distributed AP number with
the command, specify auto. For more information about the syntax, see the “AP Commands” chapter of the
Nortel WLAN Security Switch 2300 Series Command Line Reference.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
294 Configuring APs
AP Parameters:
set ap auto bias {high | low}
set ap auto blink {enable | disable}
set ap auto force-image-download {enable | disable}
set ap auto group name
set ap auto mode {enable | disable}
set ap auto persistent [ap-num | all]
set ap auto upgrade-firmware {enable | disable}
Radio Parameters:
set ap auto radiotype {11a | 11b| 11g}
set ap auto radio {1 | 2} auto-tune max-power power-level
set ap auto radio {1 | 2} mode {enable | disable}
set ap auto radio {1 | 2} radio-profile name mode {enable | disable}
Enabling the auto-AP profile
To enable the Auto-AP profile for automatic Distributed AP configuration, type the following command:
WSS# set ap auto mode enable
success: change accepted.
Specifying the radio profile used by the auto-AP profile
The Auto-AP profile uses radio profile default by default. To use another radio profile instead, use the following
command:
set ap auto radio {1 | 2} radio-profile name mode {enable | disable}
The following command changes the Auto-AP profile to use radio profile autoap1 for radio 1:
WSS# set ap auto radio 1 radio-profile autoap1
success: change accepted.
Note. You must configure the radio profile before you can apply it to the Auto-AP profile.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 295
Displaying status information for APs configured by the auto-AP profile
To display status information for APs configured by the Auto-AP profile, type the following command:
WSS# show ap status auto
ap: 100 (auto), IP-addr: 10.8.255.6 (vlan 'default'), AP model: 2330,
manufacturer: Nortel, name: ap100
====================================================
State: operational (not encrypted)
CPU info: IBM:PPC speed=266666664 Hz version=405GPr
id= ram=33554432
s/n=0333703027 hw_rev=A3
Uptime: 18 hours, 36 minutes, 27 seconds
Radio 1 type: 802.11g, state: configure succeed [Enabled] (802.11b protect)
operational channel: 1 operational power: 14
base mac: 00:0b:0e:00:d2:c0
bssid1: 00:0b:0e:00:d2:c0, ssid: public
bssid2: 00:0b:0e:00:d2:c2, ssid: employee-net
bssid3: 00:0b:0e:00:d2:c4, ssid: mycorp-tkip
Radio 2 type: 802.11a, state: configure succeed [Enabled]
operational channel: 64 operational power: 14
base mac: 00:0b:0e:00:d2:c1
bssid1: 00:0b:0e:00:d2:c1, ssid: public
bssid2: 00:0b:0e:00:d2:c3, ssid: employee-net
bssid3: 00:0b:0e:00:d2:c5, ssid: mycorp-tkip
The output displays auto next to the Distributed AP number to indicate that the AP was configured using an
Auto-AP profile.
Converting an AP configured by the auto-AP profile into a permanent AP
You can convert a temporary AP configuration created by the Auto-AP profile into a persistent AP configura-
tion on the WSS. To do so, use the following command:
set ap auto persistent {ap-num | all}
This command creates a persistent Distributed AP configuration based on the settings in the Auto-AP profile.
The Distributed AP name and number assigned by the Auto-AP profile are used for the persistent entry. For
example, if the Auto-AP profile assigned the number 100 and the name ap100 to the AP, the persistent config-
uration for the AP has the same number and name. In this case, use 100 as the ap-num with show ap, set ap, or
clear ap commands.
The AP continues to operate without interruption after you enter the set ap auto persistent command. The
next time the AP is restarted, the Auto-AP profile is not used to configure the AP. Instead, the persistent
configuration is used. (Use the save config command to make the AP configuration persistent across switch
restarts.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
296 Configuring APs
Configuring AP port parameters
To configure a WSS for connection to an AP, you must do one of the following:
•
For an AP directly connected to a WSS port, configure the WSS port as an AP access port. (“Setting the
•
For an AP indirectly connected to a WSS through an intermediate Layer or Layer network, configure a
Optionally, you also can change other parameters that affect the entire AP:
•
•
•
•
Automatic firmware upgrade capability. (See “Disabling or reenabling automatic firmware upgrades” on
page 301.)
•
(For information about configuring Auto-RF settings on a radio, see “Configuring Auto-RF” on page 391.)
Table 12 lists how many APs you can configure on a WSS, and how many APs a switch can boot. The
numbers are for directly connected and Distributed APs combined.
Table 12: Maximum APs supported per switch
Maximum That Can Be Maximum That Can Be
WSS Model
Configured
Booted
MX-2800
2382
2048
320
512
32, 64, 96 or 128*
2380
300
40, 80, or 120, depending
on the license level
2360/2361
2350
30
8
12
3
Setting the port type for a directly connected AP
You must set the port type on WSS ports that are directly connected to APs.
When you change port type, WSS Software applies default settings appropriate for the port type. Table 13 on
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 297
Table 13: AP access port defaults
Port parameter
Setting
VLAN membership
Port is removed from all VLANs. You cannot assign an AP
access port to a VLAN. WSS Software automatically assigns AP
access ports to VLANs based on user traffic.
Spanning Tree Protocol (STP) Not applicable
802.1X
Port uses authentication parameters configured for users.
Port groups
Not applicable
IGMP snooping
Maximum user sessions
Enabled as users are authenticated and join VLANs.
Not applicable
Caution! When you set the port type for AP use, you must specify the PoE state
(enable or disable) of the port. Use the WSS switch’s PoE to power Nortel APs only. If you
enable PoE on a port connected to another device, physical damage to the device can
result.
Note. You cannot configure port 7 or 8 on a 2360/2361 switch, or port 1 on a 2350, or
port 3 on a 2382, or any gigabit Ethernet port, as an AP port. To manage an AP on an 2380
switch, configure a Distributed AP connection on the switch. (See “Configuring an indirectly
To set the port type for AP access ports, use the following command:
set port type ap port-list
model {2330 | 2330A | 2330B | 2332-A1 | 2332-A2 | 2332-A3 | 2332-A4 | 2332-A5 | 2332-A6
| 2332-E1 | 2332-E2 | 2332-E3 | 2332-E4 | 2332-E5 |2332-E6 | 2332-E7 | 2332-E8 | 2332-E9 |
2332-J1}
poe {enable | disable}
[radiotype {11a | 11b| 11g}]
You must specify the AP model and the PoE state.
To set ports 11 through 14 and port 16 for AP model 2330 and enable PoE on the ports, type the following command:
WSS# set ap <apnum> port <portnum> model <ap_type> poe {enable|disable}
This may affect the power applied on the configured ports. Would you like to continue? (y/n) [n]y
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
298 Configuring APs
Configuring an indirectly connected AP
If an AP that you want to manage using the WSS is indirectly connected to the switch through a Layer 2 or
Layer 3 network, configure the AP using the following command:
set ap ap-num serial-id serial-ID
model {2330 | 2330A | 2330B | 2332-A1 | 2332-A2 | 2332-A3 | 2332-A4 | 2332-A5 |
2332-A6 | 2332-E1 | 2332-E2 | 2332-E3 | 2332-E4 | 2332-E5 |2332-E6 | 2332-E7 |
2332-E8 | 2332-E9 | 2332-J1}
[radiotype {11a | 11b| 11g}]
To configure Distributed AP connection 1 for AP model 2330 with serial-ID 0322199999, type the following
command:
WSS# set ap 1 serial-id 0322199999 model 2330
success: change accepted.
(To specify the external antenna type, use the set ap radio antennatype command. See “Configuring the
Configuring static IP addresses on distributed APs
By default, Distributed APs use the procedure described in “How a distributed AP obtains an IP address
through DHCP” on page 268 to obtain an IP address and connect to a WSS. In some installations, DHCP may
not be available. In such a case, you can manually assign static IP address information to the AP.
You can also optionally specify the WSS the Distributed AP uses as its boot device, and an 802.1Q VLAN tag
to be applied to Ethernet frames emitted from the distributed AP.
When you configure static IP information for a Distributed AP, it uses the boot procedure described in “How a
distributed AP contacts a WSS (statically configured address)” on page 270 instead of the default boot
procedure.
Specifying IP information
To specify static IP address information for a Distributed AP, use the following command:
set ap ap-num boot-configuration ip ip-addr netmask mask-addr gateway
gateway-addr [mode {enable | disable}]
To configure Distributed AP 1 to use IP address 172.16.0.42 with a 24-bit netmask, and use 172.16.0.20 as its
default router (gateway), type the following command:
WSS# set ap 1 boot-configuration ip 172.16.0.42 netmask 255.255.255.0 gateway
172.16.0.20 mode enable
success: change accepted.
The next time the Distributed AP is booted, it will use the specified IP information. If the manually assigned IP
information is incorrect, the AP uses DHCP to obtain its IP address, as described in “How a distributed AP
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 299
Specifying WSS information
To specify the WSS a Distributed AP contacts and attempts to use as its boot device, use the following
command:
set ap ap-num boot-configuration switch [switch-ip ip-addr] [name name dns ip-addr]
[mode {enable | disable}]
You can specify the WSS by its fully qualified domain name; in this case, you also specify the address of the
DNS server used to resolve the WSS’s name. If you specify both the address of the WSS, and the WSS’s name
and DNS server address, then the AP ignores the WSS’s address and uses the name.
When a static IP address is specified for a Distributed AP, there is no preconfigured DNS information or DNS
name for the WSS the Distributed AP attempts to use as its boot device. If you configure a static IP address for
a Distributed AP, but do not specify a boot device, then the WSS must be reachable via subnet broadcast.
The following command configures Distributed AP 1 to use the WSS with address 172.16.0.21 as its boot
device.
WSS# set ap 1 boot-configuration switch switch-ip 172.16.0.21 mode enable
success: change accepted.
The following command configures Distributed AP 1 to use the WSS with the name 2350 as its boot device.
The DNS server at 172.16.0.1 is used to resolve the name of the WSS.
WSS# set ap 1 boot-configuration switch name 2350 dns 172.16.0.1 mode enable
success: change accepted.
Specifying VLAN information
To specify 802.1Q VLAN tagging information for a Distributed AP, use the following command:
set ap ap-num boot-vlan vlan-tag tag-value [mode {enable | disable}]
When this command is configured, all Ethernet frames emitted from the Distributed AP are formatted with an
802.1Q tag with a specified VLAN number. Frames sent to the Distributed AP that are not tagged with this
value are ignored.
The following command configures Distributed AP 1 to use VLAN tag 100:
WSS# set ap 1 boot-vlan vlan-tag 100 mode enable
success: change accepted.
Clearing an AP from the configuration
Caution! When you clear an AP, WSS Software ends user sessions that are using the AP.
To clear the port settings from a port, use the following command:
clear port type port-list
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
300 Configuring APs
This command resets the port as a network port and removes all AP-related parameters from the port.
Note. The clear port type command does not place the cleared port in any VLAN, not
even in the default VLAN (VLAN 1). To use the cleared port in a VLAN, you must add the
To clear a Distributed AP, use the following command:
clear ap ap-num
Changing AP names
The default name of a directly attached AP is based on the port number of the AP access port attached to the
AP. For example, the default name for an AP on AP access port 1 is AP01. The default name of a Distributed
AP is based on the number you assign to it when you configure the connection. For example, the default name
for Distributed AP 1 is ap01.
AP names appear in the output of some CLI show commands and in WLAN Management Software . To
change the name of an AP, use the following command:
set {ap port-list | ap ap-num} name name
Changing bias
The CLI commands described in this section enable you to change the bias for an AP.
To change the bias of an AP, use the following command:
set {ap port-list | ap ap-num} bias {high | low}
The default bias is high.
To change the bias for a Distributed AP to low, type the following command:
WSS# set ap 1 bias low
success: change accepted.
Configuring a load-balancing group
A load-balancing group is a named set of APs. WSS Software balances user sessions among the access points
in the group.
To assign an AP to a load-balancing group, use the following command:
set {ap port-list | ap ap-num} group name
To configure a load-balancing group named loadbalance1 that contains directly-connected APs on ports 1, 4,
and 7, type the following command:
WSS# set ap 1,4,7 group loadbalance1
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 301
success: change accepted.
Disabling or reenabling automatic firmware upgrades
An AP can automatically upgrade its boot firmware by loading the upgrade version of the firmware from a
WSS when the AP is booting. Automatic firmware upgrades are enabled by default.
To disable or reenable automatic firmware upgrades, use the following command:
set {ap port-list | ap ap-num} upgrade-firmware {enable | disable}
Forcing an AP to download its operational image from the WSS
An AP’s operational image is the software that allows it to function on the network as a wireless access point.
As part of the AP boot process, an operational image is loaded into the AP’s RAM and activated. The AP
stores copies of its operational image locally, in its internal flash memory. At boot time, the AP can either load
the locally stored image, or it can download an operational image from the WSS to which it has connected.
By default, an AP model that can locally store a software image on the AP will load the locally stored image
instead of downloading its image from the WSS.
To force the AP to always download its image from the WSS instead, use the following command:
set {ap port-list | ap ap-num} force-image-download {enable | disable}
A change to the forced image download option takes place the next time the AP is restarted.
Even when forced image download is disabled (the default), the AP still checks with the WSS to verify that the
AP has the latest image, and to verify that the WSS is running WSS Software Version 5.0 or later.
The AP loads its local image only if the WSS is running WSS Software Version 5.0 or later and does not have
a newer AP image than the one in the AP’s local storage. If the switch is not running WSS Software Version
5.0 or later, or the WSS has a newer version of the AP image than the version in the AP’s local storage, the AP
loads its image from the WSS.
Enabling LED blink mode
Blink mode makes an AP easy to identify. When blink mode is enabled on AP-xxx models, the health and
radio LEDs alternately blink green and amber. When blink mode is enabled on an AP2750, the 11a LED
blinks on and off. By default, blink mode is disabled. Blink mode continues until you disable it. LED blink
mode is disabled by default.
Changing the LED blink mode does not alter operation of the AP. Only the behavior of the LEDs is affected.
To enable or disable LED blink mode, use the following command:
set {ap port-list | ap ap-num} blink {enable | disable}
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
302 Configuring APs
Configuring AP-WSS security
WSS Software provides security for management traffic between WSSs and Distributed APs. When the feature is
enabled, all management traffic between Distributed APs that support encryption and the WSS is encrypted. AP-WSS
security is set to optional by default.
The encryption uses RSA as the public key cryptosystem, with AES-CCM for data encryption and integrity checking
and HMAC-MD5 for keyed hashing and message authentication during the key exchange. Bulk data protection is
provided by AES in CCM mode (AES CTR for encryption and AES-CBC-MAC for data integrity). A 64-bit Message
Authentication Code is used for data integrity.
Note. This feature applies to Distributed APs only, not to directly connected APs
configured on AP access ports.
Note. The maximum transmission unit (MTU) for encrypted AP management traffic is
1498 bytes, whereas the MTU for unencrypted management traffic is 1474 bytes. Make
sure the devices in the intermediate network between the WSS and Distributed AP can
support the higher MTU.
Encryption key fingerprint
APs are configured with an encryption key pair at the factory. The fingerprint for the public key is displayed on a label
on the back of the AP, in the following format:
RSA
aaaa:aaaa:aaaa:aaaa:
aaaa:aaaa:aaaa:aaaa
If the AP is already installed, you can display the fingerprint in WSS Software. (See “Finding the fingerprint” on
page 303.)
Encryption options
By default, a WSS can configure and manage a Distributed AP regardless of whether the AP has an encryption key, and
regardless of whether you have confirmed the fingerprint by setting it in WSS Software.
You can configure a WSS to require Distributed APs to have an encryption key. In this case, the switch also requires
their fingerprints to be confirmed in WSS Software. When AP security is required, an AP can establish a management
session with the WSS only if its fingerprint has been confirmed by you in WSS Software.
If you do not want any APs to use encryption for management information, you can disable the feature.
Table 14 lists the AP security options and whether an AP can establish a management session with a WSS based on the
option settings.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 303
Table 14: AP security requirements
Fingerprint
Verified in WSS
Software?
AP Can Establish
Management Session with
Switch?
AP Security
Setting
AP Has
Fingerprint?
AP Security
Required
Yes
Yes
Yes
No
No
No
Not Applicable
No
AP Security
Optional
Yes
Yes
No
Yes1
1
Yes
No
Not Applicable
Yes
1. WSS Software generates a log message listing the AP serial number and fingerprint so
Verifying an AP’s fingerprint on a WSS
To verify an AP’s fingerprint, find the fingerprint and use the set ap fingerprint command to enter the finger-
print in WSS Software.
Finding the fingerprint
An AP’s fingerprint is listed on a label on the back of the AP. (See “Encryption key fingerprint” on page 302.)
If the AP is already installed and operating, use the show ap status command to display the fingerprint. The
following example shows information for Distributed AP 8, including its fingerprint:
WSS# show ap status 8
ap: 8, IP-addr: 10.2.26.40 (vlan 'default'), AP model: 2330,
manufacturer: Nortel, name: ap08
fingerprint: b4:f9:2a:52:37:58:f4:d0:10:75:43:2f:45:c9:52:c3
====================================================
State: operational (not encrypted)
CPU info: IBM:PPC speed=266666664 Hz version=405GPr
id=0x29f1886d447f111a ram=33554432
s/n=0424000779 hw_rev=A3
Uptime: 1 hours, 8 minutes, 17 seconds
Radio 1 type: 802.11g, state: configure succeed [Enabled]
operational channel: 1 operational power: 1
base mac: 00:0b:0e:0a:60:00
bssid1: 00:0b:0e:0a:60:00, ssid: public
bssid2: 00:0b:0e:0a:60:02, ssid: nortel
Radio 2 type: 802.11a, state: configure succeed [Enabled]
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
304 Configuring APs
operational channel: 48 operational power: 11
base mac: 00:0b:0e:0a:60:01
bssid1: 00:0b:0e:0a:60:01, ssid: public
bssid2: 00:0b:0e:0a:60:03, ssid: nortel
The fingerprint is displayed regardless of whether it has been verified in WSS Software.
Note. The show ap config command lists an AP’s fingerprint only if the fingerprint has
been verified in WSS Software. If the fingerprint has not been verified, the fingerprint info in
the command output is blank.
Verifying a fingerprint on the switch
To verify an AP’s fingerprint on a WSS, use the following command:
set ap num fingerprint hex
where hex is the 16-digit hexadecimal number of the fingerprint. Use a colon between each digit. Make sure
the fingerprint you enter matches the fingerprint used by the AP.
The following example sets the fingerprint for Distributed AP 8:
WSS# set ap 8 fingerprint b4:f9:2a:52:37:58:f4:d0:10:75:43:2f:45:c9:52:c3
success: change accepted.
Setting the AP security requirement on a WSS
You can configure the WSS to require all Distributed APs to have encryption keys. In this case, the WSS does
not establish a management session with a Distributed AP unless the AP has a key, and you have confirmed
the key’s fingerprint in WSS Software.
Note. A change to AP security support does not affect management sessions that are
already established. To apply the new setting to an AP, restart the AP.
To configure AP security requirements, use the following command:
set ap security {require | optional | none}
The require option enforces encryption of management traffic for all Distributed APs, and requires the key
fingerprints to be confirmed in WSS Software. The none option disables encryption of management traffic for
all Distributed APs. The default is optional, which allows connection to APs with or without encryption.
The following command configures a WSS to require Distributed APs to have encryption keys:
WSS# set ap security require
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 305
Fingerprint log message
If AP encryption is optional, and an AP whose fingerprint has not been verified in WSS Software establishes a manage-
ment session with the WSS, WSS Software generates a log message such as the following:
AP-HS:(secure optional)configure AP 0335301065 with fingerprint
c6:98:9c:41:32:ab:37:09:7e:93:79:a4:ca:dc:ec:fb
The message lists the serial number and fingerprint of the AP. You can check this information against your records to
verify that the AP is authentic.
MP-432 and 802.11n configuration
Smart Mobile provides the highest performance WLANs 802.11n with the combination of the centralized WLAN
management with optimized traffic flow. Smart Mobile’s intelligent switching is the only WLAN architecture that
allows data to be forwarded centrally or in distributed fashion, depending on the underlying application.
MP-432 includes the following:
•
•
•
•
•
•
•
40 MHz channels
High throughput
Additional Rates
MPDU aggregation
MIMO
Legacy Clients and APs
2.4 GHz and 5 GHz capabilities
You can configure different data rates on the MP-432 for 802.11b, 802.11ng, and 802.11na.
Radio Type
802.11na
Data Rate
6.0, 9.0,12.0, 18.0, 24.0, 36.0, 48.0, 54.0, MCS0-15
1.0, 2.0, 5.5, 11.0
802.11b
802.11ng
1.0, 2.0, 5.5, 6.0, 9.0, 11.0, 12.0, 18.0, 24.0, 36.0, 48.0, 54.0,
MCS0-15
For more information about MP-432 and 802.11n, see Nortel WLAN - Management Software Reference Guide.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
306 Configuring APs
PoE Requirements
PoE is different for the MP-432 because the AP has two 802.11n radios and requires more PoE support than a
single 802.3af power source. There are two possible configurations for supplying power to the MP-432:
•
If the power mode is set to “auto”, the power is managed automatically by sensing the power level on the
AP. If low power is detected, unused Ethernet is disabled and reduces the traffic on the 2.4 GHz radio. If
high power is detected, then both radios operate at 3x3 (3 transmit chains and 3 receive chains).
•
•
If the power mode is set to “high”, both radios operate at the maximum power available which requires
either 802.3at PoE or both ports using 802.3af PoE.
set ap <apnum> power-mode <auto | high>
Configuring a service profile
A service profile is a set of parameters that control advertisement (beaconing) and encryption for an SSID, as
well as default authorization attributes that apply to users accessing the SSID.
This section describes how to create a service profile and set some basic SSID parameters. To configure other
service profile parameters, see the following:
•
•
•
•
•
(For a list of the parameters controlled by service profiles and their defaults, see Table 9 on page 287.)
Creating a service profile
To create a service profile and assign an SSID to it, use the following command:
set service-profile name ssid-name ssid-name
An SSID can be up to 32 alphanumeric characters long.
You can include blank spaces in the name, if you delimit the name with single or double quotation marks. You
must use the same type of quotation mark (either single or double) on both ends of the string.
The following command configures a service profile named corp1, and assigns SSID mycorp_rnd to it:
WSS# set service-profile corp1 ssid-name mycorp_rnd
success: change accepted.
The following command applies the name corporate users to the SSID managed by service profile
mycorp_srvcprf:
WSS# set service-profile mycorp_srvcprf ssid-name “corporate users”
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 307
Removing a service profile
To remove a service profile, use the following command:
clear service-profile name
[soda {agent-directory | failure-page | remediation-acl | success-page |
logout-page}]
The soda options reset Sygate On-Demand (SODA) settings to their default values. If you omit the soda
option, the service profile specified by name is completely removed.
Changing a service profile setting
To change a setting in a service profile without removing the profile, use the set service-profile command for
the setting you want to change. Do not use the clear service-profile command.
Disabling or reenabling encryption for an SSID
To specify whether the SSID is encrypted or unencrypted, use the following command:
set service-profile name ssid-type [clear | crypto]
The default is crypto.
Disabling or reenabling beaconing of an SSID
To specify whether the SSID is beaconed, use the following command:
set service-profile name beacon {enable | disable}
SSIDs are beaconed by default.
An AP radio responds to an 802.11 probe any request only for a beaconed SSID. A client that sends a probe
any request receives a separate response for each of the beaconed SSIDs supported by a radio. For a nonbea-
coned SSID, radios respond only to directed 802.11 probe requests that match the nonbeaconed SSID’s SSID
string.
When you disable beaconing for an SSID, the radio still sends beacon frames, but the SSID name in the frames
is blank.
Changing the fallthru authentication type
By default, WSS Software denies access to users who do not match an 802.1X or MAC authentication rule,
and therefore fall through these authentication types. You can change the fallthru method to last-resort or
web-portal.
To change the fallthru method, use the following command:
set service-profile name auth-fallthru {last-resort | none | web-portal}
(For more information about network user authentication, see “Configuring AAA for network users” on
page 541.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
308 Configuring APs
Changing transmit rates
Each type of radio (802.11a, 802.11b, and 802.11g) that provides service to an SSID has a set of rates the radio
is allowed to use for sending beacons, multicast frames, and unicast data. The rate set also specifies the rates
clients must support in order to associate with a radio. Table 15 lists the rate settings and their defaults.
Table 15: Transmit rates
Parameter
Default Value
Description
mandatory
•
•
•
11a— 6.0,12.0,24.0
11b—1.0,2.0
11g—1.0,2.0,5.5,11.0
Set of data transmission rates that clients
are required to support in order to
associate with an SSID on an AP radio. A
client must support at least one of the
mandatory rates.
These rates are advertised in the basic rate
set of 802.11 beacons, probe responses,
and reassociation response frames sent by
AP radios.
Data frames and management frames sent
by AP radios use one of the specified
mandatory rates.
The valid rates depend on the radio type:
•
11a—6.0, 9.0, 12.0, 18.0, 24.0, 36.0,
48.0, 54.0
•
•
11b—1.0, 2.0, 5.5, 11.0
11g—1.0, 2.0, 5.5, 6.0, 9.0, 11.0, 12.0,
18.0, 24.0, 36.0, 48.0, 54.0
Use a comma to separate multiple rates;
for example: 6.0,9.0,12.0
disabled
None. All rates applicable to the Data transmission rates that AP radios will
radio type are supported by
default.
not use to transmit data. This setting
applies only to data sent by the AP radios.
The radios will still accept frames from
clients at disabled data rates.
The valid rates depend on the radio type
and are the same as the valid rates for
mandatory.
If you disable a rate, you cannot use the
rate as a mandatory rate or the beacon or
multicast rate. All rates that are applicable
to the radio type and that are not disabled
are supported by the radio.
beacon-rate
•
•
•
11a—6.0
11b—2.0
11g—2.0
Data rate of beacon frames sent by AP
radios. This rate is also used for
probe-response frames.
The valid rates depend on the radio type
and are the same as the valid rates for
mandatory. However, you cannot set the
beacon rate to a disabled rate.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 309
Table 15: Transmit rates (continued)
Parameter
Default Value
Description
multicast-rate
auto for all radio types
Data rate of multicast frames sent by AP
radios.
•
rate—Sets the multicast rate to a
specific rate. The valid rates depend
on the radio type and are the same as
the valid rates for mandatory.
However, you cannot set the multicast
rate to a disabled rate.
•
auto—Sets the multicast rate to the
highest rate that can reach all clients
connected to the AP radio.
To change transmit rates for a service profile, use the following command:
set service-profile name transmit-rates {11a | 11b | 11g}
mandatory rate-list [disabled rate-list] [beacon-rate rate] [multicast-rate {rate |
auto}]
The following command sets 802.11a mandatory rates for service profile sp1 to 6 Mbps and 9 Mbps, disables
rates 48 Mbps and 54 Mbps, and changes the beacon rate to 9 Mbps:
WSS# set service-profile sp1 transmit-rates 11a mandatory 6.0,9.0 disabled 48.0,54.0
beacon-rate 9.0
success: change accepted.
Enforcing the Data Rates
By default, the rate set is not enforced, meaning that a client can associate with and transmit data to the AP
using a disabled data rate, although the AP does not transmit data back to the client at the disabled rate.
You can configure WSS Software to enforce the data rates, which means that a connecting client must transmit
at one of the mandatory or standard rates in order to associate with the AP. When data rate enforcement is
enabled, clients transmitting at the disabled rates are not allowed to associate with the AP.
Data rate enforcement is useful if you want to completely prevent clients from transmitting at disabled data
rates. For example, you can disable slower data rates so that clients transmitting at these rates do not consume
bandwidth on the channel at the expense of clients transmitting at faster rates.
Data rate enforcement is disabled by default. To enable data rate enforcement for a radio profile, use the
following command:
set radio-profile profile-name rate-enforcement mode {enable | disable}
For example, the following command enables data rate enforcement for radio profile rp1
WSS# set radio-profile rp1 rate-enforcement mode enable
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
310 Configuring APs
The following command sets a 802.11g mandatory rate for service profile sp1 to 54 Mbps and disables rates 1.0 Mbps
and 2.0 Mbps:
WSS# set service-profile sp1 transmit-rates 11g mandatory 54.0 disabled 1.0,2.0
The following command maps radio profile rp1 to service profile sp1.
WSS# set radio-profile rp1 service-profile sp1
After these commands are entered, if a client transmitting with a data rate of 1.0 Mbps or 2.0 Mbps attempts to associate
with an AP managed by service profile sp1, that client is not allowed to associate with the AP.
Disabling idle-client probing
By default, an AP radio sends keepalive messages (idle-client probes) every 10 seconds to each client that has an active
session on the radio, to verify that the client is still active. The probes are unicast null-data frames. Normally, a client
that is still active sends an Ack in reply to an idle-client probe.
If a client does not send any data or respond to any idle-client probes before the user idle timeout expires (see “Changing
the user idle timeout” on page 310), WSS Software changes the client’s session to the Disassociated state.
Responding to keepalive messages requires power use by a client. If you need to conserve power on the client (for
example, on a VoIP handset), you can disable idle-client probing.
To disable or reenable idle-client probing, use the following command:
set service-profile name idle-client-probing {enable | disable}
The following command disables idle-client probing on service profile sp1:
WSS# set service-profile sp1 idle-client-probing disable
success: change accepted.
Changing the user idle timeout
The user idle timeout specifies the number of seconds a client can remain idle before the WSS changes the client’s
session to the Disassociated state. A client is considered to be idle if it does not send data and does not respond to
idle-client probes. You can specify a timeout value from 20 to 86400 seconds. The default is 180 seconds (3 minutes).
To disable the user-idle timeout, set it to 0.
To change the user-idle timeout, use the following command:
set service-profile name user-idle-timeout seconds
The following command increases the user idle timeout to 360 seconds (6 minutes):
WSS# set service-profile sp1 user-idle-timeout 360
success: change accepted.
Changing the short retry threshold
The short retry threshold specifies the number of times a radio can send a short unicast frame for an SSID without
receiving an acknowledgment for the frame. A short unicast frame is a frame that is shorter than the RTS threshold.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 311
To change the short retry threshold, use the following command:
set service-profile name short-retry threshold
The threshold can be a value from 1 through 15. The default is 5.
To change the short retry threshold for service profile sp1 to 3, type the following command:
WSS# set service-profile sp1 short-retry 3
success: change accepted.
Changing the long retry threshold
The long retry threshold specifies the number of times a radio can send a long unicast frame for an SSID
without receiving an acknowledgment for the frame. A long unicast frame is a frame that is equal to or longer
than the RTS threshold.
To change the long retry threshold, use the following command:
set service-profile name long-retry threshold
The threshold can be a value from 1 through 15. The default is 5.
To change the long retry threshold for service profile sp1 to 8, type the following command:
WSS# set service-profile sp1 long-retry 8
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
312 Configuring APs
Configuring a radio profile
A radio profile is a set of parameters that apply to multiple radios. You can easily assign configuration param-
eters to many radios by configuring a profile and assigning the profile to the radios.
To configure a radio profile:
•
•
•
Create a new profile.
Change radio parameters.
Map the radio profile to one or more service profiles.
(For a list of the parameters controlled by radio profiles and their defaults, see Table 8 on page 285.)
The channel number, transmit power, and external antenna type are unique to each radio and are not controlled
by radio profiles. (To configure these parameters, see “Configuring radio-specific parameters” on page 317.)
Creating a new profile
To create a radio profile, use the following command:
set radio-profile name [mode {enable | disable}]
Specify a name of up to 16 alphanumeric characters. Do not include the mode enable or mode disable option.
After you create the radio profile, you can use the enable and disable options to enable or disable all radios
that use the profile.
To configure a new radio profile named rp1, type the following command:
WSS# set radio-profile rp1
success: change accepted.
To assign the profile to one or more radios, use the set ap radio radio-profile command. (See “Assigning a
Changing radio parameters
To change individual parameters controlled by a radio profile, use the commands described in the following
sections.
Note. You must disable all radios that are using a radio profile before you can change
parameters in the profile. (See “Disabling or reenabling all radios using a profile” on
page 339.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 313
Changing the beacon interval
The beacon interval is the rate at which a radio advertises its beaconed SSID(s). To change the beacon interval, use the
following command:
set radio-profile name beacon-interval interval
The interval can be a value from 25 ms through 8191 ms. The default is 100.
The beacon interval does not change even when advertisement is enabled for multiple SSIDs. WSS Software still sends
one beacon for each SSID during each beacon interval.
To change the beacon interval for radio profile rp1 to 200 ms, type the following command:
WSS# set radio-profile rp1 beacon-interval 200
success: change accepted.
Changing the DTIM interval
The DTIM interval specifies the number of times after every beacon that a radio sends a delivery traffic indication map
(DTIM). An AP sends the multicast and broadcast frames stored in its buffers to clients who request them in response to
the DTIM. The DTIM interval applies to both the beaconed SSID and the unbeaconed SSID.
The DTIM interval does not apply to unicast frames. An AP also stores unicast frames in buffer memory, but the AP
includes information about the buffered unicast frames in each beacon frame. When a user station receives a beacon
frame that advertises unicast frames destined for the station, the station sends a request for the frames and the AP
transmits the requested frames to the user station.
To change the DTIM interval, use the following command:
set radio-profile name dtim-interval interval
The interval can be a value from 1 through 31. The default is 1.
To change the DTIM interval for radio profile rp1 to 2, type the following command:
WSS# set radio-profile rp1 dtim-interval 2
success: change accepted.
Changing the RTS threshold
The RTS threshold specifies the maximum length a frame can be before a radio uses the Request-to-Send/Clear-to-Send
(RTS/CTS) method to send the frame. The RTS/CTS method clears the air of other traffic to avoid corruption of the
frame due to a collision with another frame.
When a frame is long enough for the RTS/CTS method to be applicable, the radio sends a Request-To-Send (RTS)
message addressed to the intended receiver for the frame. The receiver replies with a Clear-To-Send (CTS) message.
When the radio receives the CTS message, the radio transmits the frame and waits for an acknowledgment from the
receiver. The radio does not transmit additional frames until receiving the acknowledgment.
Any other user station that overhears the RTS or CTS message stops transmitting until the station overhears the
acknowledgment message.
To change the RTS threshold, use the following command:
set radio-profile name rts-threshold threshold
The threshold can be a value from 256 bytes through 3000 bytes. The default is 2346.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
314 Configuring APs
To change the RTS threshold for radio profile rp1 to 1500 bytes, type the following command:
WSS# set radio-profile rp1 rts-threshold 1500
success: change accepted.
Changing the fragmentation threshold
The fragmentation threshold specifies the longest a frame can be without being fragmented into multiple
frames by a radio before transmission. To change the fragmentation threshold, use the following command:
set radio-profile name frag-threshold threshold
The threshold can be a value from 256 through 2346. The default is 2346.
To change the fragmentation threshold for radio profile rp1 to 1500 bytes, type the following command:
WSS# set radio-profile rp1 frag-threshold 1500
success: change accepted.
Changing the maximum receive threshold
The maximum receive threshold specifies the number of milliseconds a frame received by a radio can remain
in buffer memory. To change the maximum receive lifetime, use the following command:
set radio-profile name max-rx-lifetime time
The time can be from 500 ms (0.5 second) through 250,000 ms (250 seconds). The default is 2000 ms
(2 seconds).
To change the maximum receive threshold for radio profile rp1 to 4000 ms, type the following command:
WSS# set radio-profile rp1 max-rx-lifetime 4000
success: change accepted.
Changing the maximum transmit threshold
The maximum transmission threshold specifies the number of milliseconds a frame scheduled to be trans-
mitted by a radio can remain in buffer memory. To change the maximum transmit lifetime, use the following
command:
set radio-profile name max-tx-lifetime time
The time can be from 500 ms (0.5 second) through 250,000 ms (250 seconds). The default is 2000 ms
(2 seconds).
To change the maximum transmit threshold for radio profile rp1 to 4000 ms, type the following command:
WSS# set radio-profile rp1 max-tx-lifetime 4000
success: change accepted.
Changing the preamble length
By default, 802.11b/g radios advertise support for frames with short preambles and can support frames with
short or long preambles.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 315
An 802.11b/g radio generates unicast frames to send to a client with the preamble length specified by the
client. An 802.11b/g radio always uses a long preamble in beacons, probe responses, and other broadcast or
multicast traffic.
Generally, clients assume access points require long preambles and request to use short preambles only if the
access point with which they are associated advertises support for short preambles. You can disable the adver-
tisement of support for short preambles by setting the preamble length value to long. In this case, clients
assume that the access point supports long preambles only and the clients request long preambles.
Changing the preamble length value affects only the support advertised by the radio. Regardless of the
preamble length setting (short or long), an 802.11b/g radio accepts and can generate 802.11b/g frames with
either short or long preambles.
If any client associated with an 802.11b/g radio uses long preambles for unicast traffic, the AP still accepts
frames with short preambles but does not transmit any frames with short preambles. This change also occurs if
the access point overhears a beacon from an 802.11b/g radio on another access point that indicates the radio
has clients that require long preambles.
The default preamble length value is short. This command does not apply to 802.11a radios.
To change the preamble length advertised by 802.11b/g radios, use the following command:
set radio-profile name preamble-length {long | short}
To configure 802.11b/g radios that use the radio profile rp_long to advertise support for long preambles
instead of short preambles, type the following command:
WSS# set radio-profile rp_long preamble-length long
success: change accepted.
Resetting a radio profile parameter to its default value
To reset a radio profile parameter to its default value, use the following command:
clear radio-profile name parameter
Caution! Make sure you specify the radio profile parameter you want to reset. If you
do not specify a parameter, WSS Software deletes the entire profile from the
configuration.
All radios that use this profile must be disabled before you can delete the profile. If you specify a parameter,
the setting for the parameter is reset to its default value. The settings of the other parameters are unchanged
and the radio profile remains in the configuration. If you do not specify a parameter, the entire radio profile is
deleted from the configuration.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
316 Configuring APs
To disable the radios that are using radio profile rp1 and reset the beaconed-ssid parameter to its default
value, type the following commands:
WSS# set radio-profile rp1 mode disable
WSS# clear radio-profile rp1 beaconed-ssid
success: change accepted.
Removing a radio profile
To remove a radio profile, use the following command:
clear radio-profile name
Note. You must disable all radios that are using a radio profile before you can remove
To disable the radios that are using radio profile rptest and remove the profile, type the following commands:
WSS# set radio-profile rptest mode disable
WSS# clear radio-profile rptest
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 317
Configuring radio-specific parameters
This section shows how to configure the channel and transmit power on individual radios, and how to configure for
external antennas. (For information about the parameters you can set on individual radios, see Table 9.)
Configuring the channel and transmit power
Note. If Auto-RF is enabled for channels or power, you cannot set the channels
or power manually using the commands in this section. See “Configuring Auto-RF”
To set the channel and transmit power of a radio, use the following commands:
set {ap port-list | ap ap-num} radio {1 | 2} channel channel-number
set {ap port-list | ap ap-num} radio {1 | 2} tx-power power-level
The parameters are shown in separate commands for simplicity. However, you can use the channel and tx-power
parameters on the same command line.
Specify 1 or 2 for the radio number:
•
•
•
For a single-radio model, specify radio 1.
For the 802.11b/g radio in a two-radio model, specify radio 1.
For the 802.11a radio in a two-radio model, specify radio 2.
Note. The maximum transmit power you can configure on any Nortel radio is the highest
setting allowed for the country of operation or the highest setting supported on the
hardware, whichever is lower.
To configure the 802.11b radio on port 11 for channel 1 with a transmit power of 10 dBm, type the following command:
WSS# set ap 11 radio 1 channel 1 tx-power 10
success: change accepted.
To configure the 802.11a radio on port 5 for channel 36 with a transmit power of 10 dBm, type the following command:
WSS# set ap 5 radio 2 channel 36 tx-power 10
success: change accepted.
You also can change the channel and transmit power on an individual basis.
Configuring the external antenna model
This section introduces the external antenna portfolio available for the WLAN 2300 system AP-2330/2330A/2330B and
Series 2332 Access Points.
•
The portfolio includes 802.11b/g (2.4GHz), 802.11a (5GHz) and 802.11a/b/g (2.4/5GHz) models.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
318 Configuring APs
•
The addition of external antennas to the WLAN 2300 system portfolio improves overall system value:
•
•
•
Improved deployment flexibility – Planners can choose an antenna pattern that meets coverage
requirements while allowing for convenient AP placement and installation.
Improved coverage and performance – External antennas allow planners to optimize coverage and
deliver higher available data rates to user concentrations.
Can provide a low cost fix for trouble spots - Appropriately outfitting existing APs with external
antennas can greatly improve coverage and available data rates in areas that are not adequately
serviced.
•
•
•
Increased security – Perimeter access points outfitted with directional external antennas can focus
energy inwards and increase security by preventing signal “leakage” outside the office.
Improved aesthetics – External antennas feature a 3 foot cable that allows the connected access point
to be installed out-of-sight.
Lower cost of coverage – External antennas improve overall system efficiency by effectively
directing available energy to where it’s needed. This ensures overall system utility is maximized for
any installation.
The WLAN 2300 series external antennas are the only external antennas certified by Nortel for use with WLAN 2300
systems. WLAN Access Points 2330/2330A/2330B and Series 2332 outfitted with non-certified external antenna
are not supported under Nortel support agreements.
The WLAN 2300 system must be upgraded to WSS Software v4.1 (or later) and WMS v4.1 (or later). Support for Series
2332 access points and their associated external antennas requires WSS Software v6.0 (or later) and WMS v6.0 (or
later). This upgrade includes antenna pattern libraries for the WLAN 2300 series external antenna portfolio and allows
the system to
•
Accurately predict RF environments when using the WMS planning tool to calculate coverage
provided by access points equipped with external antennas.
•
Correctly interpret received signal strength measurements from APs with external antennas when
calculating rogue device or client location.
The WLAN 2300 system external antenna portfolio is sourced from Cushcraft, a world leader in the development of
advanced antenna technology and products.
•
The Cushcraft products have been modified for compatibility with the AP-2330/2330A/2330B and
Series 2332 Access Points.
•
Nortel versions are equipped with an R-SMA (reverse SMA) type connector to comply with industry
regulatory quality standards and correctly interface with the AP-2330/2330A/2330B and Series 2332
Access Points.
•
The Cushcraft model numbers presented throughout this bulletin refer to the Nortel specific versions
and may not exactly match similar versions promoted on Cushcraft’s website or other product
materials.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 319
•
Nortel has tested and measured each product. The antenna gains expressed in dBi measurements are
the Nortel tested values and may differ slightly from those published by Cushcraft for similar
products.
Warning! Intentional radiators, such as the Nortel WLAN 2330/
2330A/2330B and Series 2332 access points, are not intended to be
operated with any antenna(s) other than those furnished by Nortel. An
intentional radiator may only be operated with the antenna(s) with
which it is authorized. For a complete listing of antennas for use with
this product, visit http://www.nortel.com/support.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
320 Configuring APs
External antenna selector guides for the AP-2330, AP-2330A, AP-2330B
and Series 2332 APs
Table 16: External Antenna Selector Guide for the AP-2330/AP-2330A/AP-2330B and
Series 2332 APs for indoor operation
WSS
Model
String
Nortel Model
Number
Cushcraft
2.4 GHz Antennas
S2403BHN36RSM
DR4000072E6 24453
(Discontinued)
DR4000072E6 has been replaced with the DR4000088E6. They
have the same electrical characteristics and the DR4000088E6 can
now be mounted on either a pole or hung from a ceiling. Certified
for use with the AP-2330, AP-2330A and AP-2330B ONLY.
S2403BPXN36RSM DR4000088E6 24493
WLAN Collinear Omni-directional Dipole Antenna contains two
collocated elements with an average gain of 4.9 dBi and a 3-foot
cable with a Reverse SMA connector. For use in Warehouses,
Auditoriums, Shopping Malls, industrial complexes and more. It
can be mounted either on a pole or hung from a ceiling.
(Replaces
DR4000072E6)
S2406PN36RSM
SL2402PN36RSM
DR4000075E6 24553
DR4000074E6 24203
WLAN Directional Patch Panel Antenna with an average gain of
6.5 dBi and a 3-foot cable with a Reverse SMA connector. For use
in Hallways or corridors. Easy to disguise or hide.
WLAN Omni-directional Patch Panel Ceiling Mount Antenna with
an average gain of 0.0 dBi and a 3-foot cable with a Reverse SMA
connector. For use in contemporary in-building WLAN
applications.
SQ2405DDN36RSM DR4000073E6 24403
WLAN Bi-directional Patch Panel Ceiling Mount Antenna with an
average gain of 4.5 dBi and a 3-foot cable with a Reverse SMA
connector. For use in Offices, Shopping Complexes, Transportation
Terminals, Educational Campuses, Hallways, and Tunnels.
S2409PN36RSM
DR4000076E6 24883
DR4000077E6 24143
WLAN Directional Patch Panel Array Antenna with an average
gain of 8.8 dBi and a 3-foot cable with a Reverse SMA connector.
For use where a shaped pattern is needed to provide enhanced
coverage of deep rooms, warehouse bays, or any elongated activity
zone
PC2415NA36RSM
WLAN 15-Element Yagi Antenna with an average gain of
14.1 dBi, 3-foot cable with a Reverse SMA connector and an
articulating mount. Antenna is rugged, easy to install and provides a
very symmetrical and uniform pattern. Designed for long, narrow
coverage environments, like a tunnel.
SR24120DN36RSM DR4000087E6 24113
WLAN Directional Patch Panel Array Antenna with an average
gain of 11 dBi, 3-foot cable with a Reverse SMA connector and
either a tilt, wall or pole mounting capability. Antenna is rugged,
easy to install and provides a very symmetrical and uniform
120 degree H-plane and 14 degree E-plane pattern. Designed for
long, wide coverage environments. Certified for use with the
AP-2330A, AP-2330B and Series 2332 APs ONLY.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 321
Table 16: External Antenna Selector Guide for the AP-2330/AP-2330A/AP-2330B and
Series 2332 APs for indoor operation (continued)
S241290PN36RSM
DR4000086E6 24123
WLAN Directional Patch Panel Array Antenna with an average
gain of 12 dBi, 3-foot cable with a Reverse SMA connector and
either a tilt, wall or pole mounting capability. Antenna is rugged,
easy to install and provides a very symmetrical and uniform
90 degree H-plane and 17 degree E-plane pattern. Designed for
long, wide coverage environments. Certified for use with the
AP-2330A, AP-2330B and Series 2332 APs ONLY.
WSS
Nortel Model
Model
Cushcraft
5.0 GHz Antennas
Number
String
SQ5153WPN36RSM DR4000069E6 5303
WLAN Squint Ceiling Mount Omni-directional Monopole Antenna
with an average gain of 3.2 dBi from 5.15 - 5.25 GHz,
2.5 dBi from 5.25 - 5.35 GHz, 1.6 dBi from 5.470 - 5.725 GHz and
0.1 dBi from 5.725 - 5.85 GHz. It has a 3-foot cable with a Reverse
SMA connector. For use in large indoor spaces, locations with high
ceilings, and where extending coverage is needed.
S5153WBPN36RSM DR4000070E6 5643
WLAN Collinear Omni-directional Dipole Antenna that contains
two collocated elements. It has an average gain of 4.5 dBi from
5.15 - 5.25 GHz, 3.8 dBi from 5.25 - 5.35 GHz, 4.7 dBi from
5.47 -5.725 GHz and 4.4 dBi from 5.725 - 5.85 GHz. It is 7" in
height, and has a 3-foot cable with a Reverse SMA connector. For
use in Warehouses, Auditoriums, Shopping Malls, industrial
complexes and other locations.
S51514WPN36RSM DR4000071E6 5133
WLAN Directional Patch Panel Antenna with an average gain of
13.1 dBi from 5.15 - 5.25 GHz, 13.0 dBi from 5.25 - 5.35 GHz,
13.0 dBi from 5.470 - 5.725 GHz and 12.9 dBi from
5.725 - 5.85 GHz. It has a 3-foot cable with a Reverse SMA
connector. For use in campus or in-building applications. It offers a
very precise and controllable pattern. Must order mounting bracket
separately.
S4901790PN36RS
DR4000090E6 5173
WLAN Directional Patch Panel Antenna with an average gain of
15.7 dBi from 5.15 - 5.25 GHz, 15.9 dBi from 5.25 - 5.35 GHz,
16.0 dBi from 5.470 - 5.725 GHz and 15.8 dBi from
5.725 - 5.85 GHz. It has a 3-foot cable with a Reverse SMA
connector and either a tilt, wall or pole mounting capability.
Antenna is rugged, easy to install and provides a very symmetrical
and uniform 90 degree H-plane and 5.5 degree E-plane pattern.
Designed for long, wide coverage environments. Certified for use
with the Series 2332 access points ONLY.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
322 Configuring APs
Table 16: External Antenna Selector Guide for the AP-2330/AP-2330A/AP-2330B and
Series 2332 APs for indoor operation (continued)
SR49120DAN36RS DR4000091E6 5103
WLAN Directional Patch Panel Antenna with an average gain of
10.0 dBi from 5.15 - 5.25 GHz, 9.9 dBi from 5.25 - 5.35 GHz,
9.6 dBi from 5.470 - 5.725 GHz and 9.5 dBi from
5.725 - 5.85 GHz. It has a 3-foot cable with a Reverse SMA
connector and either a wall or pole mounting capability. Antenna is
rugged, easy to install and provides a very symmetrical and uniform
120 degree H-plane and 15 degree E-plane pattern. Designed for
long, wide coverage environments. Certified for use with the
Series 2332 access points ONLY.
2.4/5.0 GHz Dual Antennas
S24493DSN36RSM DR4000078E6 Mixed
WLAN Dual-Band, Tri-Mode 802.11 a/b/g Spatial Diversity
Monopole Antenna. It operates over the 2.4 - 2.5 GHz and
4.90 - 5.875 GHz bands. It has an average gain of 3.0 dBi from
2.4 - 2.5 GHz, 4.0 dBi from 4.90 - 5.15 GHz, 3.9 dBi from
5.15 - 5.25 GHz, 3.2 dBi from 5.25 - 5.35 GHz, 2.9 dBi from
5.470 - 5.725 GHz and 2.6 dBi from 5.725 - 5.85 GHz. It is
equipped with a 3-foot cable and a Reverse SMA connector. Each
antenna port can be used individually to support 802.11 b/g and
802.11a systems simultaneously for dual-band, non-diversity
applications. Optimal for use in high data rate, high capacity
configurations such as enterprise offices.
Note. Outdoor operation is supported by the Series 2332 access points with WSS release
(6.0.6.2) or later and WMS release (6.0.7.1) or later.
Note. For more information about Outdoor usage, see Nortel WLAN 2300 Series Outdoor
Solution Guide (NN47250-503) when using the AP-2330A/AP-2330B or Nortel WLAN Series 2332
Outdoor Solution Guide (NN47250-506) when using the Series 2332 APs.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 323
Table 17. External Antenna Selector Guide for the AP-2330A/AP-2330B and
Series 2332 APs for Outdoor Operation
WSS
Model
String
Nortel Model
Number
Cushcraft
2.4 GHz Antennas
S2403BPXN36RSM DR4000088E6
WLAN Collinear Omni-directional Dipole Antenna that con-
tains two collocated elements with an average gain of 4.9 dBi
and a 3-foot cable with a Reverse SMA connector. For use in
Warehouses, Auditoriums, Shopping Malls, industrial com-
plexes and more. It can be mounted either on a pole or hung
from a ceiling.
24493-
NEMA
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable and the lightning protection circuitry.
24493-
NEMA-10
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 10-foot
outdoor rated extension cable.
24493-
NEMA-25
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 25-foot
outdoor rated extension cable.
24493-
OUT
Output power is compensated for the addition of lightning pro-
tection circuitry and the 10-foot plenum rated cable.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
324 Configuring APs
24493-
OUT-10
The "10" refers to the addition of the 10-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 10-foot outdoor rated extension cable.
24493-
OUT-25
The "25" refers to the addition of the 25-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 25-foot outdoor rated extension cable.
S2409PN36RSM
DR4000076E6
WLAN Directional Patch Panel Array Antenna with an average
gain of 8.8 dBi and a 3-foot cable with a Reverse SMA connec-
tor. For use where a shaped pattern is needed to provide
enhanced coverage of deep rooms, warehouse bays, or any elon-
gated activity zone.
24883-
NEMA
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable and the lightning protection circuitry.
24883-
NEMA-10
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 10-foot
outdoor rated extension cable.
24883-
NEMA-25
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 25-foot
outdoor rated extension cable.
24883-
OUT
Output power is compensated for the addition of lightning pro-
tection circuitry and the 10-foot plenum rated cable.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 325
The "10" refers to the addition of the 10-foot outdoor-rated
24883-
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 10-foot outdoor rated extension cable.
OUT-10
24883-
OUT-25
The "25" refers to the addition of the 25-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 25-foot outdoor rated extension cable.
PC2415NA36RSM DR4000077E6
WLAN 15-Element Yagi Antenna with an average gain of
14.1 dBi, 3-foot cable with a Reverse SMA connector and an
articulating mount. Antenna is rugged, easy to install and pro-
vides a very symmetrical and uniform pattern. Designed for
long, narrow coverage environments, like a tunnel.
24143-
NEMA
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable and the lightning protection circuitry.
24143-
NEMA-10
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 10-foot
outdoor rated extension cable.
24143-
NEMA-25
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 25-foot
outdoor rated extension cable.
24143-
OUT
Output power is compensated for the addition of lightning pro-
tection circuitry and the 10-foot plenum rated cable.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
326 Configuring APs
24143-
OUT-10
The "10" refers to the addition of the 10-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 10-foot outdoor rated extension cable.
24143-
OUT-25
The "25" refers to the addition of the 25-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 25-foot outdoor rated extension cable.
S241290PN36RSM DR4000086E6
WLAN Directional Patch Panel Array Antenna with an average
gain of 12 dBi, 3-foot cable with a Reverse SMA connector and
either a tilt, wall or pole mounting capability. Antenna is rug-
ged, easy to install and provides a very symmetrical and uni-
form 90 degree H-plane and 17 degree E-plane pattern.
Designed for long, wide coverage environments.
24123-
NEMA
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable and the lightning protection circuitry.
24123-
NEMA-10
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 10-foot
outdoor rated extension cable.
24123-
NEMA-25
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 25-foot
outdoor rated extension cable.
24123-
OUT
Output power is compensated for the addition of lightning pro-
tection circuitry and the 10-foot plenum rated cable.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 327
The "10" refers to the addition of the 10-foot outdoor-rated
24123-
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 10-foot outdoor rated extension cable.
OUT-10
24123-
OUT-25
The "25" refers to the addition of the 25-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 25-foot outdoor rated extension cable.
SR24120DN36RSM DR4000087E6
WLAN Directional Patch Panel Array Antenna with an average
gain of 11 dBi, 3-foot cable with a Reverse SMA connector and
either a tilt, wall or pole mounting capability. Antenna is rug-
ged, easy to install and provides a very symmetrical and uni-
form 120 degree H-plane and 14 degree E-plane pattern.
Designed for long, wide coverage environments.
24113-
NEMA
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable and the lightning protection circuitry.
24113-
NEMA-10
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 10-foot
outdoor rated extension cable.
24113-
NEMA-25
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 25-foot
outdoor rated extension cable.
24113-
OUT
Output power is compensated for the addition of lightning pro-
tection circuitry and the 10-foot plenum rated cable.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
328 Configuring APs
24113-
OUT-10
The "10" refers to the addition of the 10-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 10-foot outdoor rated extension cable.
24113-
OUT-25
The "25" refers to the addition of the 25-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 25-foot outdoor rated extension cable.
WSS
Model
String
Nortel Model
Number
Cushcraft
5.0 GHz Antennas
S5153WBPN36RSM
DR4000070E6
WLAN Collinear Omni-directional Dipole Antenna that con-
tains two collocated elements. It has an average gain of 4.5 dBi
from 5.15 - 5.25 GHz, 3.8 dBi from 5.25 - 5.35 GHz, 4.7 dBi
from 5.47 -5.725 GHz and 4.4 dBi from 5.725 - 5.85 GHz. It is
7" in height, and has a 3-foot cable with a Reverse SMA con-
nector. For use in Warehouses, Auditoriums, Shopping Malls,
industrial complexes and other locations.
5643-
NEMA
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable and the lightning protection circuitry.
5643-
NEMA-10
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 10-foot
outdoor rated extension cable.
5643-
NEMA-25
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 25-foot
outdoor rated extension cable.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 329
5643-OUT Output power is compensated for the addition of lightning pro-
tection circuitry and the 10-foot plenum rated cable.
5643-
OUT-10
The "10" refers to the addition of the 10-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 10-foot outdoor rated extension cable.
5643-
OUT-25
The "25" refers to the addition of the 25-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 25-foot outdoor rated extension cable.
S51514WPN36RSM DR4000071E6
WLAN Directional Patch Panel Antenna with an average gain
of 13.1 dBi from 5.15 - 5.25 GHz, 13.0 dBi from
5.25 - 5.35 GHz, 13.0 dBi from 5.470 - 5.725 GHz and 12.9 dBi
from 5.725 - 5.85 GHz. It has a 3-foot cable with a Reverse
SMA connector. For use in campus or in-building applications.
It offers a very precise and controllable pattern. Must order
mounting bracket separately.
5133-
NEMA
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable and the lightning protection circuitry.
5133-
NEMA-10
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 10-foot
outdoor rated extension cable.
5133-
NEMA-25
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 25-foot
outdoor rated extension cable.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
330 Configuring APs
5133-OUT Output power is compensated for the addition of lightning pro-
tection circuitry and the 10-foot plenum rated cable.
5133-
OUT-10
The "10" refers to the addition of the 10-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 10-foot outdoor rated extension cable.
5133-
OUT-25
The "25" refers to the addition of the 25-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 25-foot outdoor rated extension cable.
WSS
Model
String
Nortel Model
Number
5.0 GHz Antennas for
WLAN Series 2332 Access Points ONLY
Cushcraft
S4901790PN36RS
DR4000090E6
WLAN Directional Patch Panel Antenna with an average gain
of 15.7 dBi from 5.15 - 5.25 GHz, 15.9 dBi from
5.25 - 5.35 GHz, 16.0 dBi from 5.470 - 5.725 GHz and 15.8 dBi
from 5.725 - 5.85 GHz. It has a 3-foot cable with a Reverse
SMA connector and either a tilt, wall or pole mounting capabil-
ity. Antenna is rugged, easy to install and provides a very sym-
metrical and uniform 90 degree H-plane and 5.5 degree E-plane
pattern. Designed for long, wide coverage environments.
Certified for use with the Series 2332 access points ONLY.
5173-
NEMA
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable and the lightning protection circuitry. Certified for
use with the Series 2332 access points ONLY.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 331
To be used with the outdoor NEMA enclosure only. Output
5173-
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 10-foot
outdoor rated extension cable. Certified for use with the
Series 2332 access points ONLY.
NEMA-10
5173-
NEMA-25
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 25-foot
outdoor rated extension cable. Certified for use with the Series
2332 access points ONLY.
5173-OUT Output power is compensated for the addition of lightning pro-
tection circuitry and the 10-foot plenum rated cable.
Certified for use with the Series 2332 access points ONLY.
5173-
OUT-10
The "10" refers to the addition of the 10-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 10-foot outdoor rated extension cable.
Certified for use with the Series 2332 access points ONLY.
5173-
OUT-25
The "25" refers to the addition of the 25-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 25-foot outdoor rated extension cable.
Certified for use with the Series 2332 access points ONLY.
SR49120DAN36RS
DR4000091E6
WLAN Directional Patch Panel Antenna with an average gain
of 10.0 dBi from 5.15 - 5.25 GHz,
9.9 dBi from 5.25 - 5.35 GHz, 9.6 dBi from
5.470 - 5.725 GHz and 9.5 dBi from 5.725 - 5.85 GHz. It has a
3-foot cable with a Reverse SMA connector and either a wall or
pole mounting capability. Antenna is rugged, easy to install and
provides a very symmetrical and uniform 120 degree H-plane
and 15 degree E-plane pattern. Designed for long, wide cover-
age environments. Certified for use with the
Series 2332 access points ONLY.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
332 Configuring APs
5103-
NEMA
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable and the lightning protection circuitry.
Certified for use with the Series 2332 access points ONLY.
5103-
NEMA-10
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 10-foot
outdoor rated extension cable. Certified for use with the
Series 2332 access points ONLY.
5103-
NEMA-25
To be used with the outdoor NEMA enclosure only. Output
power is compensated for the addition of the 10-foot plenum
rated cable, the lightning protection circuitry and the 25-foot
outdoor rated extension cable. Certified for use with the
Series 2332 access points ONLY.
5103-OUT Output power is compensated for the addition of lightning pro-
tection circuitry and the 10-foot plenum rated cable.
Certified for use with the Series 2332 access points ONLY.
5103-
OUT-10
The "10" refers to the addition of the 10-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 10-foot outdoor rated extension cable.
Certified for use with the Series 2332 access points ONLY.
5103-
OUT-25
The "25" refers to the addition of the 25-foot outdoor-rated
LMR-240 extension cable. Output power is compensated for the
addition of the 10-foot plenum rated cable, the lightning protec-
tion circuitry and the 25-foot outdoor rated extension cable.
Certified for use with the Series 2332 access points ONLY.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 333
Antenna selection decision trees
The following decision trees are intended to quickly guide users to the appropriate model(s) based on basic criteria.
•
The distinction between office and industrial types refers solely to the aesthetic suitability of an antenna for each
environment. Any antenna identified as suitable for office deployments can be deployed in industrial environments
and vice versa.
•
•
The Antenna # can be used to quickly identify the appropriate corresponding model in the Antenna Descriptions
section.
Only one model of dual-band antenna is available for 802.11a/b/g installations - a Dualband, Tri-mode 802.11a/b/g
Spatial Diversity Antenna, model #: DR4000078E6. This unit has a 2.4 GHz and 5 GHz antenna built-in. It is
designed to connect to each of the external ports on the AP. It can be used with only one port connected, so it could
be used in either b/g or a mode in a stand alone application
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
334 Configuring APs
Figure 18. 5 GHz Antennas
2.4 GHz Antennas
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 335
Specifying the external antenna model
To specify the 2.4 GHz external antenna model, use the following command:
set {ap port-list | ap ap-num} radio {1 | 2} antennatype {internal | 24143 | 24123 | 24113 | 24203
| 24403 | 24453 | 24493 | 24553 | 24883 | mixed | 24143-OUT | 24143-OUT-10 |
24143-OUT-25 | 24143-NEMA | 24143-NEMA-10 | 24143-NEMA-25 | 24123-OUT |
24123-OUT-10 | 24123-OUT-25 | 24123-NEMA | 24123-NEMA-10 | 24123-NEMA-25 |
24113-OUT | 24113-OUT-10 | 24113-OUT-25 | 24113-NEMA | 24113-NEMA-10 |
24113-NEMA-25 | 24493-OUT | 24493-OUT-10 | 24493-OUT-25 | 24493-NEMA |
24493-NEMA-10 | 24493-NEMA-25 | 24883-OUT | 24883-OUT-10 | 24883-OUT-25 |
24883-NEMA | 24883-NEMA-10 | 24883-NEMA-25}
To specify the 5.0 GHz external antenna model, use the following command:
set {ap port-list | ap ap-num} radio {1 | 2} antennatype {internal | 5303 | 5643 | 5133 | 5173 |
5103 | mixed | 5133-OUT | 5133-OUT-10 | 5133-OUT-25 | 5133-NEMA | 5133-NEMA-10 |
5133-NEMA-25 | 5643-OUT | 5643-OUT-10 | 5643-OUT-25 | 5643-NEMA |
5643-NEMA-10 | 5643-NEMA-25 | 5173-OUT | 5173-OUT-10 | 5173-OUT-25 |
5173-NEMA | 5173-NEMA-10 | 5173-NEMA-25 | 5103-OUT | 5103-OUT-10 |
5103-OUT-25 | 5103-NEMA | 5103-NEMA-10 | 5103-NEMA-25}
Note. The options displayed are dependent upon the access point model number that
this command is executed against.
To configure antenna model 5303 for a 2330/2330A/2330B on AP 1, type the following command:
WSS# set ap 1 radio 1 antennatype 5303
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
336 Configuring APs
Mapping the radio profile to service profiles
To assign SSIDs to radios, you must map the service profiles for the SSIDs to the radio profile that is assigned to the
radios.
To map a radio profile to a service profile, use the following command:
set radio-profile name service-profile name
The following command maps service-profile wpa_clients to radio profile rp2:
WSS# set radio-profile rp2 service-profile wpa_clients
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 337
Assigning a radio profile and enabling radios
To assign a radio profile to radios, use the following command:
set {ap port-list | ap ap-num} radio {1 | 2} radio-profile name mode {enable | disable}
To assign radio profile rp1 to radio 1 on ports 5-8, 11-14, and 16 and enable the radios, type the following command:
WSS# set ap 5-8,11-14,16 radio 1 radio-profile rp1 mode enable
success: change accepted.
To assign radio profile rp1 to radio 2 on ports 11-14 and port 16 and enable the radios, type the following command:
WSS# set ap 11-14,16 radio 2 radio-profile rp1 mode enable
success: change accepted.
To disable radio 1 on port 6 without disabling the other radios using radio profile rp1, type the following command:
WSS# set ap 6 radio 1 radio-profile rp1 mode disable
(To disable or reenable all radios that are using a radio profile, see “Disabling or reenabling all radios using a profile” on
page 339.)
Disabling or reenabling radios
You can disable or reenable radios on a radio profile basis or individual basis. You also can reset a radio to its factory
default settings.
(To disable or reenable radios when assigning or removing a radio profile, see “Assigning a radio profile and enabling
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
338 Configuring APs
Enabling or disabling individual radios
To disable or reenable an AP radio, use the following command:
set {ap port-list | ap ap-num} radio {1 | 2} mode {enable | disable}
To disable radio 2 on port 3 and 7, type the following command:
WSS# set ap 3,7 radio 2 mode disable
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 339
Disabling or reenabling all radios using a profile
To disable or reenable all radios that are using a radio profile, use the following command:
set radio-profile name [mode {enable | disable}]
The following command enables all radios that use radio profile rp1:
WSS# set radio-profile rp1 mode enable
success: change accepted.
The following commands disable all radios that use radio profile rp1, change the beacon interval, then reenable the
radios:
WSS# set radio-profile rp1 mode disable
success: change accepted.
WSS# set radio-profile rp1 beacon-interval 200
success: change accepted.
WSS# set radio-profile rp1 mode enable
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
340 Configuring APs
Resetting a radio to its factory default settings
To disable an AP radio and reset it to its factory default settings, use the following command:
clear {ap port-list | ap ap-num} radio {1 | 2 | all}
This command performs the following actions:
•
•
Sets the transmit power, channel, and external antenna type to their default values.
Removes the radio from its radio profile and places the radio in the default radio profile.
This command does not affect the PoE setting.
To disable and reset radio 2 on the AP connected to port 3, type the following command:
WSS# clear ap 3 radio 2
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 341
Restarting an AP
To restart an AP, use the following command:
reset {ap port-list | ap ap-num}
Use the reset ap command to reset an AP configured on an AP access port. Use the reset ap command to reset a AP.
When you enter one of these commands, the AP drops all sessions and reboots.
Caution! Restarting an AP can cause data loss for users who are currently associated
with the AP.
Displaying AP information
You can display the following AP information:
•
•
•
•
•
•
•
•
•
AP and radio-specific configuration settings
Connection information for Distributed APs configured on a WSS
List of Distributed APs that are not configured on a WSS
Connection information for Distributed APs
Service profile information
Radio profile information
Status information
Information about static IP addresses on Distributed APs
Statistics counters
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
342 Configuring APs
Displaying AP configuration information
To display configuration information, use the following commands:
show ap config [port-list [radio {1 | 2}]]
show ap config [ap-num [radio {1 | 2}]]
The command lists information separately for each AP.
To display configuration information for an AP on WSS port 2, type the following command:
WSS# show ap config 2
Port 2: AP model: 2330, POE: enable, bias: high, name: MP02
boot-download-enable: YES
force-image-download: YES
Radio 1: type: 802.11g, mode: disabled, channel: 6
tx pwr: 1, profile: default
auto-tune max-power: default
Radio 2: type: 802.11a, mode: disabled, channel: 36
tx pwr: 1, profile: default
auto-tune max-power: default
To display configuration information for a AP configured on connection 1, type the following command:
WSS# show ap config 1
ap 1: serial-id: 12345678, AP model: 2330, bias: high, name: ap01
fingerprint: b4:f9:2a:52:37:58:f4:d0:10:75:43:2f:45:c9:52:c3
boot-download-enable: YES
force-image-download: YES
Radio 1: type: 802.11g, mode: disabled, channel: 6
tx pwr: 1, profile: default
auto-tune max-power: default
Radio 2: type: 802.11a, mode: disabled, channel: 36
tx pwr: 1, profile: default
auto-tune max-power: default
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 343
Displaying connection information for APs
To display connection information for APs configured on a WSS, use the following command:
show ap global [ap-num | serial-id serial-ID]
This command lists the System IP addresses of all the WSS switches on which each AP is configured, and lists the bias
for the AP on each switch. For each AP that is configured on the switch on which you use the command, the connection
number is also listed.
Connections are shown only for the APs that are configured on the WSS from which you enter the command, and only
for the Mobility Domain the switch is in.
To display connection information for all APs configured on a WSS, type the following command:
WSS# show ap global
Total number of entries: 8
ap
1
Serial Id
WSS IP Address
10.3.8.111
10.4.3.2
Bias
11223344
11223344
332211
HIGH
LOW
LOW
HIGH
HIGH
LOW
LOW
-
2
10.3.8.111
10.4.3.2
-
332211
17
-
0322100185
0322100185
0321500120
10.3.8.111
10.4.3.2
18
10.3.8.111
- 0321500120 10.4.3.2
HIGHThis command indicates that four Distributed APs are configured on the WSS, with
serial IDs 11223344, 332211, 0322100185, and 0321500120. Each AP is also configured on one of two other WSSs,
with system IP addresses 10.3.8.111 and 10.4.3.2. The bias for the AP on each WSS is listed. Normally, a Distributed
AP boots from the WSS with the high bias for the AP. (For more information, see “Resiliency and dual-homing options
The ap field indicates the connection number of each AP on the WSS on which the command is typed. A hyphen ( - ) in
the ap field indicates that the AP is configured on another WSS in the same Mobility Domain.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
344 Configuring APs
Displaying a list of APs that are not configured
To display a list on APs that are not configured, use the following command:
show ap unconfigured
The following command displays information for two APs that are not configured:
WSS# show ap unconfigured
Total number of entries: 2
Serial Id Model IP Address
Port Vlan
----------- ------ --------------- ---- --------
0333001287 2330 10.3.8.54
0333001285 2330 10.3.8.57
5
7
default
vlan-eng
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 345
Displaying active connection information for APs
A AP can have only one active data connection. To display the system IP address of the WSS that has the active connec-
tion (the switch that booted the AP), use the following command:
show ap connection [ap-num | serial-id serial-ID]
The serial-id parameter displays the active connection for a Distributed AP even if that AP is not configured on this
WSS. However, if you use the command with the ap-num parameter or without a parameter, connection information is
displayed only for APs that are configured on this WSS.
This command provides information only if the AP is configured on the switch where you use the command. The switch
does not need to be the one that booted the AP, but it must have the AP in its configuration. Also, the switch that booted
the AP must be in the same Mobility Domain as the switch where you use the command.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
346 Configuring APs
Displaying service profile information
To display service profile information, use the following command:
show service-profile {name | ?}
Entering show service-profile ? displays a list of the service profiles configured on the switch.
To display information for service profile sp1, type the following command:
WSS# show service-profile sp1
ssid-name:
corp2
yes
no
ssid-type:
crypto
no
Beacon:
Proxy ARP:
No broadcast:
Long retry limit:
DHCP restrict:
no
Short retry limit:
Auth fallthru:
5
5
none
yes
Sygate On-Demand (SODA):
SODA remediation ACL:
Custom failure web-page:
Custom agent-directory:
no
Enforce SODA checks:
Custom success web-page:
Custom logout web-page:
Static COS:
no
none
180
no
COS:
0
CAC mode:
CAC sessions:
Idle client probing:
14
yes
User idle timeout:
Keep initial vlan:
Web Portal ACL:
WEP Key 1 value:
WEP Key 3 value:
WEP Unicast Index:
Shared Key Auth:
WPA enabled:
Web Portal Session Timeout:
5
<none>
<none>
1
WEP Key 2 value:
WEP Key 4 value:
WEP Multicast Index:
<none>
<none>
1
NO
ciphers:
authentication:
cipher-tkip
802.1X
TKIP countermeasures time: 60000ms
vlan-name =
session-timeout =
service-type =
11a beacon rate:
11a mandatory rate:
11b beacon rate:
11b mandatory rate:
11g beacon rate:
11g mandatory rate:
orange
300
2
6.0
multicast rate:
AUTO
6.0,12.0,24.0
2.0
standard rates: 9.0,18.0,36.0,48.0,54.0
multicast rate:
AUTO
1.0,2.0
2.0
standard rates: 5.5,11.0
multicast rate:
AUTO
1.0,2.0,5.5,11.0
standard rates: 6.0,9.0,12.0,18.0,24.0, 36.0,48.0,54.0
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 347
Displaying radio profile information
To display radio profile information, use the following command:
show radio-profile {name | ?}
Entering show radio-profile ? displays a list of radio profiles.
To display radio profile information for the default radio profile, type the following command:
WSS# show radio-profile default
Beacon Interval:
Max Tx Lifetime:
RTS Threshold:
Long Preamble:
Tune Power:
100
2000
2346
no
DTIM Interval:
Max Rx Lifetime:
Frag Threshold:
Tune Channel:
1
2000
2346
yes
no
Tune Channel Interval:
Power ramp interval:
Countermeasures:
RFID enabled:
3600
60
Tune Power Interval:
Channel Holddown:
Active-Scan:
600
300
yes
no
none
no
WMM Powersave:
QoS Mode:
wmm
No service profiles configured.
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
348 Configuring APs
Displaying AP status information
To display status information including link state and WSS status, use the following commands:
show ap status [terse] | [port-list | all [radio {1 | 2}]]
show ap status [terse] | [ap-num | all [radio {1 | 2}]]
The terse option displays a brief line of essential status information for each directly connected AP.
The all option displays information for all directly attached APs configured on the switch.
The following command displays the status of a AP:
WSS# show ap status 1
ap: 1, IP-addr: 10.2.30.5 (vlan 'vlan-corp'), AP model: 2330,
manufacturer: Nortel, name: ap01
fingerprint: b4:f9:2a:52:37:58:f4:d0:10:75:43:2f:45:c9:52:c3
====================================================
State: operational (not encrypted)
CPU info: IBM:PPC speed=266666664 Hz version=405GPr
id=0x29c15335347f1919 ram=33554432
s/n=0333703027 hw_rev=A3
Uptime: 18 hours, 36 minutes, 27 seconds
Radio 1 type: 802.11g, state: configure succeed [Enabled] (802.11b protect)
operational channel: 1 operational power: 14
base mac: 00:0b:0e:00:d2:c0
bssid1: 00:0b:0e:00:d2:c0, ssid: public
bssid2: 00:0b:0e:00:d2:c2, ssid: employee-net
bssid3: 00:0b:0e:00:d2:c4, ssid: mycorp-tkip
Radio 2 type: 802.11a, state: configure succeed [Enabled]
operational channel: 64 operational power: 14
base mac: 00:0b:0e:00:d2:c1
bssid1: 00:0b:0e:00:d2:c1, ssid: public
bssid2: 00:0b:0e:00:d2:c3, ssid: employee-net
bssid3: 00:0b:0e:00:d2:c5, ssid: mycorp-tkip
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 349
Displaying static IP address information for APs
To display information about APs that have been configured with static IP address information, use the following
command:
show ap boot-configuration ap-num
To display statistics counters for AP 1, type the following command:
WSS# show ap boot-configuration 1
Flags: 11
ap: 1
Enable ip:
Enable vlan:
Enable wss:
Vlan Tag:
IP address:
gateway:
yes
no
yes
off
172.16.0.42 IP netmask: 255.255.255.0
172.16.0.20
WSS IP:
WSS name:
172.16.0.21 DNS:
2350
172.16.0.1
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
350 Configuring APs
Displaying AP statistics counters
To display AP statistics counters, use the following commands:
show ap counters [port-list [radio {1 | 2}]]
show ap counters [ap-num [radio {1 | 2}]]
To display statistics counters for AP 7, type the following command:
WSS# show ap counters 7
ap: 7
radio: 1
=================================
LastPktXferRate
2
PktTxCount
73473
NumCntInPwrSave
0
MultiPktDrop
MultiBytDrop
User Sessions
MIC Error Ct
0
LastPktRxSigStrength -89
LastPktSigNoiseRatio 4
TKIP Pkt Transfer Ct 0
0
0
0
TKIP Pkt Replays
0
TKIP Decrypt Err 0
CCMP Pkt Decrypt Err 0
CCMP Pkt Transfer Ct 0
Radio Recv Phy Err Ct 0
Radio Adjusted Tx Pwr 15
CCMP Pkt Replays 0
RadioResets
Transmit Retries 60501
Noise Floor -93
802.3 Packet Rx Ct 0
0
802.3 Packet Tx Ct
0
No Receive Descriptor 0
TxUni
TxUniPkt
TxMulti
Pkt
Undcrp
tByte
RxPkt
UndcrptPkt
TxMultiByte RxByte
PhyErr
Byte
1.0
1017
0
10170
0
14
3
8347
1670
258
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
3964
8695
4
2.0
5643
55683 822545 8697520
5.5
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
5
6.0
0
51
53
35
26
38
47
1
9.0
1
172
998
0
11.0
12.0
18.0
24.0
36.0
48.0
17
0
0
0
0
0
0
0
1
68
29
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs 351
TxUni
Byte
TxMulti
Pkt
Undcrp
tByte
TxUniPkt
RxPkt
UndcrptPkt
TxMultiByte RxByte
PhyErr
54.0
0
0
0
0
0
0
0
0
0
0
5
TOTAL 6660
55683 832715 8697520
41
11513
12948
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
To display statistics counters and other information for individual user sessions, use the show sessions network
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
352 Configuring APs
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring WLAN mesh services 353
Configuring WLAN mesh services
WLAN mesh services overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
Configuring WLAN mesh services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
Configuring Wireless Bridging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
Displaying WLAN Mesh Services Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358
WLAN mesh services overview
WLAN mesh services allows an AP to provide wireless services to clients, without a wired interface on the AP. Instead
of a wired interface, there is a radio link to another AP with a wired interface.
WLAN mesh services can be used at sites, when running Ethernet cable to a location is inconvenient, expensive, or
impossible.
Note. Power must be available at the location, where the Mesh AP is installed.
Multihop is now available when configuring Mesh Services. The system can support upto 16 Mesh Portals with each
Mesh Portal supporting a 6 Mesh AP fan-out with a depth of 2 Mesh APs. Also, a single AP can perform two roles:
•
•
Mesh Portal
Mesh AP
Mesh Services reliability is improved by adding the following :
•
•
•
Improved transmission of station session record.
Ability to manage link loss between Mesh Portals and Mesh APs.
Improved management of duplicate messages for SSR updates from multiple Mesh APs.
Mesh portal selection has improved by scanning for Mesh Link SSIDs and sorting them by RSSI values. The Mesh AP
establishes a link using the RSSI values in descending order. If all attempts fail, the Mesh AP scans from the beginning
of the table. After 60 seconds and no link is established, the Mesh AP reboots.
If the Mesh Link is using a DFS channel, then the Mesh Link has a timeout of 140 seconds to allow for DFS channel
assessment. Mesh Portal selection is improved by scanning for Mesh Link SSIDs and sorting them by RSSI values. The
Mesh AP establishes a link using RSSI values in descending order. If all attempts fail, the Mesh AP scans from the
beginning of the table. After 60 seconds and no link is established, the Mesh AP reboots. If the Mesh Link is using a
DFS channel, then the Mesh Link has a timeout of 140 seconds to allow for DFS channel assessment.
Figure 19 shows how a client connects to a network using WLAN mesh services.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
354 Configuring WLAN mesh services
Figure 19. WLAN Mesh Services
In the Figure 19, a client is associated with a Mesh AP and an AP without a wired interface to the network. The Mesh AP
is configured to communicate with a Mesh Portal AP and an AP with wired connectivity to an WSS. Communication
between the Mesh AP and the Mesh Portal AP takes place through a secure radio link (a Mesh Link). When associated
with the Mesh AP, the client establishes the same connectivity to the network as a Mesh AP with a wired link.
The Mesh AP and Mesh Portal AP are dual-radio APs. One radio (for example, the 802.11a radio) can be used for Mesh
Link communications, use an SSID reserved for this purpose. The Mesh AP can use the other radio for client associa-
tions (in the same manner) as a non-Mesh AP.
The Mesh Portal AP beacons a mesh services SSID on the radio, used for the Mesh Link. When the Mesh AP is booted,
the AP searches for an AP beaconing the mesh services SSID. The AP selects the Mesh Portal AP with the greatest
signal strength, then establishes a secure connection to the Mesh Portal SSID. Once this connection is established,
clients can associate with the Mesh AP.
Note. WLAN mesh services is supported ONLY on the Series 2332
access points.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring WLAN mesh services 355
Configuring WLAN mesh services
The basic configuration procedure for WLAN mesh services consists of the following tasks:
•
•
•
•
Attach the Mesh AP to the network and configure mesh services.
Configure a service profile for mesh services.
Set the security parameters to allow the Mesh AP to authenticate the network.
Optional—configure the Mesh Portal AP to emit link calibration packets and aid with positioning the Mesh
AP.
•
Detach the Mesh AP from the network and deploy the AP in a final location.
After the Mesh AP is installed in a final location and establishes a connection to the Mesh Portal AP, it can be config-
ured as any other AP on the WSS.
Configuring the Mesh AP
Note. Before a Mesh AP can be installed in a location untethered from the
network, it must be preconfigured for mesh services, including the mesh services
SSID, and the pre-shared key for establishing the connection between the Mesh
AP and the Mesh Portal AP.
1
2
Attach the AP to your network, apply power, and allow the AP to boot as a regular AP.
Once the AP has booted, use the following command to enable mesh services on the AP.
set ap num boot-configuration mesh mode {enable | disable}
Use the following command to specify the pre-shared key:
3
set ap num boot-configuration mesh {psk-phrase pass-phrase | psk-raw raw-pass}
When a pass-phrase is specified, it is converted into a raw hexadecimal key and stored in the AP boot
configuration.
4
Use the following command to specify the mesh services SSID:
set ap num boot-configuration mesh ssid mesh-ssid
When the AP is booted, and determines that there is no Ethernet link to the network, then the AP has to be
associated with the specified mesh-ssid.
When a mesh-ssid is specified, the regulatory domain of the WSS and the power restrictions are copied to
the AP flash memory. This prevents the Mesh AP from operating outside of regulatory limits after
booting and before receiving a complete configuration from the WSS. Consequently, it is im0000portant
that the regulatory and antenna information specified on the WSS reflects the locale where the Mesh AP
is to be deployed, to avoid regulatory violations.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
356 Configuring WLAN mesh services
Configuring the Service Profile for Mesh Services
Configure the Mesh Portal AP to beacon the mesh services SSID. To do this, create a service profile and enable mesh
services using the following commands:
set service-profile mesh-service-profile ssid-name mesh-ssid
set service-profile mesh-service-profile mesh mode {enable | disable}
Then, service profile can be mapped to a radio profile, that manages a radio on the Mesh Portal AP.
Note. The radio profile mapped to the service profile cannot be configured to
auto-tune power or channel settings.
Configuring Security
The secure connection between the Mesh AP and the Mesh Portal AP is established in a two-step process:
1
2
Creation of an encrypted point-to-point link between the Mesh AP and the Mesh Portal AP
Authentication of the Mesh AP.
When the Mesh AP is booted, it searches for a beacon containing the configured mesh SSID. Once the Mesh AP locates
a Mesh Portal AP with the mesh SSID, it associates with the Mesh Portal AP as a client device. The Mesh AP can then
be authenticated by the WSS.
To configure the Mesh AP it has to be authenticated. To authenticate it, use the following commands:
set service-profile mesh-service-profile rsn-ie enable
set service-profile mesh-service-profile auth-psk enable
set service-profile mesh-service-profile cipher-ccmp enable
set service-profile mesh-service-profile cipher-tkip disable
set service-profile mesh-service-profile {psk-phrase pass-phrase | psk-raw raw-pass}
set mac-user mesh-ap-mac-addr attr vlan-name default
set authentication mac ssid mesh-ssid * local
The pass-phrase or raw-pass is the same one configured on the Mesh AP. In addition, the serial number and the finger-
print of the Mesh AP must be configured on the WSS.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring WLAN mesh services 357
Enabling Link Calibration Packets on the Mesh Portal AP
A Mesh Portal AP can be configured to emit link calibration packets to assist with positioning the Mesh AP. A link cali-
bration packet is an unencrypted 802.11 management packet of type Action. When enabled on an AP, link calibration
packets are sent at the rate of 5 per second.
To enable link calibration packets on an AP radio, use the following command:
set ap num radio num link-calibration mode {enable | disable}
Only one radio on an AP can be configured to send link calibration packets. Link calibration packets are intended to be
used only during installation of APs; they are not intended to be enabled on a continual basis.
Deploying the Mesh AP
After you have configured the Mesh AP with mesh services settings, detach the AP from the wired network and place it
in the desired location. The Mesh Portal AP must be within radio range of the Mesh AP.
Configuring Wireless Bridging
You can use WLAN mesh services in a wireless bridge configuration and implement APs as bridge endpoints in a trans-
parent Layer 2 bridge. Configuring a wireless bridge to connect two sites provides an alternative to install the Ethernet
cable to provide bridge functionality.
A typical application of wireless bridging is to provide the network connectivity between two buildings using a wireless
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
358 Configuring WLAN mesh services
Figure 20. Wireless Bridging
The wireless bridge is established between a Mesh Portal AP and an associated Mesh AP. The bridged data packets are
present on the Ethernet interfaces of the two APs.
A Mesh Portal AP deployed as a bridge endpoint can support up to five Mesh APs configured as bridge endpoints. A
Mesh AP serving as a bridge endpoint picks up packets from its wired port and transfers them to the other bridge
endpoint. A simple source/destination learning mechanism is used to avoid forwarding packets across the bridge
unnecessarily.
To enable wireless bridging for a service profile, use the following command:
set service-profile mesh-service-profile bridging {enable | disable}
When wireless bridging is enabled for a service profile, the APs with the applied service profile are bridge peers. When
a Mesh AP associates with a Mesh Portal AP through this service profile, the Mesh Portal AP automatically configures
the Mesh AP to operate in bridge mode.
The show service-profile command indicates if bridging is enabled for the service profile.
Displaying WLAN Mesh Services Information
The show ap status terse command indicates which APs are Mesh APs and which are Mesh Portal APs.
For example:
WSS# show ap status terse
Total number of entries: 120
Operational: 1, Image Downloading: 0, Unknown: 119, Other: 0
Flags: o = operational, b = booting, d = image downloading
c = configuring, f = configuration failed
a = auto AP, m = mesh AP, p = mesh portal
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring WLAN mesh services 359
i = insecure, e = encrypted, u = unencrypt
AP Flag IP Address Model MAC Address
Radio1 Radio2 Uptime
--- ---- --------------- --------- ----------------- ------ ------ -------------------------
7 om-u
2332-A1 and 2332-E1 00:0b:0e:00:ca:c0 D 1/1 D56/1 19h47m
The show ap status command displays the mesh services attributes for an AP and the associated BSSID of the Mesh
Portal.
For example:
WSS# show ap status
AP: 1, IP-addr: 10.8.255.10 (vlan 'corp'), AP model: 2332-A1 and 2332-E1,
manufacturer: Nortel, name: AP01
====================================================
State: operational (not encrypt)
CPU info: Atheros:MIPS32 speed=220000000 Hz version=AR5312, ram=16777216
s/n=111111 hw_rev=n/a
Uptime: 0 hours, 0 minutes, 11 seconds
Uplink BSSID: 00:0b:0e:17:bb:00
Radio 1 type: 802.11g, state: configure succeed [Enabled] (802.11b protect)
operational channel: 6 (Auto) operational power: 18
bssid1: 00:0b:0e:fd:fd:cc, ssid: public
RFID Reports: Inactive
Antenna Link Calibration: Enabled
Radio 2 type: 802.11a, state: configure succeed [Enabled]
operational channel: 36 operational power: 17
bssid1: 00:0b:0e:fd:fd:cd, ssid: mesh-ssid (mesh)
The show mesh links command displays information about the links an AP has to Mesh APs and Mesh Portal APs.
WSS# show ap mesh-links 1
AP: 1 IP-addr: 1.1.1.3
Operational Mode: Mesh-Portal
Downlink Mesh-APs
-------------------------------------------------
BSSID: 00:0b:0e:17:bb:3f (54 Mbps)
packets
307
bytes
44279
215046
TX:
RX:
315
Use the show ap boot-configuration command to display information about a Mesh AP:
WSS# show ap boot-configuration 7
Static Boot Configuration
AP: 7
IP Address: Disabled
VLAN Tag: Disabled
Switch:
Disabled
Mesh:
Disabled
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
360 Configuring WLAN mesh services
IP Address:
Netmask:
Gateway:
VLAN Tag:
Switch IP:
Switch Name:
DNS IP:
Mesh SSID:
Mesh PSK:
For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
361
Configuring user encryption
Configuring WPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
Configuring WEP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
Encryption configuration scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382
WLAN Security Switch 2300 Series (WSS Software) encrypts wireless user traffic for all users who are successfully
authenticated to join an encrypted SSID and who are then authorized to join a VLAN. WSS Software supports the
following types of encryption for wireless user traffic:
•
•
•
•
802.11i
Wi-Fi Protected Access (WPA)
Non-WPA dynamic Wired Equivalent Privacy (WEP)
Non-WPA static WEP
WEP is described in the IEEE 802.11 standard and WPA is described in the 802.11i standard.
WPA and 802.11i provide stronger security than WEP. (802.11i uses Robust Security Network (RSN), and is sometimes
called WPA2.)
To use WPA or RSN, a client must support it. For non-WPA clients, WSS Software supports WEP. If your network
contains a combination of WPA, RSN, clients and non-WPA clients, you can configure WSS Software to provide
encryption for both types of clients.
To configure encryption parameters for an SSID, create or edit a service profile, map the service profile to a radio
profile, and add radios to the radio profile. The SSID name, advertisement setting (beaconing), and encryption settings
are configured in the service profile.
You can configure an SSID to support any combination of WPA, RSN, and non-WPA clients. For example, a radio can
simultaneously use Temporal Key Integrity Protocol (TKIP) encryption for WPA clients and WEP encryption for
non-WPA clients.
The SSID type must be crypto (encrypted) for encryption to be used. If the SSID type is clear, wireless traffic is not
encrypted, regardless of the encryption settings.
Note. WSS Software does not encrypt traffic in the wired part of the network. WSS
Software does not encrypt wireless or wired traffic for users who associate with an
unencrypted (clear) SSID.
Table 18 lists the encryption types supported by WSS Software and their default states.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
362 Configuring user encryption
Table 18: Wireless encryption defaults
Configuration Required in WSS
Software
Encryption Type
Client Support
Default State
RSN
RSN clients
Non-RSN clients
Disabled
•
•
Enable the RSN information
element (IE).
Specify the supported cipher
suites (CCMP, TKIP, 40-bit
WEP, 104-bit WEP). TKIP is
enabled by default when the
RSN IE is enabled.
WPA
WPA clients
Non-WPA clients
Disabled
•
•
Enable the WPA information
element (IE).
Specify the supported cipher
suites (CCMP, TKIP, 40-bit
WEP, 104-bit WEP). TKIP is
enabled by default when the
WPA IE is enabled.
Dynamic WEP
Static WEP
WEP clients
(WPA and RSN not
supported)
Enabled
Disabled
None
WEP clients
(WPA and RSN not
supported)
•
•
Configure the static key(s).
Assign keys to multicast and
unicast traffic.
Figure 21 shows the client support when the default encryption settings are used. A radio using the default
encryption settings encrypts traffic for non-WPA dynamic WEP clients but not for WPA clients or static WEP
clients. The radio disassociates from these other clients.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 363
Figure 21. Default encryption
WLAN Security Switch
Encryption settings:
-WPA disabled
-Dynamic WEP enabled
-Static WEP disabled
User D
User A
TKIP
WPA
Dynamic WEP
Non-WPA
User B
Dynamic 40-bit WEP
WPA
User C
Static WEP
Non-WPA
This rest of this chapter describes the encryption types and how to configure them, and provides configuration
scenarios.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
364 Configuring user encryption
Configuring WPA
Wi-Fi Protected Access (WPA) is a security enhancement to the IEEE 802.11 wireless standard. WPA provides
enhanced encryption with new cipher suites and provides per-packet message integrity checks. WPA is based on the
802.11i standard. You can use WPA with 802.1X authentication. If the client does not support 802.1X, you can use a
preshared key on the AP and the client for authentication.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 365
WPA cipher suites
WPA supports the following cipher suites for packet encryption, listed from most secure to least secure:
•
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)—CCMP provides
Advanced Encryption Standard (AES) data encryption. To provide message integrity, CCMP uses the Cipher Block
Chaining Message Authentication Code (CBC-MAC).
•
•
•
Temporal Key Integrity Protocol (TKIP)—TKIP uses the RC4 encryption algorithm, a 128-bit encryption key, a
48-bit initialization vector (IV), and a message integrity code (MIC) called Michael.
Wired Equivalent Privacy (WEP) with 104-bit keys—104-bit WEP uses the RC4 encryption algorithm with a
104-bit key.
WEP with 40-bit keys—40-bit WEP uses the RC4 encryption algorithm with a 40-bit key.
You can configure APs to support one or more of these cipher suites. For all of these cipher suites, WSS Software
dynamically generates unique session keys for each session. WSS Software periodically changes the keys to reduce the
likelihood that a network intruder can intercept enough frames to decode a key.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
366 Configuring user encryption
Figure 22 shows the client support when WPA encryption for TKIP only is enabled. A radio using WPA with TKIP
encrypts traffic only for WPA TKIP clients but not for CCMP or WEP clients. The radio disassociates from these other
clients.
Figure 22. WPA encryption with TKIP only
WLAN Security Switch
Encryption settings:
-WPA enabled: TKIP only
-Dynamic WEP disabled
-Static WEP disabled
User D
TKIP
WPA
User A
Dynamic WEP
Non-WPA
User C
User B
Static WEP
Non-WPA
Dynamic 40-bit WEP
WPA
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 367
Figure 23 shows the client support when both WEP encryption and TKIP are enabled. A radio using WPA
with TKIP and WEP encrypts traffic for WPA TKIP clients, WPA WEP clients, and non-WPA dynamic WEP
clients, but not for CCMP or static WEP clients. The radio disassociates from these other clients.
Figure 23. WPA encryption with TKIP and WEP
WLAN Security Switch
Encryption settings:
-WPA enabled: TKIP,WEP40
-Dynamic WEP enabled
-Static WEP disabled
User D
TKIP
WPA
User A
Dynamic WEP
Non-WPA
User C
User B
Static WEP
Non-WPA
Dynamic 40-bit WEP
WPA
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
368 Configuring user encryption
TKIP countermeasures
WPA access points and clients verify the integrity of a wireless frame received on the network by generating a keyed
message integrity check (MIC). The Michael MIC used with TKIP provides a holddown mechanism to protect the
network against tampering.
•
If the recalculated MIC matches the MIC received with the frame, the frame passes the integrity check and the
access point or client processes the frame normally.
•
If the recalculated MIC does not match the MIC received with the frame, the frame fails the integrity check. This
condition is called a MIC failure. The access point or client discards the frame and also starts a 60-second timer. If
another MIC failure does not occur within 60 seconds, the timer expires. However, if another MIC failure occurs
before the timer expires, the device takes the following actions:
●
An AP that receives another frame with an invalid MIC ends its sessions with all TKIP and WEP
clients by disassociating from the clients. This includes both WPA WEP clients and non-WPA WEP
clients. The access point also temporarily shuts down the network by refusing all association or
reassociation requests from TKIP and WEP clients. In addition, WSS Software generates an SNMP
trap that indicates the WSS port and radio that received frames with the two MIC failures as well as
the source and destination MAC addresses in the frames.
●
A client that receives another frame with an invalid MIC disassociates from its access point and does
not send or accept any frames encrypted with TKIP or WEP.
The AP or client refuses to send or receive traffic encrypted with TKIP or WEP for the duration of the
countermeasures timer, which is 60,000 milliseconds (60 seconds) by default. When the countermeasures
timer expires, the access point allows associations and reassociations and generates new session keys for
them. You can set the countermeasures timer for AP radios to a value from 0 to 60,000 milliseconds (ms).
If you specify 0 ms, the radios do not use countermeasures but instead continue to accept and forward
encrypted traffic following a second MIC failure. However, WSS Software still generates an SNMP trap
to inform you of the MIC failure.
The MIC used by CCMP, CBC-MAC, is even stronger than Michael and does not require or provide countermeasures.
WEP does not use a MIC. Instead, WEP performs a cyclic redundancy check (CRC) on the frame and generates an
integrity check value (ICV).
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 369
WPA authentication methods
You can configure an SSID to support one or both of the following authentication methods for WPA clients:
•
802.1X—The AP and client use an Extensible Authentication Protocol (EAP) method to authenticate one another,
then use the resulting key in a handshake to derive a unique key for the session. The 802.1X authentication method
requires user information to be configured on AAA servers or in the WSS’s local database. This is the default WPA
authentication method.
•
Preshared key (PSK)—An AP radio and a client authenticate one another based on a key that is statically
configured on both devices. The devices then use the key in a handshake to derive a unique key for the session. For
a given service profile, you can globally configure a PSK for use with all clients. You can configure the key by
entering an ASCII passphrase or by entering the key itself in raw (hexadecimal) form.
Note. For a MAC client that authenticates using a PSK, the RADIUS servers or
local database still must contain an authentication rule for the client, to assign the
client to a VLAN.
WSS Software sets the timeout for the key exchanges between WPA (or RSN) clients and the AP to the same value as
the last setting of the retransmission timeout. The retransmission timeout is set to the lower of the 802.1X supplicant
timeout or the RADIUS session-timeout attribute. See “Setting EAP retransmission attempts” on page 655 for more
information.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
370 Configuring user encryption
WPA information element
A WPA information element (IE) is a set of extra fields in a wireless frame that contain WPA information for the access
point or client. To enable WPA support in a service profile, you must enable the WPA IE. The following types of
wireless frames can contain a WPA IE:
•
Beacon (sent by an AP)—The WPA IE in a beacon frame advertises the cipher suites and authentication methods
that an AP radio supports for the encrypted SSID. The WPA IE also lists the cipher suites that the radio uses to
encrypt broadcast and multicast frames. An AP radio always uses the least secure of the cipher suites to encrypt
broadcast and multicast frames to ensure that all clients associated with the SSID can decrypt the frames. An AP
radio uses the most secure cipher suite supported by both the radio and a client to encrypt unicast traffic to that
client.
•
•
Probe response (sent by an AP radio)—The WPA IE in a probe response frame lists the same WPA information that
is contained in the beacon frame.
Association request or reassociation (sent by a client)—The WPA IE in an association request lists the
authentication method and cipher suite the client wants to use.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 371
Client support
To use the TKIP or CCMP cipher suite for encryption, a client must support WPA. However, an AP radio
configured for WPA can support non-WPA clients who use dynamic WEP or static WEP. If the WPA IE is
enabled in the service profile used by an SSID supported by the radio, and the 40-bit WEP or 104-bit WEP
cipher suite also is enabled in the service profile, WSS Software allows a non-WPA client to authenticate
using WEP under the following circumstances:
•
If a client wants to authenticate using dynamic WEP, WSS Software uses 802.1X to authenticate the
client if either the WEP40 or WEP104 cipher suite is enabled for WPA.
•
If a client wants to authenticate using static WEP, the radio checks for the static WEP key presented by
the client. If the keys match, WSS Software authenticates the client. Because the WEP key is static, WSS
Software does not use 802.1X to authenticate the client.
To allow a non-WPA client that uses dynamic WEP to be authenticated by a radio on which WPA IE is
enabled, enable the WEP40 or WEP104 cipher suite in the service profile for the SSID the client will access.
To prevent non-WPA clients that use dynamic WEP from being authenticated, do not enable the WEP40 or
WEP104 cipher suite in the service profile.
To allow a client that uses static WEP to be authenticated, configure the same WEP keys on the client and the
service profile.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
372 Configuring user encryption
Table 19 lists the encryption support for WPA and non-WPA clients.
Table 19: Encryption support for WPA and non-WPA clients
Client Encryption Type
WSS Software
WPA—CC WPA—TKI WPA—WE WPA—WE Dynamic
Static
WEP
Encryption Type
MP
P
P40
P104
WEP
Supported
WPA—CCMP
WPA—TKIP
Supported
Supported
Supported
Supported
Supported
WPA—WEP40
WPA—WEP104
Dynamic WEP
Static WEP
Supported
Supported
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 373
Configuring WPA
To configure AP radios to support WPA:
1
2
3
Create a service profile for each SSID that will support WPA clients.
Enable the WPA IE in the service profile.
Enable the cipher suites you want to support in the service profile. (TKIP is enabled by default.)
Optionally, you also can change the countermeasures timer value for TKIP.
4
5
Map the service profile to the radio profile that will control IEEE settings for the radios.
Assign the radio profile to the radios and enable the radios.
If you plan to use PSK authentication, you also need to enable this authentication method and enter an ASCII
passphrase or a hexadecimal (raw) key.
Creating a service profile for WPA
Encryption parameters apply to all users who use the SSID configured by a service profile. To create a service
profile, use the following command:
set service-profile name
To create a new service profile named wpa, type the following command:
WSS# set service-profile wpa
success: change accepted.
Enabling WPA
To enable WPA, you must enable the WPA information element (IE) in the service profile. To enable the
WPA IE, use the following command:
set service-profile name wpa-ie {enable | disable}
To enable WPA in service profile wpa, type the following command:
WSS# set service-profile wpa wpa-ie enable
success: change accepted.
Specifying the WPA cipher suites
To use WPA, at least one cipher suite must be enabled. You can enable one or more of the following cipher
suites:
•
•
•
•
CCMP
TKIP
40-bit WEP
104-bit WEP
By default, TKIP is enabled and the other cipher suites are disabled.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
374 Configuring user encryption
To enable or disable cipher suites, use the following commands:
set service-profile name cipher-ccmp {enable | disable}
set service-profile name cipher-tkip {enable | disable}
set service-profile name cipher-wep104 {enable | disable}
set service-profile name cipher-wep40 {enable | disable}
To enable the 40-bit WEP cipher suite in service profile wpa, type the following command:
WSS# set service-profile wpa cipher-wep40 enable
success: change accepted.
After you type this command, the service profile supports TKIP and 40-bit WEP.
Note. Microsoft Windows XP does not support WEP with WPA. To configure a service
Changing the TKIP countermeasures timer value
By default, WSS Software enforces TKIP countermeasures for 60,000 ms (60 seconds) after a second MIC failure within
a one-minute interval. To change the countermeasures timer value, use the following command:
set service-profile name tkip-mc-time wait-time
To change the countermeasures wait time in service profile wpa to 30 seconds, type the following command:
WSS# set service-profile wpa tkip-mc-time 30000
success: change accepted.
Enabling PSK authentication
By default, WPA uses 802.1X dynamic keying. If you plan to use static keys, you must enable PSK authentication and
configure a passphrase or the raw key. You can configure the passphrase or key globally. You also can configure keys on
an individual MAC client basis.
By default, 802.1X authentication remains enabled when you enable PSK authentication.
To enable PSK authentication, use the following command:
set service-profile name auth-psk {enable | disable}
To enable PSK authentication in service profile wpa, type the following command:
WSS# set service-profile wpa auth-psk enable
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 375
Configuring a global PSK passphrase or raw key for all clients
To configure a global passphrase for all WPA clients, use the following command:
set service-profile name psk-phrase passphrase
The passphrase must be from 8 to 63 characters long, including blanks. If you use blanks, you must enclose the
string in quotation marks.
To configure service profile wpa to use passphrase 1234567890123<>?=+&% The quick brown fox jumps
over the lazy sl, type the following command:
WSS# set service-profile wpa psk-phrase "1234567890123<>?=+&% The quick
brown fox jumps over the lazy sl"
success: change accepted.
As an alternative to entering a passphrase, which WSS Software converts into a key, you can enter the key
itself in raw hexadecimal format. To enter a PSK key in raw format, use the following command:
set service-profile name psk-raw hex
For hex, type a 64-bit ASCII string representing a 32-digit hexadecimal number. Enter the two-character
ASCII form of each hexadecimal number.
Examples To configure service profile wpa to use a raw PSK with PSK clients,
type a command such as the following:
WSS# set service-profile wpa psk-raw
c25d3fe4483e867d1df96eaacdf8b02451fa0836162e758100f5f6b87965e59d
success: change accepted.
Disabling 802.1X authentication for WPA
To disable 802.1X authentication for WPA clients, use the following command:
set service-profile name auth-dot1x {enable | disable}
Note. This command does not disable 802.1X authentication for non-WPA clients.
To disable WPA authentication in service profile wpa, type the following command:
WSS# set service-profile wpa auth-dot1x disable
success: change accepted.
Displaying WPA settings
To display the WPA settings in a service profile, use the following command:
show service-profile {name | ?}
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
376 Configuring user encryption
To display the WPA settings in effect in service profile wpa, type the following command:
WSS# show service-profile sp1
ssid-name:
private ssid-type:
yes Proxy ARP:
no No broadcast:
5 Long retry limit:
crypto
no
Beacon:
DHCP restrict:
no
Short retry limit:
Auth fallthru:
5
none Sygate On-Demand (SODA):
yes SODA remediation ACL:
Custom failure web-page:
no
Enforce SODA checks:
Custom success web-page:
Custom logout web-page:
Static COS:
Custom agent-directory:
no COS:
0
CAC mode:
none CAC sessions:
180 Idle client probing:
14
yes
User idle timeout:
Keep initial vlan:
Web Portal ACL:
WEP Key 1 value:
WEP Key 3 value:
WEP Unicast Index:
Shared Key Auth:
WPA enabled:
no Web Portal Session Timeout:
5
<none> WEP Key 2 value:
<none> WEP Key 4 value:
1 WEP Multicast Index:
NO
<none>
<none>
1
ciphers: cipher-tkip, cipher-wep40
authentication: 802.1X
TKIP countermeasures time: 30000ms
11a beacon rate:
6.0 multicast rate:
AUTO
11a mandatory rate: 6.0,12.0,24.0 standard rates: 9.0,18.0,36.0,48.0,54.0
11b beacon rate:
2.0 multicast rate:
AUTO
11b mandatory rate: 1.0,2.0 standard rates: 5.5,11.0
11g beacon rate:
2.0 multicast rate:
AUTO
11g mandatory rate: 1.0,2.0,5.5,11.0 standard rates: 6.0,9.0,12.0,18.0,24.0, 36.0,48.0,54.0
The WPA settings appear at the bottom of the output.
Note. The WPA fields appear in the show service-profile output only when WPA is
enabled.
Assigning the service profile to radios and enabling the radios
After you configure WPA settings in a service profile, you can map the service profile to a radio profile, assign the radio
profile to radios, and enable the radios to activate the settings.
To map a service profile to a radio profile, use the following command:
set radio-profile name service-profile name
To assign a radio profile to radios and enable the radios, use the following command:
set ap port-list radio {1 | 2} radio-profile name mode {enable | disable}
To map service profile wpa to radio profile bldg1, type the following command:
WSS# set radio-profile blgd1 service-profile wpa
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 377
To assign radio profile bldg1 to radio 1 on ports 5-8, 11-14, and 16 and enable the radios, type the following command:
WSS# set ap 5-8,11-14,16 radio 1 radio-profile bldg1 mode enable
success: change accepted.
To assign radio profile bldg1 to radio 2 on ports 11-14 and port 16 and enable the radios, type the following command:
WSS# set ap 11-14,16 radio 2 radio-profile bldg1 mode enable
success: change accepted.
Configuring RSN (802.11i)
Robust Security Network (RSN) provides 802.11i support. RSN uses AES encryption.
You can configure a service profile to support RSN clients exclusively, or to support RSN with WPA clients, or even
RSN, WPA and WEP clients.
The configuration tasks for a service profile to use RSN are similar to the tasks for WPA:
1
2
3
Create a service profile for each SSID that will support RSN clients.
Enable the RSN IE in the service profile.
Enable the cipher suites you want to support in the service profile. (TKIP is enabled by default.)
Optionally, you also can change the countermeasures timer value for TKIP.
4
5
Map the service profile to the radio profile that will control IEEE settings for the radios.
Assign the radio profile to the radios and enable the radios.
If you plan to use PSK authentication, you also need to enable this authentication method and enter an ASCII passphrase
or a hexadecimal (raw) key.
Creating a service profile for RSN
Encryption parameters apply to all users who use the SSID configured by a service profile. To create a service profile,
use the following command:
set service-profile name
To create a new service profile named rsn, type the following command:
WSS# set service-profile rsn
success: change accepted.
Enabling RSN
To enable RSN, you must enable the RSN information element (IE) in the service profile. To enable the RSN IE, use the
following command:
set service-profile name rsn-ie {enable | disable}
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
378 Configuring user encryption
To enable RSN in service profile wpa, type the following command:
WSS# set service-profile rsn rsn-ie enable
success: change accepted.
Specifying the RSN cipher suites
To use RSN, at least one cipher suite must be enabled. You can enable one or more of the following cipher
suites:
•
•
•
•
CCMP
TKIP
40-bit WEP
104-bit WEP
By default, TKIP is enabled and the other cipher suites are disabled.
To enable or disable cipher suites, use the following commands:
set service-profile name cipher-ccmp {enable | disable}
set service-profile name cipher-tkip {enable | disable}
set service-profile name cipher-wep104 {enable | disable}
set service-profile name cipher-wep40 {enable | disable}
To enable the CCMP cipher suite in service profile rsn, type the following command:
WSS# set service-profile rsn cipher-ccmp enable
success: change accepted.
After you type this command, the service profile supports both TKIP and CCMP.
Note. Microsoft Windows XP does not support WEP with RSN. To configure a service
profile to provide WEP for XP clients, leave RSN disabled and see “Configuring WEP” on
Changing the TKIP countermeasures timer value
To change the TKIP countermeasures timer, see “Changing the TKIP countermeasures timer value” on
page 374. The procedure is the same for WPA and RSN.
Enabling PSK authentication
To enable PSK authentication, see “Enabling PSK authentication” on page 374. The procedure is the same for
WPA and RSN.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 379
Displaying RSN settings
To display the RSN settings in a service profile, use the following command:
show service-profile {name | ?}
The RSN settings appear at the bottom of the output.
Note. The RSN-related fields appear in the show service-profile output only when
RSN is enabled.
Assigning the service profile to radios and enabling the radios
After you configure RSN settings in a service profile, you can map the service profile to a radio profile, assign the radio
profile to radios, and enable the radios to activate the settings.
To map a service profile to a radio profile, use the following command:
set radio-profile name service-profile name
To assign a radio profile to radios and enable the radios, use the following command:
set ap port-list radio {1 | 2} radio-profile name mode {enable | disable}
To map service profile rsn to radio profile bldg2, type the following command:
WSS# set radio-profile blgd2 service-profile rsn
success: change accepted.
Configuring WEP
Wired-Equivalent Privacy (WEP) is a security protocol defined in the 802.11 standard. WEP uses the RC4 encryption
algorithm to encrypt data.
To provide integrity checking, WEP access points and clients check the integrity of a frame’s cyclic redundancy check
(CRC), generate an integrity check value (ICV), and append the value to the frame before sending it. The radio or client
that receives the frame recalculates the ICV and compares the result to the ICV in the frame. If the values match, the
frame is processed. If the values do not match, the frame is discarded.
WEP is either dynamic or static depending on how the encryption keys are generated. APs support dynamic WEP and
static WEP.
•
For dynamic WEP, WSS Software dynamically generates keys for broadcast, multicast, and unicast traffic. WSS
Software generates unique unicast keys for each client session and periodically regenerates (rotates) the broadcast
and multicast keys for all clients. You can change or disable the broadcast or multicast rekeying interval.
•
For static WEP, WSS Software uses statically configured keys typed in the WSS switch’s configuration and on the
wireless client and does not rotate the keys.
Dynamic WEP encryption is enabled by default. You can disable dynamic WEP support by enabling WPA and leaving
the WEP-40 or WEP-104 cipher suites disabled. If you use dynamic WEP, 802.1X must also be configured on the client
in addition to WEP.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
380 Configuring user encryption
Static WEP encryption is disabled by default. To enable static WEP encryption, configure the static WEP keys
and assign them to unicast and multicast traffic. Make sure you configure the same static keys on the clients.
To support dynamic WEP in a WPA environment, enable WPA and enable the WEP-40 or WEP-104 cipher
This section describes how to configure and assign static WEP keys. (To change other key-related settings, see
Figure 24 shows an example of a radio configured to provide static and dynamic WEP encryption for
non-WPA clients. The radio uses dynamically generated keys to encrypt traffic for dynamic WEP clients. The
radio also encrypts traffic for static WEP clients whose keys match the keys configured on the radio.
Figure 24. Encryption for dynamic and static WEP
WLAN Security Switch
WPA disabled
Dynamic WEP enabled
Static WEP enabled
-Unicast key = a1b1c1d1e1
-Multicast key = a2b2c2d2e2
User D
TKIP
WPA
User A
Dynamic WEP
Non-WPA
User C
Static WEP
-Unicast key = a1b1c1d1e1
-Multicast key = a2b2c2d2e2
Non-WPA
User B
Dynamic 40-bit WEP
WPA
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 381
Setting static WEP key values
WSS Software supports dynamic WEP automatically. To enable static WEP, configure WEP keys and assign them to
unicast and multicast traffic. You can set the values of the four static WEP keys, then specify which of the keys to use for
encrypting multicast frames and unicast frames. If you do this, WSS Software continues to support dynamic WEP in
addition to static WEP.
To set the value of a WEP key, use the following command:
set service-profile name wep key-index num key value
The key-index num parameter specifies the index you are configuring. You can specify a value from 1 through 4.
The key value parameter specifies the hexadecimal value of the key. Type a 10-character ASCII string (representing a
5-byte hexadecimal number) or type a 26-character ASCII string (representing a 13-byte hexadecimal number). You can
use numbers or letters. ASCII characters in the following ranges are supported:
•
•
•
0 to 9
A to F
a to f
To configure WEP key index 1 for radio profile rp1 to aabbccddee, type the following command:
WSS# set service-profile rp1 wep key-index 1 key aabbccddee
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
382 Configuring user encryption
Assigning static WEP keys
When static WEP is enabled, static WEP key 1 is assigned to unicast and multicast traffic by default. To assign
another key to unicast or multicast traffic, use the following commands:
set service-profile name wep active-multicast-index num
set service-profile name wep active-unicast-index num
The num parameter specifies the key and the value can be from 1 to 4.
To configure an SSID that uses service profile wepsrvc to use WEP key index 2 for encrypting multicast
traffic, type the following command:
WSS# set service-profile wepsrvc wep active-multicast-index 2
success: change accepted.
To configure an SSID that uses service profile wepsrvc4 to use WEP key index 4 for encrypting unicast traffic,
type the following command:
WSS# set service-profile wepsrvc4 wep active-unicast-index 4
success: change accepted.
Encryption configuration scenarios
The following scenarios provide examples of ways in which you can configure encryption for network clients:
•
•
•
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 383
Enabling WPA with TKIP
The following example shows how to configure WSS Software to provide authentication and TKIP encryption
for 801.X WPA clients. This example assumes that pass-through authentication is used for all users. A
RADIUS server group performs all authentication and authorization for the users.
1
Create an authentication rule that sends all 802.1X users of SSID mycorp in the EXAMPLE
domain to the server group shorebirds for authentication. Type the following command:
WSS# set authentication dot1x ssid mycorp EXAMPLE\* pass-through
shorebirds
2
3
4
Create a service profile named wpa for the SSID. Type the following command:
WSS# set service-profile wpa
success: change accepted.
Set the SSID in the service profile to mycorp. Type the following command:
WSS# set service-profile wpa ssid-name wpa
success: change accepted.
Enable WPA in service profile wpa. Type the following command:
WSS# set service-profile wpa wpa-ie enable
success: change accepted.
TKIP is already enabled by default when WPA is enabled.
5
Display the service profile wpa to verify the changes. Type the following command:
WSS# show service-profile sp1
ssid-name:
mycorp ssid-type:
crypto
no
Beacon:
yes Proxy ARP:
no No broadcast:
5 Long retry limit:
none Sygate On-Demand (SODA):
yes SODA remediation ACL:
Custom failure web-page:
DHCP restrict:
no
Short retry limit:
Auth fallthru:
5
no
Enforce SODA checks:
Custom success web-page:
Custom logout web-page:
Static COS:
Custom agent-directory:
no COS:
0
CAC mode:
none CAC sessions:
180 Idle client probing:
14
yes
User idle timeout:
Keep initial vlan:
Web Portal ACL:
WEP Key 1 value:
WEP Key 3 value:
WEP Unicast Index:
Shared Key Auth:
WPA enabled:
no Web Portal Session Timeout:
5
<none> WEP Key 2 value:
<none> WEP Key 4 value:
1 WEP Multicast Index:
NO
<none>
<none>
1
ciphers: cipher-tkip
authentication: 802.1X
TKIP countermeasures time: 60000ms
...
6
Map service profile wpa to radio profile rp1. Type the following commands:
WSS# set radio-profile rp1 service-profile wpa
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
384 Configuring user encryption
success: change accepted.
7
Apply radio profile rp1 to radio 1 on port 5 and to radios 1 and 2 on port 11, enable the radios,
and verify the configuration changes. Type the following commands:
WSS# set ap 5,11 radio 1 radio-profile rp1 mode enable
success: change accepted.
WSS# set ap 11 radio 2 radio-profile rp1 mode enable
success: change accepted.
WSS# show ap config
Port 5: AP model: 2330, POE: enable, bias: high, name: MP05
boot-download-enable: YES
force-image-download: YES
Radio 1: type: 802.11a, mode: enabled, channel: 36
tx pwr: 1, profile: rp1
auto-tune max-power: default,
Port 11: AP model: 2330, POE: enable, bias: high, name: MP11
boot-download-enable: YES
force-image-download: YES
Radio 1: type: 802.11g, mode: enabled, channel: 6
tx pwr: 1, profile: rp1
auto-tune max-power: default
Radio 2: type: 802.11a, mode: enabled, channel: 36
tx pwr: 1, profile: rp1
auto-tune max-power: default
8
Save the configuration. Type the following command:
WSS# save config
success: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 385
Enabling dynamic WEP in a WPA network
The following example shows how to configure WSS Software to provide authentication and encryption for
801.X dynamic WEP clients, and for 801.X WPA clients using TKIP. This example assumes that pass-through
authentication is used for all users. The commands are the same as those in “Enabling WPA with TKIP” on
page 383, with the addition of a command to enable a WEP cipher suite. The WEP cipher suite allows authen-
tication and encryption for both WPA and non-WPA clients that want to authenticate using dynamic WEP.
1
Create an authentication rule that sends all 802.1X users of SSID mycorp in the EXAMPLE
domain to the server group shorebirds for authentication. Type the following command:
WSS# set authentication dot1x ssid thiscorp EXAMPLE\* pass-through
shorebirds
2
3
4
5
Create a service profile named wpa-wep for the SSID. Type the following command:
WSS# set service-profile wpa-wep
success: change accepted.
Set the SSID in the service profile to thiscorp. Type the following command:
WSS# set service-profile wpa-wep ssid-name thiscorp
success: change accepted.
Enable WPA in service profile wpa-wep. Type the following command:
WSS# set service-profile wpa-wep wpa-ie enable
success: change accepted.
Enable the WEP40 cipher suite in service profile wpa-wep. Type the following command:
WSS# set service-profile wpa-wep cipher-wep40 enable
success: change accepted.
TKIP is already enabled by default when WPA is enabled.
6
Display the service profile wpa-wep to verify the changes. Type the following command:
WSS# show service-profile sp1
ssid-name:
mycorp ssid-type:
crypto
no
Beacon:
yes Proxy ARP:
no No broadcast:
5 Long retry limit:
none Sygate On-Demand (SODA):
yes SODA remediation ACL:
Custom failure web-page:
DHCP restrict:
no
Short retry limit:
Auth fallthru:
5
no
Enforce SODA checks:
Custom success web-page:
Custom logout web-page:
Static COS:
Custom agent-directory:
no COS:
0
CAC mode:
none CAC sessions:
180 Idle client probing:
14
yes
User idle timeout:
Keep initial vlan:
Web Portal ACL:
WEP Key 1 value:
WEP Key 3 value:
WEP Unicast Index:
Shared Key Auth:
WPA enabled:
no Web Portal Session Timeout:
5
<none> WEP Key 2 value:
<none> WEP Key 4 value:
1 WEP Multicast Index:
NO
<none>
<none>
1
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
386 Configuring user encryption
ciphers: cipher-tkip, cipher-wep40
authentication: 802.1X
TKIP countermeasures time: 60000ms
...
7
Map service profile wpa-wep to radio profile rp2. Type the following commands:
WSS# set radio-profile rp2 service-profile wpa-wep
success: change accepted.
8
Apply radio profile rp2 to radio 1 on port 5 and to radios 1 and 2 on port 11, enable the radios, and verify
the configuration changes. Type the following commands:
WSS# set ap 5,11 radio 1 radio-profile rp2 mode enable
success: change accepted.
WSS# set ap 11 radio 2 radio-profile rp2 mode enable
success: change accepted.
WSS# show ap config
Port 5: AP model: 2330, POE: enable, bias: high, name: AP05
boot-download-enable: YES
force-image-download: YES
Radio 1: type: 802.11a, mode: enabled, channel: 36
tx pwr: 1, profile: rp2
auto-tune max-power: default
Port 11: AP model: 2330, POE: enable, bias: high, name: AP11
boot-download-enable: YES
force-image-download: YES
Radio 1: type: 802.11g, mode: enabled, channel: 6
tx pwr: 1, profile: rp2
auto-tune max-power: default
Radio 2: type: 802.11a, mode: enabled, channel: 36
tx pwr: 1, profile: rp2
auto-tune max-power: default
9
Save the configuration. Type the following command:
WSS# save config
success: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 387
Configuring encryption for MAC clients
The following example shows how to configure WSS Software to provide PSK authentication and TKIP or 40-bit WEP
encryption for MAC clients:
1
2
3
Create an authentication rule that sends all MAC users of SSID voice to the local database for
authentication and authorization. Type the following command:
WSS# set authentication mac ssid voice * local
success: configuration saved.
Configure a MAC user group named wpa-for-mac that assigns all MAC users in the group to VLAN blue.
Type the following command:
WSS# set mac-usergroup wpa-for-mac attr vlan-name blue
success: configuration saved.
Add MAC users to MAC user group wpa-for-mac. Type the following commands:
WSS# set mac-user aa:bb:cc:dd:ee:ff group wpa-for-mac
success: configuration saved.
WSS# set mac-user a1:b1:c1:d1:e1:f1 group wpa-for-mac
success: configuration saved.
4
Verify the AAA configuration changes. Type the following command:
WSS# show aaa
Default Values
authport=1812 acctport=1813 timeout=5 acct-timeout=5
retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server
State
Addr
Ports T/o Tries Dead
---------------------------------------------------------------
----
Server groups
Web Portal:
enabled
set authentication mac ssid voice * local
mac-usergroup wpa-for-mac
vlan-name = blue
mac-user aa:bb:cc:dd:ee:ff
Group = wpa-for-mac
mac-user a1:b1:c1:d1:e1:f1
Group = wpa-for-mac
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
388 Configuring user encryption
5
6
7
8
Create a service profile named wpa-wep-for-mac for SSID voice. Type the following command:
WSS# set service-profile wpa-wep-for-mac
success: change accepted.
Set the SSID in the service profile to voice. Type the following command:
WSS# set service-profile wpa-wep-for-mac ssid-name voice
success: change accepted.
Enable WPA in service profile wpa-wep-for-mac. Type the following command:
WSS# set service-profile wpa-wep-for-mac wpa-ie enable
success: change accepted.
Enable the WEP40 cipher suite in service profile wpa-wep-for-mac. Type the following command:
WSS# set service-profile wpa-wep-for-mac cipher-wep40 enable
success: change accepted.
TKIP is already enabled by default when WPA is enabled.
9
Enable PSK authentication in service profile wpa-wep-for-mac. Type the following command:
WSS# set service-profile wpa-wep-for-mac auth-psk enable
success: change accepted.
10 Configure a passphrase for the preshared key. Type the following command:
WSS# set service-profile wpa-wep-for-mac psk-phrase "passphrase to convert into a
preshared key"
success: change accepted.
11 Display the WPA configuration changes. Type the following command:
WSS# show service-profile sp1
ssid-name:
voice
yes
no
ssid-type:
crypto
no
Beacon:
Proxy ARP:
DHCP restrict:
Short retry limit:
Auth fallthru:
No broadcast:
Long retry limit:
no
5
5
none
Sygate On-Demand (SODA):
SODA remediation ACL:
Custom failure web-page:
Custom agent-directory:
no
Enforce SODA checks: yes
Custom success web-page:
Custom logout web-page:
Static COS:
no
COS:
0
CAC mode:
none
180
no
CAC sessions:
Idle client probing:
14
yes
User idle timeout:
Keep initial vlan:
Web Portal ACL:
WEP Key 1 value:
WEP Key 3 value:
WEP Unicast Index:
Shared Key Auth:
WPA enabled:
Web Portal Session Timeout:
5
<none>
<none>
1
WEP Key 2 value:
WEP Key 4 value:
WEP Multicast Index:
<none>
<none>
1
NO
ciphers: cipher-tkip, cipher-wep40
authentication:
pre-shared key
TKIP countermeasures time: 60000ms
pre-shared-key:
92f99cd49e186cadee13fda7b2a2bac78975 a5723a4a6b31b5b5395d6b001dbe
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring user encryption 389
12 Map service profile wpa-wep-for-mac to radio profile rp3. Type the following commands:
WSS# set radio-profile rp3 service-profile wpa-wep-for-mac
success: change accepted.
13 Apply radio profile rp3 to radio 1 on port 4 and to radios 1 and 2 on port 6 and enable the radios, and
verify the configuration changes. Type the following commands:
WSS# set ap 4,6 radio 1 radio-profile rp3 mode enable
success: change accepted.
WSS# set ap 6 radio 2 radio-profile rp3 mode enable
success: change accepted.
WSS# show ap config
Port 4: AP model: 2330, POE: enable, bias: high, name: AP04
boot-download-enable: YES
force-image-download: YES
Radio 1: type: 802.11a, mode: enabled, channel: 36
tx pwr: 1, profile: rp3
auto-tune max-power: default
Port 6: AP model: 2330, POE: enable, bias: high, name: AP06
boot-download-enable: YES
force-image-download: YES
Radio 1: type: 802.11g, mode: enabled, channel: 6
tx pwr: 1, profile: rp3
auto-tune max-power: default
Radio 2: type: 802.11a, mode: enabled, channel: 36
tx pwr: 1, profile: rp3
auto-tune max-power: default
14 Save the configuration. Type the following command:
WSS# save config
success: configuration saved.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
390 Configuring user encryption
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
391
Configuring Auto-RF
Auto-RF overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
Changing Auto-RF settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396
Locking down tuned settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Displaying Auto-RF information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399
Auto-RF overview
The Auto-RF feature dynamically assigns channel and power settings to AP radios, and adjusts those settings when
needed. Auto-RF can perform the following tasks:
•
•
Assign initial channel and power settings when an AP radio is started.
Periodically assess the RF environment and change the channel or power settings if needed.
By default, Auto-RF is enabled for channel configuration and disabled for power configuration.
Note. Auto-RF of channels on 802.11a radios uses only the bottom eight channels in the
band (36, 40, 44, 48, 52, 56, 60, and 64). To use a higher channel number, you must
disable Auto-RF of channels on the radio profile the radio is in, and statically configure the
channel.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
392 Configuring Auto-RF
Initial channel and power assignment
The following process is used to assign the channel and power to an AP radio when it is first enabled:
•
If Auto-RF is disabled for both channel and power assignment, the radio uses the channel and power settings in the
radio profile that manages the radio. After this, the channel and power do not change unless you change the settings
in the radio profile, or enable Auto-RF.
•
If Auto-RF is enabled for channel and power assignment, the radio performs an RF scan and reports the results to
the WSS that is managing the AP the radio is on. The scan results include third-party access points. Based on the
scan results, WSS Software sets the channel and power on the radio. WSS Software always selects channel and
power settings that are valid for the country of operation.
●
●
Initial channel assignment—WSS Software selects a channel at random from the set of valid
channels for the radio type and country code. After this, each subsequent time the radio or Auto-RF
is restarted, a different channel is selected to ensure even distribution among the channels.
During radio operation, WSS Software periodically reevaluates the channel and changes it if needed.
Initial power assignment—The AP sets a radio’s initial power level to the maximum value allowed
for the country code (regulatory domain). In a deployment with few APs, the radio remains at
maximum power. Otherwise, the radio reduces power until the power is just enough to reach the
AP’s nearest neighbor that is on the same channel.
How channels are selected
When a radio first comes up, if Auto-RF for channels is enabled, the initial channel selected will follow a uniform distri-
bution of channels that spans the list of channels, rather than selecting the next sequential channel number.
For example, the range of valid channels for 802.11a radios in the US is as follows:
40, 44, 48, 52, 56, 60, 64, and 68
On each WSS, the first channel chosen will be random. Assuming that channel 60 is the first channel selected, the order
of the channel selections will be as follows:
Order:
2
5
8
3
6
1
4
7
Channel:
40
44
48
52
56
60
64
68
After these initial 8 channel selections are chosen, the pattern will repeat itself.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Auto-RF 393
Channel and power tuning
Auto-RF can change the channel or power of a radio, to compensate for RF changes such as interference, or to
maintain at least the minimum data transmit rate for associated clients. A radio continues to scan on its active
data channel and on other channels and reports the results to its WSS.
Periodically, the switch examines these results to determine whether the channel or the power needs to be
changed.
Power tuning
By default, the switch evaluates the scan results for possible power changes every 300 seconds (5 minutes),
and raises or lowers the power level if needed.
If Auto-RF determines that a power change is needed on a radio, WSS Software ramps the power up or down
until the new power level is reached. Ramp-up or ramp-down of the power occurs in 1 dBm increments, at
regular time intervals. The default interval is 60 seconds and is configurable. The power ramp amount (1 dBm
per interval) is not configurable.
Channel tuning
By default, the switch evaluates the scan results for possible channel changes every 3600 seconds (1 hour).
WSS Software uses the following parameters to determine whether to change the channel on a radio:
•
Presence of active sessions.
By default, if the radio has active sessions, WSS Software does not change the channel. If the
radio does not have any active sessions, WSS Software uses the remaining parameters to
determine whether to change the channel.
•
•
•
•
Received signal strength indication (RSSI)
Amount of noise on the channel
Packet retransmission count, which is the rate at which the radio receives retransmitted packets.
Utilization, calculated based on the number of multicast packets per second that a radio can send on a
channel while continuously sending fixed-size frames over a period of time.
•
•
Phy error count, which is the number of frames received by the AP radio that have physical layer errors.
A high number of Phy errors can indicate the presence of a non-802.11 device using the same RF
spectrum.
Received CRC error count. A high number of CRC errors can indicate a hidden node or co-channel
interference.
The thresholds for these parameters are not configurable. Auto-RF also can change a radio’s channel when the
channel tuning interval expires, if a channel that has less disturbance is detected. Disturbance is based on the
number of neighbors the radio has and each neighbor’s RSSI.
A radio also can change its channel before the channel tuning interval expires to respond to RF anomalies. An
RF anomaly is a sudden major change in the RF environment, such as sudden major interference on the
channel.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
394 Configuring Auto-RF
By default, a radio cannot change its channel more often than every 900 seconds, regardless of the RF environment. This
channel holddown avoids unnecessary changes due to very transient RF changes, such as activation of a microwave
oven.
Tuning the transmit data rate
A radio sends beacons, probe requests, and probe responses at the minimum transmit data rate allowed for clients. This
gives them the maximum distance. All other packets are transmitted at a rate determined by their destination. All packets
are transmitted at the same power level.
By default, the following minimum data rates are allowed:
•
•
5.5 Mbps for 802.11b/g clients
24 Mbps for 802.11a clients
You can statically change the transmit data rates for radios, on a radio profile basis. (For information, see “Changing
transmit rates” on page 308.) However, Auto-RF does not change transmit rates automatically.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Auto-RF 395
Auto-RF parameters
Table 20 lists the Auto-RF parameters and their default settings.
Table 20: Defaults for Auto-RF parameters
Radio Behavior When Parameter
Set To Default Value
Parameter
Default Value
Radio profile parameters
channel-config
enable
3600
When the radio is first enabled,
Auto-RF sets the channel based on the
channels in use on neighboring access
points.
channel-interval
Every 3600 seconds, WSS Software
examines the RF information gathered
from the network and determines
whether the channel needs to be
changed to compensate for RF changes.
channel-holddown
channel-lockdown
power-config
900
WSS Software maintains the channel
setting on a radio for at least 900
seconds regardless of RF changes.
disabled
disable
WSS Software continues to
dynamically change channels if needed
based on network conditions.
WSS Software uses the highest power
level allowed for the country of
operation or the highest supported by
the hardware, whichever is lower.
power-interval
300
Every 300 seconds, WSS Software
examines the RF information gathered
from the network and determines
whether the power needs to be changed
to compensate for RF changes.
power-lockdown
disabled
60
WSS Software continues to
dynamically change power settings if
needed based on network conditions.
power-ramp-interval
When Auto-RF determines that power
should be increased or decreased, WSS
Software changes the power by 1 dBm
every 60 seconds until the power setting
is reached.
Individual radio parameters
max-power
Maximum
allowed for
country of
operation
Auto-RF never sets a radio’s power to a
level that is higher than the maximum
allowed for the country of operation
(countrycode).
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
396 Configuring Auto-RF
Changing Auto-RF settings
Changing channel tuning settings
Disabling or reenabling channel tuning
Auto-RF for channels is enabled by default. To disable or reenable the feature for all radios in a radio profile,
use the following command:
set radio-profile name auto-tune channel-config {enable | disable} [no-client]
The no-client option allows WSS Software to change the channel on a radio even if the radio has active client
sessions. Without this option, WSS Software does not change the channel unless there are no active client
sessions on the radio.
To disable channel tuning for radios in the rp2 radio profile, type the following command:
WSS# set radio-profile rp2 auto-tune channel-config disable
success: change accepted.
Changing the channel tuning interval
The default channel tuning interval is 3600 seconds. You can change the interval to a value from 0 to 65535
seconds. If you set the interval to 0, Auto-RF does not reevaluate the channel at regular intervals. However,
Auto-RF can still change the channel in response to RF anomalies. Nortel recommends that you use an interval
of at least 300 seconds (5 minutes).
To change the channel tuning interval, use the following command:
set radio-profile name auto-tune channel-interval seconds
To set the channel tuning interval for radios in radio profile rp2 to 2700 seconds (45 minutes), type the
following command:
WSS# set radio-profile rp2 auto-tune channel-interval 2700
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Auto-RF 397
Changing the channel holddown interval
The default channel holddown interval is 900 seconds. You can change the interval to a value from 0 to 65535 seconds.
To change the channel holddown interval, use the following command:
set radio-profile name auto-tune channel-holddown holddown
To change the channel holddown for radios in radio profile rp2 to 600 seconds, type the following command:
WSS# set radio-profile rp2 auto-tune channel-holddown 600
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
398 Configuring Auto-RF
Changing power tuning settings
Enabling power tuning
Auto-RF for power is disabled by default. To enable or disable the feature for all radios in a radio profile, use
the following command:
set radio-profile name auto-tune power-config {enable | disable}
To enable power tuning for radios in the rp2 radio profile, type the following command:
WSS# set radio-profile rp2 auto-tune power-config enable
success: change accepted.
Changing the power tuning interval
The default power tuning interval is 300 seconds. You can change the interval to a value from 1 to 65535
seconds. To change the power tuning interval, use the following command:
set radio-profile name auto-tune power-interval seconds
To set the power tuning interval for radios in radio profile rp2 to 240 seconds, type the following command:
WSS# set radio-profile rp2 auto-tune power-interval 240
success: change accepted.
Changing the maximum default power allowed on a radio
By default, the maximum power level that Auto-RF can set on a radio is the same as the maximum power level
allowed for the country of operation. To change the maximum power level that Auto-RF can assign, use the
following command:
set {ap port-list | ap ap-num} radio {1 | 2} auto-tune max-power power-level
The power-level can be a value from 1 to 20.
To set the maximum power that Auto-RF can set on radio 1 on the AP on port 7 to 12 dBm, type the following
command.
WSS# set ap 7 radio 1 auto-tune max-power 12
success: change accepted.
Locking down tuned settings
You can convert dynamically assigned channels and power settings into statically configured settings, by
locking them down. When you lock down channel or power settings, WSS Software converts the latest values
set by Auto-RF into static settings.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Auto-RF 399
You can lock down channel or power settings on a radio-profile basis. WSS Software implements the lock down by
changing the set ap radio channel or set ap radio tx-power command for each radio managed by the radio profile.
To lock down channel or power settings, use the following commands:
set radio-profile name auto-tune channel-lockdown
set radio-profile name auto-tune power-lockdown
To verify the static settings, use the show ap config command.
To save the locked down settings, you must save the switch’s configuration.
The following commands lock down the channel and power settings for radios in radio profile rp2:
WSS# set radio-profile rp2 auto-tune channel-lockdown
success: change accepted.
WSS# set radio-profile rp2 auto-tune power-lockdown
success: change accepted.
Displaying Auto-RF information
You can display the Auto-RF configuration, a list of RF neighbors, and the values of RF attributes.
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
400 Configuring Auto-RF
Displaying Auto-RF settings
To display the Auto-RF settings that you can configure in a radio profile, use the following command:
show radio-profile {name | ?}
Entering show radio-profile ? displays a list of radio profiles.
To display the Auto-RF and other settings in the default radio profile, type the following command. (This example
shows the Auto-RF parameters in bold type.)
WSS# show radio-profile default
Beacon Interval:
Max Tx Lifetime:
RTS Threshold:
Long Preamble:
Tune Power:
100 DTIM Interval:
2000 Max Rx Lifetime:
2346 Frag Threshold:
no Tune Channel:
no Tune Channel Interval:
600 Power ramp interval:
300 Countermeasures:
yes RFID enabled:
1
2000
2346
yes
3600
60
none
Tune Power Interval:
Channel Holddown:
Active-Scan:
no
WMM Powersave:
no QoS Mode:
wmm
No service profiles configured.
To display the Auto-RF settings that you can configure on an individual radio, use the following commands:
show ap config [port-list [radio {1 | 2}]]
show ap config [ap-num [radio {1 | 2}]]
To display the Auto-RF and other individual radio settings on radio 1 of a directly connected AP access port connected
to WSS port 2, type the following command:
WSS# show ap config 2 radio 1
Port 2: AP model: 2330, POE: enable, bias: high, name: MP02
boot-download-enable: YES
force-image-download: NO
Radio 1: type: 802.11g, mode: disabled, channel: 6
tx pwr: 1, profile: default
auto-tune max-power: default
To display the Auto-RF and other individual radio settings on both radios on the Distributed AP configured on connec-
tion 1, type the following command:
WSS# show ap config 1
Ap 1: serial-id: 12345678, AP model: 2330, bias: high, name: AP01
fingerprint: b4:f9:2a:52:37:58:f4:d0:10:75:43:2f:45:c9:52:c3
boot-download-enable: YES
force-image-download: NO
Radio 1: type: 802.11g, mode: disabled, channel: 6
tx pwr: 1, profile: default
auto-tune max-power: default
Radio 2: type: 802.11a, mode: disabled, channel: 36
tx pwr: 1, profile: default
auto-tune max-power: default
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring Auto-RF 401
Displaying RF neighbors
To display the other radios that a specific Nortel radio can hear, use the following commands:
show auto-tune neighbors [ap ap-num [radio {1 | 2| all}]]
show auto-tune neighbors [ap ap-num [radio {1 | 2| all}]]
The list of radios includes beaconed third-party SSIDs, and both beaconed and unbeaconed Nortel SSIDs.
To display neighbor information for radio 1 on the directly connected AP on port 2, type the following command:
WSS# show auto-tune neighbors ap 2 radio 1
Total number of entries for port 2 radio 1: 5
Channel Neighbor BSS/MAC
------- ----------------- ----------
1 00:0b:85:06:e3:60
RSSI
------
-46
-78
-74
-50
-72
1 00:0b:0e:00:0a:80
1 00:0b:0e:00:d2:c0
1 00:0b:85:06:dd:00
1 00:0b:0e:00:05:c1
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
402 Configuring Auto-RF
Displaying RF attributes
To display the current values of the RF attributes Auto-RF uses to decide whether to change channel or power settings,
use the following commands:
show auto-tune attributes [ap ap-num [radio {1 | 2| all}]]
show auto-tune attributes [ap ap-num [radio {1 | 2| all}]]
To display RF attribute information for radio 1 on the directly connected AP on port 2, type the following command:
WSS# show auto-tune attributes ap 2 radio 1
Auto-tune attributes for :
Noise:
-92 Packet Retransmission Count:
0 Phy Errors Count:
122
0
Utilization:
CRC Errors count:
0
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
403
Configuring APs to be AeroScout
listeners
Locating an RFID tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
AeroScout RFID tags are wireless transmitters that you can place on assets such as office equipment to track the equip-
ment’s location. Each tag regularly transmits its unique ID. AeroScout listeners detect the transmissions from the RFID
tags and relay this information to an AeroScout Engine or WSS. You can use an AeroScout Engine or WLAN Manage-
ment Software to locate the asset.
APs can be configured as AeroScout listeners. An AP configured to be an AeroScout listener detects RFID tag IDs and
sends the tag information to the WSS managing the AP. If an AeroScout Engine is configured to request the information
from the AP, the AP also sends the information to the AeroScout Engine.
The accuracy of the location information depends on the number of listeners (APs). Nortel recommends that you
configure at least three listeners.
Note. You can configure APs or directly connected APs to listen for RFID tags. However,
if you plan to use an AeroScout Engine to display asset locations, you must use Distributed
APs. RFID tag information from directly connected APs is available only to WLAN
Management Software.You must manually configure a unique static IP address for each AP
designated as a listener.
Configuring AP radios to listen for AeroScout RFID tags
To configure AP radios to listen for AeroScout RFID tags:
•
•
Configure a service profile for the AeroScout listeners and set the SSID type to clear (unencrypted).
Configure a radio profile for the AeroScout listeners.
●
●
●
Disable Auto-RF of channels on the service profile. Channels on RFID tags are statically configured.
Therefore, the listener should not dynamically change channels.
Disable Scheduled RF Scanning on the service profile. When Scheduled RF Scanning is enabled,
radios go off-channel for brief intervals to scan for rogues.
Enable RFID mode on the service profile. RFID mode allows AP radios to accept Aeroscout Engine
commands. An AP will forward RFID tags to an Aeroscout Engine after receiving an Enable Access
Point command from the Aeroscout Engine.
●
Map the AeroScout listeners’ service profile to the radio profile.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
404 Configuring APs to be AeroScout listeners
•
•
Set the channel on each radio to the channel on which the RFID tags transmit. You can use the same channel on all
the RFID tags.
Map the AP radios to the radio profile and enable the radios.
Note. An AP always forwards RFID tag information to its WSS, even of RFID mode is
disabled.
The following example shows the commands to configure three Distributed APs to be AeroScout listeners. This example
assumes that the APs have already been installed and configured.
WSS# set service-profile rfid-listeners ssid-type clear
success: change accepted.
WSS# set radio-profile rfid-listeners active-scan disable
success: change accepted.
WSS# set radio-profile rfid-listeners auto-tune channel-config disable
success: change accepted.
WSS# set radio-profile rfid-listeners rfid-mode enable
success: change accepted.
WSS# set radio-profile rfid-listeners service-profile rfid-listeners
success: change accepted.
WSS# set ap 67 radio 1 channel 7
success: change accepted.
WSS# set ap 68 radio 1 channel 7
success: change accepted.
WSS# set ap 69 radio 1 channel 7
success: change accepted.
WSS# set ap 67 radio 1 radio-profile rfid-listeners mode enable
success: change accepted.
WSS# set ap 68 radio 1 radio-profile rfid-listeners mode enable
success: change accepted.
WSS# set ap 69 radio 1 radio-profile rfid-listeners mode enable
success: change accepted.
Locating an RFID tag
You can use an AeroScout Engine or WLAN Management Software to locate an asset to which an RFID tag is attached.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring APs to be AeroScout listeners 405
Using an AeroScout engine
1
2
3
4
Load the site map in AeroScout System Manager.
Mark the origin point (0,0), if not already done.
Calibrate distance, if not already done.
Add each AP configured as a listener to the map, and enter its IP address.
Note. To look up a AP’s IP address, use the show ap status command.
5
6
7
Enable RSSI location calculation.
Enable tag positioning.
Enable the map to use the APs.
To check an AP’s status, right-click on the AP icon and select Status.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
406 Configuring APs to be AeroScout listeners
Using WMS
If your network is modeled in a WLAN Management Software network plan, you can use WLAN Management Software
to locate devices that have AeroScout asset tags. This capability has the following requirements:
•
Three or more listeners are required for optimal location results. WLAN Management Software will attempt to
display a tag’s location even if there are fewer than three listeners, but the location might not be accurate.
•
The listener APs must be in the network plan, on the floor where the asset tags are located.
1
Connect to WLAN Management Software Services (the server) and open the network plan that contains
the site information.
2
Select the Monitor tool bar option (at the top of the main WLAN Management Software window). The
Monitor dashboard appears.
3
4
Under the Clients graph, click Details.
In the Manage menu of the Task List panel, select Find AeroScout Tag. The Find AeroScout Tags dialog
appears.
5
Enter the search criteria:
a
Select Find all AeroScout Tags, or leave Find a specific AeroScout Tag selected and type the MAC
address of the asset tag.
b
Select the search scope.
6
7
Click Next. A list of asset tags appears.
To locate an asset:
a
b
Select its tag in the list.
Select Locate AeroScout Tag.
A picture of the floor plan where the tag is located appears. The asset’s likely location is indicated.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
407
AirDefense integration with the
Nortel WLAN 2300 system
About AirDefense integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
Converting an AP into an AirDefense sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408
This chapter describes how the AirDefense security system integrates with the Nortel WLAN 2300 system, and how a
Nortel Access Point can be converted into an AirDefense sensor.
About AirDefense integration
The AirDefense system is an enterprise-class security solution that allows you to protect against threats and intrusions
into your wireless network. The AirDefense solution can be integrated with the Nortel WLAN 2300 system, comple-
menting Nortel network security features by providing a centralized server dedicated to security analysis and record
keeping.
AirDefense sensors constantly monitor the network, relaying information to a central AirDefense server, which collects
and analyzes the information. WMS can be configured to receive alert information from the AirDefense server.
The AirDefense security solution can detect and report when events such as the following occur:
•
•
•
•
•
•
An attacker sends spoofed deauthentication or disassociation frames to clients in the network
An attacker spoofs client MAC addresses to flood the network with traffic and create a denial of service attack
An unauthorized access point appears in the network
Excessive traffic is observed between wireless clients
An excessive number of decryption errors are observed
A NetStumbler scan is detected on the network
The Nortel WLAN 2300 system integrates with the AirDefense security solution in the following ways:
•
Nortel Access Points can be configured to operate as AirDefense sensors, reporting information about possible
threats or intrusions to an AirDefense server
•
WMS can be configured to receive SNMP traps from an AirDefense server. These traps can be correlated to alarms
in WMS, and viewed and managed in WMS’s Alarms view.
•
•
You can access the AirDefense server user interface directly from WMS
AirDefense sensors can be added to a WMS network plan. WMS can determine the number of AirDefense sensors
required for an area and place them on a floor plan.
Figure 25 illustrates how the AirDefense security solution integrates with the Nortel WLAN 2300 system.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
408 AirDefense integration with the Nortel WLAN 2300 system
Figure 25. AirDefense integration with the Nortel WLAN 2300 system
Distributed AP
WMS
Client
AirDefense
Sensor
WMS
Server
WMS User can access
AirDefense UI from WMS
(Converted AP)
WSS
AirDefense Server
In the example above, a Distributed AP converted to operate as an AirDefense sensor monitors the network and sends
information to the AirDefense server, via a WSS. The AirDefense server analyzes the information received from the
sensors and relays SNMP traps to the WMS server, where they can be viewed as alarms by WMS clients.
A user running a WMS client can gain access to the user interface on the AirDefense server directly from WMS.
Note. AirDefence system doesn’t work on 2332-Xn
Converting an AP into an AirDefense sensor
This section describes the procedures for converting an AP into an AirDefense sensor, specifying the AirDefense server
the converted AP sends information to, and how to convert an AirDefense sensor back to an AP.
Note. Converting an AP to an AirDefense sensor is supported only for model
2330.
The following tasks are described:
•
•
•
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
AirDefense integration with the Nortel WLAN 2300 system 409
•
•
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
410 AirDefense integration with the Nortel WLAN 2300 system
Copying the AirDefense sensor software to the WSS
The AirDefense sensor software is contained in a file called adconvert.bin, which can be obtained from Nortel. After
obtaining the AirDefense sensor software, you copy the file to the WSS that manages the AP to be converted to an AirD-
efense sensor.
For example, the following command copies the adconvert.bin file from a TFTP server to the WSS:
WSS# copy tftp://172.16.0.1/adconvert.bin adconvert.bin
..................success: received 945572 bytes in 10.090 seconds [ 93713 bytes/sec]
success: copy complete.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
AirDefense integration with the Nortel WLAN 2300 system 411
Loading the AirDefense sensor software on the AP
After the AirDefense sensor software is copied to the WSS, you can configure an AP to load the software. When you do
this, the software is transferred to the AP, which then reboots and comes up as an AirDefense sensor.
To configure an AP to load the AirDefense sensor software, use the following command:
set ap ap-num image filename
For example, the following command causes Distributed AP 1 to load the adconvert.bin file, then reboot as an AirDe-
fense sensor:
WSS# set ap 1 image adconvert.bin
This will change the file a AP will boot. Would you like to continue? (y/n) [n] y
How a converted AP obtains an IP address
If you had previously configured the AP to use a static IP address, then when the AP boots as an AirDefense sensor, it
uses that same IP address. Otherwise, the converted AP uses DHCP to obtain its IP address.
Optionally, the converted AP can obtain an IP address directly from an AirDefense server. To do this, configure your
DHCP server to include the IP address or hostname of the AirDefense server in the Option 43 field of the DHCP Offer
message. After receiving a DHCP Offer identifying an AirDefense server in the option 43 field, a converted AP contacts
the AirDefense server and gets an IP address from it.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
412 AirDefense integration with the Nortel WLAN 2300 system
Specifying the AirDefense server
To specify the AirDefense server the converted AP sends information to, do the following:
1
2
Open a Web browser and establish a secure (https) connection to the converted AP.
Using the converted AP’s Web interface, specify the IP address, subnet mask, and default gateway of the
AirDefense server.
After you do this, the converted AP can download a software image from the specified AirDefense server and operate as
an AirDefense sensor.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
AirDefense integration with the Nortel WLAN 2300 system 413
Converting an AirDefense sensor back to an AP
Once an AP is converted to an AirDefense sensor, you can convert the AP back to a Nortel Access Point by doing the
following:
1
2
Open a Web browser and establish a secure (https) connection to the converted AP.
Click the Revert button in the converted AP’s Web interface.
When you do this, the AP reboots and comes up as a Nortel Access Point.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
414 AirDefense integration with the Nortel WLAN 2300 system
Clearing the AirDefense sensor software from the AP’s configuration
To clear the AirDefense sensor software file from the AP’s configuration, use the following command:
clear ap ap-num image
For example, the following command causes the AirDefense sensor software file to be cleared from the configuration of
Distributed AP 1:
WSS# clear ap 1 image
success: change accepted.
The next time the AP is booted, it will come up as a Nortel Access Point.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
415
Configuring quality of service
About QoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415
Changing QoS settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
Displaying QoS information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
This chapter describes the Quality of Service (QoS) features supported in WSS Software and how to configure and
manage them.
About QoS
WSS Software supports Layer 2 and Layer 3 classification and marking of traffic, and prioritized forwarding of wireless
traffic for time-sensitive applications such as voice and video.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
416 Configuring quality of service
Summary of QoS features
QoS features are configured in radio profiles and service profiles. Table 21 lists the QoS features in WSS Software.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 417
Table 21.QoS parameters
QoS Feature
Description
Configuration Command
QoS parameters configured in the radio profile
QoS mode
Method used to set contention window set radio-profile qos-mode
parameters of forwarding queues on
See the following:
APs. One of the following modes can
be enabled:
•
•
•
SpectraLink Voice Priority
Wi-Fi Multimedia
•
WMM must be configured in order to
accept WMM clients.
WMM powersave
support
Unscheduled Automatic Powersave
Delivery (U-APSD).
set radio-profile
wmm-powersave
U-APSD enables clients that use
powersave mode to more efficiently
request buffered unicast packets from
AP radios.
See the following:
•
•
QoS parameters configured in service profiles
CAC mode
Call Admission Control, which
regulates addition of new sessions on
AP radios. One of the following modes
can be enabled:
set service-profile cac-mode
See the following:
•
•
•
None (the default)
Session-based
•
Static CoS
Simple CoS assignment. When
enabled, static CoS assigns the same
CoS value to all traffic on the service
profile SSID. Static CoS is disabled by
default.
set service-profile static-cos
set service-profile cos
See the following:
•
•
The default static CoS value is 0.
Using client
Differentiated
Services
Code Point (DSCP)
value
Whether the AP classifies the QoS
level for IP packets from an external
client based on the DSCP value,
instead of 802.11 WMM user priority.
set service-profile
use-client-dscp
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
418 Configuring quality of service
Table 21.QoS parameters (continued)
QoS Feature
Description
Configuration Command
Transmit rates
Data transmission rates supported by
each radio type. The following
categories are specified:
set service-profile
transmit-rates
•
•
•
Beacon
Multicast
Mandatory (a client must support
at least one of these rates to
associate)
•
•
Disabled
Standard (valid rates that are not
disabled and are not mandatory)
Defaults:
•
Mandatory:
•
•
•
802.11a—6.0, 12.0, 24.0
802.11b—5.5, 11.0
802.11g—1.0, 2.0, 5.5, 11.0
•
•
Disabled—None. All rates
applicable to the radio type are
supported by default.
Beacon:
•
•
•
802.11a—6.0
802.11b—5.5
802.11g—5.5
•
Multicast—auto for all radio types
(highest rate that can reach all
associated clients is used)
Broadcast control
Mechanisms to reduce overhead
caused by wireless broadcast traffic or
traffic from unauthenticated clients.
One or more of the following can be
enabled:
set service-profile proxy-arp
set service-profile no-broadcast
set service-profile dhcp-restrict
See the following:
•
•
•
Proxy ARP
No-Broadcast
DHCP Restrict
•
All three options are disabled by
default.
•
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 419
Table 21.QoS parameters (continued)
QoS Feature
Description
Configuration Command
Session timers
Keepalives and timeouts for clients
sessions. The following timeout
parameters can be configured:
set service-profile
user-idle-timeout
•
user idle timeout—Period a client
can remain idle before being
disassociated (default: 180
seconds)
idle-client probing—keepalives
sent to clients (enabled by default)
set service-profile
idle-client-probing
•
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
420 Configuring quality of service
End-to-End QoS
WSS and APs each perform classification on ingress to determine a CoS value for the packet. This CoS value
is used to mark the packet at the egress interface and to determine priority treatment on egress from the AP.
CoS values range from 0 to 7. Differentiated Services Code Point (DSCP) is a 6-bit value in IP-TOS with a
range from 0 to 63.
WSS and MP access points each provide classification and marking for QoS:
•
•
WSS switches and APs classify wired traffic based on the 802.1p tag value (for tagged VLAN traffic) or
DSCP value. Tunnel packets are classified using the DSCP of the tunnel header (TH), other packets with
the inner or 'client' DSCP.
APs classify ingress traffic from wireless clients based on the user priority value in the 802.11 header. If
the use-client-dscp option is enabled for a service profile, WMM QoS is ignored, and the QoS level is
classified based on the DSCP value. 802.11 data packets without WMM are classified as QoS level 0
unless static CoS is enabled or the use-client-dscp option is enabled.
•
•
WSSs and APs mark CoS for wired traffic in 802.1p and TH DSCP.
APs place traffic to a wireless client in a forwarding queue, based on the CoS value, and mark user
priority for WMM clients. The traffic is then forwarded based on the queue priority.
QoS Mapping
The mapping between DSCP and CoS values is configurable. An ingress map determines how DSCP values
are classified into CoS values. An egress map determines how CoS values are marked in the TH DSCP. The
WSS and associated APs share the same set of maps.
Note. It is recommended to configure the same ingress and egress maps across the
mobility domain.
Note. It is also recommended that any CoS value mapped to a DSCP value and
then mapped back to CoS results in the same CoS value.
Mapping from 802.1p, WMM user priority to CoS is static. Also, mapping from CoS to access category (AC)
on the APs is static.
Table 24 shows how WMM priority information is mapped across the network.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 421
Table 22: WMM Priority Mappings
WMM User
Priority
AP Forwarding
Queue
CoS
802.1p
IP ToS
IP Precedence
DSCP
0
1
2
3
4
5
6
7
0
1
2
3
4
5
6
7
0
1
2
3
4
5
6
7
0
0
1
2
3
4
5
6
7
0
Best Effort
Background
Background
Best Effort
Video
0x20
0x40
0x60
0x80
0xa0
0xc0
0xe0
8
16
24
32
40
48
56
Voice
Table 25 lists the default mappings between internal CoS values on an AP and the forwarding queues.
Table 23: CoS-to-AP-Forwarding-Queue Mappings
AP Forwarding Queue
(Access Category)
CoS
1 or 2
0 or 3
4 or 5
6 or 7
Background
Best Effort
Video
Voice
To display CoS mappings and queue usage statistics on an AP, see “Displaying AP forwarding queue statistics” on
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
422 Configuring quality of service
QoS mode
WSS Software supports Layer 2 and Layer 3 classification and marking of traffic, to help provide end-to-end
QoS throughout the network. The following modes of QoS are supported:
•
Wi-Fi Multimedia (WMM)—Provides wireless QoS for time-sensitive applications such as voice and
video. WMM QoS is enabled by default and does not require any configuration.
•
SpectraLink Voice Priority (SVP)—Provides optimized forwarding of SVP voice traffic. SVP QoS is
disabled by default.
Session-based Call Admission Control (CAC) is also supported. You can use CAC with either QoS mode to
ensure bandwidth availability by limiting the number of active sessions a radio can have.
The static CoS option enables you to easily set CoS for all traffic on an SSID by marking all the SSID’s traffic
with the same CoS value.
You can use ACLs to override CoS markings or set CoS for non-WMM traffic.
The following sections describe each of these options.
WMM QoS mode
WSSs and APs each provide classification and marking for WMM QoS:
•
WSSs classify and mark traffic based on 802.1p tag value (for tagged traffic) or Differentiated Services
Code Point (DSCP) value.
•
APs classify ingress traffic from wireless clients based on the service type value in the 802.11 header, and
mark the DSCP value in the IP tunnel on which the AP forwards the user traffic to the WSS.
APs place traffic from a WSS to a wireless client in a forwarding queue based on the DSCP
value in the tunnel carrying the traffic, then forward the traffic based on the queue’s priority.
mark egress traffic. Figure 28 on page 425 and Figure 29 on page 426 show how APs classify ingress traffic
and mark egress traffic. The figures show the default mappings between DSCP and CoS. (For information
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 423
Figure 26. QoS on WSSs—Classification of Ingress Packets
WSS receives packet.
Set packet CoS
based on 802.1p:
1 -> 1
2 -> 2
3 -> 3
4 -> 4
5 -> 5
6 -> 6
7 -> 7
802.1p value
that is not 0?
Yes
No (802.1p = 0)
Look up CoS for
DSCP value and
set packet CoS:
0 - 7 -> 0
8 - 15 -> 1
DSCP value
that is not 0?
Yes
16 - 23 -> 2
24 - 31 -> 3
32 - 39 -> 4
40 - 47 -> 5
48 - 55 -> 6
56 - 63 -> 7
No (DCSP = 0)
ACE on egress VLAN
or AP sets CoS?
Set packet CoS
to ACE CoS value.
Yes
No
Use CoS mapped
from DSCP or
802.1p, or leave
Mark egress packet.
CoS unset if 802.1p
and DSCP are both 0.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
424 Configuring quality of service
Figure 27. QoS on WSSs—marking of egress packets
WSS has classified
ingress packet.
Mark 802.1p
with CoS value:
1 -> 1
Egress interface has
802.1Q VLAN tag?
2 -> 2
3 -> 3
4 -> 4
5 -> 5
6 -> 6
7 -> 7
Yes
No VLAN tag
Look up CoS and mark
packet’s DSCP value:
1 -> 8
Egress interface
is IP tunnel?
2 -> 16
3 -> 24
4 -> 32
5 -> 40
6 -> 48
7 -> 56
Yes
No
Transmit packet.
Do not mark DSCP.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 425
Figure 28. QoS on APs —classification and marking of packets from clients to
WSSs
AP receives packet
from client.
Set packet CoS
with static CoS
value.
Static CoS
enabled?
Yes
No
Set packet CoS
based on 802.11
Service Type:
1 -> 1
2 -> 2
3 -> 3
4 -> 4
5 -> 5
6 -> 6
7 -> 7
Set tunnel’s IP ToS
to 802.1p value.
Set tunnel
IP ToS to static
CoS value.
Look up CoS and mark
packet’s DSCP value:
Mark packet with
DSCP value
mapped to static
1 -> 8
2 -> 16
3 -> 24
4 -> 32
5 -> 40
6 -> 48
7 -> 56
CoS value.
Transmit packet to WSS.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
426 Configuring quality of service
Figure 29. QoS on APs —classification and marking of packets from WSSs to
clients
AP receives packet
from WSS.
Set packet CoS
with static CoS
value.
Static CoS
enabled?
Yes
No
Look up CoS for
DSCP value and
set packet CoS:
0 - 7 -> 0
8 - 15 -> 1
16 - 23 -> 2
24 - 31 -> 3
32 - 39 -> 4
40 - 47 -> 5
48 - 55 -> 6
56 - 63 -> 7
Map CoS value to AP forwarding
queue:
0 or 3 -> Background
1 or 2 -> Best Effort
4 or 5 -> Video
6 or 7 -> Voice
Mark 802.11
Service Type
with CoS value.
Transmit packet to client.
The following sections describe in more detail how the WMM QoS mode works on WSSs and APs.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 427
WMM QoS on the WSS
WSS Software performs classification on ingress to determine a packet’s CoS value. This CoS value is used to mark the
packet at the egress interface.
The classification and marking performed by the switch depend on whether the ingress interface has an 802.1p or DSCP
value other than 0, and whether the egress interface is tagged or is an IP tunnel.
The mappings between DSCP and CoS values are configurable. (See “Changing CoS mappings” on page 435.) 802.1p
and CoS values map directly and are not configurable. DSCP 0 of the DSCP-to-CoS map is reserved. 802.1p determines
CoS for packets with DSCP 0. CoS 0 of the CoS-to-DSCP map is also reserved. CoS 0 packets are marked with DSCP 0.
Table 24 shows how WMM priority information is mapped across the network. When WMM is enabled, Nortel switches
and APs perform these mappings automatically.
Table 24.WMM Priority Mappings
AP
Forwarding
Queue
Service
Type
IP Precedence IP ToS
DSCP
802.1p
CoS
0
3
1
2
4
5
6
7
0
3
1
2
4
5
6
7
0
0
0
3
1
2
4
5
6
7
0
3
1
2
4
5
6
7
Background
Best Effort
Video
0x60
0x20
0x40
0x80
0xa0
0xc0
0xe0
24
8
16
32
40
48
56
Voice
You can use static CoS to assign the same CoS value to all packets for a specific SSID. The static CoS value is assigned
on the AP, in both traffic directions (from the client to the WSS and from the WSS to the client). (For information, see
You also can use ACLs to override marking for specific packets. Configure ACEs that use the dscp option to match on
ingress DSCP value, and use the cos option to mark CoS. A CoS value assigned by an ACE overrides the internal CoS
WMM QoS on an AP
APs use forwarding queues to prioritize traffic for wireless clients.
For a packet received by the AP from a client, the AP classifies the packet based on the service type in the 802.11 header
and maps the service type value to an internal CoS value. The AP then marks the DSCP value in the IP tunnel header to
the WSS based on the internal CoS value.
For a packet received from a WSS and addressed to a client, the AP classifies the packet by mapping the DSCP value in
the IP tunnel header to an internal CoS value. The AP then assigns the packet to a forwarding queue based on the internal
CoS value. The AP also marks the service type in the 802.11 header based on the internal CoS value.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
428 Configuring quality of service
An AP uses the DSCP-to-CoS and CoS-to-DSCP mappings of the WSS that is managing it. If you change mappings on
a WSS, the change also applies to the AP. Likewise, if an AP changes to another WSS (for example, after an AP restart),
the AP uses the mappings in effect on the new WSS.
Table 25 lists the default mappings between an AP’s internal CoS values and its forwarding queues.
Table 25.Default
CoS-to-AP-forwarding-queue mappings
AP Forwarding
Queue
CoS
1 or 2
0 or 3
4 or 5
6 or 7
Background
Best Effort
Video
Voice
(To display an AP’s CoS mappings and queue usage statistics, see “Displaying AP forwarding queue statistics” on
page 440.)
Figure 30 shows an example of end-to-end QoS in a Nortel network. In this example, voice traffic is prioritized based on
WMM. This example assumes that the QoS mappings are set to their default values.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 429
Figure 30. WMM QoS in a Nortel network
Layer 3
4
3
802.1p = 7
802.1p = 7
IP ToS = 0xe0 Voice Data. . .
IP ToS = 0xe0 Voice Data. . .
WSS A
WSS B
Tnl Hdr IP ToS = 0xe0
Voice Data. . .
5
Layer 3
2
Tnl Hdr IP ToS = 0xe0
Voice Data. . .
AP A
AP B
1
Srvc Type = 7 Voice Data . . .
6
Voice
Video
Best Effort
Bgrnd
User with WMM device
User with WMM device
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
430 Configuring quality of service
Figure 30 on page 429 shows the following process:
1
2
A user sends voice traffic from a WMM VoIP phone. The phone marks the CoS field of the packet with
service type 7, indicating that the packet is for high priority (voice) traffic.
AP A receives the voice packet and classifies the packet by mapping the service type in the 802.11 header
to an internal CoS value. In this example, the service type is 7 and maps to internal CoS 7.
The AP encapsulates the data in an IP tunnel packet, and marks the DSCP value in the tunnel header
based on the internal CoS value. In this example, the AP maps internal CoS 7 to DSCP 56 and marks the
IP tunnel header’s DSCP field with value 56. The AP then sends the packet to the WSS.
3
WSS A receives the packet on the IP tunnel connecting the WSS to AP A. The WSS classifies the packet
based on the DSCP value in the IP header of the tunnel packet (in this example, DSCP 56), and maps this
value to an internal CoS value (in this example, 7).
Note. In this example, the WSS interface with the AP is untagged, so the WSS
does not classify the packet based on its 802.1p value.
WSS A marks the packet based on the packet’s internal CoS value. In this example, the egress interface is
in a VLAN and has an 802.1Q VLAN tag. Therefore, the WSS marks both the 802.1p value (with 7) and
the tunnel header’s DSCP value (with 56). WSS A sends the packet to WSS B on the IP tunnel that
connects the two switches.
Note. An ACL can override a packet’s marking. If a packet matches a permit
ACL mapped to the outbound traffic direction on the AP port, Distributed AP, or
user VLAN, and the ACL sets the CoS value, the tunnel header’s DSCP value is
marked based on the CoS value in the ACL instead.
4
WSS B receives the packet from the Layer 3 cloud. The packet has an 802.1Q VLAN tag, so the WSS
classifies the packet by mapping its 802.1p value (in this example, 7) to the matching internal CoS value
(also 7). However, because the packet also has a non-zero value in the DSCP field of the tunnel header,
the WSS reclassifies the packet by mapping the DSCP value (56) to an internal CoS value (7) instead.
5
6
WSS B encapsulates the packet in an IP tunnel packet and marks the DSCP value in the tunnel header
based on the packet’s internal CoS value. In this example, the WSS marks the tunnel header with DSCP
56. WSS B sends the packet to AP B on the IP tunnel that connects them.
AP B receives the packet and does the following:
●
●
●
Maps the DSCP value in the tunnel header (56) to an internal CoS value (7).
Marks the packet’s service type based on the internal CoS value (7).
Places the packet in a forwarding queue (Voice) based on the internal CoS value (7).
In this example, the AP places the packet in the Voice forwarding queue. The Voice queue has
statistically more access to the air than the other queues, so the user’s voice traffic receives priority
treatment.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 431
Bandwidth Management for QoS
You can configure maximum bandwidth (full duplex rate) for aggregates of access categories (ACs) for a wireless client.
Downstream packets are shaped and upstream packets are policed. The AP has one queue per AC and each queue is a
finite size (<100 packets). If the network to AP flow exceeds the determined rate, the AP queue overflows and packets
are sent to the AP radio AC queues independently. The VoIP queue is given more transmit opportunities and therefore
empties faster than other queues. To configure this feature, use the following command:
WSS# set qos-profile profile-name max-bw max-bw-kb
The max-bw-kb attribute is a value between 1 and 100,000 Kbps.
If you configure SSID medium time weights, you will guarantee a minimum service level to specific service profiles on
a radio. Medium time weights determine the relative transmit utilization of the radio between service profiles. You can
configure the weight from 1 to 100 with 100 as the sum of all configured weights.
To configure SSID medium weights, use the following command:
WSS# set radio-profile profile-name weighted-fair-queuing mode [enable|disable] weight
service-profile-weight
You can configure SSID bandwidth limits to restrict traffic through a service profile. The configured limit is full duplex
in increments of Kbps and is only enforced on a transmitted packets. SSID weights do not restrict bandwidth unless the
radio is congested. Hence, you may select SSID bandwidth limits over SSID weights as bandwidth limits effectively
place a measurable cap on bandwidth through the AP uplink. To configure maximum bandwidth per SSID, use the
following command:
WSS# set service-profile <profile-name> max-bw [max-bw-kb]
SVP QoS mode
The SVP QoS mode optimizes forwarding of SVP traffic by setting the random wait time an AP
radio waits before transmitting the traffic to 0 microseconds.
Normally, an AP radio waits an additional number of microseconds following the fixed wait time,
before forwarding a queued packet or frame. Each forwarding queue has a different range of
possible random wait times. The Voice queue has the narrowest range, whereas the Background and
Best Effort queues have the widest range. The random wait times ensure that the Voice queue gets
statistically more access to the air than the other queues.
By setting the random wait time to 0 for SVP, the SVP QoS mode provides SVP traffic the greatest
possible access to the air, on a statistical basis. The QoS mode affects forwarding of SVP traffic only.
The random wait times for other types of traffic are the same as those used when the QoS mode is
WMM.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
432 Configuring quality of service
U-APSD support
WMM clients that use powersave mode can more efficiently request buffered unicast packets from AP radios by using
U-APSD.
When U-APSD support is enabled in WSS Software, a client can retrieve buffered unicast packets for a traffic priority
enabled for U-APSD by sending a QoS data or QoS-Null frame for that priority. U-APSD can be enabled for individual
traffic priorities, for individual clients, based on the client’s request. A client enables U-APSD for a traffic priority by
indicating this preference when (re)associating with the AP radio.
A client can but is not required to request U-APSD for all four traffic priorities. The AP radio still buffers packets for all
traffic priorities even if the client does not request U-APSD for them. However, to retrieve buffered packets for priorities
that are not using U-APSD, a client must send a separate PSpoll for each buffered packet.
U-APSD is supported only for QoS mode WMM.
Call admission control
Call Admission Control (CAC) is an optional feature that helps ensure that high-priority clients have adequate band-
width, by limiting the number of active sessions AP radios can have for an SSID. For example, you can limit the number
of active sessions on a VoIP SSID to ensure that each call receives the bandwidth required for quality voice service.
You can use CAC with either QoS mode (WMM or SVP).
CAC is disabled by default. You can enable session-based CAC on a service-profile basis. When enabled, CAC limits
the number of active sessions a radio can have to 14 by default. You can change the maximum number of sessions to a
value from 0 to 100.
Note. CAC is configured on a service profile basis and limits association to radios only
for the service profile’s SSID. Association to the radios by clients on other SSIDs is not
limited. To ensure voice quality, do not map other service profiles to the radio profile you
plan to use for voice traffic.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 433
Broadcast control
You also can enhance bandwidth availability on an SSID by enabling the following broadcast control features:
•
•
Proxy ARP—WSS responds on behalf of wireless clients to ARP requests for their IP addresses.
DHCP Restrict—WSS captures and does not forward any traffic except DHCP traffic for a wireless client who is
still being authenticated and authorized.
•
No Broadcast—Sends unicasts to clients for ARP requests and DHCP Offers and Acks instead of forwarding them
as multicasts.
All these broadcast control options are disabled by default.
(To enable broadcast control features, see “Using the client DSCP value to classify QoS level” on page 436.)
Static CoS
You can configure WSS Software to mark all wireless traffic on an SSID with a specific CoS value. When static CoS is
enabled, the AP marks all traffic between clients and the WSS for a given SSID with the static CoS value. The static CoS
value must be configured on the SSID’s service profile.
Static CoS is the simplest method of CoS marking to configure. However, the static CoS value applies to all traffic
regardless of traffic type. To instead assign CoS based on specific traffic types within an SSID, use an ACL. (See “Over-
Note. When static CoS is enabled, you cannot override the static CoS value by using
ACLs to mark CoS.
Overriding CoS
You can configure an ACL that marks packets that match the ACL with a specific CoS value. CoS is not changed in
packets that do not match the ACE (ACL rule) that sets the CoS. (For more information, see “Enabling prioritization for
Note. If static CoS is enabled, the static CoS value is always used. The CoS cannot be
changed using an ACL.
Changing QoS settings
You can change the settings of the following QoS options:
•
•
•
QoS mode
U-APSD support
CAC state and maximum number of sessions
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
434 Configuring quality of service
•
•
•
Broadcast control
Static CoS state and CoS value
DSCP-CoS mappings
The QoS mode is configurable on a radio-profile basis. CAC and static CoS are configurable on a service-profile basis.
DSCP-CoS mapping is configurable on a global switch basis.
Changing the QoS mode
The default QoS mode is WMM. To change the QoS mode on a radio profile, use the following command:
set radio-profile name qos-mode {svp | wmm}
For example, the following command changes the QoS mode for radio profile rp1 to SVP:
WSS# set radio-profile rp1 qos-mode svp
success: change accepted.
Note. SVP configuration requires ACLs to set CoS, in addition to the SVP QoS mode.
Enabling U-APSD support
U-APSD support is disabled by default. To enable it on a radio profile, use the following command:
set radio-profile name wmm-powersave {enable | disable}
For example, the following command enables U-APSD on radio profile rp1:
WSS# set radio-profile rp1 qos-mode svp
success: change accepted.
Configuring call admission control
To configure CAC for an SSID, enable the feature on the SSID’s service profile. When enabled, CAC limits the number
of active sessions a radio can have to 14 by default. You can change the maximum number of sessions to a value from 0
to 100.
Enabling CAC
To enable or disable CAC on a service profile, use the following command:
set service-profile name cac-mode {none | session}
For example, to enable session-based CAC on service profile sp1, use the following command:
WSS# set service-profile sp1 cac-mode session
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 435
Changing the maximum number of active sessions
When CAC is enabled, the maximum number of active sessions a radio can have is 14 by default. To change the
maximum number of sessions, use the following command:
set service-profile name cac-session max-sessions
The max-sessions can be a value from 0 to 100.
For example, to change the maximum number of sessions for radios used by service profile sp1 to 10, use the following
command:
WSS# set service-profile sp1 cac-session 10
success: change accepted.
Configuring static CoS
To configure static CoS for an SSID, enable the feature and set the CoS value. AP radios that forward traffic for the
SSID mark all the traffic with the static CoS value and use the corresponding forwarding queue to forward the traffic.
The static CoS value applies to all traffic on the SSID.
To enable static CoS and set the CoS value, use the following commands:
set service-profile name static-cos {enable | disable}
set service-profile name cos level
The level can be a value from 0 (lowest priority) to 7 (highest priority). The default is 0.
For example, to configure static CoS 7 for service profile sp1, use the following commands:
WSS# set service-profile sp1 static-cos enable
success: change accepted.
WSS# set service-profile sp1 cos 7
success: change accepted.
Changing CoS mappings
To change CoS mappings, use the following commands:
set qos dscp-to-cos-map dscp-range cos level
set qos cos-to-dscp-map level dscp dscp-value
The first command changes the mapping of ingress DSCP values to the internal QoS table when marking packets. The
second command changes the mappings of the internal QoS values to DSCP value when tagging outbound packets.
The following command changes the mapping of DSCP value 45 from CoS value 5 to CoS value 7. (The change affects
classification but does not affect marking.)
WSS# set qos dscp-to-cos-map 45 cos 7
success: change accepted.
The following command changes the mapping of CoS value 6 from DSCP value 48 to DSCP value 55. (The change
affects marking but does not affect classification.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
436 Configuring quality of service
WSS# set qos cos-to-dscp-map 6 dscp 55
success: change accepted.
Using the client DSCP value to classify QoS level
To configure WSS Software to classify the QoS level of IP
Enabling broadcast control
To enable broadcast control features on a service-profile basis, using the following commands:
set service-profile name proxy-arp {enable | disable}
set service-profile name dhcp-restrict {enable | disable}
set service-profile name no-broadcast {enable | disable}
For example, to enable all these broadcast control features in service profile sp1, use the following commands:
WSS# set service-profile sp1 proxy-arp enable
success: change accepted.
WSS# set service-profile sp1 dhcp-restrict enable
success: change accepted.
WSS# set service-profile sp1 no-broadcast enable
success: change accepted.
Displaying QoS information
You can display the following types of information for QoS:
•
•
•
•
•
•
•
Radio profile QoS settings: QoS mode, U-APSD support
Service profile QoS settings: CAC, static CoS, and broadcast control settings
Broadcast control settings
Default CoS mappings
Individual DSCP-to-CoS or CoS-to-DSCP mappings
The DSCP table (a reference of standard mappings from DSCP to IP ToS and IP precedence)
QoS Statistics for the AP forwarding queues
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 437
Displaying a radio profile’s QoS settings
To display the QoS mode and all other settings for a radio profile, use the following command:
show radio-profile {name | ?}
The following example shows the configuration of radio profile rp1.
WSS# show radio-profile rp1
Beacon Interval:
Max Tx Lifetime:
RTS Threshold:
Long Preamble:
Tune Power:
100 DTIM Interval:
2000 Max Rx Lifetime:
2346 Frag Threshold:
no Tune Channel:
no Tune Channel Interval:
600 Power ramp interval:
300 Countermeasures:
yes RFID enabled:
1
2000
2346
yes
3600
Tune Power Interval:
Channel Holddown:
Active-Scan:
60
none
no
WMM Powersave:
no QoS Mode:
wmm
Service profiles: sp1
In this example, the QoS mode is WMM and U-APSD support (WMM powersave) is disabled.
(For more information about this command’s output, see the “AP Commands” chapter in the Nortel WLAN Security
Switch 2300 Series Command Line Reference.)
Displaying a service profile’s QoS settings
To display QoS settings and all other settings for a service profile, use the following command:
show service-profile {name | ?}
The following example shows the configuration of the sp1 service profile.
WSS# show service-profile sp1
ssid-name:
corp2 ssid-type:
crypto
Beacon:
yes Proxy ARP:
no
DHCP restrict:
Short retry limit:
Auth fallthru:
no No broadcast:
no
5
5 Long retry limit:
none Sygate On-Demand (SODA):
yes SODA remediation ACL:
Custom failure web-page:
no
Enforce SODA checks:
Custom success web-page:
Custom logout web-page:
Static COS:
Custom agent-directory:
no COS:
0
CAC mode:
session CAC sessions:
180 Idle client probing:
14
yes
User idle timeout:
Keep initial vlan:
Web Portal ACL:
WEP Key 1 value:
WEP Key 3 value:
WEP Unicast Index:
Shared Key Auth:
WPA enabled:
no Web Portal Session Timeout:
5
<none> WEP Key 2 value:
<none> WEP Key 4 value:
1 WEP Multicast Index:
NO
<none>
<none>
1
ciphers: cipher-tkip
authentication: 802.1X
TKIP countermeasures time: 60000ms
11a beacon rate:
6.0 multicast rate:
AUTO
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
438 Configuring quality of service
11a mandatory rate: 6.0,12.0,24.0 standard rates: 9.0,18.0,36.0,48.0,54.0
11b beacon rate:
2.0 multicast rate:
AUTO
11b mandatory rate: 1.0,2.0 standard rates: 5.5,11.0
11g beacon rate:
2.0 multicast rate:
AUTO
11g mandatory rate: 1.0,2.0,5.5,11.0 standard rates: 6.0,9.0,12.0,18.0,24.0, 36.0,48.0,54.0
Note. Configuration information for some settings appears in other chapters. To
(For more information about this command’s output, see the “AP Commands” chapter in the Nortel WLAN Security
Switch 2300 Series Command Line Reference.)
Displaying CoS mappings
WSS Software provides commands for displaying the default CoS mappings and configured mappings.
Displaying the default CoS mappings
To display the default CoS mappings, use the following command:
WSS# show qos default
Ingress QoS Classification Map (dscp-to-cos)
Ingress DSCP
CoS Level
===============================================================================
00-09
10-19
20-29
30-39
40-49
50-59
60-63
0
1
2
3
5
6
7
0
1
2
3
5
6
7
0
1
2
4
5
6
7
0
1
2
4
5
6
7
0
1
3
4
5
6
0
1
3
4
5
6
0
2
3
4
5
7
0
2
3
4
5
7
1
2
3
4
6
7
1
2
3
4
6
7
Egress QoS Marking Map (cos-to-dscp)
CoS Level
0
1
2
3
4
5
6
7
===============================================================================
Egress DSCP
Egress ToS byte
0
8
16 24 32 40 48 56
0x00 0x20 0x40 0x60 0x80 0xA0 0xC0 0xE0
Displaying a DSCP-to-CoS mapping
To display the CoS value to which a specific DSCP value is mapped during classification, use the following command:
show qos dscp-to-cos-map dscp-value
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring quality of service 439
The following command displays the CoS value to which DSCP value 55 is mapped:
WSS# show qos dscp-to-cos-map 55
dscp 55 is classified as cos 6
Displaying a CoS-to-DSCP mapping
To display the DSCP value to which a specific CoS value is mapped during marking, use the following command:
show qos cos-to-dscp-map cos-value
The following command displays the DSCP value to which CoS value 6 is mapped:
WSS# show qos cos-to-dscp-map 6
cos 6 is marked with dscp 48 (tos 0xC0)
Displaying the DSCP table
To display the standard mappings of DSCP, ToS, and precedence values, use the following command:
WSS# show qos dscp-table
DSCP
TOS
precedence tos
dec hex
------------
dec hex
----------------
-----------------------
0
1
2
3
4
5
6
7
8
9
0x00
0x01
0x02
0x03
0x04
0x05
0x06
0x07
0x08
0x09
0
4
8
0x00
0x04
0x08
0
0
0
0
0
0
0
0
1
1
0
2
4
6
12 0x0c
16 0x10
20 0x14
24 0x18
28 0x1c
32 0x20
36 0x24
8
10
12
14
0
2
...
63 0x3f
252 0xfc
7
14
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
440 Configuring quality of service
Displaying AP forwarding queue statistics
You can display statistics for AP forwarding queues, using the following commands:
show ap qos-stats [ap-num] [clear]
show ap qos-stats [port-list] [clear]
The clear option clears the counters after displaying their values.
The following command shows statistics for the AP forwarding queues on a Distributed AP:
WSS# show ap qos-stats 4
CoS
Queue
Tx
TxDrop
=======================================
AP: 4 radio: 1
1,2
0,3
4,5
6,7
Background
BestEffort
Video
0
0
278
0
0
15327
0
1714881
Voice
AP: 4 radio: 2
1,2
0,3
4,5
6,7
Background
BestEffort
Video
0
0
0
0
0
0
Voice
0
0
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
441
Configuring and managing spanning
tree protocol
Enabling the spanning tree protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442
Changing standard spanning tree parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 443
Displaying spanning tree information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456
Spanning tree configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462
The purpose of the Spanning Tree Protocol (STP) is to maintain a loop-free network. A loop-free path is accomplished
when a device recognizes a loop in the topology and blocks one or more redundant paths.
WLAN Security Switch 2300 Series (WSS Software) supports 802.1D and Per-VLAN Spanning Tree protocol
(PVST+).
•
•
WSS Software uses 802.1D bridge protocol data units (BPDUs) on VLAN ports that are untagged. However, each
VLAN still runs its own instance of STP, even if two or more VLANs contain untagged ports. To run a single
instance of STP in 802.1D mode on the entire switch, configure all network ports as untagged members of the same
VLAN. WSS Software does not support running 802.1D on multiple tagged VLANs.
WSS Software uses PVST+ BPDUs on VLAN ports that are tagged. PVST+ BPDUs include tag information in the
802.1Q field of the BPDUs. WSS Software runs a separate instance of PVST+ on each tagged VLAN.
Note. STP does not run on AP access ports or wired authentication ports and does not
affect traffic flow on these port types.
Note. When you create a VLAN, STP is disabled on the new VLAN by default,
regardless of the STP state of other VLANs on the device.
Note. The IEEE 802.1D spanning tree specifications refer to networking devices that
forward Layer 2 traffic as bridges. In this context, a WSS is a bridge. Where this manual or
the product interface uses the term bridge, you can assume the term is applicable to the
WSS.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
442 Configuring and managing spanning tree protocol
Enabling the spanning tree protocol
STP is disabled by default. You can enable STP globally or on individual VLANs.
To enable STP, use the following command:
set spantree {enable | disable}
[{all | vlan vlan-id | port port-list vlan-id}]
To enable STP on all VLANs configured on a WSS, type the following command:
WSS# set spantree enable
success: change accepted.
To verify the STP state and display the STP parameter settings, enter the show spantree command. For infor-
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 443
Changing standard spanning tree parameters
You can change the following standard STP parameters:
•
•
•
Bridge priority
Port cost
Port priority
Bridge priority
The bridge priority determines the WSS’s eligibility to become the root bridge. You can set this parameter globally or on
individual VLANs.
The root bridge is elected based on the bridge priority of each device in the spanning tree. The device with the highest
bridge priority is elected to be the root bridge for the spanning tree. The bridge priority is a numeric value from 0
through 65,535. Lower numeric values represent higher priorities. The highest priority is 0, and the lowest priority is
65,535. The default bridge priority for all devices is 32,768.
If more than one device has the highest bridge priority (lowest numeric value), the device with the lowest MAC address
becomes the root bridge.
If the root bridge fails, STP elects a new root bridge based on the bridge priorities of the remaining bridges.
Port cost
Port cost is a numeric value that STP adds to the total cost of a path to the root bridge. When a designated bridge has
multiple equal-cost paths to the root bridge, the designated bridge uses the path with the lowest total cost. You can set
this parameter on an individual port basis, for all VLANs the port is in, or for specific VLANs.
You can specify a value from 1 through 65,535 for the port cost. The default depends on the port speed and link type.
Table 26 lists the defaults for STP port path cost.
Table 26.SNMP port path cost defaults
Port Speed
Link Type
Default Port Path Cost
1000 Mbps
Full Duplex Aggregate Link (Port
Group)
19
1000 Mbps
100 Mbps
Full Duplex
4
Full Duplex Aggregate Link (Port
Group)
19
100 Mbps
100 Mbps
10 Mbps
Full Duplex
Half Duplex
18
19
19
Full Duplex Aggregate Link (Port
Group)
10 Mbps
10 Mbps
Full Duplex
Half Duplex
95
100
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
444 Configuring and managing spanning tree protocol
Port priority
Port priority is the eligibility of the port to be the designated port to the root bridge, and thus part of the path to
the root bridge. When the WSS has more than one link to the root bridge, STP uses the link with the lowest
priority value. You can set this parameter on an individual port basis, for all VLANs the port is in, or for
specific VLANs.
Specify a priority from 0 (highest priority) through 255 (lowest priority). The default is 128.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 445
Changing the bridge priority
To change the bridge priority, use the following command:
set spantree priority value {all | vlan vlan-id}
Specify a bridge priority from 0 through 65,535. The default is 32,768. The all option applies the change
globally to all VLANs. Alternatively, specify an individual VLAN.
To change the bridge priority of VLAN pink to 69, type the following command:
WSS# set spantree priority 69 vlan pink
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
446 Configuring and managing spanning tree protocol
Changing STP port parameters
You can change the STP cost and priority of an individual port, on a global basis or an individual VLAN basis.
Changing the STP port cost
To change the cost of a port, use one of the following commands.
set spantree portcost port-list cost cost
set spantree portvlancost port-list cost cost {all | vlan vlan-id}
The set spantree portcost command changes the cost for ports in the default VLAN (VLAN 1) only. The set spantree
portvlancost command changes the cost for ports in a specific other VLAN or in all VLANs.
Specify a value from 1 through 65,535 for the cost. The default depends on the port speed and link type. (See Table 26
The all option applies the change to all VLANs. Alternatively, specify an individual VLAN.
To change the cost on ports 3 and 4 in the default VLAN to 20, type the following command:
WSS# set spantree portcost 3,4 cost 20
success: change accepted.
To change the cost for the same ports in VLAN mauve, type the following command:
WSS# set spantree portvlancost 3,4 cost 20 vlan mauve
success: change accepted.
Resetting the STP port cost to the default value
To reset the STP port cost to the default value, use one of the following commands:
clear spantree portcost port-list
clear spantree portvlancost port-list {all | vlan vlan-id}
The command applies only to the ports you specify. The port cost on other ports remains unchanged.
To reset the cost of ports 3 and 4 in the default VLAN to the default value, type the following command:
WSS# clear spantree portcost 3-4
success: change accepted.
To reset the cost of ports 3 and 4 for VLAN beige, type the following command:
WSS# clear spantree portvlancost 3-4 vlan beige
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 447
Changing the STP port priority
To change the priority of a port, use one of the following commands:
set spantree portpri port-list priority value
set spantree portvlanpri port-list priority value {all | vlan vlan-id}
The set spantree portpri command changes the priority for ports in the default VLAN (VLAN 1) only. The
set spantree portvlanpri command changes the priority for ports in a specific other VLAN or in all VLANs.
Specify a priority from 0 (highest priority) through 255 (lowest priority). The default is 128.
The all option applies the change to all VLANs. Alternatively, specify an individual VLAN.
To set the priority of ports 3 and 4 in the default VLAN to 48, type the following command:
WSS# set spantree portpri 3-4 priority 48
success: change accepted.
To set the priority of ports 3 and 4 to 48 in VLAN mauve, type the following command:
WSS# set spantree portvlanpri 3-4 priority 48 vlan mauve
success: change accepted.
Resetting the STP port priority to the default value
To reset the STP port priority to the default value, use one of the following commands:
clear spantree portpri port-list
clear spantree portvlanpri port-list {all | vlan vlan-id}
The command applies only to the ports you specify. The port cost on other ports remains unchanged.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
448 Configuring and managing spanning tree protocol
Changing spanning tree timers
You can change the following STP timers:
•
Hello interval—The interval between configuration messages sent by a WSS when the switch is acting as
the root bridge. You can specify an interval from 1 through 10 seconds. The default is 2 seconds.
•
Forwarding delay—The period of time a bridge other than the root bridge waits after receiving a topology
change notification to begin forwarding data packets. You can specify a delay from 4 through 30 seconds.
The default is 15 seconds. (The root bridge always forwards traffic.)
•
Maximum age—The period of time that a WSS acting as a designated bridge waits for a new hello packet
from the root bridge before determining that the root bridge is no longer available and initiating a
topology change. You can specify an age from 6 through 40 seconds. The default is 20 seconds.
Changing the STP hello interval
To change the hello interval, use the following command:
set spantree hello interval {all | vlan vlan-id}
Specify an interval from 1 through 10 seconds. The default is 2 seconds.
The all option applies the change to all VLANs. Alternatively, specify an individual VLAN.
To change the hello interval for all VLANs to 4 seconds, type the following command:
WSS# set spantree hello 4 all
success: change accepted.
Changing the STP forwarding delay
To change the forwarding delay, use the following command:
set spantree fwddelay delay {all | vlan vlan-id}
Specify a delay from 4 through 30 seconds. The default is 15 seconds.
The all option applies the change to all VLANs. Alternatively, specify an individual VLAN.
To change the forwarding delay on VLAN pink to 20 seconds, type the following command:
WSS# set spantree fwddelay 20 vlan pink
success: change accepted.
Changing the STP maximum age
To change the maximum age, use the following command:
set spantree maxage aging-time {all | vlan vlan-id}
Specify an age from 6 through 40 seconds. The default is 20 seconds.
The all option applies the change to all VLANs. Alternatively, specify an individual VLAN.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 449
To change the maximum acceptable age for root bridge hello packets on all VLANs to 15 seconds, type the following
command:
WSS# set spantree maxage 15 all
success: change accepted.
Configuring and managing STP fast convergence
features
The standard STP timers delay traffic forwarding briefly after a topology change. The time a port takes to change from
the listening state to the learning state or from the learning state to the forwarding state is called the forwarding delay. In
some configurations, this delay is unnecessary. The WSS provides the following fast convergence features to bypass the
forwarding delay:
•
•
•
Port fast
Backbone fast
Uplink fast
Port fast convergence
Port fast convergence bypasses both the listening and learning stages and immediately places a port in the forwarding
state. You can use port fast convergence on ports that are directly connected to servers, hosts, or other MAC stations.
Note. Do not use port fast convergence on ports connected to other bridges.
Backbone fast convergence
Backbone fast convergence accelerates a port’s recovery following the failure of an indirect link. Normally, when a
forwarding link fails, a bridge that is not directly connected to the link does not detect the link change until the maximum
age timer expires. Backbone fast convergence enables the WSS to listen for bridge protocol data units (BPDUs) sent by
a designated bridge when the designated bridge’s link to the root bridge fails. The switch immediately verifies whether
BPDU information stored on a port is still valid. If not, the bridge immediately starts the listening stage on the port.
Note. If you plan to use the backbone fast convergence feature, you must enable it on all
the bridges in the spanning tree.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
450 Configuring and managing spanning tree protocol
Uplink fast convergence
Uplink fast convergence enables a WSS that has redundant links to the network core to immediately change the state of
a backup link to forwarding if the primary link to the root fails. Uplink fast convergence bypasses the listening and
learning states to immediately enter the forwarding state.
Note. The uplink fast convergence feature is applicable to bridges that are acting as
access switches to the network core (distribution layer) but are not in the core themselves.
Do not enable the feature on WSS switches that are in the network core.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 451
Configuring port fast convergence
To enable or disable port fast convergence, use the following command:
set spantree portfast port port-list {enable | disable}
To enable port fast convergence on ports 9, 11, and 13, type the following command:
WSS# set spantree portfast port 9,11,13 enable
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
452 Configuring and managing spanning tree protocol
Displaying port fast convergence information
To display port fast convergence information, use the following command:
show spantree portfast [port-list]
To display port fast convergence information for all ports, type the following command:
WSS# show spantree portfast
Port
-------
1
2
3
4
5
6
7
Vlan
------- -----------
Portfast
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
2
2
2
2
disable
disable
disable
enable
disable
disable
disable
disable
disable
disable
disable
disable
disable
disable
disable
disable
disable
enable
disable
disable
enable
8
10
15
16
17
18
19
20
21
22
11
12
13
14
In this example, port fast convergence is enabled on ports 11 and 14 in VLAN 2 and port 4 in VLAN 1.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 453
Configuring backbone fast convergence
To enable or disable backbone fast convergence, use the following command:
set spantree backbonefast {enable | disable}
To enable backbone fast convergence on all VLANs, type the following command:
WSS# set spantree backbonefast enable
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
454 Configuring and managing spanning tree protocol
Displaying the backbone fast convergence state
To display the state of the backbone fast convergence feature, use the following command:
show spantree backbonefast
Here is an example:
WSS# show spantree backbonefast
Backbonefast is enabled
In this example, backbone fast convergence is enabled.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 455
Configuring uplink fast convergence
To enable or disable uplink fast convergence, use the following command:
set spantree uplinkfast {enable | disable}
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
456 Configuring and managing spanning tree protocol
Displaying uplink fast convergence information
To display uplink fast convergence information, use the following command:
show spantree uplinkfast [vlan vlan-id]
The following command displays uplink fast convergence information for all VLANs:
WSS# show spantree uplinkfast
VLAN
---------
1
port list
-------------
1(fwd),2,3
In this example, ports 1, 2, and 3 provide redundant links to the network core. Port 1 is forwarding traffic. The
remaining ports block traffic to prevent a loop.
Displaying spanning tree information
You can use CLI commands to display the following STP information:
•
•
•
•
Bridge STP settings and individual port information
Blocked ports
Statistics
Port fast, backbone fast, and uplink fast convergence information
Note. For information about the show commands for the fast convergence features, see
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 457
Displaying STP bridge and port information
To display STP bridge and port information, use the following command:
show spantree [port port-list | vlan vlan-id] [active]
By default, STP information for all ports and all VLANs is displayed. To display STP information for specific ports or a
specific VLAN only, enter a port list or a VLAN name or number. For each VLAN, only the ports contained in the
VLAN are listed in the command output.
To list only the ports that are in the active (forwarding) state, enter the active option.
To display STP information for VLAN mauve, type the following command:
WSS# show spantree vlan mauve
VLAN
3
Spanning tree mode
Spanning tree type
Spanning tree enabled
PVST+
IEEE
Designated Root
00-02-4a-70-49-f7
Designated Root Priority 32768
Designated Root Path Cost 19
Designated Root Port
1
Root Max Age 20 sec Hello Time 2 sec Forward Delay 15 sec
Bridge ID MAC ADDR
Bridge ID Priority
00-0b-0e-02-76-f7
32768
Bridge Max Age 20 sec Hello Time 2 sec Forward Delay 15 sec
Port
Vlan
STP-State Cost Prio Portfast
------------------------------------------------------------------------------
1
1
1
1
1
1
1
Forwarding 19 128 Disabled
2
Blocking
Blocking
19 128 Disabled
19 128 Disabled
3
10
15
16
Forwarding 19 128 Disabled
Blocking
Blocking
19 128 Disabled
19 128 Disabled
In this example, VLAN mauve contains ports 1 through 3, 10, 15 and 16. Ports 1 and 10 are forwarding traffic. The other
ports are blocking traffic.
(For more information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
458 Configuring and managing spanning tree protocol
Displaying the STP port cost on a VLAN basis
To display a brief list of the STP port cost for a port in each of its VLANs, use the following command:
show spantree portvlancost port-list
This command displays the same information as the show spantree command’s Cost field in a concise format
for all VLANs. The show spantree command lists all the STP information separately for each VLAN.
To display the STP port cost of port 1, type the following command:
WSS# show spantree portvlancost 1
port 1 VLAN 1 have path cost 19
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 459
Displaying blocked STP ports
To display information about ports that are in the STP blocking state, use the following command:
show spantree blockedports [vlan vlan-id]
To display information about blocked ports on a WSS for the default VLAN (VLAN 1), type the following
command:
WSS# show spantree blockedports vlan default
Port
------------------------------------------------------------------------
22 190 Blocking 4 128 Disabled
Vlan
Port-State Cost Prio Portfast
Number of blocked ports (segments) in VLAN 1 : 1
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command
Line Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
460 Configuring and managing spanning tree protocol
Displaying spanning tree statistics
To display STP statistics, use the following command:
show spantree statistics [port-list [vlan vlan-id]]
To display STP statistics for port 1, type the following command:
WSS# show spantree statistics 1
BPDU related parameters
Port 1
VLAN 1
spanning tree enabled for VLAN = 1
port spanning tree
state
port_id
enabled
Forwarding
0x8015
0x15
port_number
path cost
0x4
message age (port/VLAN)
designated_root
designated cost
designated_bridge
designated_port
top_change_ack
config_pending
port_inconsistency
0(20)
00-0b-0e-00-04-30
0x0
00-0b-0e-00-04-30
38
FALSE
FALSE
none
Port based information statistics
config BPDU's xmitted(port/VLAN)
config BPDU's received(port/VLAN)
tcn BPDU's xmitted(port/VLAN)
tcn BPDU's received(port/VLAN)
0 (1)
21825 (43649)
0 (0)
2 (2)
forward transition count (port/VLAN) 1 (1)
scp failure count
root inc trans count (port/VLAN)
0
1 (1)
FALSE
0 (0)
inhibit loopguard
loop inc trans count
Status of Port Timers
forward delay timer
INACTIVE
forward delay timer value
message age timer
message age timer value
15
ACTIVE
0
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 461
INACTIVE
0
INACTIVE
0
topology change timer
topology change timer value
hold timer
hold timer value
delay root port timer
delay root port timer value
delay root port timer restarted is
INACTIVE
0
FALSE
VLAN based information & statistics
spanning tree type
spanning tree multicast address
ieee
01-00-0c-cc-cc-cd
bridge priority
32768
00-0b-0e-12-34-56
bridge MAC address
bridge hello time
2
bridge forward delay
topology change initiator:
last topology change occurred:
topology change
topology change time
topology change detected
topology change count
topology change last recvd. from
15
0
Tue Jul 01 2003 22:33:36.
FALSE
35
FALSE
1
00-0b-0e-02-76-f6
Other port specific info
dynamic max age transition
port BPDU ok count
msg age expiry count
0
21825
0
link loading
0
BPDU in processing
num of similar BPDU's to process
received_inferior_bpdu
FALSE
0
FALSE
next state
0
src MAC count
total src MAC count
curr_src_mac
next_src_mac
21807
21825
00-0b-0e-00-04-30
00-0b-0e-02-76-f6
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
462 Configuring and managing spanning tree protocol
Clearing STP statistics
To clear the STP statistics counters, use the following command.
clear spantree statistics port-list [vlan vlan-id]
As soon as you enter the command, WSS Software resets the STP counters for the specified ports or VLANs to 0. The
software then begins incrementing the counters again.
Spanning tree configuration scenario
This scenario configures a VLAN named backbone for a WSS’s connections to the network backbone, adds ports 21 and
22 to the VLAN, and enables STP on the VLAN to prevent loops.
1
Remove the network cables from ports 21 and 22 or use WSS Software to disable the ports,. This prevents
a loop until you complete the STP configuration. To disable the ports and verify the results, type the
following commands:
WSS# set port disable 21-22
success: set "disable" on port 21-22
WSS# show port status
Port Name Admin Oper Config Actual Type
Media
===============================================================================
1
2
up up auto 100/full network 10/100BaseTx
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
down down auto
down down auto
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
network
2
Configure a backbone VLAN and verify the configuration change. Type the following commands:
WSS# set vlan 10 name backbone port 21-22
success: change accepted.
WSS# show vlan config
Admin VLAN Tunl
VLAN Name
Port
Tag State
Status State Affin Port
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing spanning tree protocol 463
---- --------------- ------ ----- ----- --------------- ----- -----
1 default
Up Up
5
1
none Up
5
10 backbone
Up Down
21
22
none Down
none Down
3
Enable STP on the backbone VLAN and verify the change. Type the following commands:
WSS# set spantree enable vlan backbone
success: change accepted.
WSS# show spantree vlan 10
VLAN
10
Spanning tree mode
Spanning tree type
Spanning tree enabled
PVST+
IEEE
Designated Root
00-0b-0e-00-04-0c
Designated Root Priority
Designated Root Path Cost
We are the root
32768
0
Root Max Age 20 sec Hello Time 2 sec Forward Delay 15 sec
Bridge ID MAC ADDR
Bridge ID Priority
00-0b-0e-00-04-0c
32768
Bridge Max Age 20 sec Hello Time 2 sec Forward Delay 15 sec
Port Vlan STP-State Cost Prio Portfast
---------------------------------------------------------------
-----
21
22
10
10
Disabled
Disabled
4 128
4 128
Disabled
Disabled
4
Reconnect or reenable ports 21 and 22 and verify the change. Type the following commands:
WSS# set port enable 21-22
success: set "enable" on port 21-22
WSS# show port status
Port Name
Admin Oper Config Actual Type
Media
===============================================================================
1
2
up up auto 100/full network 10/100BaseTx
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
3
4
5
6
7
8
9
10
11
12
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
464 Configuring and managing spanning tree protocol
13
14
15
16
17
18
19
20
21
22
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
up down auto
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
network 10/100BaseTx
up up auto 1000/full network
up up auto 1000/full network
5
Wait for STP to complete the listening and learning stages and converge, then verify that STP is operating
properly and blocking one of the ports in the backbone VLAN. Type the following command:
WSS# show spantree vlan 10
VLAN
10
Spanning tree mode
Spanning tree type
Spanning tree enabled
PVST+
IEEE
Designated Root
00-0b-0e-00-04-0c
Designated Root Priority
Designated Root Path Cost
We are the root
32768
0
Root Max Age 20 sec Hello Time 2 sec Forward Delay 15 sec
Bridge ID MAC ADDR
Bridge ID Priority
00-0b-0e-00-04-0c
32768
Bridge Max Age 20 sec Hello Time 2 sec Forward Delay 15 sec
Port
-------
21
Vlan
-------
10
STP-State
-----------
Forwarding
Blocking
Cost Prio Portfast
----- ----- --------
4 128
4 128
Disabled
Disabled
22
10
6
Save the configuration. Type the following command:
WSS# save configsuccess: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
465
Configuring and managing IGMP
snooping
Disabling or reenabling IGMP snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
Disabling or reenabling proxy reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
Enabling the pseudo-querier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
Changing IGMP timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
Enabling router solicitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471
Configuring static multicast ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472
Displaying multicast information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474
Internet Group Management Protocol (IGMP) snooping controls multicast traffic on a WSS by forwarding packets for a
multicast group only on the ports that are connected to members of the group. A multicast group is a set of IP hosts that
receive traffic addressed to a specific Class D IP address, the group address.
The WSS listens for multicast packets and maintains a table of multicast groups, as well as their sources and receivers,
based on the traffic. IGMP snooping is enabled by default.
You can configure IGMP snooping parameters and enable or disable the feature on an individual VLAN basis.
The current software version supports IGMP versions 1 and 2.
Disabling or reenabling IGMP snooping
IGMP snooping is enabled by default. To disable or reenable the feature, use the following command:
set igmp {enable | disable} [vlan vlan-id]
If you do not specify a VLAN ID, the change is applied to all VLANs on the WSS.
Disabling or reenabling proxy reporting
Proxy reporting reduces multicast overhead by sending only one report for each active group to the multicast routers,
instead of sending a separate report from each multicast receiver. For example, if the WSS receives reports from three
receivers for multicast group 237.255.255.255, the switch sends only one report for the group to the routers. One report
is sufficient to cause the routers to continue sending data for the group. Proxy reporting is enabled by default.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
466 Configuring and managing IGMP snooping
To disable or reenable proxy reporting, use the following command:
set igmp proxy-report {enable | disable} [vlan vlan-id]
Enabling the pseudo-querier
The IGMP pseudo-querier enables IGMP snooping to operate in a VLAN that does not have a multicast router to send
IGMP general queries to clients.
Note. Nortel recommends that you use the pseudo-querier only when the VLAN
contains local multicast traffic sources and no multicast router is servicing the subnet.
To enable the pseudo-querier, use the following command:
set igmp querier {enable | disable} [vlan vlan-id]
Changing IGMP timers
You can change the following IGMP timers:
•
•
•
Query interval—Number of seconds that elapse between general queries sent by the WSS to advertise multicast
groups.
Other-querier-present interval—Number of seconds that the WSS waits for a general query to arrive from another
querier before electing itself the querier.
Query response interval—Number of tenths of a second that the WSS waits for a receiver to respond to a
group-specific query message before removing the receiver from the receiver list for the group.
Note. The query interval, other-querier-present interval, and query response
interval are applicable only when the WSS is querier for the subnet. For the switch
to become the querier, the pseudo-querier feature must be enabled on the switch
and the switch must have the lowest IP address among all the devices eligible to
•
•
Last member query interval—Number of tenths of a second that the WSS waits for a response to a group-specific
query after receiving a leave message for that group, before removing the receiver that sent the leave message from
the list of receivers for the group. If there are no more receivers for the group, the switch also sends a leave message
for the group to multicast routers.
Robustness value—Number used as a multiplier to adjust the IGMP timers to the amount of traffic loss that occurs
on the network. Set the robustness value higher to adjust for more traffic loss.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IGMP snooping 467
Changing the query interval
To change the IGMP query interval timer, use the following command:
set igmp qi seconds [vlan vlan-id]
For seconds, you can specify a value from 1 through 65,535. The default is 125 seconds.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
468 Configuring and managing IGMP snooping
Changing the other-querier-present interval
To change the other-querier-present interval, use the following command:
set igmp oqi seconds [vlan vlan-id]
For seconds, you can specify a value from 1 through 65,535. The default is 255 seconds.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IGMP snooping 469
Changing the query response interval
To set the query response interval, use the following command:
set igmp qri tenth-seconds [vlan vlan-id]
You can specify a value from 1 through 65,535 tenths of a second. The default is 100 tenths of a second (10 seconds).
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
470 Configuring and managing IGMP snooping
Changing the last member query interval
To set the last member query interval, use the following command:
set igmp lmqi tenth-seconds [vlan vlan-id]
You can specify a value from 1 through 65,535 tenths of a second. The default is 10 tenths of a second (1 second).
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IGMP snooping 471
Changing robustness
Robustness adjusts the IGMP timers to the amount of traffic loss that occurs on the network. Set the robustness value
higher to adjust for more traffic loss. To change the robustness value, use the following command:
set igmp rv num [vlan vlan-id]
You can specify a value from 2 through 255. The default is 2.
Enabling router solicitation
A WSS can search for multicast routers by sending multicast router solicitation messages. This message invites
multicast routers that receive the message and that support router solicitation to immediately advertise themselves to the
WSS. Router solicitation is disabled by default.
The WSS Software implementation of router solicitation is based on draft-ietf-idmr-igmp-mrdisc-09.txt.
To enable or disable multicast router solicitation, use the following command:
set igmp mrsol {enable | disable} [vlan vlan-id]
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
472 Configuring and managing IGMP snooping
Changing the router solicitation interval
The default multicast router solicitation interval is 30 seconds. To change the interval, use the following command:
set igmp mrsol mrsi seconds [vlan vlan-id]
You can specify 1 through 65,535 seconds. The default is 30 seconds.
Configuring static multicast ports
A WSS learns about multicast routers and receivers from multicast traffic it receives from those devices. When the WSS
receives traffic from a multicast router or receiver, the switch adds the port that received the traffic as a multicast router
or receiver port. The WSS forwards traffic to multicast routers only on the multicast router ports and forwards traffic to
multicast receivers only on the multicast receiver ports.
The router and receiver ports that the WSS learns based on multicast traffic age out if they are unused.
You can add network ports as static multicast router ports or multicast receiver ports. Ports you add do not age out.
Note. You cannot add AP access ports or wired authentication ports as static multicast
ports. However, WSS Software can dynamically add these port types to the list of multicast
ports based on multicast traffic.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IGMP snooping 473
Adding or removing a static multicast router port
To add or remove a static multicast router port, use the following command:
set igmp mrouter port port-list enable | disable
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
474 Configuring and managing IGMP snooping
Adding or removing a static multicast receiver port
To add a static multicast receiver port, use the following command:
set igmp receiver port port-list enable | disable
Displaying multicast information
You can use the CLI to display the following IGMP snooping information:
•
•
•
•
Multicast configuration information and statistics
Multicast queriers
Multicast routers
Multicast receivers
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IGMP snooping 475
Displaying multicast configuration information and statistics
To display multicast configuration information and statistics, use the following command:
show igmp [vlan vlan-id]
The show igmp command displays the IGMP snooping state, the settings of all multicast parameters you can configure,
and multicast statistics.
To display multicast information for VLAN orange, type the following command:
WSS# show igmp vlan orange
VLAN: orange
IGMP is enabled
Proxy reporting is on
Mrouter solicitation is on
Querier functionality is off
Configuration values: qi: 125 oqi: 300 qri: 100 lmqi: 10 rvalue: 2 Multicast
router information:
Port Mrouter-IPaddr Mrouter-MAC
Type TTL
---- --------------- ----------------- ----- -----
10
192.28.7.5 00:01:02:03:04:05 dvmrp 17
Group
---------------
Port Receiver-IP
--------------------
none
5
5
5
5
5
Receiver-MAC
-----------------
none
10.10.10.11 00:02:04:06:08:0b
10.10.10.13 00:02:04:06:08:0d
10.10.10.14 00:02:04:06:08:0e
10.10.10.12 00:02:04:06:08:0c
10.10.10.10 00:02:04:06:08:0a
TTL
-------
undef
258
224.0.0.2 none
237.255.255.255
237.255.255.255
237.255.255.255
237.255.255.255
237.255.255.255
258
258
258
258
Querier information: Querier for vlan orange
Port
------
1
Querier-IP
----------------------
193.122.135.178
Querier-MAC
---------------------
00:0b:cc:d2:e9:b4
TTL
-------
23
IGMP vlan member ports: 10, 12, 11, 14, 16, 15, 13, 18, 17, 1, 20, 21, 2, 22, 19, 4, 6, 5, 3, 8, 7, 9
IGMP static ports: none
IGMP statistics for vlan orange:
IGMP message type
-------------------------
General-Queries
GS-Queries
Received
-----------
0
0
Transmitted
----------------
Dropped
-----------
0
0
0
0
Report V1
Report V2
0
5
0
1
0
4
Leave
0
0
0
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
476 Configuring and managing IGMP snooping
Mrouter-Adv
Mrouter-Term
Mrouter-Sol
DVMRP
0
0
50
4
0
0
101
4
0
0
0
0
PIM V1
0
0
0
PIM V2
0
0
0
Topology notifications:
0
Packets with unknown IGMP type: 0
Packets with bad length:
Packets with bad checksum:
Packets dropped:
0
0
4
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Displaying multicast statistics only
To display multicast statistics only without also displaying all the other multicast information, use the following
command:
show igmp statistics [vlan vlan-id]
Clearing multicast statistics
To clear the multicast statistics counters, use the following command:
clear igmp statistics [vlan vlan-id]
The counters begin incrementing again, starting from 0.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IGMP snooping 477
Displaying multicast queriers
To display information about the multicast querier only without also displaying all the other multicast information, use
the following command:
show igmp querier [vlan vlan-id]
To display querier information for VLAN orange, type the following command:
WSS# show igmp querier vlan orange
Querier for vlan orange
Port Querier-IP
Querier-MAC
TTL
---- --------------- ----------------- -----
1 193.122.135.178 00:0b:cc:d2:e9:b4 23
In this example, the pseudo-querier feature is enabled on VLAN orange.
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
478 Configuring and managing IGMP snooping
Displaying multicast routers
To display information about the multicast routers only without also displaying all the other multicast information, use
the following command:
show igmp mrouter [vlan vlan-id]
To display the multicast routers in VLAN orange, type the following command:
WSS# show igmp mrouter vlan orange
Multicast routers for vlan orange
Port Mrouter-IPaddr Mrouter-MAC
Type TTL
---- --------------- ----------------- ----- -----
10
192.28.7.5 00:01:02:03:04:05 dvmrp 33
(For information about the fields in this display, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing IGMP snooping 479
Displaying multicast receivers
To display information about the multicast receivers only without also displaying all the other multicast information, use
the following command:
show igmp receiver-table [vlan vlan-id]
[group group-ip-addr/mask-length]
Use the group parameter to display receivers for a specific group or set of groups. For example, to display receivers for
multicast groups 237.255.255.1 through 237.255.255.255, in all VLANs, type the following command:
WSS# show igmp receiver-table group 237.255.255.0/24
VLAN: red
Session
---------------
237.255.255.2
237.255.255.119
Port
-------
2
Receiver-IP
---------------
10.10.20.19
10.10.30.31
Receiver-MAC
TTL
--------
112
------------------------
00:02:04:06:09:0d
00:02:04:06:01:0b
3
112
VLAN: green
Session
---------------
237.255.255.17
237.255.255.255
Port
-------
11
Receiver-IP
---------------
10.10.40.41
10.10.60.61
Receiver-MAC
TTL
--------
12
------------------------
00:02:06:08:02:0c
00:05:09:0c:0a:01
6
111
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
480 Configuring and managing IGMP snooping
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
481
Configuring and managing security
ACLs
About security access control lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
Creating and committing a security ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
Mapping security ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
Modifying a security ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500
Using ACLs to change CoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Enabling prioritization for legacy voice over IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508
Security ACL configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516
About security access control lists
A security access control list (ACL) filters packets for the purpose of discarding them, permitting them, or permitting
them with modification (marking) for class-of-service (CoS) priority treatment. A typical use of security ACLs is to
enable users to send and receive packets within the local intranet, but restrict incoming packets to the server in which
confidential salary information is stored.
Nortel provides a very powerful mapping application for security ACLs. In addition to being assigned to physical ports,
VLANs, virtual ports in a VLAN, or Distributed APs, ACLs can be mapped dynamically to a user’s session, based on
authorization information passed back from the AAA server during the user authentication process.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
482 Configuring and managing security ACLs
Overview of security ACL commands
Figure 31 provides a visual overview of the way you use WSS Software commands to set a security ACL, commit the
ACL so it is stored in the configuration, and map the ACL to a user session, VLAN, port, virtual port, or Distributed AP.
Figure 31. Setting security ACLs
ACLs in
edit buffer
null
null
Commited ACLs
ACLs mapped
to users
ACLs mapped to ports,
VLANs, and virtual ports
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 483
Security ACL filters
A security ACL filters packets to restrict or permit network traffic. These filters can then be mapped by name to authen-
ticated users, ports, VLANs, virtual ports, or Distributed APs. You can also assign a class-of-service (CoS) level that
marks the packets matching the filter for priority handling.
A security ACL contains an ordered list of rules called access control entries (ACEs), which specify how to handle
packets. An ACE contains an action that can deny the traffic, permit the traffic, or permit the traffic and apply to it a
specific CoS level of packet handling. The filter can include source and destination IP address information along with
other Layer 3 and Layer 4 parameters. Action is taken only if the packet matches the filter.
The order in which ACEs are listed in an ACL is important. WSS Software applies ACEs that are higher in the list
before ACEs lower in the list. (See “Modifying a security ACL” on page 500.) An implicit “deny all” rule is always
processed as the last ACE of an ACL. If a packet matches no ACE in the entire mapped ACL, the packet is rejected. If
the ACL does not contain at least one ACE that permits access, no traffic is allowed.
Plan your security ACL maps to ports, VLANs, virtual ports, and Distributed APs so that only one security ACL filters a
given flow of packets. If more than one security ACL filters the same traffic, WSS Software applies only the first ACL
match and ignores any other matches. Security ACLs that are mapped to users have precedence over ACLs mapped to
ports, VLANs, virtual ports, or Distributed APs.
You cannot perform ACL functions that include permitting, denying, or marking with a Class of Service (CoS) level on
packets with a multicast or broadcast destination address.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
484 Configuring and managing security ACLs
Order in which ACLs are applied to traffic
WSS Software provides different scopes (levels of granularity) for ACLs. You can apply an ACL to any of the following
scopes:
•
•
•
•
User
VLAN
Virtual port (physical ports plus specific VLAN tags)
Physical Port (network ports or Distributed APs)
WSS Software begins comparing traffic to ACLs in the order the scopes are listed above. If an ACL is mapped to more
than one of these scopes, the first ACL that matches the packet is applied and WSS Software does not compare the
packet to any more ACLs. For example, if different ACLs are mapped to both a user and a VLAN, and a user’s traffic
can match both ACLs, only the ACL mapped to the user is applied.
Traffic direction
An ACL can be mapped at any scope to either the inbound traffic direction or the outbound traffic direction. It is
therefore possible for two ACLs to be applied to the same traffic as it traverses the system: one ACL is applied on the
inbound direction and the other is applied on the outbound direction. When you map an ACL to one of the scopes listed
above, you also specify the traffic direction to which the ACL applies.
Selection of user ACLs
Identity-based ACLs (ACLs mapped to users) take precedence over location-based ACLs (ACLs mapped to VLANs,
ports, virtual ports, or Distributed APs).
ACLs can be mapped to a user in the following ways:
•
•
•
Location policy (inacl or outacl is configured on the location policy)
User group (attr filter-id acl-name.in or attr filter-id acl-name.out is configured on the user group)
Individual user attribute (attr filter-id acl-name.in or attr filter-id acl-name.out is configured on the individual
user)
•
SSID default (attr filter-id acl-name.in or attr filter-id acl-name.out is configured on the SSID’s service profile)
The user’s ACL comes from only one of these sources. The sources are listed in order from highest precedence to lowest
precedence. For example, if a user associates with an SSID that has a default ACL configured, but a location policy is
also applicable to the user, the ACL configured on the location policy is used.
Creating and committing a security ACL
The security ACLs you create can filter packets by source address, IP protocol, port type, and other characteristics.
When you configure an ACE for a security ACL, WSS Software stores the ACE in the edit buffer until you commit the
ACL to be saved to the permanent configuration. You must commit a security ACL before you can apply it to an authen-
ticated user’s session or map it to a port, VLAN, virtual port, or Distributed AP. Every security ACL must have a name.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 485
Setting a source IP ACL
You can create an ACE that filters packets based on the source IP address and optionally applies CoS packet handling.
(For CoS details, see “Class of Service” on page 486.) You can also determine where the ACE is placed in the security
ACL by using the before editbuffer-index or modify editbuffer-index variables with an index number. You can use the
hits counter to track how many packets the ACL filters.
The simplest security ACL permits or denies packets from a source IP address:
set security acl ip acl-name {permit [cos cos] | deny}
{source-ip-addr mask | any} [before editbuffer-index | modify editbuffer-index] [hits]
For example, to create ACL acl-1 that permits all packets from IP address 192.168.1.4, type the following command:
WSS# set security acl ip acl-1 permit 192.168.1.4 0.0.0.0
With the following basic security ACL command, you can specify any of the protocols supported by WSS Software:
set security acl ip acl-name {permit [cos cos] | deny} protocol-number
{source-ip-addr mask | any} {destination-ip-addr mask | any} [[precedence precedence] [tos
tos] | [dscp codepoint]] [before editbuffer-index | modify editbuffer-index] [hits]
The following sample security ACL permits all Generic Routing Encapsulation (GRE) packets from source IP address
192.168.1.11 to destination IP address 192.168.1.15, with a precedence level of 0 (routine), and a type-of-service (TOS)
level of 0 (normal). (For more information about type-of-service and precedence levels, see the Nortel WLAN Security
Switch 2300 Series Command Line Reference.) GRE is protocol number 47.
WSS# set security acl ip acl-2 permit cos 2 47 192.168.1.11 0.0.0.0 192.168.1.15 0.0.0.0
precedence 0 tos 0 hits
The security ACL acl-2 described above also applies the CoS level 2 (medium priority) to the permitted packets. (For
CoS details, see “Class of Service” on page 486.) The keyword hits counts the number of times this ACL affects packet
traffic.
Table 27 lists common IP protocol numbers. (For a complete list of IP protocol names and numbers, see www.iana.org/
assignments/protocol-numbers.) For commands that set security ACLs for specific protocols, see the following
information:
•
•
•
Table 27: Common IP protocol numbers
Number
IP Protocol
1
2
6
9
Internet Message Control Protocol (ICMP)
Internet Group Management Protocol (IGMP)
Transmission Control Protocol (TCP)
Any private interior gateway (used by Cisco for Internet Gateway Routing
Protocol)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
486 Configuring and managing security ACLs
Table 27: Common IP protocol numbers
Number
IP Protocol
17
46
User Datagram Protocol (UDP)
Resource Reservation Protocol (RSVP)
Generic Routing Encapsulation (GRE) protocol
Encapsulation Security Payload for IPSec (IPSec-ESP)
Authentication Header for IPSec (IPSec-AH)
IP Mobility (Mobile IP)
47
50
51
55
88
Enhanced Interior Gateway Routing Protocol (EIGRP)
Open Shortest Path First (OSPF) protocol
Protocol Independent Multicast (PIM) protocol
Virtual Router Redundancy Protocol (VRRP)
Layer Two Tunneling Protocol (L2TP)
89
103
112
115
Wildcard masks
When you specify source and destination IP addresses in an ACE, you must also include a mask for each in the
form source-ip-addr mask and destination-ip-addr mask.
The mask is a wildcard mask. The security ACL checks the bits in IP addresses that correspond to any 0s
(zeros) in the mask, but does not check the bits that correspond to 1s (ones) in the mask. Specify the IP address
and wildcard mask in dotted decimal notation. For example, the IP address and wildcard mask 10.0.0.0 and
0.255.255.255 match all IP addresses that begin with 10 in the first octet.
Class of Service
Class-of-service (CoS) assignment determines the priority treatment of packets transmitted by a WSS, corre-
sponding to a forwarding queue on the AP. Table 28 shows the results of CoS priorities you assign in security
ACLs.
Table 28: Class-of-Service (CoS) packet
handling
WMM Priority
Desired
CLI CoS Value to
Enter
Background
Best effort
Video
1 or 2
0 or 3
4 or 5
6 or 7
Voice
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 487
AP forwarding prioritization occurs automatically for Wi-Fi Multimedia (WMM) traffic. You do not need to
configure ACLs to provide WMM prioritization. For non-WMM devices, you can provide AP forwarding
prioritization by configuring ACLs.
If you disable WMM, AP forwarding prioritization is optimized for SpectraLink Voice Priority (SVP) instead
of WMM, and the AP does not tag packets it sends to the WSS. Otherwise, the classification and tagging
If you plan to use SVP or another non-WMM type of prioritization, you must configure ACLs to tag the
Optionally, for WMM or non-WMM traffic, you can use ACLs to change the priority of traffic sent to an AP
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
488 Configuring and managing security ACLs
Setting an ICMP ACL
With the following command, you can use security ACLs to set Internet Control Message Protocol (ICMP) parameters
for the ping command:
set security acl ip acl-name {permit [cos cos] | deny} icmp {source-ip-addr mask | any}
{destination-ip-addr mask | any} [type icmp-type] [code icmp-code]
[[precedence precedence] [tos tos] | [dscp codepoint]]
[before editbuffer-index | modify editbuffer-index] [hits]
An ICMP ACL can filter packets by source and destination IP address, TOS level, precedence, ICMP type, and ICMP
code. For example, the following command permits all ICMP packets coming from 192.168.1.3 and going to
192.168.1.4 that also meet the following conditions:
•
•
•
•
ICMP type is 11 (Time Exceeded).
ICMP code is 0 (Time to Live Exceeded).
Type-of-service level is 12 (minimum delay plus maximum throughput).
Precedence is 7 (network control).
WSS# set security acl ip acl-3 permit icmp 192.168.1.3 0.0.0.0 192.168.1.4 0.0.0.0 type 11 code
0 precedence 7 tos 12 before 1 hits
The before 1 portion of the ACE places it before any others in the ACL, so it has precedence over any later ACEs for
any parameter settings that are met.
For more information about changing the order of ACEs or otherwise modifying security ACLs, see “Modifying a
security ACL” on page 500. For information about TOS and precedence levels, see the Nortel WLAN Security Switch
ICMP includes many messages that are identified by a type field. Some also have a code within that type. Table 29 lists
some common ICMP types and codes. For more information, see www.iana.org/assignments/icmp-parameters.
Table 29: Common ICMP message types and codes
ICMP Message Type (Number)
ICMP Message Code (Number)
Echo Reply (0)
None
Destination Unreachable (3)
•
•
•
•
•
•
Network Unreachable (0)
Host Unreachable (1)
Protocol Unreachable (2)
Port Unreachable (3)
Fragmentation Needed (4)
Source Route Failed (5)
Source Quench (4)
Redirect (5)
None
•
•
•
•
Network Redirect (0)
Host Redirect (1)
Type of Service (TOS) and Network Redirect (2)
TOS and Host Redirect (3)
Echo (8)
None
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 489
Table 29: Common ICMP message types and codes (continued)
ICMP Message Type (Number)
ICMP Message Code (Number)
Time Exceeded (11)
•
•
Time to Live (TTL) Exceeded (0)
Fragment Reassembly Time Exceeded (1)
Parameter Problem (12)
Timestamp (13)
None
None
None
None
None
Timestamp Reply (14)
Information Request (15)
Information Reply (16)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
490 Configuring and managing security ACLs
Setting TCP and UDP ACLs
Security ACLs can filter TCP and UDP packets by source and destination IP address, precedence, and TOS
level. You can apply a TCP ACL to established TCP sessions only, not to new TCP sessions. In addition,
security ACLs for TCP and UDP can filter packets according to a source port on the source IP address and/or
a destination port on the destination IP address, if you specify a port number and an operator in the ACE. (For
The operator indicates whether to filter packets arriving from or destined for a port whose number is equal to
(eq), greater than (gt), less than (lt), not equal to (neq), or in a range that includes (range) the specified port.
To specify a range of TCP or UDP ports, you enter the beginning and ending port numbers.
Note. The CLI does not accept port names in ACLs. To filter on ports by name, you must
use WLAN Management Software. For more information, see the Nortel WLAN
Management Software 2300 Series Reference Guide.
Setting a TCP ACL
The following command filters TCP packets:
set security acl ip acl-name {permit [cos cos] | deny}
tcp {source-ip-addr mask | any [operator port [port2]]} {destination-ip-addr mask |
any [operator port [port2]]} [[precedence precedence] [tos tos] | [dscp codepoint]]
[established] [before editbuffer-index | modify editbuffer-index] [hits]
For example, the following command permits packets sent from IP address 192.168.1.5 to 192.168.1.6 with
the TCP destination port equal to 524, a precedence of 7, and a type of service of 15, on an established TCP
session, and counts the number of hits generated by the ACE:
WSS# set security acl ip acl-4 permit tcp 192.168.1.5 0.0.0.0 192.168.1.6 0.0.0.0 eq 524
precedence 7 tos 15 established hits
(For information about TOS and precedence levels, see the Nortel WLAN Security Switch 2300 Series
Setting a UDP ACL
The following command filters UDP packets:
set security acl ip acl-name {permit [cos cos] | deny} udp {source-ip-addr mask | any
[operator port [port2]]} {destination-ip-addr mask | any [operator port [port2]]}
[[precedence precedence] [tos tos] | [dscp codepoint]]
[before editbuffer-index | modify editbuffer-index] [hits]
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 491
For example, the following command permits UDP packets sent from IP address 192.168.1.7 to IP address 192.168.1.8,
with any UDP destination port less than 65,535. It puts this ACE first in the ACL, and counts the number of hits
generated by the ACE.
WSS# set security acl ip acl-5 permit udp 192.168.1.7 0.0.0.0 192.168.1.8 0.0.0.0 lt 65535
precedence 7 tos 15 before 1 hits
(For information about TOS and precedence levels, see the Nortel WLAN Security Switch 2300 Series Command Line
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
492 Configuring and managing security ACLs
Determining the ACE order
The set security acl command creates a new entry in the edit buffer and appends the new entry as a rule at the end of an
ACL, unless you specify otherwise. The order of ACEs is significant, because the earliest ACE takes precedence over
later ACEs. To place the ACEs in the correct order, use the parameters before editbuffer-index and modify edit-
buffer-index. The first ACE is number 1.
To specify the order of the commands, use the following parameters:
•
•
before editbuffer-index inserts an ACE before a specific location.
modify editbuffer-index changes an existing ACE.
If the security ACL you specify when creating an ACE does not exist when you enter set security acl ip, the specified
ACL is created in the edit buffer. If the ACL exists but is not in the edit buffer, the ACL reverts, or is rolled back, to the
state when its last ACE was committed, but it now includes the new ACE.
For details, see “Placing one ACE before another” on page 502 and “Modifying an existing security ACL” on page 503.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 493
Committing a Security ACL
To put the security ACLs you have created into effect, use the commit security acl command with the name of the ACL.
For example, to commit acl-99, type the following command:
WSS# commit security acl acl-99
success: change accepted.
To commit all the security ACLs in the edit buffer, type the following command:
WSS# commit security acl all
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
494 Configuring and managing security ACLs
Viewing security ACL information
To determine whether a security ACL is committed, you can check the edit buffer and the committed ACLs. After you
commit an ACL, WSS Software removes it from the edit buffer.
To display ACLs, use the following commands:
show security acl editbuffer
show security acl info all editbuffer
show security acl info
show security acl
Use the first two commands to display the ACLs that you have not yet committed to nonvolatile storage. The first
command lists the ACLs by name. The second command shows the ACLs in detail.
Use the show security acl info command to display ACLs that are already committed. ACLs are not available for
mapping until you commit them. (To commit an ACL, use the commit security acl command. See “Committing a
ACLs do not take effect until you map them to something (a user, Distributed AP, VLAN, port, or virtual port). To map
an ACL, see “Mapping security ACLs” on page 496. To display the mapped ACLs, use the show security acl command,
without the editbuffer or info option.
Viewing the edit buffer
The edit buffer enables you to view the security ACLs you create before committing them to the configuration. To view
a summary of the ACLs in the edit buffer, type the following command:
WSS# show security acl editbuffer
ACL edit-buffer table
ACL
Type Status
-------------------------------- ---- -------------
acl-99
acl-blue
acl-violet
IP Not committed
IP Not committed
IP Not committed
Viewing committed security ACLs
To view a summary of the committed security ACLs in the configuration, type the following command:
WSS# show security acl
ACL table
ACL
------
acl-2
acl-3
acl-4
Type Class Mapping
---------------------------
IP Static
IP Static
IP Static
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 495
Viewing security ACL details
You can display the contents of one or all security ACLs that are committed. To display the contents of all committed
security ACLs, type the following command:
WSS# show security acl info
ACL information for all
set security acl ip acl-999 (hits #2 0)
----------------------------------------------------
1. deny IP source IP 192.168.0.1 0.0.0.0 destination IP any
2. permit IP source IP 192.168.0.2 0.0.0.0 destination IP any enable-hits
set security acl ip acl-2 (hits #1 0)
----------------------------------------------------
1. permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0 destination IP 192.168.1.15 0.0.0.0
precedence 0 tos 0 enable-hits
You can also view a specific security ACL. For example, to view acl-2, type the following command:
WSS# show security acl info acl-2
ACL information for acl-2
set security acl ip acl-2 (hits #1 0)
----------------------------------------------------
1. permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0 destination IP 192.168.1.15 0.0.0.0
precedence 0 tos 0 enable-hits
Displaying security ACL hits
Once you map an ACL, you can view the number of packets it has filtered, if you included the keyword hits. (For infor-
WSS# show security acl hits
ACL hit-counters
Index Counter
--------------------
1
2
5
ACL-name
---------------
0 acl-2
0 acl-999
916 acl-123
To sample the number of hits the security ACLs generate, you must specify the number of seconds between samples. For
example, to sample the hits generated every 180 seconds, type the following commands:
WSS# set security acl hit-sample-rate 180
WSS# show security acl hits
ACL hit-counters
Index Counter
-------------------
1
2
ACL-name
--------------
31986 acl-red
0 acl-green
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
496 Configuring and managing security ACLs
Clearing security ACLs
The clear security acl command removes the ACL from the edit buffer only. To clear a security ACL, enter a specific
ACL name, or enter all to delete all security ACLs. To remove the security ACL from the running configuration and
nonvolatile storage, you must also use the commit security acl command.
For example, the following command deletes acl-99 from the edit buffer:
WSS# clear security acl acl-99
To clear acl-99 from the configuration, type the following command:
WSS# commit security acl acl-99
success: change accepted
Mapping security ACLs
An ACL does not take effect until you commit it and map it to a user or an interface.
User-based security ACLs are mapped to an IEEE 802.1X authenticated session during the AAA process. You can
specify that one of the authorization attributes returned during authentication is a named security ACL. The WSS maps
the named ACL automatically to the user’s authenticated session.
Security ACLs can also be mapped statically to ports, VLANs, virtual ports, or Distributed APs. User-based ACLs are
processed before these ACLs, because they are more specific and closer to the network edge.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 497
Mapping user-based security ACLs
When you configure administrator or user authentication, you can set a Filter-Id authorization attribute at the
RADIUS server or at the WSS’s local database. The Filter-Id attribute is a security ACL name with the
direction of the packets appended—for example, acl-name.in or acl-name.out. The security ACL mapped by
Filter-Id instructs the WSS to use its local definition of the ACL, including the flow direction, to filter packets
for the authenticated user.
Note. The Filter-Id attribute is more often received by the WSS through an external AAA
RADIUS server than applied through the local database.
To map a security ACL to a user session, follow these steps:
1
2
3
Create the security ACL. For example, to filter packets coming from 192.168.253.1 and going
to 192.168.253.12, type the following command:
WSS#set security acl ip acl-222 permit ip 192.168.253.1 0.0.0.0 198.168.253.12
0.0.0.0 hits
Commit the security ACL to the running configuration. For example, to commit acl-222, type
the following command:
WSS# commit security acl acl-222
success: change accepted.
Apply the Filter-Id authentication attribute to a user’s session via an external RADIUS server.
For instructions, see the documentation for your RADIUS server.
Note. If the Filter-Id value returned through the authentication and authorization
process does not match the name of a committed security ACL in the WSS, the
user fails authorization and cannot be authenticated.
4
Alternatively, authenticate the user with the Filter-Id attribute in the WSS’s local database. Use
one of the following commands. Specify .in for incoming packets or .out for outgoing packets.
Mapping Target
Commands
User authenticated by a
password
set user username attr filter-id acl-name.in
set user username attr filter-id acl-name.out
User authenticated by a
MAC address
set mac-user username attr filter-id acl-name.in
set mac-user username attr filter-id acl-name.out
When assigned the Filter-Id attribute, an authenticated user with a current session receives
packets based on the security ACL. For example, to restrict incoming packets for Natasha to
those specified in acl-222, type the following command:
WSS#set user Natasha attr filter-id acl-222.in
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
498 Configuring and managing security ACLs
You can also map a security ACL to a user group. For details, see “Assigning a security ACL to a user or a group” on
page 602. For more information about authenticating and authorizing users, see “About Administrative Access” on
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 499
Mapping security ACLs to ports, VLANs, virtual ports, or distributed APs
Security ACLs can be mapped to ports, VLANs, virtual ports, and Distributed APs. Use the following command:
set security acl map acl-name {vlan vlan-id | port port-list [tag tag-value] | ap ap-num} {in | out}
Specify the name of the ACL, the port, VLAN, tag value(s) of the virtual port, or the number of the Distributed AP to
which the ACL is to be mapped, and the direction for packet filtering. For virtual ports or Distributed APs, you can
specify a single value, a comma-separated list of values, a hyphen-separated range, or any combination, with no spaces.
For example, to map security ACL acl-222 to virtual ports 1 through 3 and 5 on port 2 to filter incoming packets, type
the following command:
WSS# set security acl map acl-222 port 2 tag 1-3,5 in
success: change accepted.
Plan your security ACL maps to ports, VLANs, virtual ports, and Distributed APs so that only one security ACL filters a
flow of packets. If more than one security ACL filters the same traffic, you cannot guarantee the order in which the ACE
rules are applied.
Displaying ACL maps to ports, VLANs, and virtual ports
Two commands display the port, VLAN, virtual port, and Distributed AP mapping of a specific security ACL. For
example, to show the ports, VLANs, virtual ports, and Distributed APs mapped to acl-999, type one of the following
commands:
WSS# show security acl map acl-999
ACL acl-999 is mapped to:
Port 9 In
Port 9 Out
WSS# show security acl
ACL table
ACL
Type Class
--------------
IP
IP
Mapping
------------
Static
--------------
acl-orange
acl-999
Static Port 9 In
Port 9 Out
acl-blue
acl-violet
IP
IP
Static Port 1 In
Static VLAN 1 Out
Clearing a security ACL map
To clear the mapping between a security ACL and one or more ports, VLANs, virtual ports, or Distributed APs, first
display the mapping with show security acl map and then use clear security acl map to remove it. This command
removes the mapping, but not the ACL.
For example, to clear the security ACL acljoe from a port, type the following commands:
WSS# show security acl map acljoe
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
500 Configuring and managing security ACLs
ACL acljoe is mapped to:
Port 4 In
WSS# clear security acl map acljoe port 4 in
success: change accepted.
After you clear the mapping between port 4 and ACL acljoe, the following is displayed when you enter show security
acl map:
WSS# show security acl map acljoe
ACL acljoe is mapped to:
Clearing a security ACL mapping does not stop the current filtering function if the ACL has other mappings. If the
security ACL is mapped to another port, a VLAN, a virtual port, or a Distributed AP, you must enter a clear security acl
map command to clear each map.
To stop the packet filtering of a user-based security ACL, you must modify the user’s configuration in the local database
on the WSS or on the RADIUS servers where packet filters are authorized. For information about deleting a security
ACL from a user’s configuration in the local WSS database, see “Clearing a security ACL from a user or group” on
page 603. To delete a security ACL from a user’s configuration on a RADIUS server, see the documentation for your
RADIUS server.
If you no longer need the security ACL, delete it from the configuration with the clear security acl and commit security
Modifying a security ACL
You can modify a security ACL in the following ways:
•
•
•
•
Add another ACE to a security ACL, at the end of the ACE list. (See “Adding another ACE to a security ACL” on
page 501.)
Place an ACE before another ACE, so it is processed before subsequent ACEs, using the before editbuffer-index
Modify an existing ACE using the modify editbuffer-index portion of the set security acl commands. (See
Use the rollback command set to clear changes made to the security ACL edit buffer since the last time it was
saved. The ACL is rolled back to its state at the last commit command. (See “Clearing security ACLs from the edit
•
•
Use the clear security acl map command to stop the filtering action of an ACL on a port, VLAN, or virtual port.
Use clear security acl plus commit security acl to completely delete the ACL from the WSS switch’s
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 501
Adding another ACE to a security ACL
The simplest way to modify a security ACL is to add another ACE. For example, suppose you wanted to modify an
existing ACL named acl-violet. Follow these steps:
1
To display all committed security ACLs, type the following command:
WSS# show security acl info
ACL information for all
set security acl ip acl-violet (hits #2 0)
----------------------------------------------------
1. permit IP source IP 192.168.253.1 0.0.0.255 destination IP
any enable-hits
2
3
To add another ACE to the end of acl-violet, type the following command:
WSS#set security acl ip acl-violet permit 192.168.123.11 0.0.0.255 hits
To commit the updated security ACL acl-violet, type the following command:
WSS# commit security acl acl-violet
success: change accepted.
4
To display the updated acl-violet, type the following command:
WSS# show security acl info
ACL information for all
set security acl ip acl-violet (hits #2 0)
----------------------------------------------------
1. permit IP source IP 192.168.253.1 0.0.0.255 destination IP
any enable-hits
2. permit IP source IP 192.168.123.11 0.0.0.255 destination IP
any enable-hits
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
502 Configuring and managing security ACLs
Placing one ACE before another
You can use the before editbuffer-index portion of the set security acl command to place a new ACE before an existing
ACE. For example, suppose you want to deny some traffic from IP address 192.168.254.12 in acl-111. Follow these
steps:
1
To display all committed security ACLs, type the following command:
WSS# show security acl info
ACL information for all
set security acl ip acl-111 (hits #4 0)
----------------------------------------------------
1. permit IP source IP 192.168.253.11 0.0.0.0 destination IP
any
set security acl ip acl-2 (hits #1 0)
----------------------------------------------------
1. permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0
destination IP 192.168.1.15 0.0.0.0 precedence 0 tos 0
enable-hits
2
3
To add the deny ACE to acl-111 and place it first, type the following commands:
WSS# set security acl ip acl-111 deny 192.168.254.12 0.0.0.255 before 1
WSS# commit security acl acl-111
success: change accepted.
To view the results, type the following command:
WSS# show security acl info
ACL information for all
set security acl ip acl-111 (hits #4 0)
----------------------------------------------------
1. deny IP source IP 192.168.254.12 0.0.0.255 destination IP
any
2. permit IP source IP 192.168.253.11 0.0.0.0 destination IP
any
set security acl ip acl-2 (hits #1 0)
----------------------------------------------------
1. permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0
destination IP 192.168.1.15 0.0.0.0 precedence 0 tos 0
enable-hits
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 503
Modifying an existing security ACL
You can use the modify editbuffer-index portion of the set security acl command to modify an active security ACL. For
example, suppose the ACL acl-111 currently blocks some packets from IP address 192.168.254.12 with the mask
0.0.0.255 and you want to change the ACL to permit all packets from this address. Follow these steps:
1
To display all committed security ACLs, type the following command:
WSS# show security acl info
ACL information for all
set security acl ip acl-111 (hits #4 0)
----------------------------------------------------
1. deny IP source IP 192.168.254.12 0.0.0.255 destination IP
any
2. permit IP source IP 192.168.253.11 0.0.0.0 destination IP
any
set security acl ip acl-2 (hits #1 0)
----------------------------------------------------
1. permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0
destination IP 192.168.1.15 0.0.0.0 precedence 0 tos 0
enable-hits
2
3
To modify the first ACE in acl-111, type the following commands:
WSS# set security acl ip acl-111 permit 192.168.254.12 0.0.0.0 modify 1
WSS# commit security acl acl-111
success: change accepted.
To view the results, type the following command:
WSS# show security acl info
ACL information for all
set security acl ip acl-111 (hits #4 0)
----------------------------------------------------
1. permit IP source IP 192.168.254.12 0.0.0.0 destination IP
any
2. permit IP source IP 192.168.253.11 0.0.0.0 destination IP
any
set security acl ip acl-2 (hits #1 0)
----------------------------------------------------
1. permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0
destination IP 192.168.1.15 0.0.0.0 precedence 0 tos 0
enable-hits
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
504 Configuring and managing security ACLs
Clearing security ACLs from the edit buffer
Use the rollback command to clear changes made to the security ACL edit buffer since it was last committed.
The ACL is rolled back to its state at the last commit command. For example, suppose you want to remove an
ACE that you just created in the edit buffer for acl-111:
1
To display the contents of all committed security ACLs, type the following command:
WSS# show security acl info
ACL information for all
set security acl ip acl-111 (hits #4 0)
----------------------------------------------------
1. permit IP source IP 192.168.254.12 0.0.0.0
destination IP any
2. permit IP source IP 192.168.253.11 0.0.0.0
destination IP any
set security acl ip acl-2 (hits #1 0)
----------------------------------------------------
1. permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0
destination IP 192.168.1.15 0.0.0.0 precedence 0 tos 0
enable-hits
2
To view a summary of the security ACLs for which you just created ACEs in the edit buffer,
type the following command:
WSS#show security acl editbuffer
ACL edit-buffer table
ACL
Type Status
------------------------------- ---- --------------
acl-a
acl-111
IP Not committed
IP Not committed
3
To view details about these uncommitted ACLs, type the following command.
WSS#show security acl info all editbuffer
ACL edit-buffer information for all
set security acl ip acl-111 (ACEs 3, add 3, del 0,
modified 2)
----------------------------------------------------
1. permit IP source IP 192.168.254.12 0.0.0.0
destination IP any
2. permit IP source IP 192.168.253.11 0.0.0.0
destination IP any
3. deny SRC source IP 192.168.253.1 0.0.0.255
set security acl ip acl-a (ACEs 1, add 1, del 0, modified
0)
----------------------------------------------------
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 505
1. permit SRC source IP 192.168.1.1 0.0.0.0
4
5
To clear the uncommitted acl-111 ACE from the edit buffer, type the following command:
WSS# rollback security acl acl-111
To ensure that you have cleared the acl-111 ACE, type the following command. Only the
uncommitted acl-a now appears.
WSS# show security acl info all editbuffer
ACL edit-buffer information for all
set security acl ip acl-a (ACEs 1, add 1, del 0, modified
0)
----------------------------------------------------
1. permit SRC source IP 192.168.1.1 0.0.0.0
6
Alternatively, to clear the entire edit buffer of all changes made since a security ACL was last
committed and display the results, type the following commands:
WSS# rollback security acl all
WSS# show security acl info all editbuffer
ACL edit-buffer information for all
Using ACLs to change CoS
For WMM or non-WMM traffic, you can change a packet’s priority by using an ACL to change the packet’s
CoS value. A CoS value assigned by an ACE overrides the CoS value assigned by the switch’s QoS map.
To change CoS values using an ACL, you must map the ACL to the outbound traffic direction on an AP port,
Distributed AP, or user VLAN.
For example, to remap IP packets from IP address 10.10.20.5 that have IP precedence value 3, to have CoS
value 7 when they are forwarded to any 10.10.30.x address on Distributed AP 2, enter the following
commands:
WSS# set security acl ip acl1 permit cos 7 ip 10.10.20.5 0.0.0.0 10.10.30.0 0.0.0.255
precedence 3
success: change accepted.
WSS# set security acl ip acl1 permit any
success: change accepted.
WSS# commit security acl acl1
success: change accepted.
WSS# set security acl map acl1 ap 2 out
success: change accepted.
The default action on an interface and traffic direction that has at least one access control entry (ACE) config-
ured, is to deny all traffic that does not match an ACE on that interface and traffic direction. The permit any
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
506 Configuring and managing security ACLs
ACE ensures that traffic that does not match the first ACE is permitted. Without this additional ACE at the end, traffic
that does not match the other ACE is dropped.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 507
Filtering based on DSCP values
You can configure an ACE to filter based on a packet’s Differentiated Services Code Point (DSCP) value, and
change the packet’s CoS based on the DSCP value. A CoS setting marked by an ACE overrides the CoS
setting applied from the switch’s QoS map.
Table 28 lists the CoS values to use when reassigning traffic to a different priority. The CoS determines the AP
forwarding queue to use for the traffic when sending it to a wireless client.
Table 30: Class-of-Service (CoS) Packet
Handling
WMM Priority
Desired
CLI CoS Value to
Enter
Background
Best effort
Video
1 or 2
0 or 3
4 or 5
6 or 7
Voice
Using the dscp option
The easiest way to filter based on DSCP is to use the dscp codepoint option. The following commands remap
IP packets from IP address 10.10.50.2 that have DSCP value 46 to have CoS value 7 when they are forwarded
to any 10.10.90.x address on Distributed AP 4:
WSS# set security acl ip acl2 permit cos 7 ip 10.10.50.2 0.0.0.0 10.10.90.0 0.0.0.255
dscp 46
success: change accepted.
WSS# set security acl ip acl2 permit any
success: change accepted.
WSS# commit security acl acl2
success: change accepted.
WSS# set security acl map acl2 ap 4 out
success: change accepted.
Using the precedence and ToS options
You also can indirectly filter on DSCP by filtering on both the IP precedence and IP ToS values of a packet.
However, this method requires two ACEs. To use this method, specify the combination of precedence and ToS
values that is equivalent to the DSCP value. For example, to filter based on DSCP value 46, configure an ACL
that filters based on precedence 5 and ToS 12. (To display a table of the precedence and ToS combinations for
each DSCP value, use the show qos dscp-table command.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
508 Configuring and managing security ACLs
The following commands perform the same CoS reassignment as the commands in “Using the dscp option” on page 507.
They remap IP packets from IP address 10.10.50.2 that have DSCP value 46 (equivalent to precedence value 5 and ToS
value 12), to have CoS value 7 when they are forwarded to any 10.10.90.x address on Distributed AP 4:
WSS# set security acl ip acl2 permit cos 7 ip 10.10.50.2 0.0.0.0 10.10.90.0 0.0.0.255 precedence
5 tos 12
success: change accepted.
WSS# set security acl ip acl2 permit cos 7 ip 10.10.50.2 0.0.0.0 10.10.90.0 0.0.0.255 precedence
5 tos 13
success: change accepted.
WSS# set security acl ip acl2 permit any
success: change accepted.
WSS# commit security acl acl2
success: change accepted.
WSS# set security acl map acl2 ap 4 out
success: change accepted.
The ACL contains two ACEs. The first ACE matches on precedence 5 and ToS 12. The second ACE matches on prece-
dence 5 and ToS 13. The IP precedence and ToS fields use 7 bits, while the DSCP field uses only 6 bits. Following the
DSCP field is a 2-bit ECN field that can be set by other devices based on network congestion. The second ACE is
required to ensure that the ACL matches regardless of the value of the seventh bit.
Note. You cannot use the dscp option along with the precedence and tos options in the
same ACE. The CLI rejects an ACE that has this combination of options.
Enabling prioritization for legacy voice over IP
WSS Software supports Wi-Fi Multimedia (WMM). WMM support is enabled by default and is automatically used for
priority traffic between WMM-capable devices.
WSS Software also can provide prioritization for non-WMM VoIP devices. However, to provide priority service to
non-WMM VoIP traffic, you must configure static CoS or configure an ACL to set the CoS for the traffic. The AP maps
the CoS value assigned by static CoS or the ACL to a forwarding queue. The examples in this section show how to
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 509
General guidelines
Nortel recommends that you follow these guidelines for any wireless VoIP implementation:
•
Ensure end-to-end priority forwarding by making sure none of the devices that will forward voice traffic resets IP
ToS or Diffserv values to 0. Some devices, such as some types of Layer 2 switches with basic Layer 3 awareness,
reset the IP ToS or Diffserv value of untrusted packets to 0.
WSS Software uses IP ToS values to prioritize voice traffic. For example, when an AP receives traffic
from its WSS, the AP classifies the traffic based on the IP ToS value in the IP header of the tunnel that is
carrying the traffic. By default, the WSS marks egress traffic for priority forwarding only if WMM is
enabled and only if the ingress traffic was marked for priority forwarding. If another forwarding device in
the network resets a voice packet’s priority by changing the IP ToS or Diffserv value to 0, the WSS does
not reclassify the packet, and the packet does not receive priority forwarding on the AP.
•
•
For WMM-capable devices, leave WMM enabled.
For SVP devices, change the QoS mode to svp. You also need to disable IGMP snooping, and configure an ACL
that marks egress traffic from the voice VLAN with CoS value 7. (See “Enabling SVP optimization for SpectraLink
phones” on page 511 for complete configuration guidelines.)
For other types of non-WMM devices, you do not need to change the QoS mode, but you must configure
an ACL to mark the traffic’s CoS value. This section shows examples for configuring VoIP for devices
that use TeleSym, and for Avaya devices.
Table 31 shows how WMM priority information is mapped across the network. When WMM is enabled in WSS
Software, WSSs and APs perform these mappings automatically.
Table 31: WMM priority mappings
AP
Forwarding
Queue
Service
Type
IP Precedence IP ToS
DSCP
802.1p
CoS
0
3
1
2
4
5
6
7
0
3
1
2
4
5
6
7
0
0
0
3
1
2
4
5
6
7
0
3
1
2
4
5
6
7
Background
Best Effort
Video
0x60
0x20
0x40
0x80
0xa0
0xc0
0xe0
24
8
16
32
40
48
56
Voice
You must map the ACL to the outbound traffic direction on an AP port, Distributed AP, or user VLAN. An ACL can set
a packet’s CoS only in these cases.
You can enable legacy VoIP support on a VLAN, port group, port list, virtual port list, Distributed AP, or user wildcard.
You do not need to disable WMM support.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
510 Configuring and managing security ACLs
Enabling VoIP support for TeleSym VoIP
To enable VoIP support for TeleSym packets, which use UDP port 3344, for all users in VLAN corp_vlan, perform the
following steps:
1
2
Configure an ACE in ACL voip that assigns IP traffic from any IP address with source UDP port 3344,
addressed to any destination address, to CoS queue 6:
WSS# set security acl ip voip permit cos 6 udp any eq 3344 any
Configure another ACE to change the default action of the ACL from deny to permit. Otherwise, the ACL
permits only voice traffic that matches the previous ACE and denies all other traffic.
WSS# set security acl ip voip permit any
Commit the ACL to the configuration:
3
4
WSS# commit security acl voip
Map the ACL to the outbound traffic direction of VLAN corp_vlan:
WSS# set security acl map voip vlan corp_vlan out
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 511
Enabling SVP optimization for SpectraLink phones
SpectraLink’s Voice Interoperability for Enterprise Wireless (VIEW) Certification Program is designed to ensure
interoperability and high performance between SVP phones and WLAN infrastructure products. Nortel WSSs and APs
are VIEW certified. This section describes how to configure WSSs and APs for SVP phones.
Nortel recommends that you plan for a maximum of 6 wireless phones per AP.
To configure WSS Software for SVP phones, perform the following configuration tasks:
•
•
Install APs and configure them on the switch. (The examples in this section assume this is already done.)
Configure a service for the voice SSID. The service profile also specifies the encryption parameters to use for the
SSID. This section shows configuration examples for WPA and for RSN (WPA2).
•
•
•
•
Configure a radio profile to manage the radios that will provide service for the voice SSID.
Configure a VLAN for the voice clients.
Configure a last-resort user in the local database.
Configure an authentication and accounting rule that allows clients of the voice SSID onto the network and places
them in the voice VLAN.
•
Configure an ACL that marks ingress and egress traffic to and from the voice VLAN with CoS value 7.
Known limitations
•
•
You cannot have WPA and WPA2 configured on handsets simultaneously within the same ESSID. SVP phones will
not check-in.
You must disable IGMP snooping when running SpectraLink’s SRP protocol. SRP uses multicast packets to
check-in which are not forwarded through the WSS when IGMP snooping is enabled. When a tunneled VLAN is
configured over a Layer 3 network, IGMP snooping must be disabled each time the tunnel is established, because
the virtual VLAN is established with IGMP snooping turned on by default.
Configuring a service profile for RSN (WPA2)
To configure a service profile for SVP phones that use RSN (WPA2):
•
•
•
•
•
Create the service profile and add the voice SSID to it.
Enable the RSN information element (IE).
Disable TKIP and enable CCMP.
Disable 802.1X authentication and enable preshared key (PSK) authentication instead.
Enter the PSK key.
The following commands configure a service profile called vowlan-wpa2 for RSN:
WSS# set service-profile vowlan-wpa2 ssid-name phones
WSS# set service-profile vowlan-wpa2 rsn-ie enable
WSS# set service-profile vowlan-wpa2 cipher-tkip disable
WSS# set service-profile vowlan-wpa2 cipher-ccmp enable
WSS# set service-profile vowlan-wpa2 auth-dot1x disable
WSS# set service-profile vowlan-wpa2 auth-psk enable
WSS# set service-profile vowlan-wpa2 psk-raw
c25d3fe4483e867d1df96eaacdf8b02451fa0836162e758100f5f6b87965e59d
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
512 Configuring and managing security ACLs
Configuring a service profile for WPA
To configure a service profile for SVP phones that use WPA:
•
•
•
•
Create the service profile and add the voice SSID to it.
Enable the WPA information element (IE). This also enables TKIP. Leave TKIP enabled.
Disable 802.1X authentication and enable preshared key (PSK) authentication instead.
Enter the PSK key.
The following commands configure a service profile called vowlan-wpa2 for RSN:
WSS# set service-profile vowlan-wpa ssid-name phones
WSS# set service-profile vowlan-wpa wpa-ie enable
WSS# set service-profile vowlan-wpa auth-dot1x disable
WSS# set service-profile vowlan-wpa auth-psk enable
WSS# set service-profile vowlan-wpa psk-raw
c25d3fe4483e867d1df96eaacdf8b02451fa0836162e758100f5f6b87965e59d
Configuring a radio profile
WSS Software has a default radio profile, which manages all radios by default. Some of the radio parameters require
changes for voice traffic. You can modify the default radio profile or create a new one.
Note. Some radio settings that are beneficial for voice traffic might not be beneficial for
other wireless clients. If you plan to support other wireless clients in addition to voice
clients, Nortel recommends that you create a new radio profile specifically for voice clients,
or use the default radio profile only for voice clients and create a new profile for other
clients. The examples in this section modify the default radio profile for voice clients.
To create or modify a radio profile for voice clients:
•
•
•
•
•
Map the service profile you created for the voice SSID to the radio profile.
Change the delivery traffic indication map (DTIM) interval to 3.
Change the QoS mode to SVP. (This also disables WMM.)
Configure APs, if not already configured.
Map radios to the radio profile and enable them.
The following commands modify the default radio profile for SVP phones:
WSS# set radio-profile default service-profile vowlan-wpa2
WSS# set radio-profile default dtim-interval 3
WSS# set radio-profile default qos-mode svp
The AP radios are already in the default radio profile by default, so they do not need to be explicitly added to the profile.
However, if you create a new radio profile for voice clients, you will need to disable the radios, map them to the new
radio profile, then reenable them.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 513
Configuring a VLAN and AAA for voice clients
WSS Software requires all clients to be authenticated by RADIUS or the local database, and to be authorized for a
specific VLAN. WSS Software places the user in the authorized VLAN.
•
Configure a VLAN for voice clients.
Note. You can use the same VLAN for other clients. However, it is a best practice to use
the VLAN primarily, if not exclusively, for voice traffic.
•
•
Disable IGMP snooping in the VLAN. (Disabling this feature is required for SVP.)
Configure a last-resort-ssid user, and set the user’s VLAN attribute to the name of the VLAN you create for the
voice clients.
•
Configure an authentication and authorization rule that matches on the last-resort username and on the voice SSID.
To configure a VLAN and a last-resort user for the voice SSID:
WSS# set vlan 2 name v1 port 3
WSS# set igmp disable vlan v1
WSS# set authentication last-resort ssid phones local
WSS# set user last-resort-phones attr vlan-name v1
The set vlan and set igmp commands create VLAN v1 and add the uplink port to it, then disable IGMP snooping in the
VLAN.
The set authentication command in this example uses the local database to authenticate all users who associate with the
SSID phones. The set user command configures the user last-resort-phones in the local database and assigns the user to
VLAN v1. When a user associates with the SSID, WSS Software appends the SSID name to the last-resort username,
and searches for the last-resort-ssid name.
Configuring an ACL to prioritize voice traffic
WSS Software does not provide priority forwarding for SVP traffic by default. To enable prioritization for SVP traffic,
you must configure an ACL and map it to the both the inbound and outbound directions of the VLAN to which the voice
clients are assigned. The ACL must contain an ACE that matches on IP protocol 119 and marks the IP ToS bits in
matching packets with CoS value 7. When an AP receives a packet with CoS value 7, the AP places the packet in the
voice queue for priority forwarding.
If the VLAN will be shared by other clients, you also need to add an ACE that permits the traffic that is not using IP
protocol 119. Otherwise, the WSS drops this traffic. Every ACL has an implicit ACE at the end that denies all traffic that
does not match any of the other ACEs in the ACL.
After you configure the ACE and map it to the VLAN, you must commit the VLAN to the configuration. The ACL does
not take effect until you map it and commit it.
The following commands configure an ACE to prioritize SVP traffic and map the ACE to the outbound direction of the
voice VLAN:
WSS# set security acl ip SVP permit cos 7 udp 10.2.4.69 255.255.255.255 gt 0 any gt 0
WSS# set security acl ip SVP permit cos 7 119 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
WSS# set security acl ip SVP permit 0.0.0.0 255.255.255.255
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
514 Configuring and managing security ACLs
WSS# set security acl map SVP vlan v1 in
WSS# set security acl map SVP vlan v1 out
WSS# commit security acl SVP
The first ACE is needed only if the active-scan feature is enabled in the radio profile. The ACE ensures that active-scan
reduces its off-channel time in the presence of FTP traffic from the TFTP server, by setting the CoS of the server traffic
to 7. This ACE gives CoS 7 to UDP traffic from TFTP server 10.2.4.69 to any IP address, to or from any UDP port other
The second ACE sets CoS to 7 for all SVP traffic.
The third ACE matches on all traffic that does not match on either of the previous ACEs.
Reason the ACL needs to be mapped to both traffic directions
If the ACL is not also mapped to the inbound direction on the voice VLAN, CoS will not be marked in the traffic if the
path to the SVP handset is over a tunnel. WSS Software does not support mapping an ACL to a tunneled VLAN.
When configured in a Mobility Domain, WSSs dynamically create tunnels to bridge clients to non-local VLANs. A
non-local VLAN is a VLAN that is not configured on the WSS that is forwarding the client's traffic. WSS Software does
not support mapping an ACL to a non-local VLAN. The CLI accepts the configuration command but the command is
not saved in the configuration.
Consider switch-1 with VLAN_A and switch-2 with VLAN_B. If a handset connected to switch-2 is placed in
VLAN_A, a tunnel is created between switch-1 and switch-2. If an ACL is mapped to VLAN_A-out on switch-1, it will
affect local clients but not clients using the same VLAN on switch-2. Also, if an ACL is mapped to VLAN_A-in on
switch-1, it will affect remote clients on switch-2, but not local clients. Nortel recommends mapping ACLs both vlan-in
and vlan-out to ensure proper CoS marking in both directions.
Setting 802.11b/g radios to 802.11b (for Siemens SpectraLink VoIP phones only)
If you plan to use Siemens SpectraLink Voice over IP (VoIP) phones, you must change the AP radios that will support
the phones to operate in 802.11b mode only. This type of phone expects the AP to operate at 802.11b rates only, not at
802.11g rates. To change a radio to support 802.11b mode only, use the radiotype 11b option with the set port type ap
or set ap command.
Disabling Auto-RF before upgrading a SpectraLink phone
If you plan to upgrade a SpectraLink phone using TFTP over an AP, Nortel recommends that you disable Auto-RF
before you begin the upgrade. This feature can increase the length of time required for the upgrade. You can disable
Auto-RF on a radio-profile basis. Use the following commands:
set radio-profile name auto-tune channel-config disable
set radio-profile name auto-tune power-config disable
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring and managing security ACLs 515
Restricting client-to-client forwarding among
IP-only clients
You can use an ACL to restrict clients in a VLAN from communicating directly at the IP layer. Configure an
ACL that has ACEs to permit traffic to and from the default router (gateway), an ACE that denies traffic
between all other addresses within the subnets, and another ACE that allows traffic that doesn’t match the
other ACEs.
Note. AN ACL can restrict IP forwarding but not Layer 2 forwarding. To restrict Layer 2
For example, to restrict client-to-client forwarding within subnet 10.10.11.0/24 in VLAN vlan-1 with default
router 10.10.11.8, perform the following steps:
1
Configure an ACE that permits all traffic from the default router IP address to any other IP
address:
WSS# set security acl ip c2c permit 10.10.11.8 0.0.0.0
2
Configure an ACE that permits traffic from any IP address to the default router IP address:
WSS# set security acl ip c2c permit ip 0.0.0.0
255.255.255.255 10.10.11.8 0.0.0.0
3
4
Configure an ACE that denies all IP traffic from any IP address in the 10.10.11.0/24 subnet to
any address in the same subnet.
WSS# set security acl ip c2c deny ip 10.10.11.0 0.0.0.255
10.10.11.0 0.0.0.255
Configure an ACE that permits all traffic that does not match the ACEs configured above:
WSS# set security acl ip c2c permit 0.0.0.0
255.255.255.255
5
6
Commit the ACL to the configuration:
WSS# commit security acl c2c
Map the ACL to the outbound and inbound traffic directions of VLAN vlan-1:
WSS# set security acl map c2c vlan vlan-1 out
WSS# set security acl map c2c vlan vlan-1 in
Note. The commands in steps 1 and 2 permit traffic to and from the default router
(gateway). If the subnet has more than one default router, add a similar pair of ACEs for
each default router. Add the default router ACEs before the ACEs that block all traffic to and
from addresses within the subnet.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
516 Configuring and managing security ACLs
Security ACL configuration scenario
The following scenario illustrates how to create a security ACL named acl-99 that consists of one ACE to permit
incoming packets from one IP address, and how to map the ACL to a port and a user:
1
2
Type the following command to create and name a security ACL and add an ACE to it.
WSS# set security acl ip acl-99 permit 192.168.1.1 0.0.0.0
To view the ACE you have entered, type the following command:
WSS# show security acl editbuffer
ACL
---------------------------------- ---- -------------
acl-99 IP Not committed
Type Status
3
4
To save acl-99 and its associated ACE to the configuration, type the following command:
WSS# commit security acl acl-99
success: change accepted.
To map acl-99 to port 9 to filter incoming packets, type the following command:
WSS# set security acl map acl-99 port 9 in
mapping configuration accepted
Because every security ACL includes an implicit rule denying all traffic that is not permitted, port 9 now
accepts packets only from 192.168.1.1, and denies all other packets.
5
6
To map acl-99 to user Natasha’s sessions when you are using the local WSS database for authentication,
configure Natasha in the database with the Filter-Id attribute. Type the following commands:
WSS#set authentication dot1x Natasha local
success: change accepted.
WSS# set user natasha attr filter-id acl-99.in
success: change accepted.
Alternatively, you can map acl-99 to Natasha’s sessions when you are using a remote RADIUS server for
authentication. To configure Natasha for pass-through authentication to the RADIUS server shorebirds,
type the following command:
WSS#set authentication dot1x Natasha pass-through shorebirds
success: change accepted.
You must then map the security ACL to Natasha’s session in RADIUS. For instructions, see the
documentation for your RADIUS server.
7
To save your configuration, type the following command:
WSS# save config
success: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
517
Managing keys and certificates
Why use keys and certificates? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 517
About keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 519
Creating keys and certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525
Displaying certificate and key information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532
Key and certificate configuration scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533
A digital certificate is a form of electronic identification for computers. The WSS requires digital certificates to authen-
ticate its communications to WLAN Management Software and Web View, to Web-based AAA clients, and to
Extensible Authentication Protocol (EAP) clients for which the WSS performs all EAP processing. Certificates can be
generated on the WSS or obtained from a certificate authority (CA). Keys contained within the certificates allow the
WSS, its servers, and its wireless clients to exchange information secured by encryption.
Note. If the switch does not already have certificates, WSS Software automatically
generates the missing ones the first time you boot using WSS Software Version 4.2 or later.
You do not need to install certificates unless you want to replace the ones automatically
generated by WSS Software. (For more information, see “Certificates automatically
Note. Before installing a new certificate, verify with the show timedate and show
timezone commands that the WSS is set to the correct date, time, and time zone.
Otherwise, certificates might not be installed correctly.
Why use keys and certificates?
Certain WSS operations require the use of public-private key pairs and digital certificates. All WLAN Management
Software and Web View users, and users for which the WSS performs IEEE 802.1X EAP authentication or Web-based
AAA, require public-private key pairs and digital certificates to be installed on the WSS.
These keys and certificates are fundamental to securing wireless, wired authentication, and administrative connections
because they support Wi-Fi Protected Access (WPA) encryption and dynamic Wired-Equivalency Privacy (WEP)
encryption.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
518 Managing keys and certificates
Wireless security through TLS
In the case of wireless or wired authentication 802.1X users whose authentication is performed by the WSS,
the first stage of any EAP transaction is Transport Layer Security (TLS) authentication and encryption.
WLAN Management Software and Web View also require a session to the WSS that is authenticated and
encrypted by TLS. Once a TLS session is authenticated, it is encrypted.
TLS allows the client to authenticate the WSS (and optionally allows the WSS to authenticate the client)
through the use of digital signatures. Digital signatures require a public-private key pair. The signature is
created with a private key and verified with a public key. TLS enables secure key exchange.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 519
PEAP-MS-CHAP-V2 security
PEAP performs a TLS exchange for server authentication and allows a secondary authentication to be
performed inside the resulting secure channel for client authentication. For example, the Microsoft Challenge
Handshake Authentication Protocol version 2 (MS-CHAP-V2) performs mutual MS-CHAP-V2 authentication
inside an encrypted TLS channel established by PEAP.
1
2
3
To form the encrypted TLS channel, the WSS must have a digital certificate and must send that
certificate to the wireless client.
Inside the WSS’s digital certificate is the WSS’s public key, which the wireless client uses to
encrypt a pre-master secret key.
The wireless client then sends the key back to the WSS so that both the WSS and the client can
derive a key from this pre-master secret for secure authentication and wireless session
encryption.
Clients authenticated by PEAP need a certificate in the WSS only when the switch performs PEAP locally, not
when EAP processing takes place on a RADIUS server. (For details about authentication options, see “Config-
About keys and certificates
Public-private key pairs and digital signatures and certificates allow keys to be generated dynamically so that
data can be securely encrypted and delivered. You generate the key pairs and certificates on the WSS or install
them on the switch after enrolling with a certificate authority (CA). The WSS can generate key pairs,
self-signed certificates, and Certificate Signing Requests (CSRs), and can install key pairs, server certificates,
and certificates generated by a CA.
Note. The WSS uses separate server certificates for Admin, EAP (802.1X), and
Web-based AAA authentication. Where applicable, the manuals refer to these server
certificates as Admin, EAP (or 802.1X), or Web-based AAA certificates respectively.
When the WSS needs to communicate with WLAN Management Software, Web View, or an 802.1X or
Web-based AAA client, WSS Software requests a private key from the switch’s certificate and key store:
•
•
•
If no private key is available in the WSS’s certificate and key store, the switch does not respond to the
request from WSS Software. If the switch does have a private key in its key store, WSS Software requests
a corresponding certificate.
If the WSS has a self-signed certificate in its certificate and key store, the switch responds to the request
from WSS Software. If the certificate is not self-signed, the switch looks for a CA’s certificate with which
to validate the server certificate.
If the WSS has no corresponding CA certificate, the switch does not respond to the request from WSS
Software. If the switch does have a corresponding CA certificate, and the server certificate is validated
(date still valid, signature approved), the switch responds.
If the WSS does not respond to the request from WSS Software, authentication fails and access is denied.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
520 Managing keys and certificates
For EAP (802.1X) users, the public-private key pairs and digital certificates can be stored on a RADIUS server. In this
case, the WSS operates as a pass-through authenticator.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 521
Public key infrastructures
A public-key infrastructure (PKI) is a system of digital certificates and certification authorities that verify and
authenticate the validity of each party involved in a transaction through the use of public key cryptography. To
have a PKI, the WSS requires the following:
•
•
•
•
•
A public key
A private key
Digital certificates
A CA
A secure place to store the private key
A PKI enables you to securely exchange and validate digital certificates between WSS switches, servers, and
users so that each device can authenticate itself to the others.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
522 Managing keys and certificates
Public and private keys
Nortel’s identity-based networking uses public key cryptography to enforce the privacy of data transmitted over the
network. Using public-private key pairs, users and devices can send encrypted messages that only the intended receiver
can decrypt.
Before exchanging messages, each party in a transaction creates a key pair that includes the public and private keys. The
public key encrypts data and verifies digital signatures, and the corresponding private key decrypts data and generates
digital signatures. Public keys are freely exchanged as part of digital certificates. Private keys are stored securely.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 523
Digital certificates
Digital certificates bind the identity of network users and devices to a public key. Network users must authenticate their
identity to those with whom they communicate, and must be able to verify the identity of other users and network
devices, such as switches and RADIUS servers.
The Nortel WLAN 2300 system supports the following types of X.509 digital certificates:
•
Administrative certificate—Used by the WSS to authenticate itself to WLAN Management Software or Web
View.
•
Secure WSS to WSS communications certificate—Used by WSSs in a Mobility Domain to securely exchange
management information. (For more information about this option, see “Configuring secure WSS to WSS
•
•
EAP certificate—Used by the WSS to authenticate itself to EAP clients.
Web-based AAA certificate—Used by the WSS to authenticate itself to Web-based AAA clients, who use a web
page served by a WSS to log onto the network.
•
Certificate authority (CA) certificates—Used by the WSS in addition to the certificates listed above, when those
certificates are from the CA.
The Admin, EAP, and Web-based AAA certificates can be generated by the WSS (self-signed) or generated and signed
by a CA. If they are signed by a CA, the CA’s own certificate is also required.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
524 Managing keys and certificates
PKCS #7, PKCS #10, and PKCS #12 object files
Public-Key Cryptography Standards (PKCS) are encryption interface standards created by RSA Data Security,
Inc., that provide a file format for transferring data and cryptographic information. Nortel supports the PKCS
Table 32: PKCS Object files supported by Nortel
File Type
Standard
Purpose
PKCS #7
Cryptographic Message Contains a digital certificate signed by a CA.
Syntax Standard
To install the certificate from a PKCS #7 file, use the crypto
certificate command to prepare WSS Software to receive the
certificate, then copy and paste the certificate into the CLI.
A PKCS #7 file does not contain the public key to go with the
certificate. Before you generate the CSR and instal the
certificate, you must generate the public-private key pair using
the crypto generate key command.
PKCS #10
PKCS #12
Certification Request
Syntax Standard
Contains a Certificate Signing Request (CSR), a special file with
encoded information needed to request a digital certificate from
a CA.
To generate the request, use the crypto generate request
command. Copy and paste the results directly into a browser
window on the CA server, or into a file to send to the CA server.
Personal Information
Exchange Syntax
Standard
Contains a certificate signed by a CA and a public-private key
pair provided by the CA to go with the certificate.
Because the key pair comes from the CA, you do not need to
generate a key pair or a certificate request on the switch. Instead,
use the copy tftp command to copy the file onto the WSS.
Use the crypto otp command to enter the one-time password
assigned to the file by the CA. (This password secures the file so
that the keys and certificate cannot be installed by an
unauthorized party. You must know the password in order to
install them.)
Use the crypto pkcs12 command to unpack the file.
Certificates automatically generated by WSS
software
The first time you boot a switch with WSS Software Version 4.2 or later, WSS Software automatically
generates keys and self-signed certificates, in cases where certificates are not already configured or installed.
WSS Software can automatically generate all the following types of certificates and their keys:
•
•
•
Admin (required for administrative access to the switch by Web View or WLAN Management Software)
EAP (required for 802.1X user access through the switch)
Web (required for Web-based AAA user access through the switch)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 525
The keys are 512 bytes long.
WSS Software automatically generates self-signed certificates only in cases where no certificate is already
configured. WSS Software does not replace self-signed certificates or CA-signed certificates that are already
configured on the switch. You can replace an automatically generated certificate by creating another
self-signed one or by installing a CA-signed one. To use a longer key, configure the key before creating the
new certificate (or certificate request, if you plan to install a CA-signed certificate).
If generated by WSS Software Version 4.2.3 or later, the automatically generated certificates are valid for
three years, beginning one week before the time and date on the switch when the certificate is generated.
Creating keys and certificates
Public-private key pairs and digital certificates are required for management access with WLAN Management
Software or Web View, or for network access by 802.1X or Web-based AAA users. The digital certificates can
be self-signed or signed by a certificate authority (CA). If you use certificates signed by a CA, you must also
install a certificate from the CA to validate the digital signatures of the certificates installed on the WSS.
Generally, CA-generated certificates are valid for one year beginning with the system time and date that are in
effect when you generate the certificate request. Self-signed certificates generated when running WSS
Software Version 4.2.3 or later are valid for three years, beginning one week before the time and date on the
switch when the certificate is generated.
Each of the following types of access requires a separate key pair and certificate:
•
•
Admin—Administrative access through WLAN Management Software or Web View
EAP—802.1X access for network users who can access SSIDs encrypted by WEP or WPA, and for users
connected to wired authentication ports
•
Web-based AAA—Web access for network users who can use a web page to log onto an unencrypted
SSID
Management access to the CLI through Secure Shell (SSH) also requires a key pair, but does not use a certifi-
Secure WSS to WSS communications also requires a key pair and certificate. However, the certificate is
generated automatically when you enable Secure WSS to WSS communications.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
526 Managing keys and certificates
Choosing the appropriate certificate installation method for your
network
Depending on your network environment, you can use any of the following methods to install certificates and
their public-private key pairs. The methods differ in terms of simplicity and security. The simplest method is
also the least secure, while the most secure method is slightly more complex to use.
•
Self-signed certificate—The easiest method to use because a CA server is not required. The WSS
generates and signs the certificate itself. This method is the simplest but is also the least secure, because
the certificate is not validated (signed) by a CA.
•
PKCS #12 object file certificate—More secure than using self-signed certificates, but slightly less
secure than using a Certificate Signing Request (CSR), because the private key is distributed in a file from
the CA instead of generated by the WSS itself. The PKCS #12 object file is more complex to deal with
than self-signed certificates. However, you can use WLAN Management Software, Web View, or the CLI
to distribute this certificate. The other two methods can be performed only using the CLI.
•
Certificate Signing Request (CSR)—The most secure method, because the WSS’s public and private
keys are created on the WSS itself, while the certificate comes from a trusted source (CA). This method
requires generating the key pair, creating a CSR and sending it to the CA, cutting and pasting the
certificate signed by the CA into the CLI, and then cutting and pasting the CA’s own certificate into the
CLI.
Table 33 lists the steps required for each method and refers you to appropriate instructions. (For complete
Table 33: Procedures for creating and validating certificates
Certificate
Installation
Method
Steps Required
Instructions
Self-signed
certificate
•
•
1. Generate a public-private key pair on
the WSS.
2. Generate a self-signed certificate on
the WSS.
PKCS #12
object file
certificate
“Installing a key pair and certificate
1. Copy a PKCS #12 object file
(public-private key pair, server
certificate, and CA certificate) from a
CA onto the WSS.
2. Enter the one-time password to unlock
the file.
3. Unpack the file into the switch’s
certificate and key store.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 527
Table 33: Procedures for creating and validating certificates (continued)
Certificate
Installation
Method
Steps Required
Instructions
Certificate
Signing Request
(CSR) certificate
•
•
1. Generate a public-private key pair on
the WSS.
2. Generate a CSR on the switch as a
PKCS #10 object file.
•
3. Give the CSR to a CA and receive a
signed certificate (a PEM-encoded
PKCS #7 object file).
4. Paste the PEM-encoded file into the
CLI to store the certificate on the
WSS.
5. Obtain and install the CA’s own
certificate.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
528 Managing keys and certificates
Creating public-private key pairs
To use a self-signed certificate or Certificate Signing Request (CSR) certificate for WSS authentication, you
must generate a public-private key pair.
To create a public-private key pair, use the following command:
crypto generate key {admin | domain | eap | ssh | web}
{128 | 512 | 1024 | 2048}
Choose the key length based on your need for security or to conform with your organization’s practices. For
example, the following command generates an administrative key pair of 1024 bits:
WSS# crypto generate key admin 1024
admin key pair generated
Some key lengths apply only to specific key types. For example, 128 applies only to domain keys.
SSH requires an SSH authentication key, but you can allow WSS Software to generate it automatically. The
first time an SSH client attempts to access the SSH server on a WSS, the switch automatically generates a
1024-byte SSH key. If you want to use a 2048-byte key instead, use the crypto generate key ssh 2048
command to generate one.
Note. After you generate or install a certificate (described in the following sections), do
not create the key pair again. If you do, the certificate might not work with the new key, in
which case you will need to regenerate or reinstall the certificate.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 529
Generating self-signed certificates
After creating a public-private key pair, you can generate a self-signed certificate. To generate a self-signed certificate,
use the following command:
crypto generate self-signed {admin | eap | web}
When you type the command, the CLI prompts you to enter information to identify the certificate. For example:
WSS# crypto generate self-signed admin
Country Name: US
State Name: CA
Locality Name: San Jose campus
Organizational Name: nortel
Organizational Unit: eng
Common Name: WSS1
Email Address: admin@example.com
Unstructured Name: WSS in wiring closet 120
success: self-signed cert for admin generated
You must include a common name (string) when you generate a self-signed certificate. The other information is
optional. Use a fully qualified name if such names are supported on your network. The certificate appears after you enter
this information.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
530 Managing keys and certificates
Installing a key pair and certificate from a PKCS #12 object file
PKCS object files provide a file format for storing and transferring storing data and cryptographic information.
object file, which you obtain from a CA, includes the private key, a certificate, and optionally the CA’s own
certificate.
After transferring the PKCS #12 file from the CA via FTP and generating a one-time password to unlock it,
you store the file in the WSS switch’s certificate and key store. To set and store a PKCS #12 object file, follow
these steps:
1
Copy the PKCS #12 object file to nonvolatile storage on the WSS. Use the following command:
copy tftp://filename local-filename
2
Enter a one-time password (OTP) to unlock the PKCS #12 object file. The password must be
the same as the password protecting the PKCS #12 file.
The password must contain at least 1 alphanumeric character, with no spaces, and must not
include the following characters:
●
●
●
Quotation marks (““)
Question mark (?)
Ampersand (&)
Note. On a WSS that handles communications to or from Microsoft Windows
clients, use a one-time password of 31 characters or fewer.
To enter the one-time password, use the following command:
crypto otp {admin | eap | web} one-time-password
3
Unpack the PKCS #12 object file into the certificate and key storage area on the WSS. Use the
following command:
crypto pkcs12 {admin | eap | web} filename
The filename is the location of the file on the WSS.
Note. WSS Software erases the OTP password entered with the crypto otp
command when you enter the crypto pkcs12 command.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 531
Creating a CSR and installing a certificate from a PKCS #7 object file
After creating a public-private key pair, you can obtain a signed certificate of authenticity from a CA by generating a
Certificate Signing Request (CSR) from the WSS. A CSR is a text block with an encoded request for a signed certificate
from the CA.
Note. Many certificate authorities have their own unique requirements. Follow the
instructions in the documentation for your CA to properly format the fields you complete
when generating a CSR.
1
To generate a request for a CA-signed certificate, use the following command:
crypto generate request {admin | eap | web}
When prompted, enter values for each of six identification fields.
You must include a common name (string) when you generate a CSR. Use a fully qualified name if such
names are supported on your network. The other information is optional. For example:
WSS# crypto generate request admin
Country Name: US
State Name: MI
Locality Name: Detroit
Organizational Name: example
Organizational Unit: eng
Common Name: WSS-34
Email Address: admin@example.com
Unstructured Name: south tower, wiring closet 125
When completed successfully, the command returns a Privacy-Enhanced Mail (PEM)-formatted
PKCS #10 CSR. PEM encoding is a way of representing a non-ASCII file format in ASCII characters.
The encoded object is the PKCS #10 CSR. Give the CSR to a CA and receive a signed certificate (a
PEM-encoded PKCS #7 object file).
2
3
To install a certificate from a PKCS #7 file, use the following command to prepare the switch to receive
it:
crypto certificate {admin | eap | web} PEM-formatted certificate
Use a text editor to open the PKCS #7 file, and copy and paste the entire text block, including the
beginning and ending delimiters, into the CLI.
Note. You must paste the entire block, from the beginning
-----BEGIN CERTIFICATE----- to the end -----END CERTIFICATE-----.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
532 Managing keys and certificates
Installing a CA’s own certificate
If you installed a CA-signed certificate from a PKCS #7 file, you must also install the PKCS #7 certificate of
that CA. (If you used the PKCS #12 method, the CA’s certificate is usually included with the key pair and
server certificate.)
To install a CA’s certificate, use the following command:
crypto ca-certificate {admin | eap | web} PEM-formatted-certificate
When prompted, paste the certificate under the prompt. For example:
WSS# crypto ca-certificate admin
Enter PEM-encoded certificate
-----BEGIN CERTIFICATE-----
MIIDwDCCA2qgAwIBAgIQL2jvuu4PO5FAQCyewU3ojANBgkqhkiG9wOBAQUFAD
CB
mzerMClaweVQQTTooewi\wpoer0QWNFNkj90044mbdrl1277SWQ8G7DiwYUtrqoQp
lKJ
.....
Lm8wmVYxP56M;CUAm908C2foYgOY40=
-----END CERTIFICATE-----
Displaying certificate and key information
To display information about certificates installed on a WSS, use the following commands:
show crypto ca-certificate {admin | eap | web}
show crypto certificate {admin | eap | web}
For example, to display information about an administrative certificate, type the following command:
WSS# show crypto certificate admin
Certificate:
Version: 3
Serial Number: 999 (0x3e7)
Subject: C=US, ST=CA, L=PLEAS, O=NRTL, OU=SQA, CN=BOBADMIN/
emailAddress=BOBADMIN, unstructuredName=BOB
Signature Algorithm: md5WithRSAEncryption
Issuer: C=US, ST=CA, L=PLEAS, O=NRTL, OU=SQA, CN=BOBADMIN/
emailAddress=BOBADMIN, unstructuredName=BOB
Validity:
Not Before: Oct 19 01:57:13 2004 GMT
Not After : Oct 19 01:57:13 2005 GMT
The last two rows of the display indicate the period for which the certificate is valid. Make sure the date and
time set on the switch are within the date and time range of the certificate.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 533
Key and certificate configuration scenarios
The first scenario shows how to generate self-signed certificates. The second scenario shows how to install CA-signed
certificates using PKCS #12 object files, and the third scenario shows how to install CA-signed certificates using CSRs
(PKCS #10 object files) and PKCS #7 object files.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
534 Managing keys and certificates
Creating self-signed certificates
To manage the security of the WSS for administrative access by WMS and Web View, and the security of
communication with 802.1X users and Web-based AAA users, create Admin, EAP, and Web-based AAA
public-private key pairs and self-signed certificates. Follow these steps:
1
2
Set time and date parameters, if not already set. (See “Configuring and managing time
Generate public-private key pairs:
WSS# crypto generate key admin 1024
key pair generated
WSS# crypto generate key eap 1024
key pair generated
WSS# crypto generate key web 1024
key pair generated
3
Generate self-signed certificates:
WSS# crypto generate self-signed admin
Country Name: US
State Name: CA
Locality Name: San Francisco
Organizational Name: example
Organizational Unit: IT
Common Name: WSS 6
Email Address: admin@example.com
Unstructured Name: WSS in wiring closet 4
success: self-signed cert for admin generated
WSS# crypto generate self-signed eap
Country Name: US
State Name: CA
Locality Name: San Francisco
Organizational Name: example
Organizational Unit: IT
Common Name: WSS 6
Email Address: admin@example.com
Unstructured Name: WSS in wiring closet 4
Self-signed cert for eap is
success: self-signed cert for eap generated
20# crypto generate self-signed web
Country Name: US
State Name: CA
Locality Name: San Francisco
Organizational Name: example
Organizational Unit: IT
Common Name: WSS 6
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 535
Email Address: admin@example.com
Unstructured Name: WSS in wiring closet 4
success: self-signed cert for web generated
4
Display certificate information for verification:
WSS# show crypto certificate admin
Certificate:
Version: 3
Serial Number: 999 (0x3e7)
Subject: C=US, ST=CA, L=PLEAS, O=NRTL, OU=SQA, CN=BOBADMIN/
emailAddress=BOBADMIN, unstructuredName=BOB
Signature Algorithm: md5WithRSAEncryption
Issuer: C=US, ST=CA, L=PLEAS, O=NRTL, OU=SQA, CN=BOBADMIN/
emailAddress=BOBADMIN, unstructuredName=BOB
Validity:
Not Before: Oct 19 01:57:13 2004 GMT
Not After : Oct 19 01:57:13 2005 GMT
WSS# show crypto certificate eap
Certificate:
Version: 3
Serial Number: 999 (0x3e7)
Subject: C=US, ST=CA, L=PLEAS, O=NRTL, OU=SQA, CN=BOBADMIN/
emailAddress=BOBADMIN, unstructuredName=BOB
Signature Algorithm: md5WithRSAEncryption
Issuer: C=US, ST=CA, L=PLEAS, O=NRTL, OU=SQA, CN=BOBADMIN/
emailAddress=BOBADMIN, unstructuredName=BOB
Validity:
Not Before: Oct 19 01:59:42 2004 GMT
Not After : Oct 19 01:59:42 2005 GMT
WSS# show crypto certificate web
Certificate:
Version: 3
Serial Number: 999 (0x3e7)
Subject: C=US, ST=CA, L=PLEAS, O=NRTL, OU=SQA, CN=BOBADMIN/
emailAddress=BOBADMIN, unstructuredName=BOB
Signature Algorithm: md5WithRSAEncryption
Issuer: C=US, ST=CA, L=PLEAS, O=NRTL, OU=SQA, CN=BOBADMIN/
emailAddress=BOBADMIN, unstructuredName=BOB
Validity:
Not Before: Oct 19 02:02:02 2004 GMT
Not After : Oct 19 02:02:02 2005 GMT
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
536 Managing keys and certificates
Installing CA-signed certificates from PKCS #12 object files
This scenario shows how to use PKCS #12 object files to install public-private key pairs, CA-signed certificates, and CA
certifies for administrative access, 802.1X (EAP) access, and Web-based AAA access.
1
Set time and date parameters, if not already set. (See “Configuring and managing time parameters” on
page 174.)
2
3
Obtain PKCS #12 object files from a certificate authority.
Copy the PKCS #12 object files to nonvolatile storage on the WSS. Use the following command:
copy tftp://filename local-filename
For example, to copy PKCS #12 files named 2048admn.p12, 20481x.p12, and 2048web.p12 from the
TFTP server at the address 192.168.253.1, type the following commands:
WSS# copy tftp://192.168.253.1/2048admn.p12 2048admn.p12
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
WSS# copy tftp://192.168.253.1/20481x.p12 20481x.p12
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
WSS# copy tftp://192.168.253.1/2048web.p12 2048web.p12
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
4
Enter the one-time passwords (OTPs) for the PKCS #12 object files. The OTP protects the PKCS #12 file.
To enter a one-time password, use the following command:
crypto otp {admin | eap | web} one-time-password
For example:
WSS# crypto otp admin SeC%#6@o%c
OTP set
WSS# crypto otp eap SeC%#6@o%d
OTP set
WSS# crypto otp web SeC%#6@o%e
OTP set
5
Unpack the PKCS #12 object files into the certificate and key storage area on the WSS. Use the following
command:
crypto pkcs12 {admin | eap | web} filename
The filename is the location of the file on the WSS.
For example:
WSS# crypto pkcs12 admin 2048admn.p12
Unwrapped from PKCS12 file:
keypair
device certificate
CA certificate
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 537
WSS# crypto pkcs12 eap 20481x.p12
Unwrapped from PKCS12 file:
keypair
device certificate
CA certificate
WSS# crypto pkcs12 web 2048web.p12
Unwrapped from PKCS12 file:
keypair
device certificate
CA certificate
Note. WSS Software erases the OTP password entered with the crypto otp
command when you enter the crypto pkcs12 command.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
538 Managing keys and certificates
Installing CA-signed certificates using a PKCS #10 object file (CSR) and
a PKCS #7 object file
This scenario shows how to use CSRs to install public-private key pairs, CA-signed certificates, and CA certifies for
administrative access, 802.1X (EAP) access, and Web-based AAA access.
1
2
Set time and date parameters, if not already set. (See “Configuring and managing time parameters” on
page 174.)
Generate public-private key pairs:
WSS# crypto generate key admin 1024
key pair generated
WSS# crypto generate key eap 1024
key pair generated
WSS# crypto generate key web 1024
key pair generated
3
Create a CSR (PKCS #10 object file) to request an administrative certificate:
WSS# crypto generate request admin
Country Name: US
State Name: CA
Locality Name: Cambria
Organizational Name: example
Organizational Unit: eng
Common Name:WSS-2
Email Address: admin@example.com
Unstructured Name: wiring closet 12
CSR for admin is
-----BEGIN CERTIFICATE REQUEST-----
MIIBdTCB3wIBADA2MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExGjAYBgNVBAM
U
EXRlY2hwdWJzQHRycHouY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC
4
...
2L8Q9tk+G2As84QYMwe9RJAjfbYM5bdWRUFiLzvK7BJgqBsCZz4DP00=
-----END CERTIFICATE REQUEST-----
4
Copy the CSR into the CA’s application.
Note. You must paste the entire block, from the beginning
-----BEGIN CERTIFICATE REQUEST----- to the end
-----END CERTIFICATE REQUEST-----.
5
6
Transfer the signed administrative certificate (PKCS #7 object file) from the CA to your computer.
Open the signed certificate file with a text editor. Copy the entire file from the first hyphen to the last.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing keys and certificates 539
7
To install the administrative certificate on the WSS, type the following command to display a prompt:
WSS# crypto certificate admin
Enter PEM-encoded certificate
8
9
Paste the signed certificate text block into the WSS switch’s CLI, below the prompt.
Display information about the certificate, to verify it:
WSS# show crypto certificate admin
11 Obtain the CA’s own certificate.
12 To install the CA’s certificate on the WSS and help authenticate the switch’s Admin certificate, type the
following command to display a prompt:
WSS# crypto ca-certificate admin
Enter PEM-encoded certificate
13 Paste the CA’s signed certificate under the prompt.
14 Display information about the CA’s certificate, to verify it:
WSS# show crypto ca-certificate admin
15 Repeat step 12 through step 14 to install the CA’s certificate for EAP (802.1X) and Web-based AAA.
SSID name “Any”
In authentication rules for wireless access, you can specify the name any for the SSID. This value is a wildcard that
matches on any SSID string requested by the user.
For 802.1X and Web-based AAA rules that match on SSID any, WSS Software checks the RADIUS servers or local
database for the username (and password, if applicable) entered by the user. If the user information matches, WSS
Software grants access to the SSID requested by the user, regardless of which SSID name it is.
For MAC authentication rules that match on SSID any, WSS Software checks the RADIUS servers or local database for
the MAC address (and password, if applicable) of the user’s device. If the address matches, WSS Software grants access
to the SSID requested by the user, regardless of which SSID name it is.
Last-resort processing
One of the fallthru authentication types you can set on a service profile or wired authentication port is last-resort.
If no 802.1X or MAC access rules are configured for a service profile’s SSID, and the SSID’s fallthru type is last-resort,
WSS Software allows users onto the SSID or port without prompting for a username or password. The default authoriza-
tion attributes set on the SSID are applied to the user. For example, if the vlan-name attribute on the service profile is set
to guest-vlan, last-resort users are placed in guest-vlan.
If no 802.1X or MAC access rules are configured for wired, and the wired authentication port’s fallthru type is
last-resort, WSS Software allows users onto the port without prompting for a username or password. The authorization
attributes set on user last-resort-wired are applied to the user.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
540 Managing keys and certificates
User credential requirements
The user credentials that WSS Software checks for on RADIUS servers or in the local database differ depending on the
type of authentication rule that matches on the SSID or wired access requested by the user.
•
For a user to be successfully authenticated by an 802.1X or Web-based AAA rule, the username and password
entered by the user must be configured on the RADIUS servers used by the authentication rule or in the switch’s
local database, if the local database is used by the rule.
•
For a user to be successfully authenticated based on the MAC address of the user’s device, the MAC address must
be configured on the RADIUS servers used by the authentication rule or in the switch’s local database, if the local
database is used by the rule. If the MAC address is configured in the local database, no password is required.
However, since RADIUS requires a password, if the MAC address is on the RADIUS server, WSS Software checks
for a password. The default well-known password is nortel but is configurable.
For a user to be successfully authenticated for last-resort access on a wired authentication port, the
RADIUS servers or local database must contain a user named last-resort-wired. If the last-resort-wired
user is configured in the local database, no password is required. However, since RADIUS requires a
password, if the last-resort-wired user is on the RADIUS server, WSS Software checks for a password.
The default well-known password is nortel but is configurable. (The same password applies to MAC
users.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
541
Configuring AAA for network users
About AAA for network users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541
AAA tools for network users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549
Configuring 802.1X authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556
Configuring Web portal Web-based AAA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
Configuring last-resort access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585
Configuring AAA for users of third-party APs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588
Assigning authorization attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 594
Overriding or adding attributes locally with a location policy . . . . . . . . . . . . . . . . . 609
Configuring accounting for wireless network users . . . . . . . . . . . . . . . . . . . . . . . . . 614
Displaying the AAA configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 620
Avoiding AAA problems in configuration order . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621
Configuring a Mobility Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624
Network user configuration scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
About AAA for network users
Network users include the following types of users:
•
•
Wireless users—Users who access the network by associating with an SSID on a Nortel radio.
Wired authentication users—Users who access the network over an Ethernet connection to a WSS port that is
configured as a wired authentication (wired-auth) port.
You can configure authentication rules for each type of user, on an individual SSID or wired authentication port basis.
WSS Software authenticates users based on user information on RADIUS servers or in the WSS’s local database. The
RADIUS servers or local database authorize successfully authenticated users for specific network access, including
VLAN membership. Optionally, you also can configure accounting rules to track network access information.
The following sections describe the WSS Software authentication, authorization, and accounting (AAA) features in
more detail.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
542 Configuring AAA for network users
Authentication
When a user attempts to access the network, WSS Software checks for an authentication rule that matches the following
parameters:
•
For wireless access, the authentication rule must match the SSID the user is requesting, and the user’s username or
MAC address.
•
For access on a wired authentication port, the authentication rule must match the user’s username or MAC address.
If a matching rule is found, WSS Software then checks RADIUS servers or the switch’s local user database for creden-
tials that match those presented by the user. Depending on the type of authentication rule that matches the SSID or wired
authentication port, the required credentials are the username or MAC address, and in some cases, a password.
Each authentication rule specifies where the user credentials are stored. The location can be a group of RADIUS servers
or the switch’s local database. In either case, if WSS Software has an authentication rule that matches on the required
parameters, WSS Software checks the username or MAC address of the user and, if required, the password to make sure
they match the information configured on the RADIUS servers or in the local database.
The username or MAC address can be an exact match or can match a userglob or MAC address wildcard, which allow
wildcards to be used for all or part of the username or MAC address. (For more information about wildcards, see “AAA
Authentication types
WSS Software provides the following types of authentication:
•
IEEE 802.1X—If the network user’s network interface card (NIC) supports 802.1X, WSS Software checks for an
802.1X authentication rule that matches the username (and SSID, if wireless access is requested), and that uses the
Extensible Authentication Protocol (EAP) requested by the NIC. If a matching rule is found, WSS Software uses
the requested EAP to check the RADIUS server group or local database for the username and password entered by
the user. If matching information is found, WSS Software grants access to the user.
•
MAC—If the username does not match an 802.1X authentication rule, but the MAC address of the user’s NIC or
Voice-over-IP (VoIP) phone and the SSID (if wireless) do match a MAC authentication rule, WSS Software checks
the RADIUS server group or local database for matching user information. If the MAC address (and password, if on
a RADIUS server) matches, WSS Software grants access. Otherwise, WSS Software attempts the fallthru
authentication type, which can be Web, last-resort, or none. (Fallthru authentication is described in more detail in
•
•
Web—A network user attempts to access a web page over the network. The WSS intercepts the HTTP or HTTPS
request and serves a login Web page to the user. The user enters the username and password, and WSS Software
checks the RADIUS server group or local database for matching user information. If the username and password
match, WSS Software redirects the user to the web page she requested. Otherwise, WSS Software denies access to
the user.
Last-resort—A network user associates with an SSID or connects to a wired authentication port, and does not enter
a username or password.
●
SSID—If 802.1X or MAC authentication do not apply to the SSID (no 802.1X or MAC access rules
are configured for the SSID), the default authorization attributes set on the SSID are applied to the
user and the user is allowed onto the network.
●
Wired authentication port—If 802.1X or MAC authentication do not apply to the port (no 802.1X or
MAC access rules have the wired option set), WSS Software checks for user last-resort-wired. If
this user is configured, the authorization attributes set for the user are applied to the user who is on
the wired authentication port and the user is allowed onto the network.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 543
Authentication algorithm
WSS Software can try more than one of the authentication types described in “Authentication types” to authenticate a
user. WSS Software tries 802.1X first. If the user’s NIC supports 802.1X but fails authentication, WSS Software denies
access. Otherwise, WSS Software tries MAC authentication next. If MAC authentication is successful, WSS Software
grants access to the user. Otherwise, WSS Software tries the fallthru authentication type specified for the SSID or wired
authentication port. The fallthru authentication type can be one of the following:
•
•
•
Web
Last-resort
None
Web and last-resort are described in “Authentication types” on page 542. None means the user is automatically denied
access. The fallthru authentication type for wireless access is associated with the SSID (through a service profile). The
fallthru authentication type for wired authentication access is specified with the wired authentication port. (For informa-
tion about service profiles, see “Service profiles” on page 280. For information about wired authentication port
Note. The fallthru authentication type None is different from the authentication method
none you can specify for administrative access. The fallthru authentication type None
denies access to a network user. In contrast, the authentication method none allows
access to the WSS by an administrator. (See “Configuring Web-based AAA for
Figure 32 shows how WSS Software tries the authentication types for wireless access. (The authentication process is
similar for access through a wired authentication port, except last-resort access requires a last-resort-wired user.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
544 Configuring AAA for network users
Figure 32. Authentication flowchart for wireless network users
Client associates with Nortel radio
or requests access from wired authentication port
Client
responds
to 802.1X?
Client requests
encrypted SSID?
Authent.
succeeds?
802.1X rule that
matches SSID?
Allow
Client
Yes
Yes
Yes
Yes
No
No
No
No
Refuse
Client
Authent.
succeeds?
MAC rule that
matches SSID?
Allow
Client
Yes
No
No
Use fallthru authentication
Authent.
succeeds?
Allow
Client
Yes
Last-resort rule that
matches SSID?
last-resort?
No
Yes
Yes
No
No
Refuse
Client
Refuse
Client
Authent.
succeeds?
Allow
Client
Web Auth rule that
matches SSID?
web?
No
Yes
Yes
Yes
Yes
No
No
Refuse
Client
Refuse
Client
Refuse
Client
none?
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 545
Last-resort access to an SSID does not require a special user (such as last-resort-ssid) to be
configured. Instead, if the fallthru authentication type on the SSID’s service profile is set to
last-resort, and the SSID does not have any 802.1X or MAC access rules, a user can access the
SSID without entering a username or password.
If the user is authenticated, WSS Software then checks the RADIUS server or local database (the same place
WSS Software looked for user information to authenticate the user) for the authorization attributes assigned to
the user. Authorization attributes specify the network resources the user can access.
The only required attribute is the Virtual LAN (VLAN) name on which to place the user. RADIUS and WSS
Software have additional optional attributes. For example, you can provide further access controls by speci-
fying the times during which the user can access the network, you can apply inbound and outbound access
control lists (ACLs) to the user’s traffic, and so on.
To assign attributes on the RADIUS server, use the standard RADIUS attributes supported on the server. To
assign attributes in the WSS’s local database, use the WSS Software vendor-specific attributes (VSAs).
The RADIUS attributes supported by WSS Software are described in “Supported RADIUS attributes” on
.
WSS Software provides the following VSAs, which you can assign to users configured in the local database or
on a RADIUS server:
No
•
Encryption-Type—Specifies the type of encryption required for access by the client. Clients who attempt
to use an unauthorized encryption method are rejected.
•
•
End-Date—Date and time after which the user is no longer allowed to be on the network.
Mobility-Profile—Controls the WSS ports a user can access. For wireless users, a WSS Software
Mobility Profile specifies the APs through which the user can access the network. For wired
authentication users, the Mobility Profile specifies the wired authentication ports through which the user
can access the network.
.
•
•
SSID—SSID the user is allowed to access after authentication.
Start-Date—Date and time at which the user becomes eligible to access the network. WSS Software does
not authenticate the user unless the attempt to access the network occurs at or after the specified date and
time, but before the end-date (if specified).
•
•
•
Time-of-Day—Day(s) and time(s) during which the user is permitted to log into the network.
URL—URL to which the user is redirected after successful Web-based AAA.
VLAN-Name—VLAN to place the user on.
You also can assign the following RADIUS attributes to users configured in the local database.
•
•
Filter-Id—Security ACL that permits or denies traffic received (input) or sent (output) the WSS.
Service-Type—Type of access the user is requesting, which can be network access, administrative access
to the enabled (configuration) mode of the WSS Software CLI, or administrative access to the nonenabled
mode of the CLI
•
Session-Timeout—Maximum number of seconds allowed for the user’s session.
Regardless of whether you configure the user and attributes on RADIUS servers or the switch’s local database,
the VLAN attribute is required. The other attributes are optional.
In addition to configuring authorization attributes for users on RADIUS servers or the switch’s local database,
you can also configure attributes within a service profile. These authorization attributes are applied to users
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
546 Configuring AAA for network users
SSID name “Any”
In authentication rules for wireless access, you can specify the name any for the SSID. This value is a wildcard that
matches on any SSID string requested by the user.
For 802.1X and Web-based AAA rules that match on SSID any, WSS Software checks the RADIUS servers or local
database for the username (and password, if applicable) entered by the user. If the user information matches, WSS
Software grants access to the SSID requested by the user, regardless of which SSID name it is.
For MAC authentication rules that match on SSID any, WSS Software checks the RADIUS servers or local database for
the MAC address (and password, if applicable) of the user’s device. If the address matches, WSS Software grants access
to the SSID requested by the user, regardless of which SSID name it is.
Last-resort processing
One of the fallthru authentication types you can set on a service profile or wired authentication port is last-resort.
If no 802.1X or MAC access rules are configured for a service profile’s SSID, and the SSID’s fallthru type is last-resort,
WSS Software allows users onto the SSID or port without prompting for a username or password. The default authoriza-
tion attributes set on the SSID are applied to the user. For example, if the vlan-name attribute on the service profile is set
to guest-vlan, last-resort users are placed in guest-vlan.
If no 802.1X or MAC access rules are configured for wired, and the wired authentication port’s fallthru type is
last-resort, WSS Software allows users onto the port without prompting for a username or password. The authorization
attributes set on user last-resort-wired are applied to the user.
User credential requirements
The user credentials that WSS Software checks for on RADIUS servers or in the local database differ depending on the
type of authentication rule that matches on the SSID or wired access requested by the user.
•
For a user to be successfully authenticated by an 802.1X or Web-based AAA rule, the username and password
entered by the user must be configured on the RADIUS servers used by the authentication rule or in the switch’s
local database, if the local database is used by the rule.
•
For a user to be successfully authenticated based on the MAC address of the user’s device, the MAC address must
be configured on the RADIUS servers used by the authentication rule or in the switch’s local database, if the local
database is used by the rule. If the MAC address is configured in the local database, no password is required.
However, since RADIUS requires a password, if the MAC address is on the RADIUS server, WSS Software checks
for a password. The default well-known password is nortel but is configurable.
For a user to be successfully authenticated for last-resort access on a wired authentication port, the
RADIUS servers or local database must contain a user named last-resort-wired. If the last-resort-wired
user is configured in the local database, no password is required. However, since RADIUS requires a
password, if the last-resort-wired user is on the RADIUS server, WSS Software checks for a password.
The default well-known password is nortel but is configurable. (The same password applies to MAC
users.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 547
accessing the SSID managed by the service profile (in addition to any attributes supplied by a RADIUS server
or the switch’s local database).
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
548 Configuring AAA for network users
Accounting
WSS Software also supports accounting. Accounting collects and sends information used for billing, auditing,
and reporting—for example, user identities, connection start and stop times, the number of packets received
and sent, and the number of bytes transferred. You can track sessions through accounting information stored
locally or on a remote RADIUS server. As network users roam throughout a Mobility Domain, accounting
records track them and their network usage.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 549
Summary of AAA features
Depending on your network configuration, you can configure authentication, authorization, and accounting (AAA) for
network users to be performed locally on the WSS or remotely on a RADIUS server. The number of users that the local
WSS database can support depends on your platform.
AAA for network users controls and monitors their use of the network:
•
Classification for customized access. As with administrative and console users, you can classify network users
through username wildcards. Based on the structured username, different AAA treatments can be given to different
classes of user. For example, users in the human resources department can be authenticated differently from users in
the sales department.
•
Authentication for full or limited access. IEEE 802.1X network users are authenticated when they identify
themselves with a credential. Authentication can be passed through to RADIUS, performed locally on the WSS, or
only partially “offloaded” to the switch. Network users without 802.1X support can be authenticated by the MAC
addresses of their devices. If neither 802.1X nor MAC authentication apply to the user, they can still be
authenticated by a fallthru authentication type, either Web-based AAA or last-resort authentication. The default
fallthru type is None, which denies access to users who do not match an 802.1X or MAC authentication rule.
•
Authorization for access control. Authorization provides access control by means of such mechanisms as per-user
security access control lists (ACLs), VLAN membership, Mobility Domain assignment, and timeout enforcement.
Because authorization is always performed on network access users so they can use a particular VLAN, the WSS
automatically uses the same AAA method (RADIUS server group or local database) for authorization that you
define for a user’s authentication.
•
•
•
Local authorization control. You can override any AAA assignment of VLAN or security ACL for individual
network users on a particular WSS by configuring the location policy on the WSS.
SSID default authorization attributes. You can configure service profiles with a set of default AAA authorization
attributes that are used when the normal AAA process or a location policy does not provide them.
Accounting for tracking users and resources. Accounting collects and sends information used for billing,
auditing, and reporting—for example, user identities, connection start and stop times, the number of packets
received and sent, and the number of bytes transferred. You can track sessions through accounting information
stored locally or on a remote RADIUS server. As network users roam throughout a Mobility Domain, accounting
records track them and their network usage.
AAA tools for network users
Authentication verifies network user identity and is required before a network user is granted access to the network. A
WSS authenticates user identity by username-password matching, digital signatures and certificates, or other methods
(for example, by MAC address).
You must decide whether to authenticate network users locally on the WSS, remotely via one or more external RADIUS
server groups, or both locally and remotely. (For server group details, see “Configuring RADIUS server groups” on
page 639.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
550 Configuring AAA for network users
“Wildcards” and groups for network user classification
“Wildcarding” lets you classify users by username or MAC address for different AAA treatments. A user
wildcard is a string used by AAA and IEEE 802.1X or Web-based AAA methods to match a user or set of
users. MAC address wildcards match authentication methods to a MAC address or set of MAC addresses.
User wildcards and MAC address wildcards can make use of wildcards. For details, see “User wildcards,
A user group is a named collection of users or MAC addresses sharing a common authorization policy. For
example, you might group all users on the first floor of building 17 into the group bldg-17-1st-floor, or group
all users in the IT group into the group infotech-people.
Wildcard “Any” for SSID matching
Authentication rules for wireless access include the SSID name, and must match on the SSID name requested
by the user for WSS Software to attempt to authenticate the user for that SSID. To make an authentication rule
match an any SSID string, specify the SSID name as any in the rule.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 551
AAA methods for IEEE 802.1X and Web network access
The following AAA methods are supported by Nortel for 802.1X and Web network access mode:
•
•
Client certificates issued by a certificate authority (CA) for authentication.
(For this method, you assign an authentication protocol to a user. For protocol details, see “IEEE 802.1X
•
•
The WSS switch’s local database of usernames and user groups for authentication.
(For configuration details, see “Adding and clearing local users for Administrative Access” on page 84,
•
A named group of RADIUS servers. The WSS supports up to four server groups, which can each contain
between one and four servers.
You can use the local database or RADIUS servers for MAC access as well. If you use RADIUS servers, make
sure you configure the password for the MAC address user as nortel. (This is the default authorization
AAA rollover process
A WSS attempts AAA methods in the order in which they are entered in the configuration:
1
2
3
The first AAA method in the list is used unless that method results in an error. If the method
results in a pass or fail, the result is final and the WSS tries no other methods.
If the WSS receives no response from the first AAA method, it tries the second method in the
list.
If the WSS receives no response from the second AAA method, it tries the third method. This
evaluation process is applied to all methods in the list.
Note. If a AAA rule specifies local as a secondary AAA method, to be used if the
RADIUS servers are unavailable, and WSS Software authenticates a client with the local
method, WSS Software starts again at the beginning of the method list when attempting to
authorize the client. This can cause unexpected delays during client processing and can
cause the client to time out before completing logon.
Local override exception
The one exception to the operation described in “AAA rollover process” takes place if the local database is the
first method in the list and is followed by a RADIUS server group method. If the local method fails to find a
matching username entry in the local database, the WSS tries the next RADIUS server group method. This
exception is referred to as local override.
If the local database is the last method in the list, however, local authentication must either accept or deny the
user, because it has no other method to roll over to.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
552 Configuring AAA for network users
Remote authentication with local backup
You can use a combination of authentication methods; for example, PEAP offload and local authentication. When PEAP
offload is configured, the WSS offloads all EAP processing from server groups; the RADIUS servers are not required to
communicate using the EAP protocols. (For details, see “Configuring 802.1X Acceleration” on page 557.) In the event
that RADIUS servers are unavailable, local authentication takes place, using the database on the WSS.
Suppose an administrator wants to rely on RADIUS servers and also wants to ensure that a certain group of users always
gets access. As shown in the following example, the administrator can enable PEAP offload, so that authentication is
performed by a RADIUS server group as the first method for these users, and configure local authentication last, in case
1
To configure server-1 and server-2 at IP addresses 192.168.253.1 and 192.168.253.2 with the password
chey3nn3, the administrator enters the following commands:
WSS# set radius server server-1 address 192.168.253.1 key chey3nn3
WSS# set radius server server-2 address 192.168.253.2 key chey3nn3
To configure server-1 and server-2 into server-group-1, the administrator enters the following command:
WSS# set server group server-group-1 members server-1 server-2
2
3
To enable PEAP offload plus local authentication for all users of SSID mycorp at @example.com, the
administrator enters the following command.
WSS# set authentication dot1x ssid mycorp *@example.com peap-mschapv2
server-group-1 local
Figure 33 shows the results of this combination of methods.
Figure 33. Remote authentication with PEAP offload using local
authentication as backup
WSS
local database
pass fail
5
RADIUS
Server-2
RADIUS
Server-1
4
3
1
2
Server-group-1
1
set authentication dot1x ssid mycorp *@example.com peap-mschapv2 server-group-1
local
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 553
Authentication proceeds as follows:
1
When user Jose@example.com attempts authentication, the WSS sends an authentication request to the
first AAA method, which is server-group-1.
Because server-group-1 contains two servers, the first RADIUS server, server-1, is contacted. If this
server responds, the authentication proceeds using server-1.
2
3
If server-1 fails to respond, the WSS retries the authentication using server-2. If server-2 responds, the
authentication proceeds using server-2.
If server-2 does not respond, because the WSS has no more servers to try in server-group-1, the WSS
attempts to authenticate using the next AAA method, which is the local method.
4
5
The WSS consults its local database for an entry that matches Jose@example.com.
If a suitable local database entry exists, the authentication proceeds. If not, authentication fails and
Jose@example.com is not allowed to access the network.
Note. If one of the RADIUS servers in the group does respond, but it indicates that the
user does not exist on the RADIUS server, or that the user is not permitted on the network,
then authentication for the user fails, regardless of any additional methods. Only if all the
RADIUS servers in the server group do not respond does the WSS attempt to authenticate
using the next method in the list.
Also note that if the primary authentication method is local and the secondary method is
RADIUS, but the user does not exist in the local database, then the WSS does attempt to
Note. Using pass-through authentication as the primary authentication method and the
local database as the secondary authentication method is not supported.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
554 Configuring AAA for network users
IEEE 802.1X Extensible Authentication Protocol types
Extensible Authentication Protocol (EAP) is a generic point-to-point protocol that supports multiple authenti-
cation mechanisms. EAP has been adopted as a standard by the Institute of Electrical and Electronic Engineers
(IEEE). IEEE 802.1X is an encapsulated form for carrying authentication messages in a standard message
exchange between a user (client) and an authenticator.
Table 34 summarizes the EAP protocols (also called types or methods) supported by WSS Software.
Table 34: EAP Authentication Protocols for local processing
EAP Type
Description
Use
Considerations
EAP-MD5
(EAP with Message
Digest Algorithm 5)
Authentication algorithm
that uses a
challenge-response
mechanism to compare
hashes
Wired authentication only 1 This protocol
provides no
encryption or key
establishment.
EAP-TLS
(EAP with Transport
Layer Security)
Protocol that provides mutual Wireless and wired
This protocol
requires X.509
public key
authentication,
authentication.
integrity-protected
encryption algorithm
negotiation, and key
exchange. EAP-TLS
provides encryption and data
integrity checking for the
connection.
All authentication is
processed on the WSS.
certificates on both
sides of the
connection.
Requires use of local
database. Not
supported for
RADIUS.
PEAP-MS-
CHAP-V2
(Protected EAP with
Microsoft Challenge
Handshake
Authentication
Protocol version 2)
The wireless client
Wireless and wired
authentication:
Only the server side
of the connection
authenticates the server
(either the WSS or a
RADIUS server) using TLS
to set up an encrypted
session. Mutual
requires a certificate.
•
The PEAP portion is
processed on the WSS.
The client needs
only a username and
password.
•
The MS-CHAP-V2
portion is processed on
the RADIUS server or
locally, depending on the
configuration.
authentication is performed
by MS-CHAP-V2.
1. EAP-MD5 does not work with Microsoft wired authentication clients.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 555
Ways a WSS can use EAP
Network users with 802.1X support cannot access the network unless they are authenticated. You can
configure a WSS to authenticate users with EAP on a group of RADIUS servers and/or in a local user database
on the WSS, or to offload some authentication tasks from the server group. Table 35 details these three basic
WSS authentication approaches.
Table 35: Three basic WSS approaches to EAP authentication
Approach Description
Pass-
through
An EAP session is established directly between the client and RADIUS server, passing
through the WSS. User information resides on the server. All authentication information and
certificate exchanges pass through the switch or use client certificates issued by a certificate
authority (CA). In this case, the switch does not need a digital certificate, although the client
might.
Local
The WSS performs all authentication using information in a local user database configured on
the switch, or using a client-supplied certificate. No RADIUS servers are required. In this
case, the switch needs a digital certificate. If you plan to use the EAP with Transport Layer
Security (EAP-TLS) authentication protocol, the clients also need certificates.
Offload
The WSS offloads all EAP processing from a RADIUS server by establishing a TLS session
between the switch and the client. In this case, the switch needs a digital certificate. When
you use offload, RADIUS can still be used for non-EAP authentication and authorization.
EAP-TLS cannot be used with offload.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
556 Configuring AAA for network users
Effects of authentication type on encryption method
Wireless users who are authenticated on an encrypted service set identifier (SSID) can have their data traffic encrypted
by the following methods:
•
•
•
Wi-Fi Protected Access (WPA) encryption
Non-WPA dynamic Wired Equivalent Privacy (WEP) encryption
Non-WPA static WEP encryption
The authentication method you assign to a user determines the encryption available to the user. Users configured for
EAP authentication, MAC authentication, Web, or last-resort authentication can have their traffic encrypted as follows:
EAP
Authentication
MAC
Authentication
Last-Resort
Web-based AAA
WPA encryption
Static WEP
Static WEP
Static WEP
Dynamic WEP
encryption
No encryption
(if SSID is
unencrypted)
No encryption
(if SSID is
unencrypted)
No encryption
(if SSID is
unencrypted)
Wired users are not eligible for the encryption performed on the traffic of wireless users, but they can be authenticated
by an EAP method, a MAC address, or a Web login page served by the WSS.
Configuring 802.1X authentication
The IEEE 802.1X standard is a framework for passing EAP protocols over a wired or wireless LAN. Within this frame-
work, you can use TLS, PEAP-TTLS, or EAP-MD5. Most EAP protocols can be passed through the WSS to the
RADIUS server. Some protocols can be processed locally on the WSS.
The following 802.1X authentication command allows differing authentication treatments for multiple users:
set authentication dot1x {ssid ssid-name | wired} user-wildcard [bonded] protocol method1
[method2] [method3] [method4]
For example, the following command authenticates wireless user Tamara, when requesting SSID wetlands, as an 802.1X
user using the PEAP-MS-CHAP-V2 method via the server group shorebirds, which contains one or more RADIUS
servers:
WSS# set authentication dot1x ssid wetlands Tamara peap-mschapv2 shorebirds
When a user attempts to connect through 802.1X, the following events occur:
1
2
For each 802.1X login attempt, WSS Software examines each command in the configuration file in strict
configuration order.
The first command whose SSID and user wildcard matches the SSID and incoming username is used to
process this authentication. The command determines exactly how this particular login attempt is
processed by the WSS.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 557
Configuring 802.1X Acceleration
You can configure the WSS to offload all EAP processing from server groups. In this case, the RADIUS server is not
required to communicate using the EAP protocols.
For PEAP-MS-CHAP-V2 offload, you define a complete user profile in the local WSS database and only a username
and password on a RADIUS server.
For example, the following command authenticates all wireless users who request SSID marshes at example.com by
offloading PEAP processing onto the WSS, while still performing MS-CHAP-V2 authentication via the server group
shorebirds:
WSS# set authentication dot1x ssid marshes *@example.com peap-mschapv2 shorebirds
To offload both PEAP and MS-CHAP-V2 processing onto the WSS, use the following command:
WSS# set authentication dot1x ssid marshes *@example.com peap-mschapv2 local
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
558 Configuring AAA for network users
Using pass-through
The pass-through method causes EAP authentication requests to be processed entirely by remote RADIUS servers in
server groups.
For example, the following command enables users at EXAMPLE to be processed via server group shorebirds or
swampbirds:
WSS# set authentication dot1X ssid marshes EXAMPLE/* pass-through shorebirds
swampbirds
The server group swampbirds is contacted only if all the RADIUS servers in shorebirds do not respond.
(For an example of the use of pass-through servers plus the local database for authentication, see “Remote authentication
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 559
Authenticating through a local database
To configure the WSS to authenticate and authorize a user against the local database in the WSS, use the following
command:
set authentication dot1x {ssid ssid-name | wired} user-wildcard [bonded] protocol local
For example, the following command authenticates 802.1X user Jose for wired authentication access via the local
database:
WSS# set authentication dot1X Jose wired peap-mschapv2 local
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
560 Configuring AAA for network users
Binding user authentication to machine authentication
Bonded Authentication™ (bonded authentication) is a security feature that binds an 802.1X user’s authentication to
authentication of the machine from which the user is attempting to log on. When this feature is enabled, WSS Software
authenticates a user only if the machine from which the user logs on has already been authenticated separately.
By default, WSS Software does not bind user authentication to machine authentication. A trusted user can log on from
any machine attached to the network.
You can use Bonded Authentication with Microsoft Windows clients that support separate 802.1X authentication for the
machine itself and for a user who uses the machine to log on to the network.
Network administrators sometimes use machine authentication in a Microsoft Active Directory domain to run login
scripts, and to control defaults, application access and updates, and so on. Bonded Authentication provides an added
security measure, by ensuring that a trusted user can log onto the network only from a trusted machine known to Active
Directory.
For example, if user bob.mycorp.com has a trusted laptop PC used for work but also has a personal laptop PC, you might
want to bind Bob’s authentication with the authentication of his workplace laptop, host/bob-laptop.mycorp.com. In this
case, Bob can log on to the company network only from his work laptop.
When Bonded Authentication is enabled, WSS Software retains information about the machine’s session when a user
logs on from that machine. WSS Software authenticates the user only if there has already been a successful machine
authentication. Evidence of the machine’s session in WSS Software indicates that the machine has successfully authenti-
cated and is therefore trusted by WSS Software. If WSS Software does not have session information for the machine,
WSS Software refuses to authenticate the user and does not allow the user onto the network from the unauthenticated
machine.
Note. If the 802.1X reauthentication parameter or the RADIUS Session-Timeout
parameter is applicable, the user must log in before the 802.1X reauthentication timeout or
the RADIUS session-timeout for the machine’s session expires. Normally, these
parameters apply only to clients that use dynamic WEP, or use WEP-40 or WEP-104
encryption with WPA or RSN.
Authentication rule requirements
Bonded Authentication requires an 802.1X authentication rule for the machine itself, and a separate 802.1X authentica-
tion rule for the user(s). Use the bonded option in the user authentication rule, but not in the machine authentication rule.
The authentication rule for the machine must be higher up in the list of authentication rules than the authentication rule
for the user.
You must use 802.1X authentication rules. The 802.1X authentication rule for the machine must use pass-through as
the protocol. Nortel recommends that you also use pass-through for the user’s authentication rule.
The rule for the machine and the rule for the user must use a RADIUS server group as the method. (Generally, in a
Bonded Authentication configuration, the RADIUS servers will use a user database stored on an Active Directory
server.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 561
Nortel recommends that you make the rules as general as possible. For example, if the Active Directory domain is
mycorp.com, the following userglobs match on all machine names and users in the domain:
•
•
host/*.mycorp.com (userglob for the machine authentication rule)
*.mycorp.com (userglob for the user authentication rule)
If the domain name has more nodes (for example, nl.mycorp.com), use an asterisk in each node that you want to match
globally. For example, to match on all machines and users in mycorp.com, use the following userglobs:
•
•
host/*.*.mycorp.com (userglob for the machine authentication rule)
*.*.mycorp.com (userglob for the user authentication rule)
Use more specific rules to direct machines and users to different server groups. For example, to direct users in
nl.mycorp.com to a different server group than users in de.mycorp.com, use the following userglobs:
•
•
•
•
host/*.nl.mycorp.com (userglob for the machine authentication rule)
*.nl.mycorp.com (userglob for the user authentication rule)
host/*.de.mycorp.com (userglob for the machine authentication rule)
*.de.mycorp.com (userglob for the user authentication rule)
Bonded Authentication period
The Bonded Authentication period is the number of seconds WSS Software allows a Bonded Authentication user to
reauthenticate.
After successful machine authentication, a session for the machine appears in the session table in WSS Software. When
the user logs on and is authenticated, the user session replaces the machine session in the table. However, since the
user’s authentication rule contains the bonded option, WSS Software remembers that the machine was authenticated.
If a Bonded Authentication user’s session is ended due to 802.1X reauthentication or the RADIUS Session-Timeout
parameter, WSS Software can allow time for the user to reauthenticate. The amount of time that WSS Software allows
for reauthentication is controlled by the Bonded Authentication period.
If the user does not reauthenticate within the Bonded Authentication period, WSS Software deletes the information
about the machine session. After the machine session information is deleted, the Bonded Authentication user cannot
reauthenticate. When this occurs, the user will need to log off, then log back on, to access the network. After multiple
failed reauthentication attempts, the user might need to reboot the PC before logging on.
By default, the Bonded Authentication period is 0 seconds. WSS Software does not wait for a Bonded Authentication
user to reauthenticate.
You can set the Bonded Authentication period to a value up to 300 seconds. Nortel recommends that you try 60 seconds,
and change the period to a longer value only if clients are unable to authenticate within 60 seconds.
To set the Bonded Authentication period, use the following command:
set dot1x bonded-period seconds
To reset the Bonded Authentication period to its default value (0), use the following command:
clear dot1x bonded-period
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
562 Configuring AAA for network users
Bonded Authentication configuration example
To configure Bonded Authentication:
•
•
•
Configure separate authentication rules for the machine and for the user(s).
Set the Bonded Authentication period.
Verify the configuration changes.
The following commands configure two 802.1X authentication rules for access to SSID mycorp. The first rule
is for authentication of all trusted laptop PCs at mycorp.com (host/*-laptop.mycorp.com). The second rule is
for bonded authentication of all users at mycorp.com (*.mycorp.com). Both rules use pass-through as the
protocol, and use RADIUS server group radgrp1.
WSS# set authentication dot1x ssid mycorp host/*-laptop.mycorp.com pass-through
radgrp1
success: change accepted.
WSS# set authentication dot1x ssid mycorp *.mycorp.com bonded pass-through
radgrp1
success: change accepted.
The following command sets the Bonded Authentication period to 60 seconds, to allow time for WEP users to
reauthenticate:
WSS# set dot1x bonded-period 60
success: change accepted.
Displaying Bonded Authentication configuration information
To display Bonded Authentication configuration information, use the following command:
show dot1x config
In the following example, bob.mycorp.com uses Bonded Authentication, and the Bonded Authentication
period is set to 60 seconds.
WSS# show dot1x config
802.1X user policy
----------------------
'host/bob-laptop.mycorp.com' on ssid 'mycorp' doing PASSTHRU
'bob.mycorp.com' on ssid 'mycorp' doing PASSTHRU (bonded)
802.1X parameter
----------------
setting
-------
supplicant timeout
auth-server timeout
quiet period
30
30
60
5
3600
2
enabled
enabled
enabled
transmit period
reauthentication period
maximum requests
key transmission
reauthentication
authentication control
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 563
WEP rekey period
WEP rekey
Bonded period
1800
enabled
60
Information for the 802.1X authentication rule for the machine (host/bob-laptop.mycorp.com) is also
displayed. However, the bonded option is configured only for the user’s authentication rule. The bonded
option applies only to the authentication rules for users, not the authentication rules for machines.
Configuring authentication and authorization by
MAC address
You must sometimes authenticate users based on the MAC addresses of their devices rather than a user-
name-password or certificate. For example, some Voice-over-IP (VoIP) phones and personal digital assistants
(PDAs) do not support 802.1X authentication. If a client does not support 802.1X, WSS Software attempts to
perform MAC authentication for the client instead. The WSS can discover the MAC address of the device
from received frames and can use the MAC address in place of a username for the client.
Users authorized by MAC address require a MAC authorization password if RADIUS authentication is
desired. The default well-known password is nortel.
Caution! Use this method with care. IEEE 802.11 frames can be forged and can result
in unauthorized network access if MAC authentication is employed.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
564 Configuring AAA for network users
Adding and clearing MAC users and user groups locally
MAC users and groups can gain network access only through the WSS. They cannot create administrative connections
to the WSS. A MAC user is created in a similar fashion to other local users except for having a MAC address instead of
a username. MAC user groups are created in a similar fashion to other local user groups.
(To create a MAC user profile or MAC user group on a RADIUS server, see the documentation for your RADIUS
server.)
Adding MAC users and groups
To create a MAC user group in the local WSS database, you must associate it with an authorization attribute and value.
Use the following command:
set mac-usergroup group-name attr attribute-name value
For example, to create a MAC user group called mac-easters with a 3000-second Session-Timeout value, type the
following command:
WSS# set mac-usergroup mac-easters attr session-timeout 3000
success: change accepted.
To configure a MAC user in the local database and optionally add the user to a group, use the following command:
set mac-user mac-addr [group group-name]
For example, type the following command to add MAC user 01:0f:03:04:05:06 to group macfans:
WSS# set mac-user 01:0f:03:04:05:06 group macfans
success: change accepted.
Clearing MAC users and groups
To clear a MAC user from a user group, use the following command:
clear mac-user mac-addr group
For example, the following command removes MAC user 01:0f:03:04:05:06 from the group the user is in:
WSS# clear mac-user 01:0f:03:04:05:06 group
success: change accepted.
The clear mac-usergroup command removes the group.
To remove a MAC user profile from the local database on the WSS, type the following command:
clear mac-user mac-address
For example, the following command removes MAC user 01:0f:03:04:05:06 from the local database:
WSS# clear mac-user 01:0f:03:04:05:06
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 565
Configuring MAC authentication and authorization
The set authentication mac command defines the AAA methods by which MAC addresses can be used for authentica-
tion. You can configure authentication for users through the MAC addresses of their devices with the following
command:
set authentication mac {ssid ssid-name | wired} mac-addr-wildcard method1 [method2]
[method3] [method4]
MAC addresses can be authenticated by either the WSS’s local database or by a RADIUS server group. For example, the
following command sets the authentication for MAC address 01:01:02:03:04:05 when requesting SSID voice, via the
local database:
WSS# set authentication mac ssid voice 01:01:02:03:04:05 local
success: change accepted
If the switch’s configuration does not contain a set authentication mac command that matches a non-802.1X client’s
MAC address, WSS Software tries MAC authentication by default.
You can also wildcard MAC addresses. For example, the following command locally authenticates all MAC addresses
that begin with the octets 01:01:02:
WSS# set authentication mac ssid voice 01:01:02:* local
success: change accepted
You can add authorization attributes to authenticated MAC users with the following command:
set mac-user mac-addr attr attribute-name value
For example, to add the MAC user 00:01:02:03:04:05 to VLAN red:
WSS# set mac-user 00:01:02:03:04:05 attr vlan-name red
success: change accepted
To change the value of an authorization attribute, reenter the command with the new value. To clear an authorization
attribute from a MAC user profile in the local database, use the following command:
clear mac-user mac-addr attr attribute-name
For example, the following command clears the VLAN assignment from MAC user 01:0f:02:03:04:05:
WSS# clear mac-user 01:0f:03:04:05:06 attr vlan-name
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
566 Configuring AAA for network users
Changing the MAC authorization password for RADIUS
When you enable MAC authentication, the client does not supply a regular username or password. The MAC address of
the user’s device is extracted from frames received from the device.
To authenticate and authorize MAC users via RADIUS, you must configure a single predefined password for MAC
users, which is called the outbound authorization password. The same password is used for all MAC user entries in the
RADIUS database. Set this password by typing the following command:
set radius server server-name author-password password
The default password is nortel.
Note. Before setting the outbound authorization password for a RADIUS server, you
must have set the address for the RADIUS server. For more information, see “Configuring
For example, the following command sets the outbound authorization password for MAC users on server bigbird to
h00per:
WSS# set radius server bigbird author-password h00per
success: change accepted.
Note. A MAC address must be dash-delimited in the RADIUS database—for example,
00-00-01-03-04-05. However, the WSS Software always displays colon-delimited MAC
addresses.
If the MAC address is in the database, WSS Software uses the VLAN attribute and other attributes associated with it for
user authorization. Otherwise, WSS Software tries the fallthru authentication type, which can be last-resort, Web, or
none.
Configuring Web portal Web-based AAA
Web-based AAA provides a simple and universal way to authenticate any user or device using a web browser. A
common application of Web-based AAA is to control access for guests on your network. When a user requests access to
an SSID or attempts to access a web page before logging onto the network, WSS Software serves a login page to the
user’s browser. After the user enters a username and password, WSS Software checks the local database or RADIUS
servers for the user information, and grants or denies access based on whether the user information is found.
WSS Software redirects an authenticated user back to the requested web page, or to a page specified by the
administrator.
Web-based AAA, like other types of authentication, is based on an SSID or on a wired authentication port.
You can use Web-based AAA on both encrypted and unencrypted SSIDs. If you use Web-based AAA on an encrypted
SSID, you can use static WEP or WPA with PSK as the encryption type.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 567
WSS Software provides a Nortel login page, which is used by default. You can add custom login pages to the
WSS’s nonvolatile storage, and configure WSS Software to serve those pages instead.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
568 Configuring AAA for network users
How Web portal Web-based AAA works
1
A Web-based AAA user attempts to access the network. For a wireless user, this begins when the user’s
network interface card (NIC) associates with an SSID on a Nortel radio. For a wired authentication user,
this begins when the user’s NIC sends data on the wired authentication port.
2
WSS Software starts a portal session for the user, and places the user in a VLAN.
●
If the user is wireless (associated with an SSID), WSS Software assigns the user to the VLAN set by
the vlan-name attribute for the SSID’s service profile.
●
If the user is on a wired authentication port, the VLAN is the one assigned to the web-portal-wired
user.
3
4
The user opens a web browser. The web browser sends a DNS request for the IP address of the home page
or a URL requested by the user.
WSS Software does the following:
●
Intercepts the DNS request, uses the WSS Software DNS proxy to obtain the URL’s IP address from
the network DNS server, and sends the address to the user’s browser.
●
5
6
The user enters their username and password in the Web-based AAA login page.
WSS Software authenticates the user by checking RADIUS or the switch’s local database for the
username and password entered by the user. If the user information is present, WSS Software authorizes
the user based on the authorization attributes set for the user.
Note. WSS Software ignores the VLAN-Name or Tunnel-Private-Group-ID attribute
associated with the user, and leaves the user in the VLAN associated with the SSID’s
service profile (if wireless) or with the web-portal-wired user (if the user is on a wired
authentication port).
7
After authentication and authorization are complete, WSS Software changes the user’s session from a
portal session with the name web-portal-ssid or web-portal-wired to a Web-based AAA session with the
user’s name. The session remains connected, but is now an identity-based session for the user instead of a
portal session.
8
9
WSS Software redirects the browser to the URL initially requested by the user or, if the URL VSA is
configured for the user, redirects the user to the URL specified by the VSA.
The web page for the URL to which the user is redirected appears in the user’s browser window.
Display of the login page
When a Web-based AAA client first tries to access a web page, the client’s browser sends a DNS request to obtain the IP
address mapped to the domain name requested by the client’s browser. The WSS proxies this DNS request to the
network’s DNS server, then proxies the reply back to the client. If the DNS server has a record for the requested URL,
the request is successful and the WSS serves a web login page to the client. However, if the DNS request is unsuccessful,
the WSS displays a message informing the user of this and does not serve the login page.
If the WSS does not receive a reply to a client’s DNS request, the WSS spoofs a reply to the browser by sending the
WSS’s own IP address as the resolution to the browser’s DNS query. The WSS also serves the web login page. This
behavior simplifies use of the Web-based AAA feature in networks that do not have a DNS server. However, if the
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 569
requested URL is invalid, the behavior gives the appearance that the requested URL is valid, since the browser receives
a login page. Moreover, the browser might cache a mapping of the invalid URL to the WSS IP address.
If the user enters an IP address, most browsers attempt to contact the IP address directly without using DNS. Some
browsers even interpret numeric strings as IP addresses (in decimal notation) if a valid address could be formed by
adding dots (dotted decimal notation). For example, 208194225132 would be interpreted as a valid IP address, when
converted to 208.194.225.132.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
570 Configuring AAA for network users
Web-based AAA requirements and recommendations
Note. WSS Software Version 5.0 does not require or support special user
web-portal-ssid, where ssid is the SSID the Web-Portal user associates with. Previous
WSS Software Versions required this special user for Web-Portal configurations. Any
web-portal-ssid users are removed from the configuration during upgrade to WSS
Software Version 5.0. However, the web-portal-wired user is still required for Web Portal
on wired authentication ports.
WSS requirements
•
Web-based AAA certificate—A Web-based AAA certificate must be installed on the switch. You can use
a self-signed (signed by the WSS) Web-based AAA certificate automatically generated by WSS
Software, manually generate a self-signed one, or install one signed by a trusted third-party certificate
If you choose to install a self-signed Web-based AAA certificate, use a common name (a
required field in the certificate), that resembles a web address and contains at least one dot.
When WSS Software serves the login page to the browser, the page’s URL is based on the
common name in the Web-based AAA certificate.
Here are some examples of common names in the recommended format:
●
●
●
web-based aaa.login
web-based aaa.customername.com
portal.local
Here are some examples of common names that are not in the recommended format:
●
●
●
web-based aaa
nrtl_webaaa
webportal
•
User VLAN—An IP interface must be configured on the user’s VLAN. The interface must be in the
subnet on which the DHCP server will place the user, so that the switch can communicate with both the
client and the client’s preferred DNS server. (To configure a VLAN, see “Configuring and managing
If users will roam from the switch where they connect to the network to other WSSs, the system
IP addresses of the switches should not be in the web-portal VLAN.
Although the SSID’s default VLAN and the user VLAN must be the same, you can use a
location policy on the switch where the service profile is configured to move the user to another
VLAN. The other VLAN is not required to be statically configured on the switch. The VLAN
does have the same requirements as other user VLANs, as described above. For example, the
user VLAN on the roamed-to switch must have an IP interface, the interface must be in the
subnet that has DHCP, and the subnet must be the same one the DHCP server will place the
user in.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 571
Note. In WSS Software Version 4.1 and earlier, the VLAN was required to be
statically configured on the WSS where Web-based AAA was configured and
through which the user accessed the network. WSS Software Version 4.2 removes
this restriction. The VLAN you want to place an authenticated Web-based AAA
user on does not need to be statically configured on the switch where Web Portal
is configured. If the VLAN you assign to a user is not statically configured on the
VLAN where the user accesses the network, the switch where the user accessed
the network builds a tunnel to the switch where the user’s VLAN is configured.
That switch uses DHCP to assign an IP address to the user.
•
•
•
Fallthru authentication type—The fallthru authentication type for each SSID and wired authentication port that you
want to support Web-based AAA, must be set to web-portal. The default authentication type for wired
authentication ports and for SSIDs is None (no fallthru authentication is used).
To set the fallthru authentication type for an SSID, set it in the service profile for the SSID, using the set
service-profile auth-fallthru command. To set it on a wired authentication port, use the auth-fall-thru
web-portal parameter of the set port type wired-auth command.
Authorization attributes—Wireless Web-Portal users get their authorization attributes from the SSID’s service
profile. To assign wireless Web-Portal users to a VLAN, use the set service-profile name attr vlan-name vlan-id
command.
Web-Portal users on wired authentication ports get their authorization attributes from the special user
web-portal-wired. To assign wired Web-Portal users to a VLAN, use the set user web-portal-wired attr
vlan-name vlan-id command. By default, web-portal-wired users are assigned to the default VLAN.
Portal ACL (created by WSS Software automatically)—The portalacl ACL captures all the portal user’s traffic
except for DHCP traffic. The portalacl has the following ACEs:
set security acl ip portalacl permit udp 0.0.0.0
255.255.255.255 eq 68 0.0.0.0 255.255.255.255 eq 67
set security acl ip portalacl deny 0.0.0.0 255.255.255.255
capture
WSS Software automatically creates the portalacl ACL the first time you set the fallthru authentication
type on any service profile or wired authentication port to web-portal.
●
The ACL is mapped to wireless Web-Portal users through the service profile. When you set the
fallthru authentication type on a service profile to web-portal, portalacl is set as the Web-Portal
ACL. The ACL is applied to a Web-Portal user’s traffic when the user associates with the service
profile’s SSID.
●
The ACL is mapped to Web-Portal users on a wired-authentication port by the Filter-id.in attribute
configured on the web-portal-wired user. When you set the fallthru authentication type on a wired
authentication port to web-portal, WSS Software creates the web-portal-wired user. WSS
Software sets the filter-id attribute on the user to portalacl.in.
Caution! Without the Web-Portal ACL, Web-based AAA users will be placed on the
network without any filters.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
572 Configuring AAA for network users
Caution! Do not change the deny rule at the bottom of the Web-Portal ACL. This rule
must be present and the capture option must be used with the rule. If the rule does not
have the capture option, the Web Portal user never receives a login page. If you need to
modify the Web-Portal ACL, create a new one instead, and modify the service profile or
web-portal-wired user to use the new ACL. (See “Portal ACL and user ACLs” on
page 572.)
•
•
Authentication rules—A web authentication rule must be configured for the Web-based AAA users. The
web rule must match on the username the Web-based AAA user will enter on the Web-based AAA login
page. (The match can be on a userglob or individual username.) The web rule also must match on the
SSID the user will use to access the network. If the user will access the network on a wired authentication
port, the rule must match on wired.
To configure authentication rules, use the set authentication web command.
Web Portal Web-based AAA must be enabled, using the set web-portal command. The feature is enabled
by default.
Portal ACL and user ACLs
The portalacl ACL, which WSS Software creates automatically, applies only when a user’s session is in the
portal state. After the user is authenticated and authorized, the ACL is no longer applicable.
To modify a user’s access while the user is still being authenticated and authorized, you can configure another
ACL and map that ACL instead to the service profile or the web-portal-wired user. Make sure to use the
capture option for traffic you do not want to allow. Nortel recommends that you do not change the portalacl
ACL. Leave the ACL as a backup in case you need to refer to it or you need to use it again.
For example, if you want to allow the user to access a credit card server while WSS Software is still authenti-
cating and authorizing the user, create a new ACL, add ACEs that are the same as the ACEs in portalacl, and
add a new ACE before the last one, to allow access to the credit card server. Make sure the last ACE in the
ACL is the deny ACE that captures all traffic that is not allowed by the other ACEs.
To modify a Web-based AAA user’s access after the user is authenticated and authorized, map an ACL to the
individual Web-based AAA user. Changes you make to the ACL mapped to the service profile or
web-portal-wired user do not affect user access after authentication and authorization are complete.
Note. The filter-id attribute in a service profile applies only to authenticated users. If this
attribute is set in a service profile for an SSID accessed by Web-Portal users, the attribute
applies only after users have been authenticated. While a Web-Portal user is still being
authenticated, the ACL set by the web-portal-acl applies instead.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 573
Network requirements
The VLAN where users will be placed must have an IP interface, and the subnet the interface is in must have access to
DHCP and DNS servers.
WSS recommendations
•
Consider installing a Web-based AAA certificate signed by a trusted CA, instead of one signed by the WSS itself.
Unless the client’s browser is configured to trust the signature on the switch’s Web-based AAA certificate, display
of the login page can take several seconds longer than usual, and might be interrupted by a dialog asking the user
what to do about the untrusted certificate. Generally, the browser is already configured to trust certificates signed by
a CA.
Client NIC recommendations
•
Configure the NIC to use DHCP to obtain its IP address.
Client Web browser recommendations
•
•
Use a well-known browser, such as Internet Explorer (Windows), Firefox (Mozilla-based), or Safari (Macintosh).
If the Web-based AAA certificate on the WSS is self-signed, configure the browser to trust the signature by
installing the certificate on the browser, so that the browser does not display a dialog about the certificate each time
the user tries to log on.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
574 Configuring AAA for network users
Configuring Web portal Web-based AAA
To configure Web Portal Web-based AAA:
1
2
Configure an SSID or wired authentication port and set the fallthru authentication type to web-portal.
The default for SSIDs and for wired authentication ports is none.
Configure individual Web-based AAA users. Because the VLAN is assigned based on the service profile
(where it is set by the attr vlan-name vlan-id option) or web-portal-wired user (where it is set to
default), WSS Software ignores the VLAN-Name and Tunnel-Private-Group-ID attributes. However,
WSS Software does assign other attributes if set.
3
4
Configure web authentication rules for the Web-based AAA users.
Save the configuration changes.
Web portal Web-based AAA configuration example
This example configures Web-Portal access to SSID mycorp.
1
Configure the user VLAN on ports 2 and 3, and configure an IP interface on the VLAN:
WSS# set vlan mycorp-vlan port 2-3
success: change accepted.
WSS# set interface mycorp-vlan ip 192.168.12.10 255.255.255.0
success: change accepted.
Note. The VLAN does not need to be configured on the switch where you
configure Web Portal but the VLAN does need to be configured on a switch
somewhere in the Mobility Domain. The user’s traffic will be tunneled to the switch
where the VLAN is configured.
2
Configure the service profile for SSID mycorp. Configuration includes the following:
●
●
●
Set the SSID name.
Change the fallthru authentication type to web-portal.
into this VLAN.
●
Enable RSN (WPA2) data encryption with CCMP. (This example assumes clients support this
encryption type.) TKIP is enabled by default and is left enabled in this example.
WSS# set service-profile mycorp-srvcprof ssid-name mycorp
success: change accepted.
WSS# set service-profile mycorp-srvcprof auth-fallthru web-portal
success: change accepted.
WSS# set service-profile mycorp-srvcprof attr vlan-name mycorp-vlan
success: change accepted.
WSS# set service-profile mycorp-srvcprof rsn-ie enable
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 575
success: change accepted.
WSS# set service-profile mycorp-srvcprof cipher-ccmp enable
success: change accepted.
3
Display the service profile to verify the changes:
WSS# show service-profile mycorp-srvcprof
ssid-name:
mycorp
yes
ssid-type:
crypto
no
Beacon:
Proxy ARP:
DHCP restrict:
no
No broadcast:
no
Short retry limit:
Auth fallthru:
5
Long retry limit:
Sygate On-Demand (SODA):
SODA remediation ACL:
Custom failure web-page:
Custom agent-directory:
COS:
5
no
none
yes
Enforce SODA checks:
Custom success web-page:
Custom logout web-page:
Static COS:
no
0
14
CAC mode:
none
180
no
CAC sessions:
User idle timeout:
Keep initial vlan:
Idle client probing:
Web Portal Session Timeout:
yes
5
Web Portal ACL:
WEP Key 1 value:
WEP Key 3 value:
WEP Unicast Index:
Shared Key Auth:
portalacl
<none>
<none>
1
WEP Key 2 value:
WEP Key 4 value:
WEP Multicast Index:
<none>
<none>
1
NO
RSN enabled:
ciphers: cipher-tkip, cipher-ccmp
authentication:
802.1X
TKIP countermeasures time: 60000ms
vlan-name = mycorp-vlan
4
Configure individual Web-based AAA users.
WSS# set user alice password alicepword
success: change accepted.
WSS# set user bob password bobpword
success: change accepted.
5
Configure a web authentication rule for Web-based AAA users. The following rule uses a wildcard (**)
to match on all user names.
The rule does not by itself allow access to all usernames. The ** value simply makes all usernames
eligible for authentication, in this case by searching the switch’s local database for the matching
usernames and passwords. If a username does not match on the access rule’s userglob, the user is denied
access without a search of the local database for the username and password.
WSS# set authentication web ssid mycorp ** local
success: change accepted.
6
Display the configuration:
WSS# show config
# Configuration nvgen'd at 2006-6-13 13:27:07
# Image 5.0.0.0.62
# Model 2350
# Last change occurred at 2006-6-13 13:24:46
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
576 Configuring AAA for network users
...
set service-profile mycorp-srvcprof ssid-name mycorp
set service-profile mycorp-srvcprof auth-fallthru
web-portal
set service-profile mycorp-srvcprof rsn-ie enable
set service-profile mycorp-srvcprof cipher-ccmp enable
set service-profile mycorp-srvcprof web-portal-acl
portalacl
set service-profile mycorp-srvcprof attr vlan-name
mycorp-vlan
...
set authentication web ssid mycorp ** local
...
set user alice password encrypted 070e2d454d0c091218000f
set user bob password encrypted 110b16070705041e00
...
set radio-profile radprof1 service-profile
mycorp-srvcprof
set ap 7 radio 2 radio-profile radprof1 mode enable
set ap 8 radio 2 radio-profile radprof1 mode enable
...
set vlan corpvlan port 2-3
set interface corpvlan ip 192.168.12.10 255.255.255.0
...
set security acl ip portalacl permit udp 0.0.0.0
255.255.255.255 eq 68 0.0.0.0 255.255.255.255 eq 67
set security acl ip portalacl deny 0.0.0.0
255.255.255.255 capture
commit security acl portalacl
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 577
External Captive Portal
You can redirect Web portal authentication to a Web server on a network rather than a local WSS database or
RADIUS. It has the following features:
•
•
•
You can connect to the local WSS with Web portal enabled.
The WSS redirects you through http or https to an external authentication Web server.
Once your credentials are verified, the external server sends a Change of Attribute (CoA) to the WSS.
The CoA requests a change in the session username on the WSS.
•
The Web server can also change or set any other allowed CoAs at the same time.
WSS# set service-profile profile-name web-portal-form <URL>
Displaying session information for Web portal Web-based AAA users
To display user session information for Web Portal Web-based AAA users, use the following command:
show sessions network [user user-wildcard | mac-addr mac-addr-wildcard | ssid
ssid-name | vlan vlan-wildcard | session-id session-id | wired] [verbose]
You can determine whether a Web Portal Web-based AAA user has completed the authentication and authori-
zation process, based on the username displayed in the session table. The following command shows the
sessions for SSID mycorp.
WSS# show sessions network ssid mycorp
User
Sess IP or MAC
ID Address
VLAN
Name
Port/
Name
Radio
------------------------------ ---- ----------------- --------------- -----
alice
4* 192.168.12.101 corpvlan
3/1
web-portal-mycorp
2 sessions total
5 192.168.12.102 corpvlan
3/1
This example shows two sessions. The session for alice has the user’s name and is flagged with an asterisk ( *
). The asterisk indicates that the user has completed authentication and authorization. The session for
web-portal-mycorp indicates that a Web-based AAA user is on the network but is still being authenticated. The
user alice has all the access privileges configured for the user, whereas the user who is still on the portal
session with the name web-portal-mycorp has limited access to resources. By default, this user can send and
receive DHCP traffic only. Everything else is captured by the web portal.
After authentication and authorization are complete, the web-portal-mycorp username is replaced with the
username entered by the Web-based AAA user during login. The following example shows session informa-
tion for the same user, but after the user is authorized to access resources on the network:
WSS# show sessions network ssid mycorp
User
Sess IP or MAC
ID Address
VLAN
Name
Port/
Name
Radio
------------------------------ ---- ----------------- --------------- -----
alice
4* 192.168.12.101 corpvlan
5* 192.168.12.102 corpvlan
3/1
3/1
bob
2 sessions total
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
578 Configuring AAA for network users
Using a custom login page
By default, WSS Software serves the Nortel login page for Web login.
To serve a custom page instead, do the following:
1
2
Copy and modify the Nortel page, or create a new page.
Create a subdirectory in the user files area of the WSS’s nonvolatile storage, and copy the custom page
into the subdirectory.
3
Configure SSIDs and wired authentication ports to use the custom form, by specifying the location of the
form.
Note. To serve a custom login page to wired authentication users, you must create a
web subdirectory and save the custom page in this directory.
WSS Software uses the following process to find the login page to serve to a user:
•
If the user is attempting to access an SSID and a custom page is specified in the service profile, WSS Software
serves the custom page.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 579
•
•
If the switch’s nonvolatile storage has a page in web named wba_form.html (web/wba_form.html), WSS
Software serves this page. This applies to all wired authentication users. The wba_form.html page also is
served to SSID users if the SSID’s service profile does not specify a custom page.
If there is no wba_form.html page and no custom page in the service profile (for an SSID), WSS Software
serves the default page.
Copying and modifying the Web login page
To copy and modify the Nortel Web login page:
1 Configure an unencrypted SSID on a WSS. The SSID is temporary and does not need to be one
you intend to use in your network. To configure the SSID, use the following commands:
set service-profile name ssid-name ssid-name
set service-profile name ssid-type clear
set service-profile name auth-fallthru web-portal
set radio-profile name service-profile name
set {ap port-list | ap ap-num} radio {1 | 2}
radio-profile name mode enable
Use the first two commands to configure a temporary SSID and temporary radio profile. Use
the last command to map the temporary radio profile with the disabled radio, and enable the
radio.
Note. If the radio you plan to use is already in service, first you will need to
disable the radio profile the radio is in and remove the radio from the profile.
2
From your PC, attempt to directly access the temporary SSID. The WSS should serve the login
page.
3
4
5
Use your browser to save a copy of the page.
Use a Web page editor or text editor to modify the page title, greeting, logo, and warning text.
Save the modified page.
Note. Filenames and paths for image source files must be relative to the HTML page.
For example, if login page mycorp-login.html and image file mylogo.gif are located in
subdirectory mycorp/, specify the image source as mylogo.gif, not mycorp/mylogo.gif. (See
the following example.)
Custom login page scenario
1
Do the following on the WSS:
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
580 Configuring AAA for network users
a
Create a temporary service profile and configure a temporary, clear SSID on it:
WSS# set service-profile tempsrvc
success: change accepted.
WSS# set service-profile tempsrvc ssid-name tempssid
success: change accepted.
WSS# set service-profile tempsrvc ssid-type clear
success: change accepted.
WSS# set service-profile tempsrvc auth-fallthru web-portal
success: change accepted.
b
Create a temporary radio profile and map the temporary service profile to it:
WSS# set radio-profile temprad service-profile tempsrvc
success: change accepted.
c
Map a radio to the temporary radio profile and enable it:
WSS# set ap 2 radio 1 radio-profile temprad mode enable
success: change accepted.
2
3
4
From your PC, attempt to directly access the temporary SSID. The WSS serves the login page.
In the browser, select File > Save As to save the login page.
Delete the temporary SSID, along with the temporary service profile and radio profile you
created for it.
WSS# set ap 2 radio 1 radio-profile temprad mode disable
success: change accepted.
WSS# clear radio-profile temprad
success: change accepted.
WSS# clear service-profile tempsrvc
success: change accepted.
5
Edit the login page:
a
Change the page title:
<title>My Corp Web-based AAA</title>
Change the logo:
b
<img src="mylogo.gif" width="143" height="65" border="0"
alt="Company Logo">
c
Change the greeting:
<h3>Welcome to Mycorp’s Wireless LAN</h3>
Change the warning statement if desired:
d
<b>WARNING:</b>
My corp’s warning text.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 581
e
Do not change the form (delimited by the <form name=> and </form> tags. The form values are
required for the page to work properly.
6
7
Save the modified page.
On the WSS, create a new subdirectory for the customized page. (The files must be on a TFTP server that
the WSS can reach over the network.)
WSS# mkdir mycorp-web-based aaa
success: change accepted.
8
Copy the files for the customized page into the subdirectory:
WSS# copy tftp://10.1.1.1/mycorp-login.html mycorp-web-based aaa/mycorp-login.html
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
WSS# copy tftp://10.1.1.1/mylogo.gif mycorp-web-based aaa/mylogo.gif
success: received 1202 bytes in 0.402 seconds [ 2112 bytes/sec]
WSS# dir mycorp-web-based aaa
===============================================================================
file:
Filename
Size
Created
file:mycorp-login.html
file:mylogo.gif
637 bytes Aug 12 2004, 15:42:26
1202 bytes Aug 12 2004, 15:57:11
1839 bytes used, 206577 Kbytes free
Total:
9
Use the following command to configure the SSID to use the custom page:
set service-profile name web-portal-form url
For the url, specify the full path; for example, mycorp-web-based aaa/mycorp-login.html. If the custom
login page includes gif or jpg images, their path names are interpreted relative to the directory from which
the page is served.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
582 Configuring AAA for network users
Using dynamic fields in Web-based AAA redirect URLs
You can include variables in the URL to which a Web-based AAA client is redirected after authentication and authoriza-
Table 36: Variables for redirect URLs
Variable
Description
$u
$v
$s
Username of the Web AAA user
VLAN to which the user was assigned during authorization
SSID the user is on
$p
Name of the service profile that manages the parameters for the
SSID
A URL string can also contain the literal characters $ and ?, if you use the values listed in Table 37.
Table 37: Values for literal characters
Variable
Description
$$
$q
The literal character $
The literal character ?
You can configure a redirect URL for a group of users or for an individual user. For example, the following command
configures a redirect URL containing a variable for the username:
WSS# set usergroup ancestors attr url http://myserver.com/$u.html
success: change accepted.
The variable applies to all Web-based AAA users in user group ancestors. When user zinjanthropus is successfully
authenticated and authorized, WSS Software redirects the user to the following URL:
http://myserver.com/zinjanthropus.html
When user piltdown is successfully authenticated and authorized, WSS Software redirects the user to the following
URL:
http://myserver.com/piltdown.html
The following example configures a redirect URL that contains a script argument using the literal character ?:
WSS# set usergroup ancestors attr url https://saqqara.org/login.php$quser=$u
success: change accepted.
When user djoser is successfully authenticated and authorized, WSS Software redirects the user to the following URL:
https://saqqara.org/login.php?user=djoser
To verify configuration of a redirect URL and other user attributes, type the show aaa command.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 583
Using an ACL other than portalacl
By default, when you set the fallthru authentication type on a service profile or wired authentication port to
web-portal, WSS Software creates an ACL called portalacl. WSS Software uses the portalacl ACL to filter
Web-Portal user traffic while users are being authenticated.
To use another ACL:
1
Create a new ACL and add the first rule contained in portalacl:
set security acl ip portalacl permit udp 0.0.0.0
255.255.255.255 eq 68 0.0.0.0 255.255.255.255 eq 67
set security acl ip portalacl deny 0.0.0.0
255.255.255.255 capture
2
3
Add the additional rules required for your application. For example, if you want to redirect
users to a credit card server, add the ACEs to do so.
Add the last rule contained in portalacl:
set security acl ip portalacl deny 0.0.0.0
255.255.255.255 capture
4
Verify the new ACL configuration, before committing it to the configuration, using the
following command:
show security acl info [acl-name | all] [editbuffer]
Commit the new ACL to the configuration, using the following command:
commit security acl
5
6
Change the Web-Portal ACL name set on the service profile, using the following command:
set service-profile name web-portal-acl aclname
Verify the change by displaying the service profile.
7
8
Save the configuration changes.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
584 Configuring AAA for network users
Configuring the Web portal Web-based AAA session timeout
period
When a client that has connected through Web Portal Web-based AAA enters standby or hibernation mode,
WSS Software may place the client’s Web Portal Web-based AAA session in the Deassociated state.
A Web Portal Web-based AAA session can be placed in the Deassociated state under the following
circumstances:
•
The client has been idle for the User idle-timeout period, which can happen when the client is in standby
or hibernation mode
•
•
The client explicitly deassociates from the AP by sending an 802.11 disassociate message
The AP handling the client's session appears to be inoperative from the WSS
When a Web Portal Web-based AAA session enters the Deassociated state, it stays in that state until one of the
following takes place:
•
The client reappears on this AP or another AP managed by a WSS, at which time the Web Portal
Web-based AAA session enters the Active state.
•
•
The Web Portal Web-based AAA session is terminated by an administrator.
The Web Portal Web-based AAA session timeout period expires, then the Web Portal Web-based AAA
session is terminated automatically.
By default, the Web Portal Web-based AAA session timeout period is 5 seconds. You can optionally change
the length of the Web Portal Web-based AAA Session Timeout period. This can be useful if you want to allow
a client connecting through Web Portal Web-based AAA to enter standby or hibernation mode, then be able to
resume its session after waking up, without having to log in again.
To change the Web Portal Web-based AAA session timeout period, use the following command:
set service-profile name web-portal-session-timeout seconds
You can specify from 5 – 28,800 seconds. The default is 5 seconds. Note that the Web Portal Web-based AAA
session timeout period applies only to Web Portal Web-based AAA sessions already authenticated with a
username and password. For all other Web Portal Web-based AAA sessions, the default Web Portal
Web-based AAA session timeout period of 5 seconds is used.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 585
Configuring the Web Portal Web-based AAA Logout Function
Configure the Web Portal web-based AAA to allow a user to manually terminate the session. When this feature is
enabled, the Web Portal web-based AAA user is successfully authenticated and redirected to the requested page, a
window appears behind the user browser. The window has a button labeled “Logout”. When you click Logout, a URL
appears and terminates the user session on the Mobility Domain.
The user logout request is sent to one of the WSS in the Mobility Domain. It does not have to be the WSS that the user
was authenticated on, or the WSS where the user session currently resides. The WSS receiving the logout request deter-
mines which WSS has the user session. If it is a local session, then the session is terminated. If another WSS in the
Mobility Domain has the session, then the request is redirected to that WSS.
Web Portal users are not required to wait for the session to timeout before logging out of the web-based AAA session,
but manually log out of the network.
To enable the Web Portal logout functionality, use the following command:
set service-profile profile-name web-portal-logout mode {enable | disable}
To specify a Web Portal logout URL, use the following command:
set service-profile profile-name web-portal-logout logout-url url
The URL should have the format https://host/logout.html. By default, the logout URL uses the IP address of the WSS
as the host part of the URL. The host can be either an IP address or a hostname.
Specifying the logout URL can be useful if you want to standardize across your network. For example, you can
configure the logout URL on all of the WSS in the Mobility Domain as wifizone.trpz.com/logout.html, where wifi-
zone.trpz.com resolves to one of the WSS, ideally the seed, in the Mobility Domain, .
To log out of the network, the user can click “Logout” in the window, or request the logout URL directly.
Standardizing the logout URL provides a backup method for the user to log out, if the window is closed inadvertently.
Note. If you requests the logout URL, you must enter a username and password in order to
identify the session on the WSS. (This is not necessary when you click “Logout” in the pop-under
window.) Both the username and password are required to identify the session. If there is more than
one session with the same username, then requesting the logout URL does not end any session.
Also, an adminstrative certificate must be configured on the WSS in order for the Web Portal web-based AAA logout
process to work.
Configuring last-resort access
Users who are not authenticated and authorized by 802.1X methods or a MAC address can gain limited access to the
network as guest users. You can configure an SSID to allow anonymous guest access, by setting its fallthru authentica-
tion type to last-resort. The authorization attributes assigned to last-resort users come from the default authorization
attributes set on the SSID.
To configure an SSID to allow last-resort access:
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
586 Configuring AAA for network users
•
•
•
•
Set the SSID name, if not already set.
Set the fallthru access type of the SSID’s service profile to last-resort.
Set the vlan-name and other authorization attributes on the SSID’s service profile.
If the SSID type will be crypto (the default), configure encryption settings.
You do not need to configure an access rule for last-resort access. Last-resort access is automatically enabled
on all service profiles and wired authentication ports that have the fallthru authentication type set to
last-resort. (The set authentication last-resort and clear authentication last-resort commands are not
needed and are not supported in WSS Software Version 5.0 and later.)
The authentication method for last-resort is always local. WSS Software does not use RADIUS for last-resort
authentication.
The following commands configure last-resort access for SSID guest-wlan. The service profile is configured
to encrypt user traffic on the SSID using 40-bit dynamic WEP, WPA, or RSN, depending on the client’s
configuration.
WSS# set service-profile last-resort-srvcprof ssid-name guest-wlan
success: change accepted.
WSS# set service-profile last-resort-srvcprof auth-fallthru last-resort
success: change accepted.
WSS# set service-profile last-resort-srvcprof attr vlan-name guest-vlan
success: change accepted.
WSS# set service-profile last-resort-srvcprof rsn-ie enable
success: change accepted.
WSS# set service-profile last-resort-srvcprof wpa-ie enable
success: change accepted.
WSS# set service-profile last-resort-srvcprof cipher-ccmp enable
success: change accepted.
WSS# set service-profile last-resort-srvcprof cipher-wep40 enable
success: change accepted.
WSS# show service-profile last-resort-srvcprof
ssid-name:
guest-wlan ssid-type:
yes Proxy ARP:
crypto
no
Beacon:
DHCP restrict:
Short retry limit:
Auth fallthru:
no No broadcast:
5 Long retry limit:
no
5
last-resort Sygate On-Demand (SODA):
no
Enforce SODA checks:
Custom success web-page:
Custom logout web-page:
Static COS:
yes SODA remediation ACL:
Custom failure web-page:
Custom agent-directory:
no COS:
0
CAC mode:
none CAC sessions:
14
yes
User idle timeout:
Keep initial vlan:
180 Idle client probing:
no Web Portal Session Timeout:
5
Web Portal ACL:
WEP Key 1 value:
WEP Key 3 value:
WEP Unicast Index:
<none> WEP Key 2 value:
<none> WEP Key 4 value:
1 WEP Multicast Index:
<none>
<none>
1
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 587
Shared Key Auth:
WPA and RSN enabled:
NO
ciphers: cipher-tkip, cipher-ccmp, cipher-wep40
authentication: 802.1X
TKIP countermeasures time: 60000ms
vlan-name = guest-vlan
...
Note. Beginning with WSS Software Version 5.0, the special user last-resort-ssid,
where ssid is the SSID name, is not required and is not supported. If you upgrade a switch
running an earlier version of WSS Software to 5.0, the last-resort-ssid users are
automatically removed from the configuration during the upgrade.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
588 Configuring AAA for network users
Configuring last-resort access for wired authentication ports
To configure a wired authentication port to allow last-resort access:
•
•
Set the fallthru authentication type on the port to last-resort.
Create a user named last-resort-wired in the switch’s local database.
The following commands configure wired authentication port 5 for last-resort access and add the special user:
WSS# set port type wired-auth 5 auth-fall-thru last-resort
success: change accepted.
WSS# set user last-resort-wired attr vlan-name guest-vlan2
success: change accepted.
Configuring AAA for users of third-party APs
A WSS can provide network access for users associated with a third-party AP that has authenticated the users
with RADIUS. You can connect a third-party AP to a WSS and configure the WSS to provide authorization
Figure 34. WSS serving as RADIUS proxy
Layer 2
or Layer 3
WSS
Wired Layer 2
connection
RADIUS server
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 589
Authentication process for users of a third-party AP
1
2
3
WSS Software uses MAC authentication to authenticate the AP.
The user contacts the AP and negotiates the authentication protocol to be used.
The AP, acting as a RADIUS client, sends a RADIUS access-request to the WSS. The access-request
includes the SSID, the user’s MAC address, and the username.
4
For 802.1X users, the AP uses 802.1X to authenticate the user, using the WSS as its RADIUS server. The
WSS proxies RADIUS requests from the AP to a real RADIUS server, depending on the authentication
method specified in the proxy authentication rule for the user.
5
6
After successful RADIUS authentication of the user (or special username, for non-802.1X users), WSS
Software assigns authorization attributes to the user from the RADIUS server’s access-accept response.
When the user’s session ends, the third-party AP sends a RADIUS stop-accounting record to the WSS.
The WSS then removes the session.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
590 Configuring AAA for network users
Requirements
Third-party AP requirements
•
The third-party AP must be connected to the WSS through a wired Layer 2 link. WSS Software cannot provide data
services if the AP and WSS are in different Layer 3 subnets.
•
•
The AP must be configured as the WSS’s RADIUS client.
The AP must be configured so that all traffic for a given SSID is mapped to the same 802.1Q tagged VLAN. If the
AP has multiple SSIDs, each SSID must use a different tag value.
•
The AP must be configured to send the following information in a RADIUS access-request, for each user who
wants to connect to the WLAN through the WSS:
●
SSID requested by the user. The SSID can be attached to the end of the called-station-id (per
Congdon), or can be in a VSA (for example, cisco-vsa:ssid=r12-cisco-1).
●
Calling-station-id that includes the user’s MAC address. The MAC address can be in any of the
following formats:
❍
❍
❍
Separated by colons (for example, AA:BB:CC:DD:EE:FF)
Separated by dashes (for example, AA-BB-CC-DD-EE-FF)
Separated by dots (for example, AABB.CCDD.EEFF)
●
Username
•
•
The AP must be configured to send a RADIUS stop-accounting record when a user’s session ends.
WSS requirements
The WSS port connected to the third-party AP must be configured as a wired authentication port. If SSID traffic
from the AP is tagged, the same VLAN tag value must be used on the wired authentication port.
•
•
A MAC authentication rule must be configured to authenticate the AP.
The WSS must be configured as a RADIUS proxy for the AP. The WSS is a RADIUS server to the AP but remains
a RADIUS client to the real RADIUS servers.
Note. The WSS system IP address must be the same as the IP address
configured on the VLAN that contains the proxy port.
•
An authentication proxy rule must be configured for the AP’s users. The rule matches based on SSID and username,
and selects the authentication method (a RADIUS server group) for proxying.
RADIUS server requirements
•
•
For 802.1X users, the usernames and passwords must be configured on the RADIUS server.
For non-802.1X users of a tagged SSID, the special username web-portal-ssid or last-resort-ssid must be
configured, where ssid is the SSID name. The fallthru authentication type (web-portal or last-resort) specified for
the wired authentication port connected to the AP determines which username you need to configure.
•
For any users of an untagged SSID, the special username web-portal-wired or last-resort-wired must be
configured, depending on the fallthru authentication type specified for the wired authentication port.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 591
Configuring authentication for 802.1X users of a third-party AP
with tagged SSIDs
To configure WSS Software to authenticate 802.1X users of a third-party AP, use the commands below to do
the following:
•
Configure the port connected to the AP as a wired authentication port. Use the following command:
set port type wired-auth port-list [tag tag-list] [max-sessions num]
[auth-fall-thru {last-resort | none | web-portal}]
•
•
Configure a MAC authentication rule for the AP. Use the following command:
set authentication mac wired mac-addr-wildcard method1
Configure the WSS port connected to the AP as a RADIUS proxy for the SSID supported by the AP. If
SSID traffic from the AP is tagged, assign the same tag value to the WSS port. Use the following
command:
set radius proxy port port-list [tag tag-value] ssid ssid-name
•
•
Add a RADIUS proxy entry for the AP. The proxy entry specifies the IP address of the AP and the UDP
ports on which the WSS listens for RADIUS access-requests and stop-accounting records from the AP.
Use the following command:
set radius proxy client address ip-address [port udp-port-number]
[acct-port acct-udp-port-number] key string
Configure a proxy authentication rule for the AP’s users. Use the following command:
set authentication proxy ssid ssid-name user-wildcard radius-server-group
For the port-list of the set port type wired-auth and set radius proxy port commands, specify the WSS
port(s) connected to the third-party AP.
For the ip-address of the set radius proxy client address command, specify the IP address of the RADIUS
client (the third-party AP). For the udp-port-number, specify the UDP port on which the WSS will listen for
RADIUS access-requests. The default is UDP port 1812. For the acct-udp-port-number, specify the UDP port
on which the WSS will listen for RADIUS stop-accounting records. The default is UDP port 1813.
The following command configures WSS ports 3 and 4 as wired authentication ports, and assigns tag value
104 to the ports:
WSS# set port type wired-auth 3-4 tag 104
success: change accepted.
You can specify multiple tag values. Specify the tag value for each SSID you plan to support.
The following command configures a MAC authentication rule that matches on the third-party AP’s MAC
address. Because the AP is connected to the WSS on a wired authentication port, the wired option is used.
WSS# set authentication mac wired aa:bb:cc:01:01:01 srvrgrp1
success: change accepted.
The following command maps SSID mycorp to packets received on port 3 or 4, using 802.1Q tag value 104:
WSS# set radius proxy port 3-4 tag 104 ssid mycorp
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
592 Configuring AAA for network users
success: change accepted.
Enter a separate command for each SSID, and its tag value, you want the WSS to support.
The following command configures a RADIUS proxy entry for a third-party AP RADIUS client at 10.20.20.9, sending
RADIUS traffic to the default UDP ports 1812 and 1813 on the WSS:
WSS# set radius proxy client address 10.20.20.9 key radkey1
success: change accepted.
The IP address is the AP’s IP address. The key is the shared secret configured on the RADIUS servers. WSS Software
uses the shared secret to authenticate and encrypt RADIUS communication.
The following command configures a proxy authentication rule that matches on all usernames associated with SSID
mycorp. WSS Software uses RADIUS server group srvrgrp1 to proxy RADIUS requests and hence to authenticate and
authorize the users.
WSS# set authentication proxy ssid mycorp ** srvrgrp1
Note. WSS Software also uses the server group you specify with this command for
accounting.
To verify the changes, use the show config area aaa command.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 593
Configuring authentication for non-802.1X users of a third-party AP with
tagged SSIDs
To configure WSS Software to authenticate non-802.1X users of a third-party AP, use the same commands as those
required for 802.1X users. Additionally, when configuring the wired authentication port, use the auth-fall-thru option
to change the fallthru authentication type to last-resort or web-portal.
On the RADIUS server, configure username web-portal-ssid or last-resort-ssid, depending on the fallthru authentica-
tion type you specify for the wired authentication port.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
594 Configuring AAA for network users
Configuring access for any users of a non-tagged SSID
If SSID traffic from the third-party AP is untagged, use the same configuration commands as the ones required for
802.1X users, except the set radius proxy port command. This command is not required and is not applicable to
untagged SSID traffic. In addition, when configuring the wired authentication port, use the auth-fall-thru option to
change the fallthru authentication type to last-resort or web-portal.
On the RADIUS server, configure username web-portal-wired or last-resort-wired, depending on the fallthru authenti-
cation type specified for the wired authentication port.
Assigning authorization attributes
Authorization attributes can be assigned to users in the local database, on remote servers, or in the service profile of the
SSID the user logs into. The attributes, which include access control list (ACL) filters, VLAN membership, encryption
type, session time-out period, and other session characteristics, let you control how and when users access the network.
When a user or group is authenticated, the local database, RADIUS server, or service profile passes the authorization
attributes to WSS Software to characterize the user’s session.
If attributes are configured for a user and also for the group the user is in, the attributes assigned to the individual user
take precedence for that user. For example, if the start-date attribute configured for a user is sooner than the start-date
configured for the user group the user is in, the user’s network access can begin as soon as the user start-date. The user
does not need to wait for the user group’s start date.
The VLAN attribute is required. WSS Software can authorize a user to access the network only if the VLAN to place the
user on is specified.
Table 38 lists the authorization attributes supported by WSS Software. (For brief descriptions of all the RADIUS attri-
butes and Nortel vendor-specific attributes supported by WSS Software, as well as the vendor ID and types for Nortel
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 595
Table 38.Authentication attributes for local users
Attribute
Description
Valid Value(s)
encryption-type
Type of encryption required One of the following numbers that identifies an
for access by the client.
Clients who attempt to use
an unauthorized encryption
method are rejected.
encryption algorithm:
•
1—AES_CCM (Advanced Encryption
Standard using Counter with CBC-MAC)
•
•
•
2—Reserved
4—TKIP (Temporal Key Integrity Protocol)
8—WEP_104 (the default) (Wired-Equivalent
Privacy protocol using 104 bits of key
strength)
•
16—WEP_40 (Wired-Equivalent Privacy
protocol using 40 bits of key strength)
•
•
32—NONE (no encryption)
64—Static WEP
In addition to these values, you can specify a sum
of them for a combination of allowed encryption
types. For example, to specify WEP_104 and
WEP_40, use 24.
end-date
filter-id
Date and time after which Date and time, in the following format:
the user is no longer
allowed to be on the
network.
YY/MM/DD-HH:MM
You can use end-date alone or with start-date.
You also can use start-date, end-date, or both in
conjunction with time-of-day.
Security access control list Name of an existing security ACL, up to
(ACL), to permit or deny
traffic received (input) or
sent (output) by the WSS.
253 alphanumeric characters, with no tabs or
spaces.
(network access mode
only)
•
Use acl-name.in to filter traffic that enters the
switch from users via an AP access port or
wired authentication port, or from the network
via a network port.
(For more information
about security ACLs, see
“Configuring and managing
•
Use acl-name.out to filter traffic sent from the
switch to users via an AP access port or wired
authentication port, or from the network via a
network port.
page 481.)
Note: If the Filter-Id value returned
through the authentication and
authorization process does not match the
name of a committed security ACL in the
WSS, the user fails authorization and is
unable to authenticate.
idle-timeout
This option is not implemented in the current WSS Software version.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
596 Configuring AAA for network users
Table 38.Authentication attributes for local users (continued)
Attribute
Description
Valid Value(s)
mobility-profile
(network access mode
only)
Mobility Profile attribute
for the user. (For more
information, see
Name of an existing Mobility Profile, which can
be up to 32 alphanumeric characters, with no tabs
or spaces.
Note: If the Mobility Profile feature is
enabled, and a user is assigned the name
of a Mobility Profile that does not exist
on the WSS, the user is denied access.
service-type
Type of access the user is
requesting.
One of the following numbers:
•
•
2—Framed; for network user access
6—Administrative; for administrative access
to the WSS, with authorization to access the
enabled (configuration) mode. The user must
enter the enable command and the correct
enable password to access the enabled mode.
•
7—NAS-Prompt; for administrative access to
the nonenabled mode only. In this mode, the
user can still enter the enable command and
the correct enable password to access the
enabled mode.
For administrative sessions, the WSS always
sends 6 (Administrative).
The RADIUS server can reply with one of the
values listed above.
If the service-type is not set on the RADIUS
server, administrative users receive NAS-Prompt
access, and network users receive Framed access.
Note: WSS Software will quietly accept
Callback Framed but you cannot select
this access type in WSS Software.
session-timeout
(network access mode
only)
Maximum number of
seconds for the user’s
session.
Number between 0 and 4,294,967,296 seconds
(approximately 136.2 years).
Note: If the global reauthentication
timeout (set by the set dot1x
reauth-period command) is shorter than
the session-timeout, WSS Software uses
the global timeout instead.
ssid
SSID the user is allowed to Name of the SSID you want the user to use. The
access after authentication. SSID must be configured in a service profile, and
the service profile must be used by a radio profile
(network access mode
only)
assigned to Nortel radios in the Mobility Domain.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 597
Table 38.Authentication attributes for local users (continued)
Attribute
Description
Valid Value(s)
start-date
Date and time at which the Date and time, in the following format:
user becomes eligible to
access the network.
YY/MM/DD-HH:MM
You can use start-date alone or with end-date.
You also can use start-date, end-date, or both in
conjunction with time-of-day.
WSS Software does not
authenticate the user unless
the attempt to access the
network occurs at or after
the specified date and time,
but before the end-date (if
specified).
time-of-day
(network access mode
only)
Day(s) and time(s) during One of the following:
which the user is permitted
to log into the network.
•
•
•
•
never—Access is always denied.
any—Access is always allowed.
al—Access is always allowed.
One or more ranges of values that consist of
one of the following day designations
(required), and a time range in hhmm-hhmm
4-digit 24-hour format (optional):
After authorization, the
user’s session can last until
either the Time-Of-Day
range or the
Session-Timeout duration
(if set) expires, whichever
is shorter.
•
•
•
•
•
•
•
•
mo—Monday
tu—Tuesday
we—Wednesday
th—Thursday
fr—Friday
sa—Saturday
su—Sunday
wk—Any day between Monday and
Friday
Separate values or a series of ranges (except time
ranges) with commas (,) or a vertical bar (|). Do
not use spaces.
The maximum number of characters is 253.
For example, to allow access only on Tuesdays
and Thursdays between 10 a.m. and 4 p.m.,
specify the following:
time-of-day tu1000-1600,th1000-1600
To allow access only on weekdays between 9 a.m
and 5 p.m., and on Saturdays from 10 p.m. until
2 a.m., specify the following:
time-of-day wk0900-1700,sa2200-0200
Note: You can use time-of-day in
conjunction with start-date, end-date,
or both.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
598 Configuring AAA for network users
Table 38.Authentication attributes for local users (continued)
Attribute
Description
Valid Value(s)
url
URL to which the user is
redirected after successful
Web-based AAA.
Web URL, in standard format. For example:
http://www.example.com
(network access mode
only)
Note: You must include the http://
portion.
You can dynamically include any of the variables
in the URL string:
•
•
•
•
$u—Username
$v—VLAN
$s—SSID
$p—Service profile name
To use the literal character $ or ?, use the
following:
•
•
$$
$q
vlan-name
(network access mode
only)
Virtual LAN (VLAN)
assignment.
Name of a VLAN that you want the user to use.
The VLAN must be configured on a WSS within
the Mobility Domain to which this WSS belongs.
Note: On some
RADIUS servers, you
might need to use the
standard RADIUS
attribute
Tunnel-Pvt-Group-ID,
instead of
VLAN-Name.
acct-interim-interval
Interval in seconds between Number between 180 and 3,600 seconds, or 0 to
accounting updates, if
start-stop accounting mode
is enabled.
disable periodic accounting updates.
The WSS ignores the acct-interim-interval value
and issues a log message if the value is below 60
seconds.
Note: If both a RADIUS server and the
WSS supply a value for the
acct-interim-interval attribute, then the
value from the WSS takes precedence.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 599
Assigning attributes to users and groups
You can assign authorization attributes to individual users or groups of users. Use any of the following
commands to assign an attribute to a user or group in the local WSS database and specify its value:
set user username attr attribute-name value
set usergroup group-name attr attribute-name value
set mac-user mac-addr attr attribute-name value
set mac-usergroup group-name attr attribute-name value
If attributes are configured for a user and also for the group the user is in, the attributes assigned to the indi-
vidual user take precedence for that user. For example, if the start-date attribute configured for a user is sooner
than the start-date configured for the user group the user is in, the user’s network access can begin as soon as
the user start-date. The user does not need to wait for the user group’s start date.
To change the value of an authorization attribute, reenter the command with the new value.
To assign an authorization attribute to a user’s configuration on a RADIUS server, see the documentation for
your RADIUS server.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
600 Configuring AAA for network users
Simultaneous login
As part of the Web-based AAA, you can limit the number of concurrent sessions that a user can have on the
network. You can use a Vendor-specific Attribute (VSA) on a RADIUS server or configure it as part of a
service profile. You can also apply the attribute to users and user groups. To configure simultaneous logins for
a user, enter the following command:
WSS# set user username attr simultaneous-logins <0-1000>
If you set the attribute to “0”, then the user is locked out of the network. The default value is unlimited access.
In addition, setting this value applies only to user session in the Mobility Domain and not for a specific WSS.
It includes the following commands:
WSS# set usergroup <group> attr simultaneous-logins <0-1000>
WSS# set service-profile <profile-name> attr simultaneous-logins <0-1000>
To clear the configuration, enter
WSS# clear user <username> attr simultaneous-logins
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 601
Assigning SSID default attributes to a service profile
You can configure a service profile with a set of default AAA authorization attributes that are used when the
normal AAA process or a location policy does not provide them. These authorization attributes are applied by
default to users accessing the SSID managed by the service profile.
Use the following command to assign an authorization attribute to a service profile and specify its value:
set service-profile name attr attribute-name value
By default, a service profile contains no SSID default authorization attributes. When specified, attributes in a
service profile are applied in addition to any attributes supplied for the user by the RADIUS server or the local
database. When the same attribute is specified both as an SSID default attribute and through AAA, then the
attribute supplied by the RADIUS server or the local database takes precedence over the SSID default attri-
bute. If a location policy is configured, the location policy takes precedence over both AAA and SSID default
attributes. The SSID default attributes serve as a fallback when neither the AAA process, nor a location policy,
provides them.
For example, a service profile might be configured with the service-type attribute set to 2. If a user accessing
the SSID is authenticated by a RADIUS server, and the RADIUS server returns the vlan-name attribute set to
orange, then that user will have a total of two attributes set: service-type and vlan-name.
If the service profile is configured with the vlan-name attribute set to blue, and the RADIUS server returns the
vlan-name attribute set to orange, then the attribute from the RADIUS server takes precedence; the user is
placed in the orange VLAN.
You can display the attributes for each connected user and whether they are set through AAA or through SSID
defaults by entering the show sessions network verbose command. You can display the configured SSID
defaults by entering the show service-profile command.
All of the authorization attributes listed in Table 38 on page 595 can be specified in a service profile except
ssid.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
602 Configuring AAA for network users
Assigning a security ACL to a user or a group
Once a security access control list (ACL) is defined and committed, it can be applied dynamically and auto-
matically to users and user groups through the 802.1X authentication and authorization process. When you
assign a Filter-Id attribute to a user or group, the security ACL name value is entered as an authorization
attribute into the user or group record in the local WSS database or RADIUS server.
Note. If the Filter-Id value returned through the authentication and authorization process
does not match the name of a committed security ACL in the WSS, the user fails
authorization and cannot be connected.
Assigning a security ACL locally
To use the local WSS database to restrict a user, a MAC user, or a group of users or MAC users to the permis-
sions stored within a committed security ACL, use the following commands:
Security ACL Target
Commands
User authenticated by a
password
set user username attr filter-id acl-name.in
set user username attr filter-id acl-name.out
Group of users authenticated
by a password
set usergroup groupname attr filter-id acl-name.in
set usergroup groupname attr filter-id acl-name.out
User authenticated by a MAC set mac-user username attr filter-id acl-name.in
address
set mac-user username attr filter-id acl-name.out
Group of users authenticated
by a MAC address
set mac-usergroup groupname attr filter-id acl-name.in
set mac-usergroup groupname attr filter-id acl-name.out
You can set filters for incoming and outgoing packets:
•
Use acl-name.in to filter traffic that enters the WSS from users via an AP access port or wired
authentication port, or from the network via a network port.
•
Use acl-name.out to filter traffic sent from the WSS to users via an AP access port or wired
authentication port, or from the network via a network port.
For example, the following command applies security ACL acl-101 to packets coming into the WSS from user
Jose:
WSS# set user Jose attr filter-id acl-101.in
success: change accepted.
The following command applies the incoming filters of acl-101 to the users who belong to the group
eastcoasters:
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 603
WSS# set usergroup eastcoasters attr filter-id acl-101.in
success: change accepted.
Assigning a security ACL on a RADIUS server
To assign a security ACL name as the Filter-Id authorization attribute of a user or group record on a RADIUS
server, see the documentation for your RADIUS server.
Clearing a security ACL from a user or group
To clear a security ACL from the profile of a user, MAC user, or group of users or MAC users in the local
WSS database, use the following commands:
clear user username attr filter-id
clear usergroup groupname attr filter-id
clear mac-user username attr filter-id
clear mac-usergroup groupname attr filter-id
If you have assigned both an incoming and an outgoing filter to a user or group, enter the appropriate
command twice to delete both security ACLs. Verify the deletions by entering the show aaa command and
checking the output.
To delete a security ACL from a user’s configuration on a RADIUS server, see the documentation for your
RADIUS server.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
604 Configuring AAA for network users
Assigning encryption types to wireless users
When a user turns on a wireless laptop or PDA, the device attempts to find an access point and form an associ-
ation with it. Because APs support the encryption of wireless traffic, clients can choose an encryption type to
use. You can configure APs to use the encryption algorithms supported by the Wi-Fi Protected Access (WPA)
security enhancement to the IEEE 802.11 wireless standard. (For details, see “Configuring user encryption” on
page 361.)
If you have configured APs to use specific encryption algorithms, you can enforce the type of encryption a
user or group must have to access the network. When you assign the Encryption-Type attribute to a user or
group, the encryption type or types are entered as an authorization attribute into the user or group record in the
local WSS database or on the RADIUS server. Encryption-Type is a Nortel vendor-specific attribute (VSA).
Clients who attempt to use an unauthorized encryption method are rejected.
Assigning and clearing encryption types locally
To restrict wireless uses or groups with user profiles in the local WSS database to particular encryption algo-
rithms for accessing the network, use one of the following commands:
set user username attr encryption-type value
set usergroup groupname attr encryption-type value
set mac-user username attr encryption-type value
set mac-usergroup groupname attr encryption-type value
WSS Software supports the following values for Encryption-Type, listed from most secure to least secure.
Encryption-type value
Encryption algorithm assigned
1
Advanced Encryption Standard using Counter with Cipher
Block Chaining Message Authentication Code
(CBC-MAC)—or AES_CCM.
2
4
8
Reserved.
Temporal Key Integrity Protocol (TKIP).
Wired-Equivalent Privacy protocol using 104 bits of key
strength (WEP_104). This is the default.
16
Wired-Equivalent Privacy protocol using 40 bits of key
strength (WEP_40).
32
64
No encryption.
Static WEP
For example, the following command restricts the MAC user group mac-fans to access the network by using
only TKIP:
WSS# set mac-usergroup mac-fans attr encryption-type 4
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 605
success: change accepted.
You can also specify a combination of allowed encryption types by summing the values. For example, the
following command allows mac-fans to associate using either TKIP or WEP_104:
WSS# set mac-usergroup mac-fans attr encryption-type 12
success: change accepted.
To clear an encryption type from the profile of a use or group of users in the local WSS database, use one of
the following commands:
clear user username attr encryption-type
clear usergroup groupname attr encryption-type
clear mac-user username attr encryption-type
clear mac-usergroup groupname attr encryption-type
Assigning and clearing encryption types on a RADIUS server
To assign or delete an encryption algorithm as the Encryption-Type authorization attribute in a user or group
record on a RADIUS server, see the documentation for your RADIUS server.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
606 Configuring AAA for network users
Keeping users on the same VLAN even after roaming
In some cases, a user can be assigned to a different VLAN after roaming to another WSS. Table 39 lists the ways a
VLAN can be assigned to a user after roaming from one WSS to another.
Table 39: VLAN assignment after roaming from one WSS to another
Location
Policy
AAA
keep-initial-vlan
SSID
VLAN Assigned By...
Yes
No
No
No
No
Yes or No
Yes
Yes or No
Yes or No
Yes
Yes or No
Yes or No
Yes or No
Yes
location policy
AAA
No
keep-initial-vlan
No
No
SSID
No
No
No
Not set—authentication
error
Yes in the table means the VLAN is set on the roamed-to WSS, by the mechanism indicated by the column header. No
means the VLAN is not set. Yes or No means the mechanism does not affect the outcome, due to another mechanism that
is set.
The VLAN Assigned By column indicates the mechanism that is used by the roamed-to switch to assign the VLAN, based
on the various ways the VLAN is set on that switch.
•
Location Policy means the VLAN is assigned by a location policy on the roamed-to switch. (The VLAN is assigned
by the vlan vlan-id option of the set location policy permit command.)
•
AAA means the Vlan-name attribute is set on for the user or the user’s group, in the roamed-to switch’s local
database or on a RADIUS server used by the roamed-to switch to authenticate the user. (The VLAN is assigned by
the vlan-name vlan-id option of the set user attr, set usergroup attr, set mac-user, or set mac-usergroup
command.)
•
keep-initial-vlan means that the VLAN is not reassigned. Instead, the VLAN assigned on the switch where the user
first accesses the network is retained. (The keep-initial-vlan option is enabled by the set service-profile name
keep-initial-vlan enable command, entered on the roamed-to switch. The name is the name of the service profile
for the SSID the user is associated with.)
•
•
SSID means the VLAN is set on the roamed-to switch, in the service profile for the SSID the user is associated with.
(The Vlan-name attribute is set by the set service-profile name attr vlan-name vlan-id command, entered on the
roamed-to switch. The name is the name of the service profile for the SSID the user is associated with.)
As shown in Table 39, even when keep-initial-vlan is set, a user’s VLAN can be reassigned by AAA or a location
policy.
Note. The keep-initial-vlan option does not apply to Web-Portal clients. Instead, VLAN
assignment for roaming Web-Portal clients automatically works the same way as when
keep-initial-vlan is enabled. The VLAN initially assigned to a Web-Portal user is not
changed except by a location policy, AAA, or SSID default setting on the roamed-to switch.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 607
To enable keep-initial-vlan, use the following command:
set service-profile name keep-initial-vlan {enable | disable}
Enter this command on the switch that will be roamed to by users.
The following command enables the keep-initial-vlan option on service profile sp3:
WSS# set service-profile sp3 keep-initial-vlan enable
success: change accepted.
When a user connects to a new service-profile which has keep-initial-vlan enabled, a lookup is done in the Mobility
Domain to find out if there is a vlan already assigned to this user. If a vlan had already been assigned to this user, the user
is placed on the same vlan unless there is a VLAN attribute from AAA or a location-policy for that user. SSID default
VLANs do not take precedence over the initial VLAN stored in the Mobility Domain, and are the intended method of
configuring the initial VLAN for the user.
If the user roams to a service-profile that has keep-initial-vlan enabled, but no vlan was previously assigned to that user
on the Mobility Domain, then the user is configured in the same manner as if he were a new user.
If the user roams to a service-profile that has keep-initial-vlan disabled, the vlan assignment is done as in pre 5.0
releases.
Keep-Initial-Vlan is not supported in a Mobility Domain which is mixed WSS Software 5.0 and pre-5.0 versions, and it
does not function across Network Domains.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
608 Configuring AAA for network users
Figure 35. Vlan assignment algorithm flowchart
User logs on (either new or after a roam)
(Authentication)
Is there a location-
policy vlan for this
Assign the vlan
to the user
Yes
user?
No
Assign the
Does AAA
have a vlan
attr for this
user
vlan from the
previous step
to the user
Yes
Yes
No
Is keep-
initial-vlan
enabled
Is there a
Assign the
cluster entry for
previous vlan
assignment?
(is this a roam)
vlan from the
previous step
to the user
Yes
No
No
Is there
Assign
an SSID
based default
vlan con-
figured
the vlan from
the previous
step to the
user
Yes
No
ERROR
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 609
Overriding or adding attributes locally with a location
policy
During the login process, the AAA authorization process is started immediately after clients are authenticated to use the
WSS. During authorization, WSS Software assigns the user to a VLAN and applies optional user attributes, such as a
session timeout value and one or more security ACL filters.
A location policy is a set of rules that enables you to locally set or change authorization attributes for a user after the user
is authorized by AAA, without making changes to the AAA server. For example, you might want to enforce VLAN
membership and security ACL policies on a particular WSS based on a client’s organization or physical location, or
assign a VLAN to users who have no AAA assignment. For these situations, you can configure the location policy on the
switch.
You can use a location policy to locally set or change the Filter-Id and VLAN-Name authorization attributes obtained
from AAA.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
610 Configuring AAA for network users
About the location policy
Each WSS can have one location policy. The location policy consists of a set of rules. Each rule contains conditions, and
an action to perform if all conditions in the rule match. The location policy can contain up to 150 rules.
The action can be one of the following:
•
•
Deny access to the network
Permit access, but set or change the user’s VLAN assignment, inbound ACL, outbound ACL, or any combination of
these attributes
The conditions can be one or more of the following:
•
•
•
•
•
AAA-assigned VLAN
Username
AP access port, Distributed AP number, or wired authentication port through which the user accessed the network
SSID name with which the user is associated
Day of the week or time of the day
Conditions within a rule are ANDed. All conditions in the rule must match in order for WSS Software to take the
specified action. If the location policy contains multiple rules, WSS Software compares the user information to the rules
one at a time, in the order the rules appear in the switch’s configuration file, beginning with the rule at the top of the list.
WSS Software continues comparing until a user matches all conditions in a rule or until there are no more rules.
Any authorization attributes not changed by the location policy remain active.
Note. It also helps local customization of the redirection URL.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 611
How the location policy differs from a security ACL
Although structurally similar, the location policy and security ACLs have different functions. The location policy on a
WSS can be used to locally redirect a user to a different VLAN or locally control the traffic to and from a user.
In contrast, security ACLs are packet filters applied to the user throughout a Mobility Domain. (For more information,
You can use the location policy to locally apply a security ACL to a user.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
612 Configuring AAA for network users
Setting the location policy
To enable the location policy function on a WSS, you must create at least one location policy rule with one of
the following commands:
set location policy deny if {ssid operator ssid-name | vlan operator vlan-wildcard | user
operator user-wildcard | port port-list | ap ap-num}
[before rule-number | modify rule-number]
set location policy permit {vlan vlan-name | inacl inacl-name | outacl outacl-name} if
{ssid operator ssid-name | vlan operator vlan-wildcard | user operator user-wildcard
| port port-list | ap ap-num}
[before rule-number | modify rule-number]
Note. Asterisks (wildcards) are not supported in SSID names. You must specify the
complete SSID name.
You must specify whether to permit or deny access, and you must identify a VLAN, username, or access port
to match. Use one of the following operators to specify how the rule must match the VLAN or username:
•
eq—Applies the location policy rule to all users assigned VLAN names matching vlan-wildcard or
having usernames that match user-wildcard.
(Like a user wildcard, a VLAN wildcard is a way to group VLANs for use in this command.
•
neq—Applies the location policy rule to all users assigned VLAN names not matching vlan-wildcard or
having usernames that do not match user-wildcard.
For example, the following command denies network access to all users matching *.theirfirm.com, causing
them to fail authorization:
WSS# set location policy deny if user eq *.theirfirm.com
The following command authorizes access to the guest_1 VLAN for all users who do not match
*.ourfirm.com:
WSS# set location policy permit vlan guest_1 if user neq *.ourfirm.com
The following command places all users who are authorized for SSID tempvendor_a into VLAN kiosk_1:
WSS# set location policy permit vlan kiosk_1 if ssid eq tempvendor_a
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 613
Applying security ACLs in a location policy rule
When reassigning security ACL filters, specify whether the filter is an input filter or an output filter, as follows:
•
Input filter—Use inacl inacl-name to filter traffic that enters the switch from users via an AP access port or wired
authentication port, or from the network via a network port.
•
Output filter—Use outacl outacl-name to filter traffic sent from the switch to users via an AP access port or wired
authentication port, or from the network via a network port.
For example, the following command authorizes users at *.ny.ourfirm.com to access the bld4.tac VLAN, and applies the
security ACL tac_24 to the traffic they receive:
WSS# set location policy permit vlan bld4.tac outacl tac_24 if user eq *.ny.ourfirm.com
The following command authorizes access to users on VLANs with names matching bld4.* and applies security ACLs
svcs_2 to the traffic they send and svcs_3 to the traffic they receive:
WSS# set location policy permit inacl svcs_2 outacl svcs_3 if vlan eq bldg4.*
You can optionally add the suffixes .in and .out to inacl-name and outacl-name for consistency with their usage in
entries stored in the local WSS database.
Displaying and positioning location policy rules
The order of location policy rules is significant. WSS Software checks a location policy rule that is higher in the list
before those lower in the list. Rules are listed in the order in which you create them, unless you move them.
To position location policy rules within the location policy, use before rule-number and modify rule-number in the set
location policy command, or use the clear location policy rule-number command.
For example, suppose you have configured the following location policy rules:
WSS show location policy
Id Clauses
----------------------------------------------------------------
1) deny if user eq *.theirfirm.com
2) permit vlan guest_1 if vlan neq *.ourfirm.com
3) permit vlan bld4.tac inacl tac_24.in if user eq *.ny.ourfirm.com
4) permit inacl svcs_2.in outacl svcs_3.out if vlan eq bldg4.*
To move the first rule to the end of the list and display the results, type the following commands:
WSS clear location policy 1
success: clause 1 is removed.
WSS set location policy deny if user eq *.theirfirm.com
WSS show location policy
Id Clauses
----------------------------------------------------------------
1) permit vlan guest_1 if vlan neq *.ourfirm.com
2) permit vlan bld4.tac inacl tac_24.in if user eq *.ny.ourfirm.com
3) permit inacl svcs_2.in outacl svcs_3.out if vlan eq bldg4.*
4) deny if user eq *.theirfirm.com
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
614 Configuring AAA for network users
Clearing location policy rules and disabling the location policy
To delete a location policy rule, use the following command:
clear location policy rule-number
Type show location policy to display the numbers of configured location policy rules. To disable the location policy on
a WSS, delete all the location policy rules.
Configuring accounting for wireless network users
Accounting records come in three types: start, stop, and update. WSS Software generates these records based on the
configured accounting mode, either start-stop or stop-only:
•
When start-stop mode is configured, a start record is generated when a user is first connected, an update record is
generated when a user roams from one AP to another, and a stop record is generated when a user terminates his or
her session.
•
When stop-only mode is configured, a stop record is generated when a user terminates his or her session.
Optionally, WSS Software can be configured to send update records at periodic intervals, and also generate an
Accounting-On message when the WSS starts, and an Accounting-Off message when the WSS is administratively shut
down. This functionality can be used in conjunction with billing systems that require periodic accounting messages.
To set accounting, type the following command:
set accounting {admin | console | dot1x | mac | web | last-resort}
{ssid ssid-name | wired} {user-wildcard | mac-addr-wildcard}
{start-stop | stop-only} method1 [method2] [method3] [method4]
For example, to store start-stop accounting records at example.com for 802.1X users of SSID mycorp in the local
database, type the following command:
WSS# set accounting dot1x ssid mycorp *@example.com start-stop local
success: change accepted.
The accounting records can contain the following session information:
Start Records
Update and Stop Records
Session date and time
Session date and time
Location of authentication (if any):
RADIUS server (1) or local database (2)
Location of authentication (if any): RADIUS server
(1) or local database (2)
ID for related sessions
Username
ID for related sessions
Username
Session duration
Timestamp
Session duration
Timestamp
VLAN name
VLAN name
Client’s MAC address
Client’s MAC address
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 615
Start Records
Update and Stop Records
AP port number and radio number
AP’s MAC address
AP port number and radio number
AP’s MAC address
Number of octets received by the WSS
Number of octets sent by the switch
Number of packets received by the switch
Number of packets sent by the switch
(For details about show accounting statistics output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference. For information about accounting update records, see “Viewing roaming accounting records” on page 619.
To configure accounting on a RADIUS server, see the documentation for your RADIUS server.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
616 Configuring AAA for network users
Configuring periodic accounting update records
If you have configured WSS Software to use start-stop mode, by default accounting update records are generated when
a user roams from one AP to another. Optionally, WSS Software can generate update records at specified periodic inter-
vals. This can be done in one of the following ways:
•
By specifying a value for the acct-interim-interval attribute on the RADIUS server. If the RADIUS server’s
access-accept response contains this attribute, then WSS Software generates update records for the user’s session at
the specified interval.
•
By specifying a value for the acct-interim-interval attribute for the user on the WSS. See the description of the
acct-interim-interval attribute in Table 38: “Authentication attributes for local users” on page 595.
If both the RADIUS server and the WSS supply a value for the user’s acct-interim-interval attribute, then the value from
the WSS takes precedence.
If there is no acct-interim-interval attribute value set, or it is set to zero on the WSS, then accounting update records are
generated only when a user roams from one AP to another.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 617
Enabling system accounting messages
You can configure WSS Software to send an Accounting-On message (Acct-Status-Type = 7) to the RADIUS server
when the WSS starts, and an Accounting-Off message (Acct-Status-Type = 8) to the RADIUS server when the WSS is
administratively shut down. To do this, use the following command:
set accounting system method1 [method2] [method3] [method4]
For example, the following command causes Accounting-On and Accounting-Off messages to be sent to RADIUS
server group shorebirds:
WSS# set accounting system shorebirds
success: change accepted.
Note that local is not a valid method for this command.
When you enter this command, an Accounting-On message is generated and sent to the specified server or server group.
Subsequent Accounting-On messages are generated each time the WSS starts. When the WSS is administratively shut
down, an Accounting-Off message is generated.
Accounting-Off messages are sent only when the WSS is administratively shut down, not when a critical failure causes
the WSS to reset. The WSS does not wait for a RADIUS server to acknowledge the Accounting-Off message; the switch
makes one attempt to send the Accounting-Off message, then shuts down.
Accounting-On and Accounting-Off messages are disabled by default. If, after enabling these messages, you want to
disable them, use the following command:
clear accounting system
For example:
WSS# clear accounting system
success: change accepted.
When you enter this command, an Accounting-Off message is generated and sent to the server or server group specified
with the set accounting system command. No further Accounting-On or Accounting-Off messages are generated.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 619
Viewing roaming accounting records
During roaming, accounting is treated as a continuation of an existing session, rather than a new session. The following
sample output shows a wireless user roaming from one WSS to another WSS.
From the accounting records, you can determine the user’s activities by viewing the Acct-Status-Type, which varies
from START to UPDATE to STOP, and the Called-Station-Id, which is the MAC address of the AP through which the
wireless user accessed the network. The Acct-Multi-Session-Id is guaranteed to be globally unique for the client.
By entering show accounting statistics commands on each WSS involved in the roaming, you can determine the user’s
movements between WSSs when accounting is configured locally.
The user started on WSS-0013:
WSS-0013# show accounting statistics
May 21 17:01:32
Acct-Status-Type=START
Acct-Authentic=2
User-Name=Administrator@example.com
Acct-Multi-Session-Id=SESSION-4-1106424789
Event-Timestamp=1053536492
Vlan-Name=default
Calling-Station-Id=00-06-25-09-39-5D
Nas-Port-Id=1/1
Called-Station-Id=00-0B-0E-76-56-A8
The user roamed to WSS-0017.
WSS-0017# show accounting statistics
May 21 17:05:00
Acct-Status-Type=UPDATE
Acct-Authentic=2
Acct-Multi-Session-Id=SESSION-4-1106424789
User-Name=Administrator@example.com
Acct-Session-Time=209
Acct-Output-Octets=1280
Acct-Input-Octets=1920
Acct-Output-Packets=10
Acct-Input-Packets=15
Event-Timestamp=1053536700
Vlan-Name=default
Calling-Station-Id=00-06-25-09-39-5D
Nas-Port-Id=2/1
Called-Station-Id=00-0B-0E-76-56-A0
The user terminated the session on WSS-0017:
WSS-0017# show accounting statistics
May 21 17:07:32
Acct-Status-Type=STOP
Acct-Authentic=2
Acct-Multi-Session-Id=SESSION-4-1106424789
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
620 Configuring AAA for network users
User-Name=Administrator@example.com
Acct-Session-Time=361
Event-Timestamp=1053536852
Acct-Output-Octets=2560
Acct-Input-Octets=5760
Acct-Output-Packets=20
Acct-Input-Packets=45
Vlan-Name=default
Calling-Station-Id=00-06-25-09-39-5D
Nas-Port-Id=2/1
Called-Station-Id=00-0B-0E-76-56-A0
If you configured accounting records to be sent to a RADIUS server, you can view the records of user roaming at the
RADIUS server. (For more information on these attributes, see “Supported RADIUS attributes” on page 795.)
For information about requesting accounting records from the RADIUS server, see the documentation for your RADIUS
server.
Displaying the AAA configuration
To view the results of the AAA commands you have set and verify their order, type the show aaa command. The order
in which the commands appear in the output determines the order in which WSS Software matches them to users.
(Sometimes the order might not be what you intended. See “Avoiding AAA problems in configuration order” on
page 621.)
For example:
WSS# show aaa
Default Values
authport=1812 acctport=1813 timeout=5 acct-timeout=5
retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server
Addr
Ports T/o Tries Dead State
--------------------------------------------------------------------
rs-3
rs-4
rs-5
198.162.1.1 1821 1813 5
198.168.1.2 1821 1813 77 11 2 UP
198.162.1.3 1821 1813 42 23 0 UP
3
0
UP
Server groups
sg1: rs-3
sg2: rs-4
sg3: rs-5
Web Portal:
enabled
set authentication admin Jose sg3
set authentication console * none
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 621
set authentication mac ssid mycorp * local
set authentication dot1x ssid mycorp Geetha eap-tls
set authentication dot1x ssid mycorp * peap-mschapv2 sg1 sg2 sg3
set accounting dot1x Nin ssid mycorp stop-only sg2
set accounting admin Natasha start-stop local
user Nin
Password = 082c6c64060b (encrypted)
Filter-Id = acl-999.in
Filter-Id = acl-999.out
mac-user 01:02:03:04:05:06
usergroup eastcoasters
session-timeout = 99
For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.
Avoiding AAA problems in configuration order
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
622 Configuring AAA for network users
Using the wildcard “Any” as the SSID name in authentication rules
You can configure an authentication rule to match on all SSID strings by using the SSID string any in the rule. For
example, the following rule matches on all SSID strings requested by all users:
set authentication web ssid any ** sg1
WSS Software checks authentication rules in the order they appear in the configuration file. As a result, if a rule with
SSID any appears in the configuration before a rule that matches on a specific SSID for the same authentication type and
userglob, the rule with any always matches first.
To ensure the authentication behavior that you expect, place the most specific rules first and place rules with SSID any
last. For example, to ensure that users who request SSID corpa are authenticated using RADIUS server group corpasrvr,
place the following rule in the configuration before the rule with SSID any:
set authentication web ssid corpa ** corpasrvr
Here is an example of a AAA configuration where the most-specific rules for 802.1X are first and the rules with any are
last:
WSS# show aaa
...
set authentication dot1x ssid mycorp Geetha eap-tls
set authentication dot1x ssid mycorp * peap-mschapv2 sg1 sg2 sg3
set authentication dot1x ssid any ** peap-mschapv2 sg1 sg2 sg3
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 623
Using authentication and accounting rules together
When you use accounting commands with authentication commands and identify users with user wildcards, WSS
Software might not process the commands in the order you entered them. As a result, user authentication or accounting
might not proceed as you intend, or valid users might fail authentication and be shut out of the network.
You can prevent these problems by using duplicate user wildcards for authentication and accounting and entering the
commands in pairs.
Configuration producing an incorrect processing order
For example, suppose you initially set up start-stop accounting as follows for all 802.1X users via RADIUS server
group 1:
WSS# set accounting dot1x ssid mycorp * start-stop group1
success: change accepted.
You then set up PEAP-MS-CHAP-V2 authentication and authorization for all users at EXAMPLE/ at server group 1.
Finally, you set up PEAP-MS-CHAP-V2 authentication and authorization for all users in the local WSS database, with
the intention that EXAMPLE users are to be processed first:
WSS# set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1
success: change accepted.
WSS# set authentication dot1x ssid mycorp * peap-mschapv2 local
success: change accepted.
The following configuration order results. The authentication commands are reversed, and WSS Software processes the
authentication of all 802.1X users in the local database and ignores the command for EXAMPLE/ users.
WSS# show aaa
...
set accounting dot1x ssid mycorp * start-stop group1
set authentication dot1x ssid mycorp * peap-mschapv2 local
set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1
Configuration for a correct processing order
To avoid processing errors for authentication and accounting commands that include order-sensitive user wildcards,
enter the commands for each user wildcard in pairs.
For example, to set accounting and authorization for 802.1X users as you intended in “Configuration producing an
incorrect processing order” on page 623, enter an accounting and authentication command for each user wildcard in the
order in which you want them processed:
WSS# set accounting dot1x ssid mycorp EXAMPLE/* start-stop group1
success: change accepted.
WSS# set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1
success: change accepted.
WSS# set accounting dot1x ssid mycorp * start-stop group1
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
624 Configuring AAA for network users
success: change accepted.
WSS# set authentication dot1x ssid mycorp * peap-mschapv2 local
success: change accepted.
The configuration order now shows that all 802.1X users are processed as you intended:
WSS# show aaa
...
set accounting dot1x ssid mycorp EXAMPLE/* start-stop group1
set authentication dot1x ssid mycorp EXAMPLE/* peap-mschapv2 group1
set accounting dot1x ssid mycorp * start-stop group1
set authentication dot1x ssid mycorp * peap-mschapv2 local
Configuring a Mobility Profile
A Mobility Profile is a way of specifying, on a per-user basis, those users who are allowed access to specified AP access
ports and wired authentication ports on a WSS. In this way, you can constrain the areas to which a user can roam. You
first create a Mobility Profile, assign it to one or more users, and finally enable the Mobility Profile feature on the WSS.
Caution! When Mobility Profile attributes are enabled, a user is denied access if
assigned a Mobility-Profile attribute in the local WSS database or RADIUS server and no
Mobility Profile of that name exists on the WSS.
Use the following command to create a Mobility Profile by giving it a name and identifying the accessible port or ports:
set mobility-profile name name
{port {none | all | port-list}} | {ap {none | all | ap-num}}
Specifying none prevents users assigned to the Mobility Profile from accessing any AP access ports, Distributed APs, or
wired authentication ports on the WSS. Specifying all allows the users access to all of the ports or Distributed APs.
Specifying an individual port or Distributed AP number or a list limits access to those ports or APs. For example, the
following command creates a Mobility Profile named roses-profile that allows access through ports 2 through 4, port 7,
and port 9:
WSS# set mobility-profile name roses-profile port 2-4,7,9
success: change accepted.
You can then assign this Mobility Profile to one or more users. For example, to assign the Mobility Profile roses-profile
to all users at EXAMPLE\, type the following command:
WSS# set user EXAMPLE\* attr mobility-profile roses-profile
success: change accepted.
(For a list of the commands for assigning attributes, see “Assigning attributes to users and groups” on page 599.)
During 802.1X authorization for clients at EXAMPLE\, WSS Software must search for the Mobility Profile named
roses-profile. If it is not found, the authorization fails and clients with usernames like EXAMPLE\jose and
EXAMPLE\tamara are rejected.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 625
If roses-profile is configured for EXAMPLE\ users on your WSS, WSS Software checks its port list. If, for example, the
current port for EXAMPLE\jose’s connection is on the list of allowed ports specified in roses-profile, the connection is
allowed to proceed. If the port is not in the list (for example, EXAMPLE\jose is on port 12, which is not in the port list),
the authorization fails and client EXAMPLE\jose is rejected.
The Mobility Profile feature is disabled by default. You must enable Mobility Profile attributes on the WSS to use it.
You can enable or disable the feature for the whole WSS only. If the Mobility Profile feature is disabled, all Mobility
Profile attributes are ignored.
To put Mobility Profile attributes into effect on a WSS, type the following command:
WSS# set mobility-profile mode enable
success: change accepted.
To display the name of each Mobility Profile and its ports, type the following command:
WSS# show mobility-profile
Mobility Profiles
Name
==========
roses-profle
Ports
=====
AP 2
AP 3
AP 4
AP 7
AP 9
To remove a Mobility Profile, type the following command:
clear mobility-profile name
Network user configuration scenarios
The following scenarios provide examples of ways in which you use AAA commands to configure access for users:
•
•
•
•
•
•
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
626 Configuring AAA for network users
General use of network user commands
The following example illustrates how to configure IEEE 802.1X network users for authentication, accounting, ACL
filtering, and Mobility Profile assignment:
1
2
Configure all 802.1X users of SSID mycorp at EXAMPLE to be authenticated by server group
shorebirds. Type the following command:
WSS# set authentication dot1x ssid mycorp EXAMPLE\* pass-through shorebirds
Configure stop-only accounting for all mycorp users at EXAMPLE, for accounting records to be stored
locally. Type the following command:
WSS# set accounting dot1x ssid mycorp EXAMPLE\* stop-only local
success: change accepted.
3
4
Configure an ACL to filter the inbound packets for each user at EXAMPLE. Type the following
command for each user:
WSS# set user EXAMPLE\usernameattr filter-id acl-101.in
This command applies the access list named acl-101 to each user at EXAMPLE.
To display the ACL, type the following command:
WSS# show security acl info acl-101
set security acl ip acl-101 (hits #0 0)
----------------------------------------------------
1. permit IP source IP 192.168.1.1 0.0.0.255 destination IP any
enable-hits
5
Create a Mobility Profile called tulip by typing the following commands:
WSS# set mobility-profile name tulip port 2,5-9
success: change accepted.
WSS# set mobility-profile mode enable
success: change accepted.
WSS# show mobility-profile
Mobility Profiles
Name
Ports
=========================
tulip
AP 2
AP 6
AP 7
AP 8
AP 9
6
To assign Mobility Profile tulip to all users at EXAMPLE, type the following command for each
EXAMPLE\ user:
WSS# set user EXAMPLE\usernameattr mobility-profile tulip
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 627
Users at EXAMPLE are now restricted to ports 2 and 5 through 9, as specified in the tulip Mobility
Profile configuration.
7
Use the show aaa command to verify your configuration. Type the following command:
WSS# show aaa
Default Values
authport=1812 acctport=1813 timeout=5 acct-timeout=5
retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server
State
Addr
Ports T/o Tries Dead
---------------------------------------------------------------
----
Web Portal:
enabled
set accounting dot1x ssid mycorp EXAMPLE\* stop-only local
set authentication dot1x ssid mycorp EXAMPLE\* pass-through
shorebirds
user tech
Password = 1315021018 (encrypted)
user EXAMPLE/nin
filter-id = acl.101.in
mobility-profile = tulip
user EXAMPLE/tamara
filter-id = acl.101.in
mobility-profile = tulip
...
8
Save the configuration:
WSS save config
success: configuration saved.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
628 Configuring AAA for network users
Enabling RADIUS pass-through authentication
The following example illustrates how to enable RADIUS pass-through authentication for all 802.1X network users:
1
Configure the RADIUS server r1 at IP address 10.1.1.1 with the string sunny for the key. Type the
following command:
WSS# set radius server r1 address 10.1.1.1 key sunny
Configure the server group sg1 with member r1. Type the following command:
WSS# set server group sg1 members r1
2
3
Enable all 802.1X users of SSID mycorp to authenticate via pass-through to server group sg1. Type the
following command:
WSS# set authentication dot1x ssid mycorp * pass-through sg1
4
Save the configuration:
WSS save config
success: configuration saved.
(For information about setting up RADIUS servers for remote authentication, see “Configuring communication with
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 629
Enabling PEAP-MS-CHAP-V2 authentication
The following example illustrates how to enable local PEAP-MS-CHAP-V2 authentication for all 802.1X network
users. This example includes local usernames, passwords, and membership in a VLAN. This example includes one
username and an optional attribute for session-timeout in seconds.
1
2
3
4
5
To set authentication for all 802.1X users of SSID thiscorp, type the following command:
WSS# set authentication dot1x ssid thiscorp * peap-mschapv2 local
To add user Natasha to the local database on the WSS, type the following command:
WSS# set user Natasha password moon
To assign Natasha to a VLAN named red, type the following command:
WSS# set user Natasha attr vlan-name red
To assign Natasha a session timeout value of 1200 seconds, type the following command:
WSS# set user Natasha attr session-timeout 1200
Save the configuration:
WSS save config
success: configuration saved.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
630 Configuring AAA for network users
Enabling PEAP-MS-CHAP-V2 offload
The following example illustrates how to enable PEAP-MS-CHAP-V2 offload. In this example, all EAP processing is
offloaded from the RADIUS server, but MS-CHAP-V2 authentication and authorization are done via a RADIUS server.
The MS-CHAP-V2 lookup matches users against the user list on a RADIUS server.
1
Configure the RADIUS server r1 at IP address 10.1.1.1 with the string starry for the key. Type the
following command:
WSS# set radius server r1 address 10.1.1.1 key starry
Configure the server group sg1 with member r1. Type the following command:
WSS# set server group sg1 members r1
2
3
Enable all 802.1X users of SSID thiscorp using PEAP-MS-CHAP-V2 to authenticate MS-CHAP-V2 on
server group sg1. Type the following command:
WSS# set authentication dot1x ssid thiscorp * peap-mschapv2 sg1
4
Save the configuration:
WSS save config
success: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring AAA for network users 631
Combining 802.1X Acceleration with pass-through authentication
The following example illustrates how to enable PEAP-MS-CHAP-V2 offload for the marketing (mktg) group and
RADIUS pass-through authentication for members of engineering. This example assumes that engineering members are
using DNS-style naming, such as is used with EAP-TLS. A WSS server certificate is also required.
1
Configure the RADIUS server r1 at IP address 10.1.1.1 with the string starry for the key. Type the
following command:
WSS# set radius server r1 address 10.1.1.1 key starry
Configure the server group sg1 with member r1. Type the following command:
WSS# set server group sg1 members r1
2
3
To authenticate all 802.1X users of SSID bobblehead in the group mktg using PEAP on the WSS and
MS-CHAP-V2 on server sg1, type the following command:
WSS# set authentication dot1x ssid bobblehead mktg\* peap-mschapv2 sg1
4
5
To authenticate all 802.1X users of SSID aircorp in @eng.example.com via pass-through to sg1, type the
following command:
WSS# set authentication dot1x ssid aircorp *@eng.example.com pass-through sg1
Save the configuration:
WSS save config
success: configuration saved.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
632 Configuring AAA for network users
Overriding AAA-assigned VLANs
The following example shows how to change the VLAN access of wireless users in an organization housed in multiple
buildings.
Suppose the wireless users on the faculty of a college English department have offices in building A and are authorized
to use that building’s bldga-prof- VLANs. These users also teach classes in building B. Because you do not want to
tunnel these users back to building A from building B when they use their wireless laptops in class, you configure the
location policy on the WSS to redirect them to the bldgb-eng VLAN.
You also want to allow writing instructors normally authorized to use any -techcomm VLAN in the college to access the
network through the bldgb-eng VLAN when they are in building B.
1
2
3
Redirect bldga-prof- VLAN users to the VLAN bldgb-eng:
WSS# set location policy permit vlan bldgb-eng if vlan eq
bldga-prof-*
Allow writing instructors from -techcomm VLANs to use the bldgb-eng VLAN:
WSS# set location policy permit vlan bldgb-eng if vlan eq
*-techcomm
Display the configuration:
WSS# show location policy
Id Clauses
-----------------------------------------------------
1) permit vlan bldgb-teach if vlan eq bldga-prof-*
2) permit vlan bldgb-eng if vlan eq *-techcomm
4
Save the configuration:
WSS save config
success: configuration saved.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
633
Configuring communication with
RADIUS
Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
Configuring RADIUS servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
Configuring RADIUS server groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639
RADIUS and server group configuration scenario . . . . . . . . . . . . . . . . . . . . . . . . . . 644
For a list of the standard and extended RADIUS attributes and Nortel vendor-specific attributes (VSAs) supported by
RADIUS overview
Remote Authentication Dial-In User Service (RADIUS) is a distributed client-server system. RADIUS servers provide a
repository for all usernames and passwords, and can manage and store large groups of users.
RADIUS servers store user profiles, which include usernames, passwords, and other AAA attributes. You can use autho-
rization attributes to authorize users for a type of service, for appropriate servers and network segments through VLAN
assignments, for packet filtering by access control lists (ACLs), and for other services during a session.
You must include RADIUS servers in a server group before you can access them. (See “Configuring RADIUS server
Figure 36 illustrates the interactions between wireless users (clients), APs, a WSS, and its attached RADIUS servers
when the clients attempt access.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
634 Configuring communication with RADIUS
Figure 36. Wireless Client, AP, WSS, and RADIUS Servers
Client (with PDA)
AP 1
AP 2
3
1
2
Client (with laptop)
Client (with laptop)
WSS
with local
database
4
RADIUS Server 1
Wired
connection(s)
Wireless
connection
RADIUS Server 2
1
2
The wireless user (client) requests an IEEE 802.11 association from the AP .
After the AP creates the association, the WSS sends an Extensible Authentication Protocol
(EAP) identity request to the client.
3
4
The client sends an EAP identity response.
From the EAP response, the WSS gets the client’s username. The WSS then searches its AAA
configuration, attempting to match the client's username against the user wildcards in the AAA
configuration.
When a match is found, the methods specified by the matching AAA command in the WSS
configuration file indicate how the client is to be authenticated, either locally on the WSS, or
via a RADIUS server group.
5
If the client does not support 802.1X, WSS Software attempts to perform MAC authentication
for the client instead. In this case, if the switch’s configuration contains a set authentication
mac command that matches the client’s MAC address, WSS Software uses the method
specified by the command. Otherwise, WSS Software uses local MAC authentication by
default.
(For information about MAC client authentication, see “Configuring MAC authentication and
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring communication with RADIUS 635
Before you begin
To ensure that you can contact the RADIUS servers you plan to use for authentication, send the ping command to each
one to verify connectivity.
ping ip-address
You can then set up communication between the WSS and each RADIUS server group.
Configuring RADIUS servers
An authentication server authenticates each client with access to a switch port before making available any services
offered by the switch or the wireless network. The authentication server can reside either in the local database on the
WSS or on a remote RADIUS server.
When a RADIUS server is used for authentication, you must configure RADIUS server parameters. For each RADIUS
server, you must, at a minimum, set the server name, the password (key), and the IP address. You can include any or all
of the other optional parameters. You can set some parameters globally for the RADIUS servers.
For RADIUS servers that do not explicitly set their own dead time and timeout timers and transmission attempts, WSS
Software sets the following values by default:
•
•
•
Dead time—0 (zero) minutes (The WSS does not designate unresponsive RADIUS servers as unavailable.)
Transmission attempts—3
Timeout (WSS wait for a server response)—5 seconds
When WSS Software sends an authentication or authorization request to a RADIUS server, WSS Software waits for the
amount of the RADIUS timeout for the server to respond. If the server does not respond, WSS Software retransmits the
request. WSS Software sends the request up to the number of retransmits configured. (The retransmit setting specifies
the total number of attempts, including the first attempt.) For example, using the default values, WSS Software sends a
request to a server up to three times, waiting 5 seconds between requests.
If a server does not respond before the last request attempt times out, WSS Software holds down further requests to the
server, for the duration of the dead time. For example, if you set the dead time to 5 minutes, WSS Software stops sending
requests to the unresponsive server for 5 minutes before reattempting to use the server.
During the holddown, it is as if the dead RADIUS server does not exist. WSS Software skips over any dead RADIUS
servers to the next live server, or on to the next method if no more live servers are available, depending on your configu-
ration. For example, if a RADIUS server group is the primary authentication method and local is the secondary method,
WSS Software fails over to the local method if all RADIUS servers in the server group are unresponsive and have
entered the dead time.
For failover authentication or authorization to work promptly, Nortel recommends that you change the dead time to a
value other than 0. With the default setting, the dead time is never invoked and WSS Software does not hold down
requests to unresponsive RADIUS servers. Instead, WSS Software attempts to send each new authentication or authori-
zation request to a server even if the server is thought to be unresponsive. This behavior can cause authentication or
authorization failures on clients because WSS Software does not fail over to the local method soon enough and the
clients eventually time out.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
636 Configuring communication with RADIUS
Configuring global RADIUS defaults
You can change RADIUS values globally and set a global password (key) with the following command. The key string
is the shared secret that the WSS uses to authenticate itself to the RADIUS server.
set radius {deadtime minutes | encrypted-key string | key string | retransmit number |
timeout seconds}
(To override global settings for individual RADIUS servers, use the set radius server command. See “Configuring indi-
For example, the following commands set the dead-time timer to 10 minutes and set the password to r8gney for all
RADIUS servers in the WSS configuration:
WSS# set radius deadtime 10
success: change accepted.
WSS# set radius key r8gney
success: change accepted.
To reset global RADIUS server settings to their factory defaults, use the following command:
clear radius {deadtime | key | retransmit | timeout}
For example, the following command resets the dead-time timer to 0 minutes on all RADIUS servers in the WSS
configuration:
WSS# clear radius deadtime
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring communication with RADIUS 637
Setting the system IP address as the source address
By default, RADIUS packets leaving the WSS have the source IP address of the outbound interface on the switch. This
source address can change when routing conditions change. If you have set a system IP address for the WSS, you can use
it as a permanent source address for the RADIUS packets sent by the switch.
To set the WSS system IP address as the address of the RADIUS client, type the following command:
WSS# set radius client system-ip
success: change accepted.
To remove the WSS’s system IP address from use as the source address in RADIUS client requests from the switch to its
RADIUS server(s), type the following command:
WSS# clear radius client system-ip
success: change accepted.
The command causes the WSS to select a source interface address based on information in its routing table as the
RADIUS client address.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
638 Configuring communication with RADIUS
Configuring individual RADIUS servers
You must set up a name and IP address for each RADIUS server. To configure a RADIUS server, use the
following command:
set radius server server-name [address ip-address] [key string]
The server name must be unique for this RADIUS server on this WSS. Do not use the same name for a
RADIUS server and a RADIUS server group. The key (password) string is the shared secret that the WSS uses
to authenticate itself to the RADIUS server. (For additional options, see the Nortel WLAN Security Switch
2300 Series Command Line Reference.)
The following command names a RADIUS server rs1 with the IP address 192.168.0.2 and the key testing123:
WSS# set radius server rs1 address 192.168.0.2 key testing123
success: change accepted.
You can configure multiple RADIUS servers. When you define server names and keys, case is significant. For
example:
WSS# set radius server rs1 address 10.6.7.8 key seCret
success: change accepted.
WSS# set radius server rs2 address 10.6.7.9 key BigSecret
success: change accepted.
Note. You must provide RADIUS servers with names that are unique. To prevent
confusion, Nortel recommends that RADIUS server names differ in ways other than case.
For example, avoid naming two servers RS1 and rs1.
You must configure RADIUS servers into server groups before you can access them. For information on
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring communication with RADIUS 639
Deleting RADIUS servers
To remove a RADIUS server from the WSS configuration, use the following command:
clear radius server server-name
Configuring RADIUS server groups
A server group is a named group of up to four RADIUS servers. Before you can use a RADIUS server for authentication,
you must first create a RADIUS server group and add the RADIUS server to that group. You can also arrange load
balancing, so that authentications are spread out among servers in the group. You must declare all members of a server
group, in contact order, when you create the group.
Once the group is configured, you can use a server group name as the AAA method with the set authentication and set
accounting commands. (See “Configuring Web-based AAA for administrative and local access” on page 73 and
Subsequently, you can change the members of a group or configure load balancing.
If you add or remove a RADIUS server in a server group, all the RADIUS dead timers for that server group are reset to
the global default.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
640 Configuring communication with RADIUS
Creating server groups
To create a server group, you must first configure the RADIUS servers with their addresses and any optional parameters.
After configuring RADIUS servers, type the following command:
set server group group-name members server-name1 [server-name2] [server-name3]
[server-name4]
For example, to create a server group called shorebirds with the RADIUS servers heron, egret, and sandpiper, type the
following commands:
WSS# set radius server egret address 192.168.253.1 key apple
WSS# set radius server heron address 192.168.253.2 key pear
WSS# set radius server sandpiper address 192.168.253.3 key plum
WSS# set server group shorebirds members egret heron sandpiper
In this example, a request to shorebirds results in the RADIUS servers being contacted in the order that they are listed in
the server group configuration, first egret, then heron, then sandpiper. You can change the RADIUS servers in server
Note. Any RADIUS servers that do not respond are marked dead (unavailable) for a
period of time. The unresponsive server is skipped over, as though it did not exist, during its
dead time. Once the dead time elapses, the server is again a candidate for receiving
requests. To change the default dead-time timer, use the set radius or set radius server
command.
Ordering server groups
You can configure up to four methods for authentication, authorization, and accounting (AAA). AAA methods can be
the local database on the WSS and/or one or more RADIUS server groups. You set the order in which the WSS attempts
the AAA methods by the order in which you enter the methods in CLI commands.
In most cases, if the first method results in a pass or fail, the evaluation is final. If the first method does not respond or
results in an error, the WSS tries the second method and so on.
However, if the local database is the first method in the list, followed by a RADIUS server group, the WSS responds to a
failed search of the database by sending a request to the following RADIUS server group. This exception is called local
override.
Configuring load balancing
You can configure the WSS to distribute authentication requests across RADIUS servers in a server group, which is
called load balancing. Distributing the authentication process across multiple RADIUS servers significantly reduces the
load on individual servers while increasing resiliency on a systemwide basis.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring communication with RADIUS 641
When you configure load balancing, the first client’s RADIUS requests are directed to the first server in the group, the
second client’s RADIUS requests are directed to the second server in the group, and so on. When the last server in the
group is reached, the cycle is repeated.
Note. WSS Software attempts to send accounting records to one RADIUS server, even
if load balancing is configured.
To configure load balancing, use the following command:
set server group group-name load-balance enable
For example, to configure RADIUS servers pelican and seagull as the server group swampbirds with load balancing:
1
Configure the members of a server group by typing the following command:
WSS# set server group swampbirds members pelican seagull
success: change accepted.
2
Enable load balancing by typing the following command:
WSS# set server group swampbirds load-balance enable
success: change accepted.
The following command disables load balancing for a server group:
clear server group group-name load-balance
Adding members to a server group
To add RADIUS servers to a server group, type the following command:
set server group group-name members server-name1 [server-name2] [server-name3]
[server-name4]]
The keyword members lists the RADIUS servers contained in the named server group. A server group can contain
between one and four RADIUS servers. This command accepts any RADIUS servers as the current set of servers. To
change the server members, you must reenter all of them.
For example, to add RADIUS server coot to server group shorebirds:
1
Determine the server group by typing the following command:
WSS# show aaa
Radius Servers
Server
Addr
Ports T/o Tries Dead State
--------------------------------------------------------------
sandpiper 192.168.253.3 1812 1813 5
3
3
3
3
0
0
0
0
UP
UP
UP
UP
heron
coot
192.168.253.1 1812 1813 5
192.168.253.4 1812 1813 5
192.168.253.2 1812 1813 5
egret
Server groups
shorebirds (load-balanced): sandpiper heron egret
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
642 Configuring communication with RADIUS
The RADIUS server coot is configured but not part of the server group shorebirds.
2
To add RADIUS server coot as the last server in the server group shorebirds, type the following
command:
WSS# set server group shorebirds members sandpiper heron egret coot
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring communication with RADIUS 643
Deleting a server group
To remove a server group, type the following command:
clear server group group-name
For example, to delete the server group shorebirds, type the following command:
WSS# clear server group shorebirds
success: change accepted.
The members of the group remain configured, although no server groups are shown:
WSS# show aaa
Default Values
authport=1812 acctport=1813 timeout=5 acct-timeout=5
retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server
Addr
Ports
T/o Tries Dead State
-----------------
sandpiper
heron
coot
egret
----------------- -----------------------------------------------------
192.168.253.3
192.168.253.1
192.168.253.4
192.168.253.2
1812 1813
1812 1813
1812 1813
1812 1813
5
5
5
5
3
3
3
3
0
0
0
0
UP
UP
UP
UP
Server groups
Configuring the RADIUS Ping Utility
RADIUS ping utility helps to troubleshoot if there are problems communicating with a RADIUS server. The “radping”
command allows the WSS to send an authentication request to a RADIUS server to determine if the server is active or
offline. You can authenticate on the RADIUS server using MSCHAPv2 authentication.
WSS# radping {server servername | group servergroup} request authentication user username
password password auth-type {plain | mschapv2}
This command sends an authentication request with the specified username and password to the RADIUS server or
RADIUS server group.
WSS# radping {server servername | group servergroup} request {acct-start | acct-stop |
acct-update} user username
This command sends an accounting request from the specified user to the specified server or server group.
WSS# radping {server servername | group servergroup} request {acct-on | acct-off}
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
644 Configuring communication with RADIUS
RADIUS and server group configuration scenario
The following example illustrates how to declare four RADIUS servers to a WSS and configure them into two
load-balancing server groups, swampbirds and shorebirds:
1
Configure RADIUS servers. Type the following commands:
WSS# set radius server pelican address 192.168.253.11 key elm
WSS# set radius server seagull address 192.168.243.12 key fir
WSS# set radius server egret address 192.168.243.15 key pine
WSS# set radius server sandpiper address 192.168.253.17 key oak
Place two of the RADIUS servers into a server group called swampbirds. Type the following command:
WSS# set server group swampbirds members pelican seagull
Enable load balancing for swampbirds. Type the following command:
WSS# set server group swampbirds load-balance enable
2
3
4
5
6
Place the other RADIUS servers in a server group called shorebirds. Type the following command:
WSS# set server group shorebirds members egret pelican sandpiper
Enable load balancing for shorebirds. Type the following command:
WSS# set server group shorebirds load-balance enable
Display the configuration. Type the following command:
WSS# show aaa
Default Values
authport=1812 acctport=1813 timeout=5 acct-timeout=5
retrans=3 deadtime=0 key=(null) author-pass=(null)
Radius Servers
Server
Addr
Ports
T/o Tries Dead State
--------- -------------- -------------------------------
sandpiper 192.168.253.17 1812 1813 5
3
3
3
3
0
0
0
0
UP
UP
UP
UP
seagull
egret
192.168.243.12 1812 1813 5
192.168.243.15 1812 1813 5
192.168.253.11 1812 1813 5
pelican
Server groups
swampbirds (load-balanced): pelican seagull
shorebirds (load-balanced): egret pelican sandpiper
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring communication with RADIUS 645
Dynamic RADIUS
This allows administrators supporting a RADIUS server to disconnect a user and change the authorization attributes of
an existing user session.
RFC 4673 (Dynamic Authorization Server MIB):
•
•
•
Dynamic Authorization Server (DAS) - The component residing on the NAS and processes the Disconnect and
Change of Authorization (CoA) requests sent by the Dynamic Authorization Client (DAC).
Dynamic Authorization Client (DAC) - The component sending the Disconnect and CoA requests to the DAS
though the DAC often resides on the RADIUS server, it can be located on a separated host, such as a rating engine.
Dynamic Authorization Server Port - The UDP that the DAS listens for Disconnect and CoA requests sent by the
DAC.
Configuration
To configure a RADIUS DAC server on a WSS, use the following commands:
WSS# set radius dac dac-name ip-address key <string>
Additional attributes include the following:
[disconnect [enable | disable] | [change-of-author [enable | disable] | replay-protection
[enable | disable] | replay-window seconds ]
To configure the dynamic authorization server port, use the following command:
WSS# set radius das-port portnum
To clear the das-port, use the following command:
WSS# clear radius das-port
To configure SSIDs for RADIUS DAC, use the following commands:
WSS# set authorization dynamic {ssid [wireless_8021X | 8021x | any |<name>]| wired
<name>}
Note. You can configure upto four SSIDs and four wired rule names for RADIUS DAC.
termination-action Attribute for RADIUS
The termination-action RADIUS attribute supports reauthentication of all access types:
•
•
•
•
dot1x
web-portal
MAC
last-resort
When the value is set to “0”, the user session is terminated after the session expires. If the value is set to “1”, the user
session is reauthenticated by sending a RADIUS request message after the session expires.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
646 Configuring communication with RADIUS
The command syntax is displayed below:
WSS# set usergroup groupname attr termination-action [0 | 1]
WSS# set user username attr termination-action [0 | 1]
Table 40. Dot1X Dynamic WEP Clients
Session Timeout (ST)
Configured (not 0)
Disconnect
0
Not set
Termination
Action (TA)
0
1
Disconnect after
dot1x timer
Disconnect after
dot1x timer
Reauthenticate
Reauthenticate
Immediate
reauthentication
after connecting
Reauthenticate
after dot1x timer
Not
set
Reauthenticate
after dot1x timer
Reauthenticate
after dot1x timer
Table 41. Non Dot1X and nondynamic WEP Dot1X Clients
Session Timeout (ST)
Configured (not 0)
Disconnect
0
Not set
Termination
Action (TA)
0
1
Never disconnect
Never disconnect
Reauthenticate
Immediate
reauthentication
after connecting
Never disconnect
Never disconnect
Not
set
Disconnect if non
Dot1X client.
Never disconnect
Reauthenticate if
Dot1X client.
MAC User range authentication
WLAN Management Software and MSS allows authentication of users based on the MAC address of a device. This
allows a set of MAC authenticated devices like VoIP phones to authenticate through a RADIUS server and through the
WSS local database without additional configuration.
WLAN Management Software allows input such as 00:11:00:* instead of the entire MAC address. Only one * (asterisk)
is allowed in the address format and it must be the last character.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring communication with RADIUS 647
During authentication of the MAC User client, the most specific entry that matches the MAC-user glob is selected.
Therefore, an entry for 00:11:30:21:ab:cd overrides an entry for 00:11:30:21:*, and an entry for 00:11:30:21:* overrides
an entry for 00:11:30:*.
Configuration
To configure a MAC User Range with MSS, follow these steps:
WSS# set mac-user 00:11:*
WSS# set mac-user 00:11:* attr value
WSS# set mac-user 00:11:* group groupname
To configure this for authentication on a RADIUS server, use the following command:
WSS# set authentication mac-prefix {ssid <name> | wired} mac-glob radius-server-group
The parameter mac-glob represents the range of MAC addresses and determines the prefix used for authentication.
During authentication, the MAC prefix is extracted from the MAC-glob and used as the user-name in the
Access-Request portion of the handshake.
MAC authentication request format
MAC Authentication request is an username and password format available in MSS for authentication through a
RADIUS server. It allows better interoperability with third-party vendors who may use different formats for MAC
address authentication.
Configuration
To configure a MAC address format, that is sent as a username to a RADIUS server for MAC authentication. To
configure the MAC address format with MSS, use the following command:
WSS# set radius server name mac-addr-format {hyphens | colons | one-hyphen | raw}
For example,
WSS# set radius server sp1 mac-addr-format
hyphens
colons
12-34-56-78-9a-bc
12:34:56:78:9a:bc
123456-789abc
123456789abc
one-hyphen
raw
You can also configure all RADIUS servers to use a specific MAC address format with the following command:
WSS# set radius mac-addr-format {hyphens | colons | one-hyphen | raw}
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
648 Configuring communication with RADIUS
Split authentication and authorization
It allows the RADIUS server to authenticate a user, but authorization attributes are taken from the WSS local user
database. This is accomplished by including a Vendor Specific Attribute (VSA) in the RADIUS Accept response. When
the WSS receives the RADIUS Accept response, the WSS uses the group name and attempts to match it to authorization
attributes of a corresponding user group in the local user database.
For the user-group name, specify a value consisting of a string 1-32 characters long. Additional values consist of the
following:
•
•
•
Type - 26
Vendor ID- 14525
Vendor Type - 9 (Nortel VSA)
Attributes that appear in the RADIUS Access Accept response are added to the session attributes. If the Access Accept
has a Nortel group-name VSA, the attributes from the corresponding user group in the local database are applied.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
649
Managing 802.1X on the WSS
Managing 802.1X on wired authentication ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . 649
Managing 802.1X encryption keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651
Setting EAP retransmission attempts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655
Managing 802.1X client reauthentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655
Managing other timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659
Displaying 802.1X information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662
Certain settings for IEEE 802.1X sessions on the WSS are enabled by default. For best results, change the settings only
if you are aware of a problem with the WSS’s 802.1X performance. For settings that you can reset with a clear
command, WSS Software reverts to the default value.
See “Managing WEP keys” on page 654 for information about changing the settings for Wired-Equivalent Privacy
protocol (WEP) key rotation (rekeying).
Caution! 802.1X parameter settings are global for all SSIDs configured on the switch.
Managing 802.1X on wired authentication ports
A wired authentication port is an Ethernet port that has 802.1X authentication enabled for access control. Like wireless
users, users that are connected to a WSS by Ethernet wire can be authenticated before they can be authorized to use the
network. One difference between a wired authenticated user and a wireless authenticated user is that data for wired users
is not encrypted after the users are authenticated.
By default, 802.1X authentication is enabled for wired authenticated ports, but you can disable it. You can also set the
port to unconditionally authorize, or unconditionally reject, all users.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
650 Managing 802.1X on the WSS
Enabling and disabling 802.1X globally
The following command globally enables or disables 802.1X authentication on all wired authentication ports on a WSS:
set dot1x authcontrol {enable | disable}
The default setting is enable, which permits 802.1X authentication to occur as determined by the set dot1X
port-control command for each wired authentication port. The disable setting forces all wired authentication ports to
unconditionally authorize all 802.1X authentication attempts by users with an EAP success message.
To reenable 802.1X authentication on wired authentication ports, type the following command:
WSS# set dot1x authcontrol enable
success: dot1x authcontrol enabled.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing 802.1X on the WSS 651
Setting 802.1X port control
The following command specifies the way a wired authentication port or group of ports handles user 802.1X
authentication attempts:
set dot1x port-control {forceauth | forceunauth | auto} port-list
The default setting is auto, which allows the WSS to process 802.1X authentication normally according to the
authentication configuration. Alternatively, you can set a wired authentication port or ports to either uncondi-
tionally authenticate or unconditionally reject all users.
For example, the following command forces port 19 to unconditionally authenticate all 802.1X authentication
attempts with an EAP success message:
WSS# set dot1x port-control forceauth 19
success: authcontrol for 19 is set to FORCE-AUTH.
Similarly, the following command forces port 12 to unconditionally reject any 802.1X attempts with an EAP
failure message:
WSS# set dot1x port-control forceunauth 12
success: authcontrol for 12 is set to FORCE-UNAUTH.
The set dot1x port-control command is overridden by the set dot1x authcontrol command. The clear dot1x
port-control command returns port control to the default auto value.
Type the following command to reset port control for all wired authentication ports:
WSS# clear dot1x port-control
success: change accepted.
Managing 802.1X encryption keys
By default, the WSS sends encryption key information to a wireless supplicant (client) in an Extensible
Authentication Protocol over LAN (EAPoL) packet after authentication is successful. You can disable this
feature or change the time interval for key transmission.
The secret Wired-Equivalent Privacy protocol (WEP) keys used by WSS Software on APs for broadcast
communication on a VLAN are automatically rotated (rekeyed) every 30 minutes to maintain secure packet
transmission. You can disable WEP key rotation for debugging purposes, or change the rotation interval.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
652 Managing 802.1X on the WSS
Enabling 802.1X key transmission
The following command enables or disables the transmission of key information to the supplicant (client) in EAPoL key
messages, after authentication:
set dot1x key-tx {enable | disable}
Key transmission is enabled by default.
The WSS sends EAPoL key messages after successfully authenticating the supplicant (client) and receiving authoriza-
tion attributes for the client. If the client is using dynamic WEP, the EAPoL Key messages are sent immediately after
authorization.
Type the following command to reenable key transmission:
WSS# set dot1x key-tx enable
success: dot1x key transmission enabled.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing 802.1X on the WSS 653
Configuring 802.1X key transmission time intervals
The following command sets the number of seconds the WSS waits before retransmitting an EAPoL packet of key
information:
set dot1x tx-period seconds
The default is 5 seconds. The range for the retransmission interval is from 1 to 65,535 seconds. For example, type the
following command to set the retransmission interval to 300 seconds:
WSS# set dot1x tx-period 300
success: dot1x tx-period set to 300.
Type the following command to reset the retransmission interval to the 5-second default:
WSS# clear dot1x tx-period
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
654 Managing 802.1X on the WSS
Managing WEP keys
Wired-Equivalent Privacy (WEP) is part of the system security of 802.1X. WSS Software uses WEP to
provide confidentiality to packets as they are sent over the air. WEP operates on the AP.
WEP uses a secret key shared between the communicators. WEP rekeying increases the security of the
network. New unicast keys are generated every time a client performs 802.1X authentication.
The rekeying process can be performed automatically on a periodic basis. By setting the Session-Timeout
RADIUS attribute, you make the reauthentication transparent to the client, who is unaware that reauthentica-
tion is occurring. A good value for Session-Timeout is 30 minutes.
WEP broadcast rekeying causes the broadcast and multicast keys for WEP to be rotated every WEP rekey
period for each radio to each connected VLAN. The WSS generates the new broadcast and multicast keys and
pushes the keys to the clients via EAPoL key messages. WEP keys are case-insensitive.
Use the set dot1x wep-rekey and the set dot1x wep-rekey-period commands to enable WEP key rotation and
configure the time interval for WEP key rotation.
Configuring 802.1X WEP rekeying
WEP rekeying is enabled by default on the WSS. Disable WEP rekeying only if you need to debug your
802.1X network.
Use the following command to disable WEP rekeying for broadcast and multicast keys:
WSS# set dot1x wep-rekey disable
success: wep rekeying disabled
Note. Reauthentication is not required for using this command. Broadcast and multicast
keys are always rotated at the same time, so all members of a given radio and VLAN
receive the new keys at the same time.
To reenable WEP rekeying, type the following command:
WSS# set dot1x wep-rekey enable
success: wep rekeying enabled
Configuring the interval for WEP rekeying
The following command sets the interval for rotating the WEP broadcast and multicast keys:
set dot1x wep-rekey-period seconds
The default is 1800 seconds (30 minutes). You can set the interval from 30 to 1,641,600 seconds (19 days).
For example, type the following command to set the WEP-rekey period to 900 seconds:
WSS# set dot1x wep-rekey-period 900
success: dot1x wep-rekey-period set to 900
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing 802.1X on the WSS 655
Setting EAP retransmission attempts
The following command sets the maximum number of times the WSS retransmits an 802.1X-encapsulated EAP request
to the supplicant (client) before it times out the authentication session:
set dot1x max-req number-of-retransmissions
The default number of retransmissions is 2. You can specify from 0 to 10 retransmit attempts. For example, type the
following command to set the maximum number of retransmission attempts to 3:
WSS# set dot1x max-req 3
success: dot1x max request set to 3.
To reset the number of retransmission attempts to the default setting, type the following command:
WSS# clear dot1x max-req
success: change accepted.
Note. To support SSIDs that have both 802.1X and static WEP clients, WSS Software
sends a maximum of two ID requests, even if this parameter is set to a higher value. Setting
the parameter to a higher value does affect all other types of EAP messages.
The amount of time WSS Software waits before it retransmits an 802.1X-encapsulated EAP request to the supplicant is
the same number of seconds as one of the following timeouts:
•
•
Supplicant timeout (configured by the set dot1x timeout supplicant command)
RADIUS session-timeout attribute
If both of these timeouts are set, WSS Software uses the shorter of the two. If the RADIUS session-timeout attribute is
not set, WSS Software uses the timeout specified by the set dot1x timeout supplicant command, by default 30 seconds.
Managing 802.1X client reauthentication
Reauthentication of 802.1X wireless supplicants (clients) is enabled on the WSS by default. By default, the WSS waits
3600 seconds (1 hour) between authentication attempts. You can disable reauthentication or change the defaults.
Note. You also can use the RADIUS session-timeout attribute to set the reauthentication
timeout for a specific client. In this case, WSS Software uses the timeout that has the lower
value. If the session-timeout is set to fewer seconds than the global reauthentication
timeout, WSS Software uses the session-timeout for the client. However, if the global
reauthentication timeout is shorter than the session-timeout, WSS Software uses the global
timeout instead.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
656 Managing 802.1X on the WSS
Enabling and disabling 802.1X reauthentication
The following command enables or disables the reauthentication of supplicants (clients) by the WSS:
set dot1x reauth {enable | disable}
Reauthentication is enabled by default.
Type the following command to reenable reauthentication of clients:
WSS# set dot1x reauth enable
success: dot1x reauthentication enabled.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing 802.1X on the WSS 657
Setting the maximum number of 802.1X reauthentication attempts
The following command sets the number of reauthentication attempts that the WSS makes before the suppli-
cant (client) becomes unauthorized:
set dot1x reauth-max number-of-attempts
The default number of reauthentication attempts is 2. You can specify from 1 to 10 attempts. For example,
type the following command to set the number of authentication attempts to 8:
WSS# set dot1x reauth-max 8
success: dot1x max reauth set to 8.
Type the following command to reset the maximum number of reauthorization attempts to the default:
WSS# clear dot1x reauth-max
success: change accepted.
Note. If the number of reauthentications for a wired authentication client is greater than
the maximum number of reauthentications allowed, WSS Software sends an EAP failure
packet to the client and removes the client from the network. However, WSS Software does
not remove a wireless client from the network under these circumstances.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
658 Managing 802.1X on the WSS
Setting the 802.1X reauthentication period
The following command configures the number of seconds that the WSS waits before attempting
reauthentication:
set dot1x reauth-period seconds
The default is 3600 seconds (1 hour). The range is from 60 to 1,641,600 seconds (19 days). This value can be
overridden by user authorization parameters.
WSS Software reauthenticates dynamic WEP clients based on the reauthentication timer. WSS Software also
reauthenticates WPA clients if the clients use the WEP-40 or WEP-104 cipher. For each dynamic WEP client
or WPA client using a WEP cipher, the reauthentication timer is set to the lesser of the global setting or the
value returned by the AAA server with the rest of the authorization attributes for that client.
For example, type the following command to set the number of seconds to 100 before reauthentication is
attempted:
WSS# set dot1x reauth-period 100
success: dot1x auth-server timeout set to 100.
Type the following command to reset the default timeout period:
WSS# clear dot1x reauth-period
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing 802.1X on the WSS 659
Setting the bonded authentication period
The following command sets the Bonded Authentication (bonded authentication) period, which is the number
of seconds WSS Software retains session information for an authenticated machine while waiting for the
802.1X client on the machine to start (re)authentication for the user.
Normally, the Bonded Authentication period needs to be set only if the network has Bonded Authentication
clients that use dynamic WEP, or use WEP-40 or WEP-104 encryption with WPA or RSN. These clients can
be affected by the 802.1X reauthentication parameter or the RADIUS Session-Timeout parameter.
To set the Bonded Authentication period, use the following command:
set dot1x bonded-period seconds
The Bonded Authentication period applies only to 802.1X authentication rules that contain the bonded option.
To reset the Bonded Authentication period to its default value, use the following command:
clear dot1x max-req
(For more information about Bonded Authentication, see “Binding user authentication to machine authentica-
Managing other timers
By default, the WSS waits 60 seconds before responding to a client whose authentication failed, and times out
a request to a RADIUS server or an authentication session with a client after 30 seconds. You can modify
these defaults.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
660 Managing 802.1X on the WSS
Setting the 802.1X quiet period
The following command configures the number of seconds a WSS remains quiet and does not respond to a supplicant
(client) after a failed authentication:
set dot1x quiet-period seconds
The default is 60 seconds. The acceptable range is from 0 to 65,535 seconds.
For example, type the following command to set the quiet period to 300 seconds:
WSS# set dot1x quiet-period 300
success: dot1x quiet period set to 300.
Type the following command to reset the 802.1X quiet period to the default:
WSS# clear dot1x quiet-period
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing 802.1X on the WSS 661
Setting the 802.1X timeout for an authorization server
Use this command to configure the number of seconds before the WSS times out a request to a RADIUS
authorization server.
set dot1x timeout auth-server seconds
The default is 30 seconds. The range is from 1 to 65,535 seconds.
For example, type the following command to set the authorization server timeout to 60 seconds:
WSS# set dot1x timeout auth-server 60
success: dot1x auth-server timeout set to 60.
To reset the authorization server timeout to the default, type the following command:
WSS# clear dot1x timeout auth-server
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
662 Managing 802.1X on the WSS
Setting the 802.1X timeout for a client
Use the following command to set the number of seconds before the WSS times out an authentication session with a
supplicant (client):
set dot1x timeout supplicant seconds
The default is 30 seconds. The range of time is from 1 to 65,535 seconds.
For example, type the following command to set the number of seconds for a timeout to 300:
WSS# set dot1x timeout supplicant 300
success: dot1x supplicant timeout set to 300.
Type the following command to reset the timeout period:
WSS# clear dot1x timeout supplicant
success: change accepted.
Displaying 802.1X information
This command displays 802.1X information for clients, statistics, VLANs, and configuration.
show dot1x {clients | stats | config}
•
•
•
show dot1x clients displays the username, MAC address, VLAN, and state of active 802.1X clients.
show dot1x config displays a summary of the current configuration.
show dot1x stats displays global 802.1X statistical information associated with connecting and authenticating.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing 802.1X on the WSS 663
Viewing 802.1X clients
Type the following command to display active 802.1X clients:
WSS# show dot1x clients
MAC Address
State
-------
Vlan
Identity
----------
-------------------
------------
00:20:a6:48:01:1f
00:05:3c:07:6d:7c
00:05:5d:7e:94:83
00:02:2d:86:bd:38
00:05:5d:7e:97:b4
00:05:5d:7e:98:1a
00:0b:be:a9:dc:4e
00:05:5d:7e:96:e3
00:02:2d:6f:44:77
00:05:5d:7e:94:89
00:06:80:00:5c:02
00:02:2d:6a:de:f2
00:02:2d:5e:5b:76
00:02:2d:80:b6:e1
00:30:65:16:8d:69
00:02:2d:64:8e:1b
Connecting
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
Authenticated
(unknown)
vlan-it
EXAMPLE\smith
vlan-eng
vlan-eng
vlan-eng
vlan-eng
vlan-pm
vlan-eng
vlan-eng
vlan-eng
vlan-eng
vlan-pm
vlan-pm
vlan-cs
EXAMPLE\jgarcia
wong@exmpl.com
EXAMPLE\hosni
EXAMPLE\tsmith
havel@NRTL.com
EXAMPLE\geetha
EXAMPLE\tamara
EXAMPLE\nwong
EXAMPLE\hhabib
smith@exmpl.com
EXAMPLE\natasha
jjg@exmpl.com
vlan-wep
vlan-eng
MAC authenticated
EXAMPLE\jose
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
664 Managing 802.1X on the WSS
Viewing the 802.1X configuration
Type the following command to display the 802.1X configuration:
WSS# show dot1x config
802.1X user policy
----------------------
'EXAMPLE\pc1' on ssid 'mycorp' doing EAP-PEAP (EAP-MSCHAPv2)
'EXAMPLE\bob' on ssid 'mycorp' doing EAP-PEAP (EAP-MSCHAPv2) (bonded)
802.1X parameter
----------------
supplicant timeout
auth-server timeout
quiet period
setting
-------
30
30
5
transmit period
5
reauthentication period
maximum requests
key transmission
reauthentication
authentication control
WEP rekey period
WEP rekey
3600
2
enabled
enabled
enabled
1800
enabled
60
Bonded period
port 5, authcontrol: auto, max-sessions: 16
port 6, authcontrol: auto, max-sessions: 1
port 7, authcontrol: auto, max-sessions: 1
port 8, authcontrol: auto, max-sessions: 1
port 9, authcontrol: auto, max-sessions: 1
port 10, authcontrol: auto, max-sessions: 1
port 11, authcontrol: auto, max-sessions: 1
port 12, authcontrol: auto, max-sessions: 1
port 13, authcontrol: auto, max-sessions: 1
port 14, authcontrol: auto, max-sessions: 1
port 15, authcontrol: auto, max-sessions: 1
port 16, authcontrol: auto, max-sessions: 1
port 22, authcontrol: auto, max-sessions: 16
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing 802.1X on the WSS 665
Viewing 802.1X statistics
Type the following command to display 802.1X statistics about connecting and authenticating:
WSS# show dot1x stats
802.1X statistic
----------------
Enters Connecting:
Logoffs While Connecting:
Enters Authenticating:
Success While Authenticating:
Timeouts While Authenticating:
Failures While Authenticating:
Reauths While Authenticating:
Starts While Authenticating:
Logoffs While Authenticating:
Starts While Authenticated:
Logoffs While Authenticated:
Bad Packets Received:
value
-------
709
112
467
0
52
0
0
31
0
85
1
0
For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
666 Managing 802.1X on the WSS
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
667
Configuring SODA endpoint security
for a WSS
About SODA endpoint security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
Configuring SODA functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670
Sygate On-Demand (SODA) is an endpoint security solution that allows enterprises to enforce security policies on client
devices without having to install any special software on the client machines. WSS Software can be configured to run
SODA security checks on users’ machines as a requirement for gaining access to the network.
About SODA endpoint security
The SODA endpoint security solution consists of six modules that provide on-demand security:
•
Virtual Desktop – Protects confidential data by virtualizing the desktop, applications, file-system, registry,
printing, removable media, and copy/paste functions. All data is encrypted on-the-fly and can optionally be erased
upon session termination. The virtual desktop is isolated from the normal desktop, protecting the session from
previous infection.
•
Host Integrity – Tests the security of the desktop to determine how much access to network resources the device
should be granted. Host integrity checks include:
●
●
●
●
Ensuring that an anti-virus product is running with up-to-date virus definitions
Ensuring that a personal firewall is active
Checking that service pack levels are met
Ensuring that critical patches are installed.
Custom checks can be implemented based on the existence of specific registry keys/values, applications,
files, or operating system platforms. Network access can also be prevented based on the existence of
specific processes.
•
•
Malicious Code Protection – Detects and blocks keystroke loggers that capture usernames and passwords, Trojans
that create back-door user accounts, and Screen Scrapers that spy on user activity.
The Malicious Code module integrates a Virtual Keyboard function that requires users to input
confidential information such as passwords using the Virtual Keyboard when accessing specific Web
sites, to protect against hardware keystroke loggers. This module uses a combination of signatures for
known exploits and behavioral detection to protect against unknown threats.
Cache Cleaner – Ensures that Web browser information, such as cookies, history, auto-completion data, stored
passwords, and temporary files are erased or removed upon termination of the user’s session, inactivity timeout, or
closing of the browser.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
668 Configuring SODA endpoint security for a WSS
•
•
Connection Control – Controls network connections based on Domain, IP address, Port, and Service. For example,
Connection Control can prevent a Trojan from sending out a confidential document, downloaded legitimately
through an SSL VPN tunnel, to a malicious e-mail server (SMTP) using a second network tunnel.
Adaptive Policies – Sense the type and location of device and adjusts access based on endpoint parameters such as
IP range, registry keys, and DNS settings
The SODA endpoint security modules are configured through Sygate On-Demand Manager (SODA Manager), a
Windows application. SODA Manager is used to create a SODA agent, which is a Java applet that is downloaded by
client devices when they attempt to gain access to the network. Once downloaded, the SODA agent runs a series of
security checks to enforce endpoint security on the client device.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SODA endpoint security for a WSS 669
SODA endpoint security support on WSSs
WSSs support SODA endpoint security functionality in the following ways:
•
SODA agent applets can be uploaded to a WSS, stored there, and downloaded by clients attempting to connect to
the network.
•
The WSS can ensure that clients run the SODA agent security checks successfully prior to allowing them access to
the network.
•
•
Different sets of security checks can be downloaded and run, based on the SSID being used by the client.
If the security checks fail, the WSS can deny the client access to the network, or grant the client limited access
based on a configured security ACL.
•
When the client closes the Virtual Desktop, the WSS can optionally disconnect the client from the network.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
670 Configuring SODA endpoint security for a WSS
How SODA functionality works on WSSs
This section describes how the SODA functionality is configured to work with a WSS, and the procedure that takes
place when a user attempts to connect to an SSID where the SODA functionality is enabled.
Note that in the current release, the SODA functionality works only in conjunction with the Web Portal Web-based AAA
feature.
SODA functionality on a WSS is configured as follows:
1
2
Using SODA Manager, a network administrator creates a SODA agent based on the security needs of the
network.
The network administrator exports the SODA agent files from SODA Manager, and saves them as a .zip
file.
3
4
The SODA agent .zip file is uploaded to the WSS using TFTP.
The SODA agent files are installed on the WSS using a CLI command that extracts the files from the .zip
file and places them into a specified directory.
5
SODA functionality is enabled for an SSID that also has Web Portal Web-based AAA configured.
Once configured, SODA functionality works as follows:
1
2
A user connects to an AP managed by a service profile where SODA functionality is enabled.
Since the Web Portal Web-based AAA feature is enabled for the SSID, a portal session is started for the
user, and the user is placed in the VLAN associated with the web-portal-ssid or web-portal-wired user.
3
The user opens a browser window and is redirected to a login page, where he or she enters a username
and password.
4
5
The user is redirected to a page called index.html, which exists in the SODA agent directory on the WSS.
The redirection to the index.html page causes the SODA agent files to be downloaded to the user’s
computer.
6
Once the SODA agent files have been downloaded, one of the following can take place:
a
If the WSS is configured to enforce the SODA agent security checks (the default), then the SODA
agent checks are run on the user’s computer. If the user’s computer passes the checks, then a
customizable success page is loaded in the browser window. The user is then moved from the portal
VLAN to his or her configured VLAN and granted access to the network.
b
c
If the WSS is configured not to enforce the SODA agent security checks, then the user is moved
from the portal VLAN to his or her configured VLAN and granted access to the network, without
waiting for the SODA agent checks to be completed.
If the user’s computer fails one of the SODA agent checks, then a customizable failure page is
loaded in the browser window. The user is then disconnected from the network, or can optionally be
granted limited network access, based on a specified security ACL.
7
At the completion of his or her session, the user can close the SODA Virtual Desktop or point to an
advertised logout URL. Either of these actions cause a customizable logout page to be loaded in the
browser window. Accessing the logout page causes the user to be disconnected from the network.
Configuring SODA functionality
Configuring SODA functionality on a WSS consists of the following tasks:
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SODA endpoint security for a WSS 671
1
2
Configure Web Portal Web-based AAA for the service profile. See “Configuring Web Portal Web-based
Using SODA manager, create the SODA agent. See “Creating the SODA agent with SODA manager” on
3
4
Copy the SODA agent to the WSS. “Copying the SODA agent to the WSS” on page 674
Install the SODA agent files in a directory on the WSS. See “Installing the SODA agent files on the
5
6
7
8
9
Enable SODA functionality for the service profile. See “Enabling SODA functionality for the service
Specify whether to require clients to pass SODA agent checks to gain access to the network (optional).
Specify a page for a client to load when the SODA agent checks run successfully (optional). See
Specify a page for a client to load when the SODA agent checks fail (optional). See “Specifying a SODA
Specify an ACL to apply to a client when it fails the SODA agent checks (optional) See “Specifying a
10 Specify a page for a client to load when logging out of the network (optional). See “Specifying a SODA
11 Specify an alternate name for the directory where the SODA agent files for a service profile are located
12 Remove the SODA agent files from the WSS (optional). See “Uninstalling the SODA agent files from the
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
672 Configuring SODA endpoint security for a WSS
Configuring Web Portal Web-based AAA for the service profile
In the current release, SODA functionality works in conjunction with the Web Portal AAA feature. Consequently, Web
Portal AAA must be enabled for the service profile for which you want to configure SODA functionality.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SODA endpoint security for a WSS 673
Creating the SODA agent with SODA manager
Sygate On-Demand Manager (SODA Manager) is a Windows application used for configuring security policies based
on locations, and for creating agents that enforce those security policies. For information on how to use SODA Manager
to create security policies, see the documentation that came with the product.
You can use SODA Manager to create a SODA agent, configuring the level of security desired according to the require-
ments of your network. When a SODA agent is created (by pressing the Apply button in SODA Manager), a
subdirectory called On-DemandAgent is created in the C:\Program Files\Sygate\Sygate On-Demand directory.
You place the contents of the On-DemandAgent directory into a .zip file (for example, soda.ZIP) and copy the file to the
Note the following when creating the SODA agent in SODA Manager:
•
The failure.html and success.html pages, when specified as success or failure URLs in SODA Manager, must be of
the format:
https://hostname/soda/ssid/xxx.html
where xxx refers to the name of the HTML file being accessed.
•
The success and failure URLs configured in SODA Manager are required to have two keywords in them: /soda/ and
success.html or failure.html. The
/soda/ keyword must immediately follow the hostname. The hostname must match the Common Name specified in
the Web-based AAA certificate.
•
•
The logout page is required to have /logout.html in the URL.
The hostname of the logout page should be set to a name that resolves to the WSS’s IP address on the VLAN where
the client resides, or should be the IP address of the WSS on the Web Portal Web-based AAA VLAN; for example:
https://10.1.1.1/logout.html
The logout page should not point to a certificate hostname that is unreachable from the client’s VLAN,
nor should it point to an IP address that is on a different VLAN, which causes the source MAC address to
be changed to the default router’s (gateway’s) MAC address. The WSS uses the client’s source MAC
address and source IP address combination to make sure the client is permitted to log itself out.
If the source IP address is on a different VLAN, then the source MAC address does not match with the
session’s MAC address, and the logout procedure fails.
•
•
Following the hostname, the URL of the logout page must exactly match logout.html. You cannot specify any other
subdirectories in the URL.
Do not use the Partner Integration button in SODA Manager to create agent files.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
674 Configuring SODA endpoint security for a WSS
Copying the SODA agent to the WSS
After creating the SODA agent with SODA manager, you copy the .zip file to the WSS using TFTP.
For example, the following command copies the soda.ZIP file from a TFTP server to the WSS:
WSS# copy tftp://172.21.12.247/soda.ZIP soda.ZIP
....................................success: received 2912917 bytes in
11.230 seconds [ 259387 bytes/sec]
success: copy complete.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SODA endpoint security for a WSS 675
Installing the SODA agent files on the WSS
After copying the .zip file containing the SODA agent files to the WSS, you install the SODA agent files into a directory
using the following command:
install soda agent agent-file agent-directory directory
This command creates the specified directory, unzips the specified agent-file and places the contents of the file into the
directory. If the directory has the same name as an SSID, then that SSID uses the SODA agent files in the directory if
SODA functionality is enabled for the service profile that manages the SSID.
For example, the following command installs the contents of the file soda.ZIP into a directory called sp1.
WSS# install soda agent soda.ZIP agent-directory sp1
This command may take up to 20 seconds...
WSS#
If SODA functionality is enabled for the service profile that manages SSID sp1, then SODA agent files in this directory
are downloaded to clients attempting to connect to SSID sp1.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
676 Configuring SODA endpoint security for a WSS
Enabling SODA functionality for the service profile
To enable SODA functionality for a service profile, use the following command:
set service-profile name soda mode {enable | disable}
When SODA functionality is enabled for a service profile, a SODA agent is downloaded to clients attempting to connect
to an AP managed by the service profile. The SODA agent performs a series of security-related checks on the client. By
default, enforcement of SODA agent checks is enabled, so that a connecting client must pass the SODA agent checks in
order to gain access to the network.
For example, the following command enables SODA functionality for service profile sp1:
WSS# set service-profile sp1 soda mode enable
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SODA endpoint security for a WSS 677
Disabling enforcement of SODA agent checks
When SODA functionality is enabled for a service profile, by default the SODA agent checks are downloaded to a client
and run before the client is allowed on the network. You can optionally disable the enforcement of the SODA security
checks, so that the client is allowed access to the network immediately after the SODA agent is downloaded, rather than
waiting for the security checks to be run.
To disable (or re-enable) the enforcement of the SODA security checks, use the following command:
set service-profile name enforce-checks {enable | disable}
For example, the following command disables the enforcement of the SODA security checks, allowing network access
to clients after they have downloaded the SODA agent, but without requiring that the SODA agent checks be completed:
WSS# set service-profile sp1 enforce-checks disable
success: change accepted.
Note that if you disable the enforcement of the SODA security checks, you cannot apply the success and failure URLs to
client devices. In addition, you should not configure the SODA agent to refer to the success and failure pages on the
WSS if you have disabled enforcement of SODA agent checks.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
678 Configuring SODA endpoint security for a WSS
Specifying a SODA agent success page
When a client successfully runs the checks performed by the SODA agent, by default a dynamically generated page is
displayed on the client indicating that the checks succeeded. You can optionally create a custom success page that is
displayed on the client instead of the dynamically generated one.
To specify a page that is loaded when a client passes the security checks performed by the SODA agent, use the
following command:
set service-profile name soda success-page page
To reset the success page to the default value, use the following command:
clear service-profile name soda success-page
The page refers to a file on the WSS. After this page is loaded, the client is placed in its assigned VLAN and granted
access to the network.
For example, the following command specifies success.html, which is a file in the root directory on the WSS, as the page
to load when a client passes the SODA agent checks:
WSS# set service-profile sp1 soda success-page success.html
success: change accepted.
The following command specifies success.html, in the soda-files directory on the WSS, as the page to load when a client
passes the SODA agent checks:
WSS# set service-profile sp1 soda success-page soda-files/success.html
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SODA endpoint security for a WSS 679
Specifying a SODA agent failure page
When the SODA agent checks fail, by default a dynamically generated page is displayed on the client indicating that the
checks failed. You can optionally create a custom failure page that is displayed on the client instead of the dynamically
generated one.
To specify a page that is loaded when a client fails the security checks performed by the SODA agent, use the following
command:
set service-profile name soda failure-page page
To reset the failure page to the default value, use the following command:
clear service-profile name soda failure-page
The page refers to a file on the WSS. After this page is loaded, the specified remediation ACL takes effect, or if there is
no remediation ACL configured, then the client is disconnected from the network.
For example, the following command specifies failure.html, which is a file in the root directory on the WSS, as the page
to load when a client fails the SODA agent checks:
WSS# set service-profile sp1 soda failure-page failure.html
success: change accepted.
The following command specifies failure.html, in the soda-files directory on the WSS, as the page to load when a client
fails the SODA agent checks:
WSS# set service-profile sp1 soda failure-page soda-files/failure.html
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
680 Configuring SODA endpoint security for a WSS
Specifying a remediation ACL
If the SODA agent checks fail on a client, by default the client is disconnected from the network. Optionally, you can
specify a failure page for the client to load (with the set service-profile soda failure-page command, described above).
You can optionally specify a remediation ACL to apply to the client when the failure page is loaded. The remediation
ACL can be used to grant the client limited access to network resources, for example.
To specify a remediation ACL to be applied to a client if it fails the checks performed by the SODA agent, use the
following command:
set service-profile name soda remediation-acl acl-name
To disable use of the remediation ACL for the service profile, use the following command:
clear service-profile name soda remediation-acl
The acl-name refers to an existing security ACL. If there is no remediation ACL configured for the service profile, then
the client is disconnected from the network when the failure page is loaded.
If configured, a remediation ACL is applied to a client when the client loads the failure page. A client loads the failure
page only if the service profile is set to enforce SODA agent checks, and the client fails the SODA agent checks. Conse-
quently, in order to apply a remediation ACL to a client, you must make sure the service profile is set to enforce SODA
agent checks.
For example, the following command configures the WSS to apply acl-1 to a client when it loads the failure page:
WSS# set service-profile sp1 soda remediation-acl acl-1
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SODA endpoint security for a WSS 681
Specifying a SODA agent logout page
When a client closes the SODA virtual desktop, the client is automatically disconnected from the network. You can
optionally specify a page that is loaded when the client logs out of the network. To do this, use the following command:
set service-profile name soda logout-page page
To reset the logout page to the default value, use the following command:
clear service-profile name soda logout-page
The page refers to a file on the WSS.
You must also enable the HTTPS server on the WSS, so that clients can log out of the network and access the logout
page using HTTPS. To do this, use the following command:
set ip https server enable
The client can request the logout page at any time, to ensure that the client’s session has been terminated. You can add
the IP address of the WSS to the DNS server as a well-known name, and you can advertise the URL of the page to users
as a logout page.
For example, the following command specifies logout.html, which is a file in the root directory on the WSS, as the page
to load when a client closes the SODA virtual desktop:
WSS# set service-profile sp1 soda logout-page logout.html
success: change accepted.
The following command specifies logout.html, in the soda-files directory on the WSS, as the page to load when a client
closes the SODA virtual desktop:
WSS# set service-profile sp1 soda logout-page soda-files/logout.html
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
682 Configuring SODA endpoint security for a WSS
Specifying an alternate SODA agent directory for a service profile
By default, the WSS expects SODA agent files for a service profile to be located in a directory with the same name as
the SSID configured for the service profile. You can optionally specify a different directory for the SODA agent files
used for a service profile. To do this, use the following command:
set service-profile name soda agent-directory directory
To reset the SODA agent directory to the default value, use the following command:
clear service-profile name soda agent-directory
If the same SODA agent is used for multiple service profiles, you can specify a single directory for SODA agent files on
the WSS, rather than placing the same SODA agent files in a separate directory for each service profile.
For example, the following command specifies soda-agent as the location for SODA agent files for service profile sp1:
WSS# set service-profile sp1 soda agent-directory soda-agent
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Configuring SODA endpoint security for a WSS 683
Uninstalling the SODA agent files from the WSS
To remove the directory on the WSS that contains SODA agent files, use the following command:
uninstall soda agent agent-directory directory
This command removes the SODA agent directory and all of its contents. All files in the specified directory are
removed. The command removes the directory and its contents, regardless of whether it contains SODA agent files.
For example, the following command removes the directory sp1 and all of its contents:
WSS# uninstall soda agent agent-directory sp1
This will delete all files in agent-directory, do you wish to continue? (y|n) [n]y
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
684 Configuring SODA endpoint security for a WSS
Displaying SODA configuration information
To view information about the SODA configuration for a service profile, use the show service profile command.
The following is an example of the output of the show service profile command for service profile sp1. In the example,
the fields related to SODA functionality are highlighted in bold.
WSS# show service-profile sp1
ssid-name:
corp2
yes
no
ssid-type:
crypto
no
Beacon:
Proxy ARP:
DHCP restrict:
Short retry limit:
Auth fallthru:
Enforce SODA checks:
No broadcast:
Long retry limit:
no
5
5
yes
none
Sygate On-Demand (SODA):
SODA remediation ACL:
Custom failure web-page:
Custom agent-directory:
COS:
yes
Custom success web-page:
Custom logout web-page:
Static COS:
CAC mode:
no
0
5
none
180
no
CAC sessions:
14
yes
User idle timeout:
Keep initial vlan:
Web Portal ACL:
WEP Key 1 value:
WEP Key 3 value:
WEP Unicast Index:
Shared Key Auth:
WPA enabled:
Idle client probing:
Web Portal Session Timeout:
<none>
<none>
1
WEP Key 2 value:
WEP Key 4 value:
WEP Multicast Index:
<none>
<none>
1
NO
ciphers: cipher-tkip
authentication: 802.1X
TKIP countermeasures time: 60000ms
vlan-name =
session-timeout =
service-type =
11a beacon rate:
11a mandatory rate:
11b beacon rate:
11b mandatory rate:
11g beacon rate:
11g mandatory rate:
orange
300
2
6.0
multicast rate:
standard rates:
multicast rate:
standard rates:
multicast rate:
standard rates:
AUTO
6.0,12.0,24.0
9.0,18.0,36.0,48.0,54.0
2.0
AUTO
1.0,2.0
5.5,11.0
2.0
AUTO
1.0,2.0,5.5,11.0
6.0,9.0,12.0,18.0,24.0, 36.0,48.0,54.0
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
685
Managing sessions
About the session manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685
Displaying and clearing administrative sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685
Displaying and clearing network sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689
Displaying and changing network session timers . . . . . . . . . . . . . . . . . . . . . . . . . . . 696
About the session manager
A session is a related set of communication transactions between an authenticated user (client) and the specific station to
which the client is bound. Packets are exchanged during a session. A WSS supports the following kinds of sessions:
•
•
Administrative sessions—A network administrator managing the WSS
Network sessions—A network user exchanging traffic with a network through the WSS
The WSS session manager manages the sessions for each client, but does not examine the substance of the traffic.
Clearing (ending) a session deauthenticates the administrator or user from the session and disassociates wireless clients.
Displaying and clearing administrative sessions
To display session information and statistics for a user with administrative access to the WSS, use the following
command:
show sessions {admin | console | telnet [client]}
You can view all administrative sessions, or only the sessions of administrators with access to the WSS through a Telnet
or SSH connection or the console port. You can also display information about administrative Telnet sessions from
remote clients.
To clear administrative sessions, use the following command:
clear sessions {admin | console | telnet [client [session-id]]}
Caution! Clearing administrative sessions might cause your session to be cleared.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
686 Managing sessions
Displaying and clearing all administrative sessions
To view information about the sessions of all administrative users, type the following command:
WSS# show sessions admin
Tty
Username
Time (s)
------------
3644
Type
------- --------------
tty0
---------------
Console
Telnet
tty2
tty3
tech
sshadmin
6
381
SSH
3 admin sessions
To clear the sessions of all administrative users, type the following command:
WSS# clear sessions admin
This will terminate manager sessions, do you wish to continue? (y|n) [n]y
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing sessions 687
Displaying and clearing an administrative console session
To view information about the user with administrative access to the WSS through a console plugged into the switch,
type the following command:
WSS# show sessions console
Tty
Username
Time (s) Type
---------- --------
------- --------------
tty0
5310
Console
1 console session
To clear the administrative sessions of a console user, type the following command:
WSS# clear sessions console
This will terminate manager sessions, do you wish to continue? (y|n) [y]y
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
688 Managing sessions
Displaying and clearing administrative Telnet sessions
To view information about administrative Telnet sessions, type the following command:
WSS# show sessions telnet
Tty
------- -------------------- -------- ----
tty3 sshadmin 2099 SSH
Username
Time (s) Type
1 telnet session
To clear the administrative sessions of Telnet users, type the following command:
WSS# clear sessions telnet
This will terminate manager sessions, do you wish to continue? (y|n) [y]y
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing sessions 689
Displaying and clearing client Telnet sessions
To view administrative sessions of Telnet clients, type the following command:
WSS# show sessions telnet client
Session Server Address
Server Port Client Port
-------
-------------------
192.168.1.81
10.10.1.22
------------
23
-----------
48000
0
1
23
48001
To clear the administrative sessions of Telnet clients, use the following command:
clear sessions telnet [client [session-id]]
You can clear all Telnet client sessions or a particular session. For example, the following command clears Telnet client
session 1:
WSS# clear sessions telnet client 1
Displaying and clearing network sessions
Use the following command to display information about network sessions:
show sessions network [user user-wildcard | mac-addr mac-addr-wildcard | ssid ssid-name | vlan
vlan-wildcard | session-id session-id | wired] [verbose]
In most cases, you can display both summary and detailed (verbose) information for a session. For example, the
following command displays summary information about all current network sessions:
WSS# show sessions network
User Name
-----------------------
EXAMPLE
Sess IP or MAC ID Address
-------------------------------------
5* 192.168.12.100
VLAN Name
-----------------
vlan-eng
Port/Radio
---------------
3/1
1/1
3/1
1/2
1/1
jose@example.com
00:30:65:16:8d:69
761
5125* 192.168.12.141
4385* 192.168.19.199
00:0b:be:15:46:56
vlan-eng
vlan-wep
(none)
763
00:02:2d:02:10:f5
(none)
5 sessions total
An asterisk (*) in the Sess ID field indicates a session that is fully active. (For more information about the fields in the
output, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.)
(For information about getting detailed output, see “Displaying verbose network session information” on page 691.)
You can display and clear network sessions in the following ways:
•
•
•
By the MAC address of the user. (See “Displaying and clearing network sessions by MAC address” on page 693.)
By the name of the VLAN to which the user belongs. (See “Displaying and clearing network sessions by VLAN
•
By the local session ID. (See “Displaying and clearing network sessions by session ID” on page 695.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
690 Managing sessions
Note. Authorization attribute values can be changed during authorization. If the values
are changed, show sessions output shows the values that are actually in effect following
any changes.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing sessions 691
Displaying verbose network session information
In the show sessions network commands, you can specify verbose to get more in-depth information.
For example, to display detailed information for all network sessions, type the following command:
WSS# show sessions network verbose
User Name
Sess IP or MAC ID Address
-------------------------------------
5* 192.168.12.100
VLAN Name
-----------------
vlan-eng
Port/Radio
---------------
3/1
-----------------------
EXAMPLE\wrong
Client MAC: 00:02:2c:64:8e:1b
GID:
SESS-5-000430-835541-bab048c4
ACTIVE (prev AUTHORIZED)
WSS 192.168.12.7, port 10, AP/radio 0422900147/1, as of 02:43:03 ago
State:
now on:
jose@example.com
5125* 192.168.12.14
vlan-eng
1/1
Client MAC:
GID:
00:01:2e:6e:ab:a5
SESS-5125-000430-843069-2b7d0
ACTIVE
State:
(prev AUTHORIZED)
now on:
WSS 192.168.12.7, port 1, AP/radio 0422900147/1, as of 00:37:35 ago
00:30:65:16:8d:69
4385* 192.168.19.199
vlan-wep
3/1
Client MAC:
GID:
00:10:65:16:8d:69
SESS-4385-000430-842879-bf7a7
ACTIVE
State:
(prev AUTHORIZED)
now on:
WSS 192.168.12.7, port 3, AP/radio 0222900129/1, as of 00:40:45 ago
761
00:0b:be:15:46:56
00:0e:be:15:46:56
SESS-761-000430-845313-671851
AUTH AND ASSOC (prev AUTH,ASSOC REQ)
WSS 192.168.12.7, port 1, AP/radio 0422900147/2, as of 00:00:11 ago
(none)
1/2
Client MAC:
GID:
State:
now on:
User Name
-----------------------
Sess IP or MAC ID Address
-------------------------------------
VLAN Name
-----------------
Port/Radio
---------------
763
00:02:2d:02:10:f5
00:02:0d:02:10:f5
(none)
1/1
Client MAC:
GID:
SESS-763-000430-845317-fb2c2d
State:
now on:
AUTH AND ASSOC
WSS 192.168.12.7, port 1, AP/radio 0422900147/1, as of 00:00:07 ago
(prev AUTH,ASSOC REQ)
5 sessions total
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
692 Managing sessions
Displaying and clearing network sessions by username
You can view sessions by a username or user wildcard. (For a definition of user wildcards and their format, see “User
To see all sessions for a specific user or for a group of users, type the following command:
show sessions network user user-wildcard
For example, the following command shows all sessions of users whose names begin with E:
WSS# show sessions network user E*
User Name
Sess IP or MAC ID Address
VLAN Name
-----------------
Port/Radio
-----------------------
EXAMPLE\singh
EXAMPLE\havel
-------------------------------------
12* 192.168.12.185
---------------
vlan-eng
vlan-eng
3/2
1/2
13* 192.168.12.104
2 sessions match criteria (of 3 total)
Use the verbose keyword to see more information. For example, the following command displays detailed session infor-
mation about nin@example.com:
WSS# show sessions network user nin@example.com verbose
User Name
-----------------------
nin@example.com
Client MAC:
GID:
Sess IP or MAC ID Address
-------------------------------------
5* 192.168.12.141
VLAN Name
-----------------
Port/Radio
---------------
vlan-eng
1/1
00:02:2d:6e:ab:a5
SESS-5-000430-686792-d8b3c564
State:
ACTIVE
(prev AUTHORIZED)
now on:
192.168.12.7, port 1, AP/radio 0422900147/1, as of 00:23:32 ago
1 sessions match criteria (of 10 total)
To clear all the network sessions of a user or group of users, use the following command:
clear sessions network user user-wildcard
For example, the following command clears the sessions of users named Bob:
WSS# clear sessions network user Bob*
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing sessions 693
Displaying and clearing network sessions by MAC address
You can view sessions by MAC address or MAC address wildcard. (For a definition of MAC address wildcards and
their format, see “MAC address wildcards” on page 47.) To view session information for a MAC address or set of MAC
addresses, type the following command:
show sessions network mac-addr mac-addr-wildcard
For example, the following command displays the sessions for MAC address 01:05:5d:7e:98:1a:
WSS# show sessions net mac-addr 01:05:5d:7e:98:1a
User
Name
Sess IP or MAC
ID Address
VLAN
Name
Port/
Radio
--------------------------- ---- --------------- ------------- -----
EXAMPLE\havel 13* 192.168.12.104 vlan-eng
1/2
To clear all the network sessions for a MAC address or set of MAC addresses, use the following command:
clear sessions network mac-addr mac-addr-wildcard
For example, to clear all sessions for MAC address 00:01:02:04:05:06, type the following command:
WSS# clear sessions network mac-addr 00:01:02:04:05:06
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
694 Managing sessions
Displaying and clearing network sessions by VLAN name
You can view all session information for a specific VLAN or VLAN wildcard. (For a definition of VLAN wildcards and
To see all network sessions information for a VLAN or set of VLANs, type the following command:
show sessions network vlan vlan-wildcard
For example, the following command displays the sessions for VLAN west:
WSS# show sessions network vlan west
User Name
-----------------------
EXAMPLE\tamara
Sess IP or MAC ID Address
-------------------------------------
8* 192.168.12.174
VLAN Name
Port/Radio
---------------
-----------------
west
1/1
2/1
1/2
1/2
3/2
host/laptop.example.com
EXAMPLE\havel
EXAMPLE\jose
11* 192.168.12.164
17* 192.168.12.195
20* 192.168.12.171
21* 192.168.12.169
west
west
west
EXAMPLE\geetha
west
To clear the sessions on a VLAN or set of VLANs, use the following command:
clear sessions network vlan vlan-wildcard
For example, the following command clears the sessions of all users on VLAN red:
WSS# clear sessions network vlan red
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing sessions 695
Displaying and clearing network sessions by session ID
You can display information about a session by session ID. To find local session IDs, enter the show sessions command.
You can view more detailed information for an individual session, including authorization parameters and, for wireless
sessions, packet and radio statistics.
For example, to display information about session 27, type the following command:
WSS# show sessions network session-id 88
Local Id: 88
Global Id: SESS-88-00040f-876766-623fd6
State:
SSID:
ACTIVE
Rack-39-PM
Port/Radio: 10/1
MAC Address: 00:0f:66:f4:71:6d
User Name: last-resort-Rack-39-PM
IP Address: 10.2.39.217
Vlan Name: default
Tag:
1
Session Start: Wed Apr 12 21:19:27 2006 GMT
Last Auth Time: Wed Apr 12 21:19:26 2006 GMT
Last Activity: Wed Apr 12 21:19:49 2006 GMT ( <15s ago)
Session Timeout: 0
Idle Time-To-Live: 175
Login Type:
LAST-RESORT
EAP Method:
NONE, using server 172.16.0.1
Session statistics as updated from AP:
Unicast packets in: 31
Unicast bytes in: 3418
Unicast packets out: 18
Unicast bytes out: 2627
Multicast packets in: 0
Multicast bytes in: 0
Number of packets with encryption errors: 0
Number of bytes with encryption errors: 0
Last packet data rate: 48
Last packet signal strength: -60 dBm
Last packet data S/N ratio: 35
Protocol: 802.11
Session CAC: disabled
For example, to display information about per session QoS statistics.
Syntax WSS# show sessions network session-id 75
Local ID:
Global ID:
State:
75
SESS-71-3b993e-27276-77bf514
ACTIVE
Nortel-Voice
SSID:
VLAN Name:
VLAN120
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
696 Managing sessions
<Information omited>
Packets
Bytes
46309
Rx Unicast
7218167
53269
0
Rx Multicast
Rx Encrypt Err
Tx Unicast
1461
0
48828
6674559
Queue
Tx Packets Tx Dropped Re-Transmit
Background
BestEffort
Video
79
0
0
0
0
0
3495
0
58
0
Voice
43972
975
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
The verbose option is not available with the show sessions network session-id command.
To clear network sessions by session ID, type the following command with the appropriate local session ID number.
clear sessions network session-id session-id
For example, the following command deletes network session 9:
WSS# clear sessions network session-id 9
SM Apr 11 19:53:38 DEBUG SM-STATE: localid 9, mac 00:06:25:09:39:5d,
flags 0000012fh, to change state to KILLING
Localid 9, globalid SESSION-9-893249336 moved from ACTIVE to KILLING
(client=00:06:25:09:39:5d)
Displaying and changing network session timers
WSS Software periodically sends keepalive probes to wireless clients to verify that the clients are still present. The
keepalive probes are null data frames sent as unicasts to each client. WSS Software expects each client to respond with
an Ack. WSS Software sends the keepalives every 10 seconds. You can disable the keepalives but the keepalive interval
is not configurable.
WSS Software also maintains an idle timer for each user (wireless client). Each time the client sends data or responds to
a keepalive probe, WSS Software resets the idle timer to 0 for the client. However, if the client remains idle for the
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing sessions 697
period of the idle timer, WSS Software changes the client’s session to the Disassociated state. The default idle timeout
value is 180 seconds (3 minutes). You can change the timeout to a value from 20 to 86400 seconds. To disable the
timeout, specify 0.
Keepalive probes and the user idle timeout are configurable on a service-profile basis.
Note. WSS Software temporarily keeps session information for disassociated web-portal
clients to allow them time to reassociate after roaming. (See “Configuring the Web portal
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing sessions 699
Changing or disabling the user idle timeout
To change the user idle timeout for a service profile, use the following command:
set service-profile name user-idle-timeout seconds
For example, to change the user idle timeout for service profile sp1 to 6 minutes (360 seconds), use the following
command:
WSS# set service-profile sp1 user-idle-timeout 360
success: change accepted.
To disable the user idle timeout, use the following command:
WSS# set service-profile sp1 user-idle-timeout 0
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
700 Managing sessions
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
701
Rogue detection and counter
measures
About rogues and RF detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701
Summary of rogue detection features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708
Configuring rogue detection lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709
Enabling countermeasures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 715
Disabling or reenabling Scheduled RF Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . 716
Enabling AP signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 716
Disabling or reenabling logging of rogues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717
Enabling rogue and countermeasures notifications . . . . . . . . . . . . . . . . . . . . . . . . . . 717
IDS and DoS alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717
Displaying RF detection information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 728
AP radios automatically scan the RF spectrum for other devices transmitting in the same spectrum. The RF scans
discover third-party transmitters in addition to other Nortel radios. WSS Software considers the non-Nortel transmitters
to be devices of interest, which are potential rogues.
You can display information about the devices of interest. To identify friendly devices, such as non-Nortel access points
in your network or neighbor’s network, you can add them to the known devices list. You also can enable countermea-
sures to prevent clients from using the devices that truly are rogues.
With WLAN Management Software, you also can display the physical location of a rogue device. (For more informa-
tion, see the Nortel WLAN Management Software 2300 Series Reference Guide.)
About rogues and RF detection
RF detection detects all the IEEE 802.11 devices in a Mobility Domain and can single out the unauthorized rogue access
points.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
702 Rogue detection and counter measures
Rogue access points and clients
A rogue access point is an access point that is not authorized to operate in a network. Rogue access points and
their clients undermine the security of an enterprise network by potentially allowing unchallenged access to
the network by any wireless user or client in the physical vicinity. Rogue access points and users can also
interfere with the operation of your enterprise network.
Rogue classification
When WSS Software detects a third-party wireless device that is not allowed on the network, WSS Software
classifies the device as one of the following:
•
•
•
•
•
AP—an access point on the wireless network
Client—a wireless client on the network
Ad hoc—a wireless network established between wireless clients.
Tag—devices with RFID tags on the network.
Unknown—unidentified wireless devices on the network.
When you enable countermeasures, you can specify whether to issue them against rogues and interfering
devices, or against rogues only. For example, if you do not want to issue countermeasures against your
neighbor’s wireless devices, you can select to issue countermeasures against rogues only. Auto-RF can auto-
matically change AP radio channels to work around interfering devices without attacking those devices.
In addition, you can optionally configure WSS Software to issue on-demand countermeasures. On-demand
countermeasures are those launched against devices that you have manually specified in the WSS’s attack list.
When you enable on-demand countermeasures, WSS Software issues them only against the devices that have
been manually specified in the attack list, not to other devices determined to be rogues for other reasons, such
as policy violations.
When WSS Software directs an AP radio to issue countermeasures against a rogue, WSS Software changes the
channel on the radio to the channel on which the rogue traffic is detected. The radio remains on that channel as
long as the radio is issuing countermeasures against the rogue, even if Auto-RF is enabled.
To classify devices on the WSS, use the following commands:
WSS-2# set rfdetect classification ssid-masquerade [rogue|skip-test]
WSS-2# set rfdetect classification seen-in-network [rogue|skip-test]
WSS-2# set rfdetect classification ad-hoc [rogue|skip-test]
WSS-2# set rfdetect classification default [rogue|suspect|neighbor]
Selecting skip-test means to skip the test and go to the next test in the list. You can classify RF data based on a
specified criteria and includes the following list:
•
•
•
•
masquerade—ssidAn SSID is masquerading as an SSID already on the network.
seen-in-network—The MAC address is in the forwarding database of the WSS.
ad-hoc—This device is part of an ad-hoc network.
default—Set the default classification as a rogue, suspect, or neighbor.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 703
To clear all classifications and reset to default values, use the following command:
WSS-2# clear rfdetect classification
Rogue detection lists
Rogue detection lists specify the third-party devices and SSIDs that WSS Software allows on the network, and
the devices WSS Software classifies as rogues. You can configure the following rogue detection lists:
•
Permitted SSID list—A list of SSIDs allowed in the Mobility Domain. WSS Software generates a
message if an SSID that is not on the list is detected.
•
•
Rogue List—devices not permitted on the network.
Client black list—A list of MAC addresses of wireless clients who are not allowed on the network. WSS
Software prevents clients on the list from accessing the network through a WSS. If the client is placed on
the black list dynamically by WSS Software due to an association, reassociation, or disassociation flood,
WSS Software generates a log message.
•
Neighbor list—A list of third-party devices to exempt from rogue detection. MSS does not count devices
on the Neighbor list as rogues or interfering devices, and does not issue counter measures against them.
An empty permitted SSID list or permitted vendor list implicitly allows all SSIDs or vendors. However, when
you add an entry to the SSID or vendor list, all SSIDs or vendors that are not in the list are implicitly disal-
lowed. An empty client black list implicitly allows all clients, and an empty ignore list implicitly considers all
third-party wireless devices to be potential rogues.
All the lists except the black list require manual configuration. You can configure entries in the black list and
WSS Software also can place a client in the black list due to an association, reassociation or disassociation
flood from the client.
The rogue classification algorithm examines each of these lists when determining whether a device is a rogue.
Figure 37 shows how the rogue detection algorithm uses the lists.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
704 Rogue detection and counter measures
Figure 37. Rogue detection algorithm
AP radio detects wireless packet.
Source MAC in
Ignore List?
SSID in Permitted
SSID List?
No
No
Yes
No
Yes
Yes
OUI in Permitted
Vendor List?
Generate an alarm.
Yes
Classify device as a rogue.
Issue countermeasures
(if enabled).
Source MAC in
Attack List?
No
Rogue classification
algorithm deems the
device to be a rogue?
Yes
No
Device is not a threat.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 705
RF detection scans
All radios continually scan for other RF transmitters. Radios perform passive scans and active scans:
•
•
Passive scans—The radio listens for beacons and probe responses.
Active scans—The radio sends probe any requests (probe requests with a null SSID name) to solicit
probe responses from other access points.
Passive scans are always enabled and cannot be disabled. Active scans are enabled by default but can be
disabled on a radio-profile basis.
Radios perform both types of scans on all channels allowed for the country of operation. (This is the regulatory
domain set by the set system countrycode command.) 802.11b/g radios scan in the 2.4 GHz to 2.4835 GHz
spectrum. 802.11a radios scan in the 5.15 GHz to 5.85 GHz spectrum.
Both enabled radios and disabled radios perform these scans.
The active-scan algorithm is sensitive to high-priority (voice or video) traffic or heavy data traffic. Active-scan
scans for 30 msec once every second, unless either of the following conditions is true:
•
High-priority traffic (voice or video) is present at 64 Kbps or higher. In this case, active-scan scans for
30 msec every 60 seconds.
•
Heavy data traffic is present at 4 Mbps or higher. In this case, active-scan scans for 30 msec every
5 seconds.
On a disabled radio, the radio is dedicated to rogue detection and scans on each channel in round-robin
fashion.
Radio configuration has the ability of separate scanning behaviors independently controlled by separate attri-
butes. For example, a “disabled” radio does not transmit or receive, and a radio that is scanning but not
providing radio service to clients is in “sentry” mode.
In addition, it has the capability to weight scanning time on the radios. By weighting the scanning time, a
higher proportion of time is spent on “operational” channels. This increases the probability that an event of
interest is detected within a short time.
If the AP is in “sentry” mode, the LEDs alternate between green and yellow/amber. If the radio is “disabled”
the LED is a solid yellow/amber color.
Dynamic Frequency Selection (DFS)
Some regulatory domains require conformance to ETSI document EN 301 893. Section 4.6 of that document
specifies requirements for Dynamic Frequency Selection (DFS). These requirements apply to radios operating
in the 5 GHz band (802.11a radios).
In countries where Dynamic Frequency Selection (DFS) is required, WSS Software performs the appropriate
check for radar. If radar is detected on a channel, the AP radio stops performing active scans on that channel in
accordance with DFS. However, the radio continues to passively scan for beacons from rogue devices.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
706 Rogue detection and counter measures
When an AP radio detects radar on a channel, the radio switches to another channel and does not attempt to use the
channel where the radar was detected for 30 minutes. WSS Software also generates a message.
Note. The Auto-RF feature must be enabled. Otherwise WSS Software cannot change
the channel.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 707
Countermeasures
You can enable WSS Software to use countermeasures against rogues. Countermeasures consist of packets
that interfere with a client’s ability to use the rogue.
Countermeasures are disabled by default. You can enable them on an individual radio-profile basis. When you
enable them, all devices of interest that are not in the known devices list become viable targets for countermea-
sures. Countermeasures can be enabled against all rogue and interfering devices, against rogue devices only, or
against devices explicitly configured in the WSS’s attack list. The Mobility Domain’s seed switch automati-
cally selects individual radios to send the countermeasure packets.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
708 Rogue detection and counter measures
Mobility Domain requirement
RF Detection requires the Mobility Domain to be completely up. If a Mobility Domain is not fully operational
(not all members are up), no new RF Detection data is processed. Existing RF Detection information ages out
normally. Processing of RF Detection data is resumed only when all members of the Mobility Domain are up.
If a seed switch in the Mobility Domain cannot resume full operation, you can restore the Mobility Domain to
full operation, and therefore resume RF Detection data processing, by removing the inoperative switch from
the member list on the seed.
Summary of rogue detection features
Table 42 lists the rogue detection features in WSS Software.
Table 42.Rogue detection features
Applies To
Rogue Detection
Description
Third-Party
APs
Feature
Clients
Classification
WSS Software can classify third-party Yes
Yes
APs as rogues or interfering devices. A
rogue is a third-party AP whose MAC
address WSS Software knows from the
wired side of the network. An
interfering device does not have a
MAC address known on the wired side.
WSS Software can detect rogue clients,
locate their APs, and issue
countermeasures against the APs.
Permitted vendor list List of OUIs to allow on the network. Yes
An OUI is the first three octets of a
No
MAC address and uniquely identifies
an AP’s or client’s vendor.
Permitted SSID list
List of SSIDs allowed on the network. Yes
WSS Software can issue
Yes
countermeasures against third-party
APs sending traffic for an SSID that is
not on the list.
Client black list
Attack list
List of client or AP MAC addresses
that are not allowed on the wireless
network. WSS Software drops all
packets from these clients or APs.
Yes
Yes
Yes
No
List of AP MAC addresses to attack.
WSS Software can issue
countermeasures against these APs
whenever they are detected on the
network.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 709
Table 42.Rogue detection features (continued)
Applies To
Rogue Detection
Feature
Description
Third-Party
APs
Clients
Ignore list
List of MAC addresses to ignore
during RF detection. WSS Software
does not classify devices on this list as
rogues or interfering devices, and does
not issue countermeasures against
them.
Yes
Yes
Countermeasures
Packets sent by Nortel APs to interfere Yes
with the operation of a rogue or
interfering device.
Countermeasures are configurable on a
radio-profile basis.
Yes
No
Scheduled RF
Scanning
Scheduled RF Scanning sends probe
any requests (probes with a null SSID
name) to look for rogue APs.
Yes
Scheduled RF Scanning is configurable
on a radio-profile basis.
Nortel AP signature Value in an AP’s management frames No
that identifies the AP to WSS
No
Software. AP signatures help prevent
spoofing of the AP MAC address.
Log messages and
traps
Messages and traps for rogue activity. Yes
Messages are described in “IDS and
Yes
Configuring rogue detection lists
The following sections describe how to configure lists to specify the devices that are allowed on the network and the
devices that WSS Software should attack with countermeasures.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
710 Rogue detection and counter measures
Configuring a permitted vendor list
The permitted vendor list specifies the third-party AP or client vendors that are allowed on the network. WSS Software
does not list a device as a rogue or interfering device if the device’s OUI is in the permitted vendor list.
By default, the permitted vendor list is empty and all vendors are allowed. If you configure a permitted vendor list, WSS
Software allows only the devices whose OUIs are on the list. The permitted vendor list applies only to the WSS on
which the list is configured. WSSs do not share permitted vendor lists.
If you add a device that WSS Software has classified as a rogue to the permitted vendor list, but not to the ignore list,
WSS Software can still classify the device as a rogue. Adding an entry to the permitted vendor list merely indicates that
the device is from an allowed vendor. However, to cause WSS Software to stop classifying the device as a rogue, you
must add the device’s MAC address to the ignore list.
To add an entry to the permitted vendor list, use the following command:
set rfdetect vendor-list {client | ap} mac-addr
The following command adds an entry for clients whose MAC addresses start with aa:bb:cc:
WSS# set rfdetect vendor-list client aa:bb:cc:00:00:00
success: MAC aa:bb:cc:00:00:00 is now in client vendor-list.
The trailing 00:00:00 value is required.
To display the permitted vendor list, use the following command:
show rfdetect vendor-list
The following example shows the permitted vendor list on a switch:
WSS# show rfdetect vendor-list
Total number of entries: 1
OUI
Type
----------------- ------
aa:bb:cc:00:00:00 client
11:22:33:00:00:00 ap
To remove an entry from the permitted vendor list, use the following command:
clear rfdetect vendor-list {client | ap} {mac-addr | all}
The following command removes client OUI aa:bb:cc:00:00:00 from the permitted vendor list:
WSS# clear rfdetect vendor-list client aa:bb:cc:00:00:00
success: aa:bb:cc:00:00:00 is no longer in client vendor-list.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 711
Configuring a permitted SSID list
The permitted SSID list specifies the SSIDs that are allowed on the network. If WSS Software detects packets
for an SSID that is not on the list, the AP that sent the packets is classified as a rogue. WSS Software issues
countermeasures against the rogue if they are enabled.
By default, the permitted SSID list is empty and all SSIDs are allowed. If you configure a permitted SSID list,
WSS Software allows traffic only for the SSIDs that are on the list. The permitted SSID list applies only to the
WSS on which the list is configured. WSSs do not share permitted SSID lists.
If you add a device that WSS Software has classified as a rogue to the permitted SSID list, but not to the ignore
list, WSS Software can still classify the device as a rogue. Adding an entry to the permitted SSID list merely
indicates that the device is using an allowed SSID. However, to cause WSS Software to stop classifying the
device as a rogue, you must add the device’s MAC address to the ignore list.
To add an SSID to the list, use the following command:
set rfdetect ssid-list ssid-name
The following command adds SSID mycorp to the list of permitted SSIDs:
WSS# set rfdetect ssid-list mycorp
success: ssid mycorp is now in ssid-list.
To display the permitted SSID list, use the following command:
show rfdetect ssid-list
The following example shows the permitted SSID list on WSS:
WSS# show rfdetect ssid-list
Total number of entries: 3
SSID
-----------------
mycorp
corporate
guest
To remove an SSID from the permitted SSID list, use the following command:
clear rfdetect ssid-list ssid-name
The following command clears SSID mycorp from the permitted SSID list:
WSS# clear rfdetect ssid-list mycorp
success: mycorp is no longer in ssid-list.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
712 Rogue detection and counter measures
Configuring a client black list
The client black list specifies clients that are not allowed on the network. WSS Software drops all packets from the
clients on the black list.
By default, the client black list is empty. In addition to manually configured entries, the list can contain entries added by
WSS Software. WSS Software can place a client in the black list due to an association, reassociation or disassociation
flood from the client.
The client black list applies only to the WSS on which the list is configured. WSSs do not share client black lists.
To add an entry to the list, use the following command:
set rfdetect black-list mac-addr
The following command adds client MAC address 11:22:33:44:55:66 to the black list:
WSS# set rfdetect black-list 11:22:33:44:55:66
success: MAC 11:22:33:44:55:66 is now blacklisted.
To display the client black list, use the following command:
show rfdetect black-list
The following example shows the client black list on a WSS:
WSS# show rfdetect black-list
Total number of entries: 1
Blacklist MAC
----------------- ----------------- ------- ---
11:22:33:44:55:66 configured
11:23:34:45:56:67 assoc req flood 3
Type
Port TTL
-
-
25
To remove a MAC address from the client black list, use the following command:
clear rfdetect black-list mac-addr
The following command removes MAC address 11:22:33:44:55:66 from the black list:
WSS# clear rfdetect black-list 11:22:33:44:55:66
success: 11:22:33:44:55:66 is no longer blacklisted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 713
Configuring an attack list
The attack list specifies the MAC addresses of devices that WSS Software should issue countermeasures against
whenever the devices are detected on the network. The attack list can contain the MAC addresses of APs and clients.
By default, the attack list is empty. The attack list applies only to the WSS on which the list is configured. WSSs do not
share attack lists.
When on-demand countermeasures are enabled, only those devices configured in the attack list are subject to counter-
measures. In this case, devices found to be rogues by other means, such as policy violations or by determining that the
device is providing connectivity to the wired network, are not attacked.
Note. If you are using on-demand countermeasures in a Mobility Domain, you should
synchronize the attack lists on all the WSSs in the Mobility Domain. See “Using on-demand
To add an entry to the attack list, use the following command:
set rfdetect attack-list mac-addr
The following command adds MAC address aa:bb:cc:44:55:66 to the attack list:
WSS# set rfdetect attack-list 11:22:33:44:55:66
success: MAC 11:22:33:44:55:66 is now in attacklist.
To display the attack list, use the following command:
show rfdetect attack-list
The following example shows the attack list on a switch:
WSS# show rfdetect attack-list
Total number of entries: 1
Attacklist MAC Port/Radio/Chan RSSI
SSID
----------------- ----------------- ------ ------------
11:22:33:44:55:66 ap 2/1/11
-53 rogue-ssid
To remove a MAC address from the attack list, use the following command:
clear rfdetect attack-list mac-addr
The following command clears MAC address 11:22:33:44:55:66 from the attack list:
WSS# clear rfdetect attack-list 11:22:33:44:55:66
success: 11:22:33:44:55:66 is no longer in attacklist.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
714 Rogue detection and counter measures
Configuring an ignore list
By default, when countermeasures are enabled, WSS Software considers any non-Nortel transmitter to be a rogue device
and can send countermeasures to prevent clients from using that device. To prevent WSS Software from sending coun-
termeasures against a friendly device, add the device to the known devices list:
If you add a device that WSS Software has classified as a rogue to the permitted vendor list or permitted SSID list, but
not to the ignore list, WSS Software can still classify the device as a rogue. Adding an entry to the permitted vendor list
or permitted SSID list merely indicates that the device is from an allowed manufacturer or is using an allowed SSID.
However, to cause WSS Software to stop classifying the device as a rogue, you must add the device’s MAC address to
the ignore list.
To add a device to the ignore list, use the following command:
set rfdetect ignore mac-addr
The mac-addr is the BSSID of the device you want to ignore.
Note. If you try to initiate countermeasures against a device on the ignore list, the ignore
list takes precedence and WSS Software does not issue the countermeasures.
Countermeasures apply only to rogue devices.
To ignore BSSID aa:bb:cc:11:22:33 during all RF scans, type the following command:
WSS# set rfdetect ignore aa:bb:cc:11:22:33
success: MAC aa:bb:cc:11:22:33 is now ignored.
To remove a BSSID from the ignore list, use the following command:
clear rfdetect ignore mac-addr
To display the ignore list, use the following command:
show rfdetect ignore
The following command displays an ignore list containing two BSSIDs:
WSS# show rfdetect ignore
Total number of entries: 2
Ignore MAC
-----------------
aa:bb:cc:11:22:33
aa:bb:cc:44:55:66
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 715
Enabling countermeasures
Caution! Countermeasures affect wireless service on a radio. When an AP radio is
sending countermeasures, the radio is disabled for use by network traffic, until the radio
finishes sending the countermeasures.
Countermeasures are disabled by default. You can enable them on an individual radio profile basis. To enable counter-
measures on a radio profile, use the following command:
set radio-profile name countermeasures {all | rogue | configured | none}
The all option enables or disables countermeasures for rogues and for interfering devices. This option is equivalent to
the scope of rogue detection in WSS Software Version 3.x. The rogue option enables or disables countermeasures for
rogues only.
The configured option causes radios to attack only devices specified in the attack list on the WSS (on-demand counter-
measures). When this option is used, devices found to be rogues by other means, such as policy violations or by
determining that the device is providing connectivity to the wired network, are not attacked.
The none option disables countermeasures for this radio profile.
The following command enables countermeasures in radio profile radprof3 for rogues only:
WSS# set radio-profile radprof3 countermeasures rogue
success: change accepted.
The following command causes radios managed by radio profile radprof3 to issue countermeasures against devices in
the WSS’s attack list:
WSS# set radio-profile radprof3 countermeasures configured
success: change accepted.
To disable countermeasures on a radio profile, use the following command:
clear radio-profile name countermeasures
The following command disables countermeasures in radio profile radprof3:
WSS# clear radio-profile radprof3 countermeasures
success: change accepted.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
716 Rogue detection and counter measures
Using on-demand countermeasures in a Mobility Domain
If you are using on-demand countermeasures in a Mobility Domain, you should enable the feature and synchronize the
attack lists on all the WSSs in the Mobility Domain. This ensures a WSS attacks devices in its attack list, rather than
devices that may be specified in the attack lists of other WSSs in the Mobility Domain, which could produce unexpected
results.
For example, in a Mobility Domain consisting of three WSSs, if WSS A has an attack list consisting of MAC address 1,
and WSS B has an attack list consisting of MAC address 2, then WSS C (the seed for the Mobility Domain) might
determine that the optimal radio to attack MAC address 2 is attached to WSS A.
This would mean that MAC address 2 would be attacked from WSS A, even though MAC address 2 does not reside in
WSS A’s attack list. In addition, if the AP attached to WSS A is busy attacking MAC address 2, then MAC address 1
might not be attacked at all if it comes on the network.
By making the attack lists identical on all of the WSSs in the Mobility Domain when you enable on-demand counter-
measures, it ensures that a WSS always attacks MAC addresses that reside in its attack list. Note that WSSs do not share
attack lists automatically, so you must manually synchronize the attack lists on the WSSs in the Mobility Domain.
Disabling or reenabling Scheduled RF Scanning
When Scheduled RF Scanning is enabled, the AP radios managed by the switch look for rogue devices by sending probe
any frames (probes with a null SSID name), to solicit probe responses from other APs.
Scheduled RF Scanning is enabled by default. You can disable or reenable the feature on an individual radio profile
basis. To disable or reenable Scheduled RF Scanning on a radio profile, use the following command:
set radio-profile name active-scan {enable | disable}
The following command disables Scheduled RF Scanning in radio profile radprof3:
WSS# set radio-profile radprof3 active-scan disable
success: change accepted.
Enabling AP signatures
An AP signature is a set of bits in a management frame sent by an AP that identifies that AP to WSS Software. If
someone attempts to spoof management packets from a Nortel AP, WSS Software can detect the spoof attempt.
AP signatures are disabled by default. To enable or disable them, use the following command:
set rfdetect signature {enable | disable}
The command applies only to APs managed by the WSS on which you enter the command. To enable signatures on all
APs in a Mobility Domain, enter the command on each WSS in the Mobility Domain.
Note. You must use the same AP signature setting (enabled or disabled) on all WSSs in
a Mobility Domain.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 717
Disabling or reenabling logging of rogues
By default, a WSS generates a log message when a rogue is detected or disappears. To disable or reenable the log
messages, use the following command:
set rfdetect log {enable | disable}
To display log messages on a switch, use the following command:
show log buffer
(This command has optional parameters. For complete syntax information, see the Nortel WLAN Security Switch 2300
Series Command Line Reference.)
Enabling rogue and countermeasures notifications
By default, all SNMP notifications (informs or traps) are disabled. To enable or disable notifications for rogue detection,
Intrusion Detection System (IDS), and Denial of Service (DoS) protection, configure a notification profile that sends all
the notification types for these features. (For syntax information and an example, see “Configuring a notification profile”
IDS and DoS alerts
WSS Software can detect illegitimate network access attempts and attempts to disrupt network service. In response,
WSS Software generates messages and SNMP notifications. The following sections describe the types of attacks and
security risks that WSS Software can detect.
For examples of the log messages that WSS Software generates when DoS attacks or other security risks are detected,
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
718 Rogue detection and counter measures
Flood attacks
A flood attack is a type of Denial of Service attack. During a flood attack, a rogue wireless device attempts to overwhelm
the resources of other wireless devices by continuously injecting management frames into the air. For example, a rogue
client can repeatedly send association requests to try to overwhelm APs that receive the requests.
The threshold for triggering a flood message is 100 frames of the same type from the same MAC address, within a
one-second period. If WSS Software detects more than 100 of the same type of wireless frame within one second, WSS
Software generates a log message. The message indicates the frame type, the MAC address of the sender, the listener
(AP and radio), channel number, and RSSI.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 719
DoS attacks
When Scheduled RF Scanning is enabled on APs, WSS Software can detect the following types of DoS attacks:
•
•
•
RF Jamming—The goal of an RF jamming attack is to take down an entire WLAN by overwhelming the radio
environment with high-power noise. A symptom of an RF jamming attack is excessive interference. If an AP radio
detects excessive interference on a channel, and Auto-RF is enabled, WSS Software changes the radio to a different
channel.
Deauthenticate frames—Spoofed deauthenticate frames form the basis for most DoS attacks, and are the basis for
other types of attacks including man-in-the-middle attacks. The source MAC address is spoofed so that clients think
the packet is coming from a legitimate AP. If an AP detects a packet with its own source MAC address, the AP
knows that the packet was spoofed.
Broadcast deauthenticate frames—Similar to the spoofed deauthenticate frame attack above, a broadcast
deauthenticate frame attack generates spoofed deauthenticate frames, with a broadcast destination address instead
of the address of a specific client. The intent of the attack is to disconnect all stations attached to an AP.
•
•
•
Disassociation frames—A disassociation frame from an AP instructs the client to end its association with the AP.
The intent of this attack is to disconnect clients from the AP.
Null probe responses—A client’s probe request frame is answered by a probe response containing a null SSID.
Some NIC cards lock up upon receiving such a probe response.
Decrypt errors—An excessive number of decrypt errors can indicate that multiple clients are using the same MAC
address. A device’s MAC address is supposed to be unique. Multiple instances of the same address can indicate that
a rogue device is pretending to be a legitimate device by spoofing its MAC address.
•
Fake AP—A rogue device sends beacon frames for randomly generated SSIDs or BSSIDs. This type of attack can
cause clients to become confused by the presence of so many SSIDs and BSSIDs, and thus interferes with the
clients’ ability to connect to valid APs. This type of attack can also interfere with Auto-RF when an AP is trying to
adjust to its RF neighborhood.
•
•
SSID masquerade—A rogue device pretends to be a legitimate AP by sending beacon frames for a valid SSID
serviced by APs in your network. Data from clients that associate with the rogue device can be accessed by the
hacker controlling the rogue device.
Spoofed AP—A rogue device pretends to be a Nortel AP by sending packets with the source MAC address of the
Nortel AP. Data from clients that associate with the rogue device can be accessed by the hacker controlling the
rogue device.
Note. WSS Software detects a spoofed AP attack based on the fingerprint of
the spoofed AP. Packets from the real AP have the correct signature, while
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
720 Rogue detection and counter measures
Netstumbler and Wellenreiter applications
Netstumbler and Wellenreiter are widely available applications that hackers can use to gather information about the APs
in your network, including location, manufacturer, and encryption settings.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 721
Wireless bridge
A wireless bridge can extend a wireless network outside the desired area. For example, someone can place a wireless
bridge near an exterior wall to extend wireless coverage out into the parking lot, where a hacker could then gain access
to the network.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
722 Rogue detection and counter measures
Ad-Hoc network
An ad-hoc network is established directly among wireless clients and does not use the infrastructure network (a network
using an AP). An ad-hoc network might not be an intentionally malicious attack on the network, but it does steal
bandwidth from your infrastructure users.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 723
Weak WEP key used by client
A weak initialization vector (IV) makes a WEP key easier to hack. WSS Software alerts you regarding clients who are
using weak WEP IVs so that you can strengthen the encryption on these clients or replace the clients.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
724 Rogue detection and counter measures
Disallowed devices or SSIDs
You can configure the following types of lists to explicitly allow specific devices or SSIDs:
•
•
Permitted SSID list—WSS Software generates a message if an SSID that is not on the list is detected.
Permitted vendor list—WSS Software generates a message if an AP or wireless client with an OUI that is not on the
list is detected.
•
Client black list—WSS Software prevents clients on the list from accessing the network through a WSS. If the
client is placed on the black list dynamically by WSS Software due to an association, reassociation or
disassociation flood, WSS Software generates a log message.
By default, these lists are empty and all SSIDs, vendors, and clients are allowed. For more information, see “Summary
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 725
Displaying statistics counters
To display IDS and DoS statistics counters, use the show rfdetect counters commands. (See “Displaying statistics
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
726 Rogue detection and counter measures
IDS log message examples
Table 43 shows examples of the log messages generated by IDS.
Table 43.IDS and DoS log messages
Message Type
Example Log Message
Probe message flood
Client aa:bb:cc:dd:ee:ff is sending probe message flood.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Authentication
message flood
Client aa:bb:cc:dd:ee:ff is sending authentication message flood.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Null data message
flood
Client aa:bb:cc:dd:ee:ff is sending null data message flood.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Management frame 6
flood
Client aa:bb:cc:dd:ee:ff is sending rsvd mgmt frame 6 message flood.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Management frame 7
flood
Client aa:bb:cc:dd:ee:ff is sending rsvd mgmt frame 7 message flood.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Management frame D Client aa:bb:cc:dd:ee:ff is sending rsvd mgmt frame D message flood.
flood
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Management frame E
flood
Client aa:bb:cc:dd:ee:ff is sending rsvd mgmt frame E message flood.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Management frame F
flood
Client aa:bb:cc:dd:ee:ff is sending rsvd mgmt frame F message flood.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Associate request flood Client aa:bb:cc:dd:ee:ff is sending associate request flood on port 2
Reassociate request
flood
Client aa:bb:cc:dd:ee:ff is sending re-associate request flood on port 2
Disassociate request
flood
Client aa:bb:cc:dd:ee:ff is sending disassociate request flood on port 2
Weak WEP
initialization vector
(IV)
Client aa:bb:cc:dd:ee:ff is using weak wep initialization vector.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Decrypt errors
Client aa:bb:cc:dd:ee:ff is sending packets with decrypt errors.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Spoofed
deauthentication
frames
Deauthentication frame from AP aa:bb:cc:dd:ee:ff is being spoofed.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Spoofed disassociation Disassociation frame from AP aa:bb:cc:dd:ee:ff is being spoofed.
frames
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Null probe responses
AP aa:bb:cc:dd:ee:ff is sending null probe responses.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
Broadcast
deauthentications
AP aa:bb:cc:dd:ee:ff is sending broadcast deauthentications.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 727
Table 43.IDS and DoS log messages (continued)
Message Type
Example Log Message
Fake AP SSID (when
source MAC address is
known)
FakeAP SSID attack detected from aa:bb:cc:dd:ee:ff.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53 SSID myssid.
Fake AP SSID (when
source MAC address is
not known)
FakeAP BSSID attack detected.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53 SSID myssid.
Spoofed SSID
AP Mac aa:bb:cc:dd:ee:ff(ssid myssid) is masquerading our ssid used by
aa:bb:cc:dd:ee:fd.
Detected by listener aa:bb:cc:dd:ee:fc(port 2, radio 1), channel 11 with
RSSI -53.
Wireless bridge
detected
Wireless bridge detected with address aa:bb:cc:dd:ee:ff.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53 SSID myssid.
Netstumbler detected
Netstumbler detected from aa:bb:cc:dd:ee:ff.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53 SSID myssid.
Wellenreiter detected
Wellenreiter detected from aa:bb:cc:dd:ee:ff.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53 SSID myssid.
Ad-hoc client frame
detected
Adhoc client frame detected from aa:bb:cc:dd:ee:ff.
Seen by AP on port 2, radio 1 on channel 11 with RSSI -53 SSID myssid.
Spoofed AP
AP Mac aa:bb:cc:dd:ee:ff(ssid myssid) is being spoofed. Received
fingerprint 1122343 does not match our fingerprint 123344.
Detected by listener aa:bb:cc:dd:ee:fd(port 2, radio 1), channel 11 with
RSSI -53.
Disallowed SSID
detected
AP Mac aa:bb:cc:dd:ee:ff(ssid myssid) is not part of ssid-list.
Detected by listener aa:bb:cc:dd:ee:fd(port 2, radio 1), channel 11 with
RSSI -53.
AP from disallowed
vendor detected
AP Mac aa:bb:cc:dd:ee:ff(ssid myssid) is not part of vendor-list.
Detected by listener aa:bb:cc:dd:ee:fd(port 2, radio 1), channel 11 with
RSSI -53.
Client from disallowed Client Mac aa:bb:cc:dd:ee:ff is not part of vendor-list. Detected by
vendor detected listener aa:bb:cc:dd:ee:fd(port 2, radio 1), channel 11 with RSSI -53.
Interfering client seen Client Mac aa:bb:cc:dd:ee:ff is seen on the wired network by WSS
on wired network
10.1.1.1 on port 3 vlan 2 tag 1. Detected by listener
aa:bb:cc:dd:ee:fd(port 2, radio 1), channel 11 with RSSI -53.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
728 Rogue detection and counter measures
Displaying RF detection information
Table 44.Rogue detection show commands
Command
Description
show rfdetect clients
[mac mac-addr]
Displays all wireless clients detected on the air.
show rfdetect counters
Displays statistics for rogue and Intrusion
Detection System (IDS) activity detected by the
APs managed by a WSS.
show rfdetect mobility-domain
[ssid ssid-name | bssid mac-addr]
Displays information about rogues detected in a
Mobility Domain.
This command is valid only on the Mobility
Domain’s seed switch.
show rfdetect data
Displays information about all BSSIDs detected
on the air, and labels those that are from rogues
or interfering devices.
This command is valid on any switch in the
Mobility Domain.
show rfdetect visible mac-addr
Displays the BSSIDs detected by a specific
Nortel radio.
show rfdetect visible
ap ap-num [radio {1 | 2}]
show rfdetect visible
ap ap-num [radio {1 | 2}]
show rfdetect countermeasures
Displays the current status of countermeasures
against rogues in the Mobility Domain.
This command is valid only on the Mobility
Domain seed.
show rfdetect vendor-list
Displays the list of OUIs that are allowed on the
network. An OUI identifies a piece of
networking equipment’s vendor. (See
page 710.)
show rfdetect ssid-list
show rfdetect black-list
Displays the list of SSIDs that are allowed on
the network. (See “Configuring a permitted
Displays the list of wireless clients that are not
allowed on the network. (See “Configuring a
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 729
Table 44.Rogue detection show commands (continued)
Command
Description
show rfdetect attack-list
Displays the list of wireless devices that you
want APs to attack with countermeasures. (See
show rfdetect ignore
Displays the BSSIDs of third-party devices that
WSS Software ignores during RF detection
scans. (See “Configuring an ignore list” on
page 714.)
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
730 Rogue detection and counter measures
Displaying rogue clients
To display the wireless clients detected by a WSS, use the following command:
show rfdetect clients [mac mac-addr]
The following command shows information about all wireless clients detected by a WSS’s APs:
WSS# show rfdetect clients
Total number of entries: 30
User Name
Sess IP or MAC ID Address
-------------------------------------
5* 192.168.12.100
VLAN Name
Port/Radio
---------------
-----------------------
EXAMPLE
jose@example.com
00:30:65:16:8d:69
761
-----------------
vlan-eng
vlan-eng
vlan-wep
(none)
3/1
1/1
3/1
1/2
1/1
5125* 192.168.12.141
4385* 192.168.19.199
00:0b:be:15:46:56
763
00:02:2d:02:10:f5
(none)
Client MAC
Client Vendor
AP MAC Vendor
AP Port/Radio/Channel
NoL Type Last seen
--------------- ----------------
--------------------
Unknown
Unknown
Unknown
Unknown
Unknown
Unknown
------------------------- -----------------------
00:03:7f:bf:16:70
00:04:23:77:e6:e5
00:05:5d:79:ce:0f
00:05:5d:7e:96:a7
00:05:5d:7e:96:ce
00:05:5d:84:d1:c5
Unknown
Intel
D-Link
D-Link
D-Link
D-Link
ap 1/1/6
ap 1/1/2
ap 1/1/149
ap 1/1/149
ap 1/1/157
ap 1/1/1
1 intfr 207
1 intfr 155
1 intfr 87
1 intfr 117
1 intfr 162
1 intfr 52
The following command displays more details about a specific client:
WSS# show rfdetect clients mac 00:0c:41:63:fd:6d
Client Mac Address: 00:0c:41:63:fd:6d, Vendor: Linksys
Port: ap 1, Radio: 1, Channel: 11, RSSI: -82, Rate: 2, Last Seen (secs ago): 84
Bssid: 00:0b:0e:01:02:00, Vendor: Nortel, Type: intfr, Dst: ff:ff:ff:ff:ff:ff
Last Rogue Status Check (secs ago): 3
The first line lists information for the client. The other lines list information about the most recent 802.11 packet
detected from the client.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 731
Displaying rogue detection counters
To display rogue detection statistics counters, use the following command:
show rfdetect counters
The command shows counters for rogue activity detected by the WSS on which you enter the command.
WSS# show rfdetect counters
Type
Current Total
-------------------------------------------------- ------------ ------------
Rogue access points
0
139
0
0
1116
0
Interfering access points
Rogue 802.11 clients
Interfering 802.11 clients
802.11 adhoc clients
4
347
1
0
Unknown 802.11 clients
20
965
0
0
Interfering 802.11 clients seen on wired network
802.11 probe request flood
0
0
0
802.11 authentication flood
802.11 null data flood
0
0
0
802.11 mgmt type 6 flood
802.11 mgmt type 7 flood
802.11 mgmt type d flood
802.11 mgmt type e flood
802.11 mgmt type f flood
802.11 association flood
0
0
0
0
0
0
0
0
0
0
0
0
0
0
802.11 reassociation flood
802.11 disassociation flood
Weak wep initialization vectors
Spoofed access point mac-address attacks
Spoofed client mac-address attacks
Ssid masquerade attacks
0
0
0
0
0
0
0
0
1
12
Spoofed deauthentication attacks
Spoofed disassociation attacks
Null probe responses
0
0
0
0
626
11380
Broadcast deauthentications
FakeAP ssid attacks
0
0
0
0
0
0
0
FakeAP bssid attacks
Netstumbler clients
0
0
Wellenreiter clients
0
Active scans
1796
196
4383
196
Wireless bridge frames
Adhoc client frames
8
0
Access points present in attack-list
Access points not present in ssid-list
Access points not present in vendor-list
Clients not present in vendor-list
Clients added to automatic black-list
0
0
0
0
0
0
0
0
0
0
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
732 Rogue detection and counter measures
Displaying SSID or BSSID information for a Mobility Domain
To display SSID or BSSID information for an entire Mobility Domain, use the following command on the seed switch:
show rfdetect mobility-domain [ssid ssid-name | bssid mac-addr]
The following command displays summary information for all SSIDs and BSSIDs detected in the Mobility Domain:
WSS# show rfdetect mobility-domain
Total number of entries: 194
Flags: i = infrastructure, a = ad-hoc, u = unresolved
c = CCMP, t = TKIP, 1 = 104-bit WEP, 4 = 40-bit WEP, w = WEP(non-WPA)
BSSID
Vendo Type
Flag SSID
------------------- ---------------- -----------------------------------
00:07:50:d5:cc:91
00:07:50:d5:dc:78
00:09:b7:7b:8a:54
00:0a:5e:4b:4a:c0
00:0a:5e:4b:4a:c2
00:0a:5e:4b:4a:c4
00:0a:5e:4b:4a:c6
00:0a:5e:4b:4a:c8
00:0a:5e:4b:4a:ca
...
Cisco
Cisco
Cisco
3Com
3Com
3Com
3Com
3Com
3Com
intfr i----w r27-cisco
1200-2
intfr i----w r116-cisco1200-2
intfr i-----
intfr i----- public
intfr i----w Nortelwlan
intfr ic---- nrtl-ccmp
intfr i----w nrtl-tkip
intfr i----w nrtl-voip
intfr i----- nrtl-web-based aaa
The lines in this display are compiled from data from multiple listeners (AP radios). If an item has the value unresolved,
not all listeners agree on the value for that item. Generally, an unresolved state occurs only when an AP or a Mobility
Domain is still coming up, and lasts only briefly.
The following command displays detailed information for rogues using SSID nrtl-web-based aaa.
WSS# show rfdetect mobility-domain ssid nrtl-web-based aaa
BSSID: 00:0a:5e:4b:4a:ca Vendor: 3Com SSID: nrtl-web-based aaa
Type: intfr Adhoc: no Crypto-types: clear
WSS-IPaddress: 10.8.121.102 Port/Radio/Ch: 3/1/11 Mac: 00:0b:0e:00:0a:6a
Device-type: interfering Adhoc: no Crypto-types: clear
RSSI: -85 SSID: nrtl-web-based aaa
BSSID: 00:0b:0e:00:7a:8a Vendor: Nortel SSID: nrtl-web-based aaa
Type: intfr Adhoc: no Crypto-types: clear
WSS-IPaddress: 10.8.121.102 Port/Radio/Ch: 3/1/1 Mac: 00:0b:0e:00:0a:6a
Device-type: interfering Adhoc: no Crypto-types: clear
RSSI: -75 SSID: nrtl-web-based aaa
WSS-IPaddress: 10.3.8.103 Port/Radio/Ch: ap 1/1/1 Mac: 00:0b:0e:76:56:82
Device-type: interfering Adhoc: no Crypto-types: clear
RSSI: -76 SSID: nrtl-web-based aaa
Two types of information are shown. The lines that are not indented show the BSSID, vendor, and information about the
SSID. The indented lines that follow this information indicate the listeners (AP radios) that detected the SSID. Each set
of indented lines is for a separate AP listener.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 733
In this example, two BSSIDs are mapped to the SSID. Separate sets of information are shown for each of the BSSIDs,
and information about the listeners for each BSSID is shown.
The following command displays detailed information for a BSSID.
WSS# show rfdetect mobility-domain bssid 00:0b:0e:00:04:d1
BSSID: 00:0b:0e:00:04:d1 Vendor: Cisco SSID: notmycorp
Type: rogue Adhoc: no Crypto-types: clear
WSS-IPaddress: 10.8.121.102 Port/Radio/Ch: 3/2/56 Mac: 00:0b:0e:00:0a:6b
Device-type: rogue Adhoc: no Crypto-types: clear
RSSI: -72 SSID: notmycorp
WSS-IPaddress: 10.3.8.103 Port/Radio/Ch: ap 1/1/157 Mac: 00:0b:0e:76:56:82
Device-type: rogue Adhoc: no Crypto-types: clear
RSSI: -72 SSID: notmycorp
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
734 Rogue detection and counter measures
Displaying RF detect data
To display information about the APs detected by an individual WSS, use the following command:
show rfdetect data
You can enter this command on any switch in the Mobility Domain.
WSS# show rfdetect data
Total number of entries: 197
Flags: i = infrastructure, a = ad-hoc
c = CCMP, t = TKIP, 1 = 104-bit WEP, 4 = 40-bit WEP, w = WEP(non-WPA)
BSSID
Vendor Type
Port/Radio/Ch Flags
-----------------------
3/1/6 i----w -61
3/1/6 i----w -82
3/1/2 i----- -57
3/1/11 i----- -57
3/1/11 i-t1-- -86
3/1/11 ic---- -85
3/1/11 i-t--- -85
3/1/11 i----w -83
3/1/11 i----- -85
RSSI Age SSID
-------------------------
6 r27-cisco1200-2
6 r116-cisco1200-2
6
----------------- -----------------
00:07:50:d5:cc:91
00:07:50:d5:dc:78
00:09:b7:7b:8a:54
00:0a:5e:4b:4a:c0
00:0a:5e:4b:4a:c2
00:0a:5e:4b:4a:c4
00:0a:5e:4b:4a:c6
00:0a:5e:4b:4a:c8
00:0a:5e:4b:4a:ca
Cisco intfr
Cisco intfr
Cisco intfr
3Com intfr
3Com intfr
3Com intfr
3Com intfr
3Com intfr
3Com intfr
6 public
6 trapezewlan
6 nrtl-ccmp
6 nrtl-tkip
6 nrtl-voip
6 nrtl-web-based aaa
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 735
Displaying the APs detected by an AP radio
To display the APs detected by an AP radio, use any of the following commands:
show rfdetect visible mac-addr
show rfdetect visible ap ap-num [radio {1 | 2}]
show rfdetect visible ap ap-num [radio {1 | 2}]
To following command displays information about the rogues detected by radio 1 on ap port 3:
WSS# show rfdetect visible ap 3 radio 1
Total number of entries: 104
Flags: i = infrastructure, a = ad-hoc
c = CCMP, t = TKIP, 1 = 104-bit WEP, 4 = 40-bit WEP, w = WEP(non-WPA)
Transmit MAC Vendor Type Ch RSSI Flags SSID
----------------- ------- ----- --- ---- ------ --------------------------------
00:07:50:d5:cc:91 Cisco intfr 6 -60 i----w r27-cisco1200-2
00:07:50:d5:dc:78 Cisco intfr 6 -82 i----w r116-cisco1200-2
00:09:b7:7b:8a:54 Cisco intfr 2 -54 i-----
00:0a:5e:4b:4a:c0 3Com intfr 11 -57 i----- public
00:0a:5e:4b:4a:c2 3Com intfr 11 -86 i-t1-- trapezewlan
00:0a:5e:4b:4a:c4 3Com intfr 11 -85 ic---- nrtl-ccmp
00:0a:5e:4b:4a:c6 3Com intfr 11 -85 i-t--- nrtl-tkip
00:0a:5e:4b:4a:c8 3Com intfr 11 -83 i----w nrtl-voip
00:0a:5e:4b:4a:ca 3Com intfr 11 -85 i----- nrtl-web-based aaa
...
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
736 Rogue detection and counter measures
Displaying countermeasures information
To display the current status of countermeasures against rogues in the Mobility Domain, use the following command:
show rfdetect countermeasures
This command is valid only on the Mobility Domain’s seed switch.
WSS# show rfdetect countermeasures
Total number of entries: 190
Rogue MAC
Type Countermeasures WSS-IPaddr
Port/Radio
Radio Mac /Channel
----------------- ----- ------------------ --------------- -------------
00:0b:0e:00:71:c0 intfr 00:0b:0e:44:55:66 10.1.1.23
00:0b:0e:03:00:80 rogue 00:0b:0e:11:22:33 10.1.1.23
ap 4/1/6
ap 2/1/11
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Rogue detection and counter measures 737
Testing the RFPing
The "rfping" command provides information about the RF link between the WSS and the client based on sending test
packets to the client. The output of the command indicates the number of test packets received and acknowledged by the
client as well as the client's signal strength and signal-to-noise ratio. The command is executed from the CLI superuser
prompt.
To test the rfping
WSS# rfping mac {mac-addr} session-id {session-id}
WSS# rfping mac 00:09:2d:94:25:a9
RFPing to 00:09:2d:94:25:a9 :
Session-Id: 672
Packets Sent
---------------- -------------------
20 20
Packets Rcvd
RSSI
--------- --------
-62 32
SNR
RTT (micro-secs)
----------------------
6307
WSS# rfping session-id 28
RFPing to 00:90:7a:03:d8:13 :
Session-Id: 28
Packets Sent
---------------- -------------------
20 20
The following table indicates the command output.
Packets Rcvd
RSSI
--------- --------
-62 32
SNR
RTT (micro-secs)
----------------------
6307
Table 45. RFPing command output
Feedback
Explanation
Packets Sent
Packets Received
RSSI
The number of test packets sent from the WSS to the client.
The number of test packets acknowledged by the client.
Received signal strength indication (RSSI) - the strength of the RF signal from the
client, in decibels referred to 1 milliwatt (dBm)
SNR
Signal-to-noise ratio (SNR), in decibels (dB), of the data received from the client.
RTT (micro-secs)
The round-trip time (RTT) in microseconds, for the client's response to the test
packets
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
738 Rogue detection and counter measures
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
739
Managing system files
About system files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739
Working with files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 742
Managing configuration files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 750
Backing up and restoring the system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757
Upgrading the system image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760
A WLAN—Security Switch (WSS) contains nonvolatile storage. WSS Software allows you to manage the files in
nonvolatile storage. In addition, you can copy files between the WSS and a TFTP server on the network.
About system files
Generally, a WSS’s nonvolatile storage contains the following types of files:
•
•
•
System image files—The operating system software for the WSS and its attached APs
Configuration files—CLI commands that configure the WSS and its attached APs
System log files—Files containing log entries generated by WSS Software.
When you power on or reset the WSS or reboot the software, the switch loads a designated system image, then loads
configuration information from a designated configuration file.
A WSS can also contain temporary files with trace information used for troubleshooting. Temporary files are not stored
in nonvolatile memory, but are listed when you display a directory of the files on the switch.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
740 Managing system files
Displaying software version information
To display the software, firmware, and hardware versions, use the following command:
show version [details]
The details option displays hardware and software information about the APs configured on the WSS.
To display version information for a WSS, type the following command:
WSS# show version
Wireless Security Software, Version: 5.0.7.0 QA 20
Copyright (c) 2005 - 2006 Nortel. All rights reserved.
Build Information: (build#20) REL_5_0_branch 2006-11-17 00:10:00
Model:
2360
Hardware
Mainboard:
Serial number
Flash:
Kernel:
BootLoader:
version 1 ; revision 01 ; FPGA version 8
STP1W400H6
1.0.0 - 0
QNX-630
4.3 / 5.0.4
To also display AP information, type the following command:
WSS# show version details
Wireless Security Software, Version: 5.0.7.0 QA 20
Copyright (c) 2005 - 2006 Nortel. All rights reserved.
Build Information: (build#20) REL_5_0_branch 2006-11-17 00:10:00
Label:
Build Suffix:
Model:
5.0.7.0.20_111706
-d-O1-nortel
2360
Hardware
Mainboard:
CPU Model:
Serial number
Flash:
version 1 ; revision 01 ; FPGA version 8
405EP (Revision 9.80)
STP1W400H6
1.0.0 - 0
Kernel:
QNX-630
BootLoader:
4.3 / 5.0.4
Port/AP AP Model Serial #
Versions
-------- ---------- -------------- ------------------------
1 /- 2330
STP1W20EV9 H/W : 02
F/W1 : 5.7
F/W2 : 5.7
S/W : 5.0.7.0.20_111706_0010_
BOOT S/W : 5.0.7.0.20_111706_0010_
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 741
(For additional information about the output, see the Nortel WLAN—Security Switch 2300 Series Command Line
Reference.)
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
742 Managing system files
Displaying boot information
Boot information consists of the WSS Software version and the names of the system image file and configuration file
currently running on the WSS. The boot command also lists the system image and configuration file that will be loaded
after the next reboot. The currently running versions are listed in the Booted fields. The versions that will be used after
the next reboot are listed in the Configured fields.
To display boot information, type the following command:
WSS# show boot
Configured boot version:
Configured boot image:
4.1.0.65
boot1:mx040100.020
Configured boot configuration: file:configuration
Backup boot configuration:
file:backup.cfg
Booted version:
4.1.0.65
Booted image:
Booted configuration:
Product model:
boot1:mx040100.020
file:configuration
WSS
In this example, the switch is running software version 4.1.0.65. The switch used the mx040100.020 image file in boot
partition boot1 and the configuration configuration file for the most recent reboot. The switch is set to use image file
mx040100.020 in boot partition boot1 and configuration file configuration for the next reboot. If WSS Software cannot
read the configuration file when the switch is booted, then the configuration file backup.cfg is used instead.
Each time the WSS successfully loads a WSS Software software image, a reference to this image is saved as the “safe
boot” image. If the WSS Software software cannot be loaded the next time the WSS is booted, then the WSS automati-
cally attempts to load the safe boot image.
Boot failover might occur when an image update is attempted, and the update process fails. For example, with image A
loaded on the WSS, you can configure the WSS to load image B the next time the switch is booted. When the switch is
reset, if image B fails to load, the switch then attempts to load image A (the last image successfully loaded on the WSS).
(For additional information about the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference.)
Working with files
The following section describe how to manage files stored on the WSS.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 743
Displaying a list of files
Files are stored on a WSS in the following areas:
•
•
•
File—Contains configuration files
Boot—Contains system image files
Temporary—Contains log files and other files created by WSS Software
The file and boot areas are in nonvolatile storage. Files in nonvolatile storage remain in storage following a
software reload or power cycle. The files in the temporary area are removed following a software reload or
power cycle.
The boot area is divided into two partitions, boot0 and boot1. Each partition can contain one system image file.
The file area can contain subdirectories. Subdirectory names are indicated by a forward slash at the end of the
name. In the following example, dangdir and old are subdirectories.
To display a list of the files in nonvolatile storage and temporary files, type the following command:
WSS# dir
==============================================================================
=
file:
Filename
Size
Created
file:configuration
file:corp2:corp2cnfig
corp_a/
48 KB Jul 12 2005, 15:02:32
17 KB Mar 14 2005, 22:20:04
512 bytes May 21 2004, 19:15:48
14 KB Mar 14 2005, 22:20:04
512 bytes May 16 2004, 17:23:44
40 KB May 09 2005, 21:08:30
12 KB Mar 15 2005, 19:18:44
28 KB Apr 19 2005, 16:37:18
file:dangcfg
old/
file:pubsconfig-april062005
file:sysa_bak
file:testback
Total:
159 Kbytes used, 207663 Kbytes free
==============================================================================
=
Boot:
Filename
Size
Created
boot0:mx040100.020
*boot1:mx040100.020
9780 KB Aug 23 2005, 15:54:08
9796 KB Aug 28 2005, 21:09:56
Boot0: Total:
Boot1: Total:
9780 Kbytes used, 2460 Kbytes free
9796 Kbytes used, 2464 Kbytes free
==============================================================================
=
temporary files:
Filename
Size
Created
core:command_audit.cur
37 bytes Aug 28 2005, 21:11:41
Total:
37 bytes used, 91707 Kbytes free
The following command displays the files in the old subdirectory:
WSS# dir old
==============================================================================
=
file:
Filename
Size
Created
file:configuration.txt
3541 bytes Sep 22 2003, 22:55:44
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
744 Managing system files
file:configuration.xml
24 KB Sep 22 2003, 22:55:44
Total:
27 Kbytes used, 207824 Kbytes free
The following command limits the output to the contents of the user files area:
WSS# dir file:
===============================================================================
file:
Filename
Size
Created
file:configuration
file:corp2:corp2cnfig
corp_a/
48 KB Jul 12 2005, 15:02:32
17 KB Mar 14 2005, 22:20:04
512 bytes May 21 2004, 19:15:48
14 KB Mar 14 2005, 22:20:04
512 bytes May 16 2004, 17:23:44
40 KB May 09 2005, 21:08:30
12 KB Mar 15 2005, 19:18:44
28 KB Apr 19 2005, 16:37:18
file:dangcfg
dangdir/
file:pubsconfig-april062005
file:sysa_bak
file:testback
Total:
159 Kbytes used, 207663 Kbytes free
The following command limits the output to the contents of the /tmp/core subdirectory:
WSS# dir core:
===============================================================================
file:
Filename
Size
Created
core:command_audit.cur
37 bytes Aug 28 2005, 21:11:41
Total:
37 bytes used, 91707 Kbytes free
The following command limits the output to the contents of the boot0 partition:
WSS# dir boot0:
===============================================================================
file:
Filename
Size
Created
boot0:mx040100.020
9780 KB Aug 23 2005, 15:54:08
Total:
9780 Kbytes used, 207663 Kbytes free
(For information about the fields in the output, see the Nortel WLAN Security Switch 2300 Series Command Line
Reference)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 745
Copying a file
You can perform the following copy operations:
•
•
•
•
Copy a file from a TFTP server to nonvolatile storage.
Copy a file from nonvolatile storage or temporary storage to a TFTP server.
Copy a file from one area in nonvolatile storage to another.
Copy a file to a new filename in nonvolatile storage.
To copy a file, use the following command.
copy source-url destination-url
A URL can be one of the following:
•
•
•
•
[subdirname/]filename
file:[subdirname/]filename
tftp://ip-addr/[subdirname/]filename
tmp:filename
The filename and file:filename URLs are equivalent. You can use either URL to refer to a file in a WSS’s nonvolatile
memory.
The tftp://ip-addr/filename URL refers to a file on a TFTP server. If DNS is configured on the WSS, you can specify a
TFTP server’s hostname as an alternative to specifying the IP address.
The tmp:filename URL refers to a file in temporary storage. You can copy a file out of temporary storage but you cannot
copy a file into temporary storage.
The subdirname/ option specifies a subdirectory.
If you are copying a system image file into nonvolatile storage, the destination-url must include the boot partition name.
You can specify one of the following:
•
•
boot0:/filename
boot1:/filename
You must specify the boot partition that was not used to load the currently running image.
The maximum supported file size for TFTP is 32 MB.
Note. You can copy a file from a WSS to a TFTP server or from a TFTP server to a
WSS, but you cannot use WSS Software to copy a file directly from one TFTP server to
another.
To copy the file floor2wss from nonvolatile storage to a TFTP server, type the following command:
WSS# copy floor2wss tftp://10.1.1.1/floor2mx
success: sent 365 bytes in 0.401 seconds [ 910 bytes/sec]
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
746 Managing system files
The above command copies the file to the same filename on the TFTP server. To rename the file when
copying it, type the following command:
WSS# copy floor2wss tftp://10.1.1.1/floor2mx-backup
success: sent 365 bytes in 0.401 seconds [ 910 bytes/sec]
To copy a file named newconfig from a TFTP server to nonvolatile storage, type the following command:
WSS# copy tftp://10.1.1.1/newconfig newconfig
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
The above command copies the file to the same filename. To rename the file when copying it, type the
following command:
WSS# copy tftp://10.1.1.1/newconfig mxconfig
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
To copy system image MX010101.020 from a TFTP server to boot partition 1 in nonvolatile storage, type the
following command:
WSS# copy tftp://10.1.1.107/NT504103.001 boot1:NT504103.001
............................................................................................................success: received
9163214 bytes in 105.939 seconds [ 86495 bytes/sec]
To rename test-config to new-config, you can copy it from one name to the other in the same location, and then
delete test-config. Type the following commands:
WSS# copy test-config new-config
WSS# delete test-config
success: file deleted.
To copy file corpa-login.html from a TFTP server into subdirectory corpa in a WSS’s nonvolatile storage,
type the following command:
WSS# copy tftp://10.1.1.1/corpa-login.html corpa/corpa-login.html
success: received 637 bytes in 0.253 seconds [ 2517 bytes/sec]
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 747
Using an image file’s MD5 checksum to verify its integrity
If you download an image file from the Nortel support site and install it in a switch’s boot partition, you can verify that
the file has not been corrupted while being copied.
md5 [boot0: | boot1:]filename
To verify an image file’s integrity:
1
2
Download the image file from the Nortel support site onto a TFTP server, and use the CLI copy tftp
command on the WSS to copy the image onto the switch’s nonvolatile storage.
On the Nortel support site, click on the MD5 link next to the link for the image file, to display the MD5
checksum for the file. Here is an example:
b9cf7f527f74608e50c70e8fb896392a NT504103.001
On the WSS, use the dir command to display the contents of nonvolatile storage.
Enter a command such as the following to calculate the checksum for the file:
3
4
pubs# md5 boot0:NT504103.001
MD5 (boot0:NT504103.001) = b9cf7f527f74608e50c70e8fb896392a
Note. You must include the boot partition name in the filename. For example,
you must specify boot0:NT504103.001. If you specify only NT504103.001, the CLI
displays a message stating that the file does not exist.
5
6
7
Compare the checksum on the support site with the checksum calculated by the WSS. If they match, then
the file has not been corrupted.
If you have not already done so, use the set boot partition command to configure the WSS to boot from
the partition containing the new image.
Use the reset system [force] command to restart the switch using the new image.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
748 Managing system files
Deleting a file
Caution! WSS Software does not prompt you to verify whether you want to delete a
file. When you press Enter after typing a delete command, WSS Software immediately
deletes the specified file. Nortel recommends that you copy a file to a TFTP server before
deleting the file.
Note. WSS Software does not allow you to delete the currently running software image
file or the running configuration.
To delete a file, use the following command:
delete url
The URL can be a filename of up to 128 alphanumeric characters.
To copy a file named testconfig to a TFTP server and delete the file from nonvolatile storage, type the
following commands:
WSS# copy testconfig tftp://10.1.1.1/testconfig
success: sent 365 bytes in 0.401 seconds [ 910 bytes/sec]
WSS# delete testconfig
success: file deleted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 749
Creating a subdirectory
You can create subdirectories in the user files area of nonvolatile storage. To create a subdirectory, use the following
command:
mkdir [subdirname]
To create a subdirectory called corp2 and display the root directory to verify the result, type the following commands:
WSS# mkdir corp2
success: change accepted.
WSS# dir
===============================================================================
file:
Filename
Size
17 KB
Created
file:configuration
file:configuration.txt
corp2/
May 21 2004, 18:20:53
379 bytes May 09 2004, 18:55:17
512 bytes May 21 2004, 19:22:09
512 bytes May 21 2004, 19:15:48
13 KB May 16 2004, 18:30:44
512 bytes May 16 2004, 17:23:44
512 bytes Sep 23 2003, 21:58:48
corp_a/
file:dangcfg
dangdir/
old/
Total:
33 Kbytes used, 207822 Kbytes free
===============================================================================
Boot:
Filename
Size
Created
*boot0:bload
746 KB May 09 2004, 19:02:16
8182 KB May 09 2004, 18:58:16
8197 KB May 21 2004, 18:01:02
*boot0:mx030000.020
boot1:mx030000.020
Boot0: Total:
Boot1: Total:
8928 Kbytes used, 3312 Kbytes free
8197 Kbytes used, 4060 Kbytes free
===============================================================================
temporary files:
Filename
Total:
Size
Created
0 bytes used, 93537 Kbytes free
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
750 Managing system files
Removing a subdirectory
To remove a subdirectory from nonvolatile storage, use the following command:
rmdir [subdirname]
To remove subdirectory corp2, type the following example:
WSS# rmdir corp2
success: change accepted.
Managing configuration files
A configuration file contains CLI commands that set up the WSS. The switch loads a designated configuration file
immediately after loading the system software when the software is rebooted. You also can load a configuration file
while the switch is running to change the switch’s configuration.
When you enter CLI commands to make configuration changes, these changes are immediately added to the device’s
running configuration but are not saved to the configuration file.
This section describes how to display the running configuration and the configuration file, and how to save and load
configuration changes. A procedure is also provided for resetting the WSS to its factory default configuration.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 751
Displaying the running configuration
To display the configuration running on the WSS, use the following command:
show config [area area] [all]
The area area parameter limits the display to a specific configuration area. (For more information, see the
Nortel WLAN Security Switch 2300 Series Command Line Reference.)
The all parameter includes all commands that are set at their default values. Without the all parameter, the
show config command lists only those configuration commands that set a parameter to a value other than the
default.
To display the running configuration, type the following command:
WSS# show config
# Configuration nvgen'd at 2004-5-10 19:08:38
# Image 2.1.0
# Model WSS
# Last change occurred at 2004-5-10 16:31:14
set trace authentication level 10
set ip dns server 10.10.10.69 PRIMARY
set ip dns server 10.20.10.69 SECONDARY
set ip route default 10.8.1.1 1
set log console disable severity debug
set log session disable severity alert
set log buffer enable severity error messages 200
set log trace disable severity error mbytes 10
set log server 192.168.253.11 severity critical
set timezone PST -8 0
set summertime PDT start first sun apr 2 0 end last sun oct 2 0
set system name WSS
set system countrycode US
set system contact nortel-pubs
set radius server r1 address 192.168.253.1 key sunflower
set server group sg1 members r1
set enablepass password b6b706525e1814394621eeb2a1c4d5803fcf
set authentication console * none
set authentication admin * none
set user tech password encrypted 1315021018
press any key to continue, q to quit.
To display only the VLAN configuration commands, type the following command:
WSS# show config area vlan
# Configuration nvgen'd at 2004-5-10 19:08:38
# Image 2.1.0
# Model WSS
# Last change occurred at 2004-5-10 16:31:14
set vlan 1 port 1
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
752 Managing system files
set vlan 10 name backbone tunnel-affinity 5
set vlan 10 port 21
set vlan 10 port 22
set vlan 3 name red tunnel-affinity 5
set igmp mrsol mrsi 60 vlan 1
set igmp mrsol mrsi 60 vlan 10
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 753
Saving configuration changes
To save the running configuration to a configuration file, use the following command:
save config [filename]
If you do not specify a filename of up to 128 alphanumeric characters, the command replaces the startup configuration
file that was loaded the last time the software was rebooted. (To display the filename of that configuration file, see
To save the running configuration to the file loaded the last time the software was rebooted, type the following
command:
WSS# save config
success: configuration saved.
To save the running configuration to a file named newconfig, type the following command:
WSS# save config newconfig
success: configuration saved to newconfig.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
754 Managing system files
Specifying the configuration file to use after the next reboot
By default, the WSS loads the configuration file named configuration from nonvolatile storage following a software
reboot. To use a different configuration file in nonvolatile storage after rebooting, use the following command:
set boot configuration-file filename
To configure a WSS to load the configuration file floor2mx from nonvolatile storage following the next software reboot,
type the following command:
WSS# set boot configuration-file floor2mx
success: boot config set.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 755
Loading a configuration file
Caution! This command completely removes the running configuration and replaces it
with the configuration contained in the file. Nortel recommends that you save a copy of the
current running configuration to a backup configuration file before loading a new
configuration.
To load configuration commands from a file into the WSS switch’s running configuration, use the following command:
load config [url]
The default URL is the name of the configuration file loaded after the last reboot.
To load a configuration file named newconfig, type the following command:
WSS# load config newconfig
Reloading configuration may result in lost of connectivity, do you wish to continue? (y/n) [n]y
success: Configuration reloaded
After you type y, WSS Software replaces the running configuration with the configuration in the newconfig file. If you
type n, WSS Software does not load the newconfig file and the running configuration remains unchanged.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
756 Managing system files
Specifying a backup configuration file
In the event that part of the configuration file is invalid or otherwise unreadable, WSS Software stops reading informa-
tion in the configuration file and does not use it. You can optionally specify a backup file to load if WSS Software
cannot load the original configuration file.
To specify a backup configuration file, use the following command:
set boot backup-configuration filename
To specify a file called backup.cfg as the backup configuration file, use the following command:
WSS# set boot backup-configuration backup.cfg
success: backup boot config filename set.
After enabling this feature, you can specify that a backup configuration file not be used by entering the following
command:
WSS# clear boot backup-config
success: Backup boot config filename was cleared.
To display the name of the file specified as the backup configuration file, enter the show boot command. For example:
pubs# show boot
Configured boot version:
4.1.0.60
Configured boot image:
boot0:mx040100.020
Configured boot configuration: file:configuration
Backup boot configuration:
backup.cfg
Booted version:
Booted image:
Booted configuration:
Product model:
4.1.0.60
boot0:mx040100.020
file:configuration
WSS
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 757
Resetting to the factory default configuration
To reset the WSS to its factory default configuration, use the following command:
clear boot config
This command removes the configuration file that the WSS searches for after the software is rebooted.
To back up the current configuration file named configuration and reset the WSS to the factory default configuration,
type the following commands:
WSS# copy configuration tftp://10.1.1.1/backupcfg
success: sent 365 bytes in 0.401 seconds [ 910 bytes/sec]
WSS# clear boot config
success: Reset boot config to factory defaults.
WSS# reset system force
...... rebooting ......
The reset system force command reboots the switch. The force option immediately restarts the system and reboots. If
you do not use the force option, the command first compares the running configuration to the configuration file. If the
files do not match, WSS Software does not restart the WSS but instead displays a message advising you to either save
the configuration changes or use the force option.
Backing up and restoring the system
WSS Software has commands that enable you to easily backup and restore WSS system and user files:
backup system [tftp:/ip-addr/]filename [all | critical]
restore system [tftp:/ip-addr/]filename [all | critical] [force]
The backup command creates an archive in Unix tape archive (tar) format.
The restore command unzips an archive created by the backup command and copies the files from the archive onto the
switch. If a file in the archive has a counterpart on the switch, the archive version of the file replaces the file on the
switch. The restore command does not delete files that do not have counterparts in the archive. For example, the
command does not completely replace the user files area. Instead, files in the archive are added to the user files area. A
file in the user area is replaced only if the archive contains a file with the same name.
You can create or unzip an archive located on a TFTP server or in the switch’s nonvolatile storage. If you specify a
TFTP server as part of the filename with the backup command, the archive is copied directly to the TFTP server and not
stored locally on the switch.
Both commands have options to specify the types of files you want to back up and restore:
•
critical—Backs up or restores system files, including the configuration file used when booting, and certificate files.
The size of an archive created by this option is generally 1MB or less. This is the default for the restore command.
•
all—Backs up or restores the same files as the critical option, and all files in the user files area of nonvolatile
storage. (The user files area contains the set of files listed in the file section of dir command output.) Archive files
created by the all option are larger than files created by the critical option. The file size depends on the files in the
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
758 Managing system files
user area, and the file can be quite large if the user area contains image files. This is the default for the backup
command.
Note. If the archive’s files cannot fit on the switch, the restore operation fails.
Nortel recommends deleting unneeded image files before creating or restoring an
archive.
Use the critical option if you want to back up or restore only the system-critical files required to operate and communi-
cate with the switch. Use the all option if you also want to back up or restore Web-based AAA pages, backup
configuration files, image files, and any other files stored in the user files area of nonvolatile storage.
The maximum supported file size is 32 MB. If the file size of the tarball is too large, delete unnecessary files (such as
unneeded copies of system image files) and try again, or use the critical option instead of the all option.
Neither option archives image files or any other files listed in the Boot section of dir command output. The all option
archives image files only if they are present in the user files area.
The backup command stores the MAC address of the switch in the archive. By default, the restore command works
only if the MAC address in the archive matches the MAC address of the switch where the restore command is entered.
The force option overrides this restriction and allows you to unpack one switch’s archive onto another switch.
Caution! Do not use the force option unless advised to do so by Nortel TAC. If you
restore one switch’s system files onto another switch, you must generate new key pairs
and certificates on the switch.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 759
Managing configuration changes
The backup command places the boot configuration file into the archive. (The boot configuration file is the Configured
boot configuration in the show boot command’s output.) If the running configuration contains changes that have not
been saved, these changes are not in the boot configuration file and are not archived. To make sure the archive contains
the configuration that is currently running on the switch, use the save config command to save the running configuration
to the boot configuration file, before using the backup command.
The restore command replaces the boot configuration on the switch with the one in the archive. The boot configuration
includes the configuration filename and the image filename to use after the next switch restart. (These are the Configured
boot image and Configured boot configuration files listed in the show boot command’s output.) The restore command
does not affect the running image or the running configuration.
If you want to use the configuration in the boot configuration file restored from an archive instead of the configuration
currently running on the switch, use the load config command to load the boot configuration file, or restart the switch. If
instead, you want to replace the configuration restored from the archive with the running configuration, use the save
config command to save the running configuration to the boot configuration file.
Note. The next time the switch is restarted after the restore command is used, the
switch uses the boot configuration filename that was in use when the archive was created.
If you change the boot configuration filename after creating the archive, the new name is
not used when the switch is restarted. To use the new configuration, use the save config
filename command, where filename is the name of the boot configuration file restored from
the archive, before you restart the switch. If you have already restarted the switch, use the
load config filename command to load the new configuration, then use the save config
filename command.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
760 Managing system files
Backup and restore examples
The following command creates an archive of the system-critical files and copies the archive directly to a TFTP server.
The filename in this example includes a TFTP server IP address, so the archive is not stored locally on the switch.
WSS# backup system tftp:/10.10.20.9/sysa_bak critical
success: sent 28263 bytes in 0.324 seconds [ 87231 bytes/sec]
The following command restores system-critical files on a switch, from archive sysa_bak:
WSS# restore system tftp:/10.10.20.9/sysa_bak
success: received 11908 bytes in 0.150 seconds [ 79386 bytes/sec]
success: restore complete.
Upgrading the system image
To upgrade the WSS from one WSS Software version to another, use the procedure in this section. For a given release,
there may be notes and cautions that apply only to that release. Consequently, before upgrading to a new software image,
you should also consult the release notes for that release.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 761
Preparing the WSS for the upgrade
Caution! Save the configuration, then create a backup of your WSS files before
you upgrade the switch. Nortel recommends that you make a backup of the switch files
before you install the upgrade. If an error occurs during the upgrade, you can restore your
switch to its previous state.
Use the following command to save the configuration. Unsaved changes will be lost during the upgrade procedure.
save config [filename]
If the switch is running WSS Software Version 4.0 or later, you can use the following command to back up the switch’s
files:
backup system [tftp:/ip-addr/]filename [all | critical]
To restore a switch that has been backed up, use the following command:
restore system [tftp:/ip-addr/]filename [all | critical] [force]
“Upgrade scenario” on page 762 shows an example use of the backup command. For more information about these
Note. If you have made configuration changes but have not saved the changes, use the
save config command to save the changes, before you back up the switch.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
762 Managing system files
Upgrading an individual switch using the CLI
1
2
3
Save the configuration, using the save config command.
Back up the switch, using the backup system command.
Copy the new system image onto a TFTP server.
download the image onto the server.
4
Copy the new system image file from the TFTP server into a boot partition in the switch’s nonvolatile
storage.
You can copy the image file only into the boot partition that was not used for the most recent restart. For
example, if the currently running image was booted from partition 0, you can copy the new image only
into partition 1.
5
6
Set the boot partition to the one with the upgrade image for the next restart.
To verify that the new image file is installed, type show boot.
Reboot the software.
To restart a WSS and reboot the software, type the following command:
reset system [force]
When you restart the WSS, the switch boots using the new WSS Software image. The switch also sends the AP version
of the new boot image to APs and restarts the APs. After an AP restarts, it checks the version of the new AP boot image
to make sure the boot image is newer than the boot image currently installed on the AP. If the boot image is newer, the
AP completes installation of its new boot image by copying the boot image into the AP’s flash memory, which takes
about 30 seconds, then restarts again. The upgrade of the AP is complete after the second restart.
Upgrade scenario
To upgrade 2382 from WSS Software Version 5.0 to WSS Software Version 6.0, type the following commands.
Note. This example copies the image file into boot partition 1. On your switch, copy the
image file into the boot partition that was not used the last time the switch was restarted.
For example, if the switch booted from boot partition 1, copy the new image into boot
partition 0. To see boot partition information, type the show boot command.
WSS# save config
success: configuration saved.
WSS# backup system tftp://172.16.0.10/sysa_bak
success: sent 13628 bytes in 0.150 seconds [ 90853 bytes/sec]
success: received 13628 bytes in 0.146 seconds [ 93342 bytes/sec]
success: backup complete.
WSS# copy tftp://172.16.0.10/NT504105.001 boot1:NT504105.001
.........................................success: received 7441834 bytes in 106.899 seconds [ 69615 bytes/sec]
WSS# set boot partition boot1
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Managing system files 763
success: Boot partition set to boot1:NT504105.001 <4.1.5.1>.
WSS# show boot
Configured boot version:
Configured boot image:
5.0.5.1
boot1:NT504105.001
Configured boot configuration: file:configuration
Backup boot configuration:
backup
Booted version:
5.0.4.6
Booted image:
Booted configuration:
Product model:
boot0:NT504105.001
file:configuration
2360/2361
WSS# reset system
This will reset the entire system. Are you sure (y/n) y
...... rebooting ......
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
764 Managing system files
Command changes during upgrade
When you upgrade a WSS, some commands from the previously installed release may have been deprecated or changed
in the new release, which may affect your configuration. For information about commands that were deprecated or
changed from a previous release, see the release notes for the release you are installing.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
765
Appendix A: Troubleshooting a
WSS
Fixing common WSS setup problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 766
Recovering the system when the enable password is lost . . . . . . . . . . . . . . . . . . . . . 768
Configuring and managing the system log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769
Running traces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776
Using show commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780
Port mirroring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 782
Remotely monitoring traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 783
Some common problems that occur during WSS installation and basic configuration are simple to solve. However, to
“recover” the system password, you must delete the existing WSS configuration.
System logs provide a history of WSS Software events. Traces display real-time messages from all WSS Software areas.
Some show commands are particularly useful in troubleshooting. The show tech-support command combines a number
of show commands into one, and provides an extensive snapshot of your WSS configuration settings for the Nortel
Enterprise Technical Support (NETS).
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
766 Appendix A:Troubleshooting a WSS
Fixing common WSS setup problems
Table 46 contains remedies for some common problems that can occur during basic installation and setup of a WSS.
Table 46: WSS setup problems and remedies
Symptom
Diagnosis
Remedy
WLAN Management
The switch’s time and date are
1. Use set timezone to set the time
zone in which you are operating the
switch. (See “Setting the time zone”
2. Use set timedate to configure the
current time and date in that time
zone. (See “Statically configuring
page 178.)
Software or a web browser currently incorrect, or were
(if you are using Web
View) warns that the
WSS’s certificate date is
invalid.
incorrect when you generated
the self-signed certificate or
certificate request.
3. Reconfigure the administrative
certificate(s). (See “Managing keys
4. If you have already configured a
certificate on the switch for
authentication by network users,
you must recreate this certificate,
too.
WSS does not accept
The country code might not be
1. Type the show system command to
display the country code configured
on the switch.
configuration information set or might be set for another
for an AP or a radio.
country.
2. If the value in the System
Countrycode field is NONE or is for
a country other than the one in
which you are operating the switch,
use the set system countrycode
command to configure the correct
country code. (See “Specifying the
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 767
Table 46: WSS setup problems and remedies (continued)
Symptom
Diagnosis
Remedy
Client cannot access the
network.
This symptom has more than
one possible cause:
•
The client might be failing
authentication or might
not be authorized for a
VLAN.
1. Type the show aaa command to
ensure that the authentication rules
on the WSS allow the client to
authenticate. (See “Displaying the
2. Check the authorization rules in the
switch’s local database (show aaa)
or on the RADIUS servers to ensure
the client is authorized to join a
VLAN that is configured on at least
one of the WSSs in the Mobility
Domain. (See “Assigning
page 594.)
•
If the client and switch
configurations are correct,
a VLAN might be
disconnected. A client
connected to a
disconnected VLAN is
unable to access the
network.
1. Type the show vlan config
command to check the status of
each VLAN.
2. If a VLAN is disconnected (VLAN
state is Down), check the network
cables for the VLAN’s ports. At
least one of the ports in a VLAN
must have a physical link to the
network for the VLAN to be
connected.
Configuration information The configuration changes
disappears after a software were not saved.
reload.
1. Retype the commands for the
missing configuration information.
2. Type the save config command to
save the changes.
Mgmt LED is quickly
blinking amber.
The WSS was unable to load Type the boot command at the boot prompt.
the system image file.
CLI stops at boot prompt
(boot>).
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
768 Appendix A:Troubleshooting a WSS
Recovering the system when the enable password is
lost
You can recover any model switch if you have lost or forgotten the enable password. You also can recover a 2350 even
if you have lost or forgotten the login password.
Caution! Recovering the system will delete your configuration file.
To recover a WSS, use one of the following procedures.
2350
1
After the switch has fully booted, use a pin to press the factory reset switch for at least 5 seconds. This
operation erases the switch’s configuration.
2
3
Use a web browser to access IP address 192.168.100.1. This address accesses the Web Quick Start.
Use the Web Quick Start to set the administrator usernames and passwords and other parameters. Make
sure you reconfigure the switch’s IP connection.
4
2382, 2380 or 2360/2361
1
Reboot the switch, and interrupt the WSS boot process.
Insert a pin into the restart switch or power the WSS off and on again to cause the WSS to reboot.
Figure 38 shows the location of the restart switch. The restart switch on a 2360/2361, 2380 or 2382
switch is also located next to its serial console port.
Figure 38. WSS restart switch location
Restart switch
Rst
100-240V
50/60 Hz
8A MAX
Mgmt
Console
1
2
3
4
5
6
7
8
9
10
Link
AP
21
22
Link
AP
DISCONNEC
ALL POWER
BEFORE
11 12 13 14
15 16 17 18 19 20
SERVICING
2
When you see descending numbers on the console, press q, then press Enter.
Type the following command at the boot> prompt:
boot> boot OPT+=default
3
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 769
If you do not type the command before the reset cycle is complete, the WSS returns to the state it was in before you
restarted it.
Once you have entered the command, the WSS returns to its initial unconfigured state. For information on how to
For model 2382, 2360/2361, you also can reconfigure basic parameters using the Web Quick Start. Use a web browser to
access IP address 192.168.100.1.
Caution! Use an enable password that you will remember. If you lose the password, the
only way to restore it causes the system to return to its default settings and wipes out the
configuration.
Configuring and managing the system log
System logs provide information about system events that you can use to monitor and troubleshoot WSS Software.
Event messages for the WSS and its attached APs can be stored or sent to the following destinations:
•
•
•
•
Stored in a local buffer on the WSS
Displayed on the WSS console port
Displayed in an active Telnet session
Sent to one or more syslog servers, as specified in RFC 3164
The system log is a file in which the newest record replaces the oldest. These entries are preserved in nonvolatile
memory through system reboots.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
770 Appendix A:Troubleshooting a WSS
Log message components
Each log message contains the following components:
Field
Description
Facility
Date
Portion of WSS Software that is affected
Time and date the message is generated
Severity
page 771.)
Tag
Identifier for the message
Message
Description of the error condition
Logging destinations and levels
A logging destination is the location to which logged event messages are sent for storage or display. By default, only
session logging is disabled. You can enable or disable logging to each destination and filter the messages by the severity
System events and conditions at different severity levels can be logged to multiple destinations. By default, events at the
error level and higher are posted to the console and to the log buffer. Debug output is logged to the trace buffer by
Table 47: System log destinations and defaults
Destination
Definition
Default Operation and Severity Level
buffer
Sends log information to the
nonvolatile system buffer.
Buffer is enabled and shows error-level events.
console
current
Sends log information to the
console.
Console is enabled and shows error-level events.
Settings for the type of session that the user is
Sends log information to the
current Telnet or console session. currently having with the WSS
server
ip-address
Sends log information to the
syslog server at the specified IP
address.
Server is set during configuration and displays
error-level events.
sessions
trace
Sets defaults for Telnet sessions. Logging is disabled and shows information-level
events when enabled.
Sends log information to the
volatile trace buffer.
Trace is enabled and shows debug output.
Specifying a severity level sends log messages for events or conditions at that level or higher to the logging destination.
Table 48 lists the severity levels and their descriptions. (For defaults, see Table 47: “System log destinations and
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 771
Table 48: Event severity levels
Severity
Description
emergency
alert
The WSS is unusable.
Action must be taken immediately.
critical
You must resolve the critical conditions. If the conditions are not
resolved, the WSS can reboot or shut down.
error
The WSS is missing data or is unable to form a connection.
A possible problem exists.
warning
notice
Events that potentially can cause system problems have occurred. These
are logged for diagnostic purposes. No action is required.
info
Informational messages only. No problem exists.
Output from debugging.
debug
Note: The debug level produces a lot of messages, many of
which can appear to be somewhat cryptic. Debug messages
are used primarily by Nortel for troubleshooting and are not
intended for administrator use.
Using log commands
To enable, disable, or modify system logging to the WSS’s log buffer, console, current Telnet session, or trace buffer,
use the following command:
set log {buffer | console | current | sessions | trace} [severity severity-level] [enable | disable]
To configure system logging to a syslog server, use the following command:
set log server ip-addr [port port-number] severity severity-level [local-facility facility-level]
To enable periodic mark messages for use in troubleshooting, use the following command:
set log mark [enable | disable] [severity level]
[interval interval]
To view log entries in the system or trace buffer, use the following command:
show log buffer | trace
To clear log messages from the system or trace buffer, use the following command:
clear log buffer | trace
To stop sending messages to a syslog server, use the following command:
clear log server ip-addr
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
772 Appendix A:Troubleshooting a WSS
Logging to the log buffer
The system log consists of rolling entries stored as a last-in first-out queue maintained by the WSS. Logging to the
buffer is enabled by default for events at the error level and higher.
To modify settings to another severity level, use the following command:
set log buffer severity severity-level
For example, to set logging to the buffer for events at the warning level and higher, type the following command:
WSS# set log buffer severity warning
success: change accepted.
To view log entries in the system log buffer, use the following command:
show log buffer [{+|-} number-of-messages] [facility facility-name] [matching string] [severity
severity-level]
You can display the most recent messages or the oldest messages:
•
•
Type a positive number (for example, +100) to display that number of log entries starting from the oldest in the log.
Type a negative number (for example, -100) to display that number of log entries starting from the newest in the log.
You can search for strings by using the keyword matching and typing any string, such as a username or IP address.
You can display event information at a particular severity level. (See Table 48 on page 771 for information on severity
levels.)
For example, the following command displays all messages at the error severity level or higher:
WSS# show log buffer severity error
SYS Jun 02 17:41:35. 176214 ERROR nos_vms_port?add: Failed to set default vlan v1 an:4096
for port 3 rc 1
To filter the event log by WSS Software area, use the facility facility-name keyword. For a list of facilities for which you
can view event messages, type the following command:
WSS# show log buffer facility ?
<facility name>
Select one of: KERNEL, AAA, SYSLOGD, ACL, APM, ARP, ASO,
BOOT, CLI, CLUSTER, CRYPTO, DOT1X, NET, ETHERNET, GATEWAY, HTTPD,
IGMP, IP, MISC, NOSE, NP, RAND, RESOLV, RIB, ROAM, ROGUE, SM, SNMPD,
SPAN, STORE, SYS, TAGMGR, TBRIDGE, TCPSSL, TELNET, TFTP, TLS, TUNNEL,
VLAN, X509, XML, AP, RAPDA, WEBVIEW, EAP, FP, STAT, SSHD, SUP, DNSD,
CONFIG, BACKUP.
To clear the buffer, type the following command:
WSS# clear log buffer
To disable logging to the system buffer, type the following command:
WSS# set log buffer disable
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 773
Logging to the console
By default, console logging is enabled and messages at the error level and higher are sent to the console.
To modify console logging, use the following command:
set log console severity severity-level
For example, to set logging to the console for events at the critical severity level and higher, type the following
command:
WSS# set log console severity critical
success: command accepted.
To disable console logging, type the following command:
WSS# set log console disable
success: change accepted.
The console is always available, but it has the following limitations:
•
•
Console logging is slow.
Messages logged to the console are dropped if the console output buffer overflows. WSS Software displays a
message indicating the number of messages dropped.
•
If you type anything to the console, the typing disables log output to the console until you press the Enter key.
Logging messages to a syslog server
To send event messages to a syslog server, use the following command:
set log server ip-addr [port port-number] severity severity-level [local-facility facility-level]
Use the IP address of the syslog server to which you want messages sent. (See Table 48 on page 771 for information
about severity levels.)
By default, WSS Software uses TCP port 514 for sending messages to the syslog server. You can use the optional port
keyword to specify a different port for syslog messages. You can specify a number from 1 to 65535.
Use the optional local-facility keyword to override the default WSS Software facility numbers and replace them with
one local facility number. Use the numbers 0 through 7 to map WSS Software event messages to one of the standard
local log facilities local0 through local7 specified by RFC 3164.
If you do not specify a local facility, WSS Software sends the messages with their default WSS Software facilities. For
example, AAA messages are sent with facility 4 and boot messages are sent with facility 20 by default.
For example, the following command sends all error-level event messages generated by a WSS to a server at IP address
192.168.153.09 and identifies them as facility 5 messages:
WSS# set log server 192.168.153.09 severity error local-facility 5
success: change accepted.
To stop sending log messages to a syslog server, use the following command:
clear log server ip-addr
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
774 Appendix A:Troubleshooting a WSS
Setting Telnet session defaults
Session logging is disabled by default, and the event level is set to information (info) or higher. To enable
event logging to Telnet sessions and change the default event severity level, use the following command:
set log sessions severity severity-level enable
To disable session logging, use the following command:
set log sessions disable
Changing the current Telnet session defaults
By default, log information is not sent to your current Telnet session, and the log level is set to information
(info) or higher. To modify the severity of events logged to your current Telnet session, use the following
command from within the session:
set log current severity severity-level
To enable current session logging, type the following command:
WSS# set log current enable
success: change accepted
To disable current session logging, type the following command:
WSS# set log current disable
success: change accepted
Logging to the trace buffer
Trace logging is enabled by default and stores debug-level output in the WSS trace buffer. To modify trace
logging to an event level higher than debug, use the following command:
set log trace severity severity-level
To disable trace logging, use the following command:
set log trace disable
success: change accepted.
(To display the trace log, see “Stopping a trace” on page 777. For information about the trace function, see
Enabling mark messages
You can configure WSS Software to generate mark messages at regular intervals. The mark messages indicate
the current system time and date. Nortel can use the mark messages to determine the approximate time when a
system restart or other event causing a system outage occurred.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 775
Mark messages are disabled by default. When they are enabled, WSS Software generates a message at the notice level
once every 300 seconds by default.
To enable mark messages, use the following command:
WSS# set log mark enable
success: change accepted.
Saving trace messages in a file
To save the accumulated trace data for enabled traces to a file in the WSS’s nonvolatile storage, use the following
command:
save trace filename
To save trace data into the file trace1 in the subdirectory traces, type the following command:
WSS# save trace traces/trace1
Displaying the log configuration
To display your current log configuration, type the following command:
WSS# show log config
Logging console:
Logging console severity:
Logging sessions:
enabled
INFO
enabled
Logging sessions severity: INFO
Logging buffer:
Logging buffer severity:
Logging trace:
Logging trace severity:
Logging buffer size:
Log marking:
enabled
ERROR
enabled
DEBUG
1048576 bytes
disabled
Log marking severity:
Log marking interval:
NOTICE
300 seconds
Logging server:
172.21.12.19 port 514 severity EMERGENCY
Current session:
Current session severity:
disabled
INFO
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
776 Appendix A:Troubleshooting a WSS
Running traces
Trace commands enable you to perform diagnostic routines. You can set a trace command with a keyword,
such as authentication or sm, to trace activity for a particular feature, such as authentication or the session
manager.
Caution! Using the set trace command can have adverse effects on system
performance. Nortel recommends that you use the lowest levels possible for initial trace
commands, and slowly increase the levels to get the data you need.
Using the trace command
Tracing is used only for debugging WSS Software. The command set trace area enables you to view
messages about the status of a specific portion of the WSS Software.
There are many trace parameters that you can run. (See “List of trace areas” on page 780.) However, this
chapter describes only authentication, authorization, the session manager (sm), and 802.1X users (dot1x), four
areas that you might find most helpful.
To focus on the object of the trace, you can add one or more of these parameters to the set trace command:
set trace [area] [mac-addr mac-addr] [port port-num] [user username] [level level]
Tracing authentication activity
Tracing authentication activity can help you diagnose authentication problems. You can trace all authentica-
tion activity, or only the activity for a specific user, MAC address, or port.
For example, to trace all authentication activity at level 4, type the following command:
WSS# set trace authentication level 4
success: change accepted.
Tracing session manager activity
You can trace all session manager commands, or only those for a specific user, MAC address, or port. For
example, to trace all session manager (sm) activity at level 3, type the following command:
WSS# set trace sm level 3
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 777
Tracing authorization activity
Tracing authorization activity can help diagnose authorization problems. For example, to trace the authorization of MAC
address 00:00:30:b8:72:b0, type the following command:
WSS# set trace authorization mac-addr 00:00:30:b8:72:b0
success: change accepted.
Tracing 802.1X sessions
Tracing 802.1X sessions can help diagnose problems with wireless clients. For example, to trace 802.1X activity for user
tamara@example.com at level 4, type the following command:
WSS# set trace dot1x user tamara@example.com level 4
success: change accepted.
Displaying a trace
Use the show trace command to show the trace areas that are enabled. For example, to display all currently running
trace commands, type the following command:
WSS# show trace
milliseconds spent printing traces: 31.945
Trace Area
Level Mac
User
Port Filter
--------------
----------------
authentication
authorization
sm
--------------
--------
3
5
5
admin
11
0
0
0
0
dot1x
2
Stopping a trace
The clear trace commands deletes running trace commands. To clear all traces or a particular trace area, type the
following command:
clear trace {all | trace area}
For example, to stop a trace of session manager activity, type the following command:
WSS# clear trace sm
success: change accepted.
About trace results
The trace commands use the underlying logging mechanism to deliver trace messages. Trace messages are generated
with the debug severity level. By default, the only log target that receives debug-level messages is the volatile trace
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
778 Appendix A:Troubleshooting a WSS
The volatile trace buffer receives messages for all log severities when any trace area is active. However, if no trace area
is active, no messages are sent to the trace buffer regardless of their severity. If you do not enable trace commands, the
trace buffer is effectively disabled.
Because traces use the logging facility, any other logging target can be used to capture trace messages if its severity is set
to debug. However, since tracing can be voluminous, Nortel discourages this in practice. To enable trace output to the
console, enter the command set log console severity debug.
If you attempt to send trace output to a Telnet session, be aware that tracing is disabled for areas processing packets that
might be associated with the Telnet session.
Displaying trace results
To view the output of currently running trace commands, use the following command:
show log trace [{+|-|/}number-of-messages] [facility facility-name] [matching string]
[severity severity-level]
For example, the following command displays a trace log of error-level events:
WSS# show log trace severity error
KERNEL Jan 15 23:08:10 ERROR duplicate IP address 10.7.122.102 sent from link address
00:05:5d:45:ae:cd
To display a specific number of trace log messages, you must enter a plus sign (+), minus sign (-), or slash (/) before the
number. These characters filter the messages displayed as follows:
+number-of-messages
-number-of-messages
/number-of-messages
Displays the specified number of log entries, starting with the oldest in
the log.
Displays the specified number of entries, starting with the newest in
the log.
Displays the specified number of the most recent entries in the log,
starting with the least recent.
To filter trace output by WSS Software area, use the facility facility-name keyword. For a list of valid facilities for
which you can view event messages, type the following command:
WSS# show log trace facility ?
<facility name>
Select one of: KERNEL, AAA, SYSLOGD, ACL, APM, ARP,ASO,
BOOT, CLI, CLUSTER, CRYPTO, DOT1X, ENCAP, ETHERNET, GATEWAY, HTTPD, IGMP,
IP, MISC, NOSE, NP, RAND, RESOLV, RIB, ROAM, ROGUE, SM, SNMPD, SPAN, STORE,
SYS, TAGMGR, TBRIDGE, TCPSSL, TELNET, TFTP, TLS, TUNNEL, VLAN, X509, XML, AP,
RAPDA, WEBVIEW, EAP, PORTCONFIG, FP.
Copying trace results to a server
To copy the contents of the trace buffer to a file on a TFTP server, use the following command:
copy trace-buffer-name tftp://[destination-ip-addr | destination-hostname]/destination-filename
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 779
To find the name of the trace buffer file, use the dir command.
For example, the following command copies the log messages in trace buffer 0000000001 to a TFTP server at IP address
192.168.253.11, in a file called log-file:
WSS# copy 0000000001 tftp://192.168.253.11/log-file
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
780 Appendix A:Troubleshooting a WSS
Clearing the trace log
To clear all messages from the trace log buffer, type the following command:
WSS# clear log trace
List of trace areas
To see all WSS Software areas you can trace, type the following command:
WSS# set trace?
Using show commands
To troubleshoot the WSS, you can use show commands to display information about different areas of the WSS
Software. The following commands can provide helpful information if you are experiencing WSS Software performance
issues.
Viewing VLAN interfaces
To view interface information for VLANs, type the following command:
WSS# show interface
* = From DHCP
VLAN Name
---------------
1 default
Address
Mask
Enabled
State
RIB
---------------- ------------------ ----------
-------- --------
0.0.0.0
192.168.12.7
192.168.19.7
0.0.0.0
255.255.255.0
255.255.255.0
NO
YES
YES
Down
Up
Up
ipv4
ipv4
ipv4
130 vlan-eng
190 vlan-wep
Viewing AAA session statistics
To view AAA session statistics, type the following command:
WSS# show aaa
Default Values
authport=1812 acctport=1813 timeout=5 acct-timeout=5
retrans=3 deadtime=5 key=(null) author-pass=(null)
Radius Servers
Server
Addr
Ports T/o Tries Dead State
-------------------------------------------------------------------
SQA2BServer
SideShow
11.1.1.11
192.168.0.21 1812 1813 5
1812 1813 5
3
3
5
0
UP
UP
Server groups
sg1: SideShow
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 781
SQA: SQA2BServer
set authentication dot1x *@xmpl.com pass-through sg1
set authentication dot1x *@xmpl.com pass-through SQA
set authentication dot1x EXAMPLE\* peap-mschapv2 sg1
user sqa
password = 08325d4f (encrypted)
session-timeout = 3600
mac-user 00:00:a6:47:ad:03
session-timeout = 3600
vlan-name = vlan-wep
mac-user 00:00:65:16:0d:69
session-timeout = 3600
vlan-name = vlan-eng
(For more information about AAA, see “Configuring Web-based AAA for administrative and local access” on
Viewing FDB information
The show fdb command displays the hosts learned by the WSS and the ports to which they are connected. To
display forwarding database (FDB) information, type the following command:
WSS# show fdb
* = Static Entry. + = Permanent Entry. # = System Entry.
VLAN TAG
--------------
130
Dest MAC/Route
Des [CoS]
Destination Ports or VCs/[Protocol Type]
--------------------------------------------------
--------------------------- -------------
3 00:05:5d:7e:94:83
1
[ALL]
[ALL]
[ALL]
[ALL]
[ALL]
[ALL]
[ALL]
[ALL]
[ALL]
130
130 00:02:2d:85:6b:4d
130 00:0b:0e:12:34:56
130 00:0b:0e:02:76:f6
2 00:02:2d:86:bd:38
t:192.168.14.6
130
t:192.168.15.5
t:192.168.14.6
130
130
3
1
130
3 00:05:5d:84:d3:d3
4097
4096
130
00:0b:0e:00:04:30
00:0b:0e:00:04:30
00:0b:0e:00:04:30
#
#
#
CPU
CPU
CPU
Total Matching FDB Entries Displayed = 32
dynamic = 27, static=0, permanent=0, system=5
(For more information about forwarding databases, see “Managing the layer 2 forwarding database” on
page 130.)
Viewing ARP information
The show arp command displays the ARP aging timer and ARP entries in the system. To display ARP infor-
mation, type the following command:
WSS# show arp
ARP aging time: 1200 seconds
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
782 Appendix A:Troubleshooting a WSS
Host HW Address VLAN Type State
------------------------------ ----------------- ----- ------- --------
10.8.1.1
10.8.107.1
00:30:b6:3e:5c:a8 1 DYNAMIC RESOLVED
00:0b:0e:00:04:0c 1 LOCAL RESOLVED
Port mirroring
Port mirroring is a troubleshooting feature that copies (mirrors) traffic sent or received by a WSS port (the source port)
to another WSS port (the observer). You can attach a protocol analyzer to the observer port to examine the source port’s
traffic. Both traffic directions (send and receive) are mirrored.
Note. Port mirroring enables you to snoop traffic on wired ports. To snoop wireless
Configuration requirements
•
•
•
The switch can have one port mirroring pair (one source port and one observer port) at a time.
The source port can be a network port, AP access port, or wired authentication port.
The observer port must be a network port, and cannot be a member of any VLAN or port group.
Configuring port mirroring
To configure port mirroring, use the following command to specify the source and observer ports:
set port mirror source-port observer observer-port
For example, to set port 2 to monitor port 1’s traffic, use the following command:
WSS# set port 1 observer 2
Attach a protocol analyzer to the observer port; in this example, port 2.
Displaying the port mirroring configuration
To display the port mirroring configuration on a switch, use the following command:
WSS# show port mirror
Port 1 is mirrored to port 2
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 783
Clearing the port mirroring configuration
To clear the port mirroring configuration from a switch, use the following command:
clear port mirror
Remotely monitoring traffic
Remote traffic monitoring enables you to snoop wireless traffic, by using a AP as a sniffing device. The AP copies the
sniffed 802.11 packets and sends the copies to an observer, which is typically a protocol analyzer such as Ethereal or
Tethereal.
How remote traffic monitoring works
To monitor wireless traffic, an AP radio compares traffic sent or received on the radio to snoop filters applied to the
radio by the network administrator. When an 802.11 packet matches all conditions in a filter, the AP encapsulates the
packet in a Tazmen Sniffer Protocol (TZSP) packet and sends the packet to the observer host IP addresses specified by
the filter. TZSP uses UDP port 37008 for its transport. (TZSP was created by Chris Waters of Network Chemistry.)
You can map up to eight snoop filters to a radio. A filter does not become active until you enable it. Filters and their
mappings are persistent and remain in the configuration following a restart. The filter state is also persistent across
restarts. Once a filter is enabled, if the switch or the AP is subsequently restarted, the filter remains enabled after the
restart. To stop using the filter, you must manually disable it.Using snoop filters on radios that use Scheduled RF
Scanning
When Scheduled RF Scanning is enabled in a radio profile, the radios that use the profile actively scan other channels in
addition to the data channel that is currently in use. Scheduled RF Scanning operates on enabled radios and disabled
radios. In fact, using a disabled radio as a dedicated scanner provides better rogue detection because the radio can spend
more time scanning on each channel.
When a radio is scanning other channels, snoop filters that are active on the radio also snoop traffic on the other
channels. To prevent monitoring of data from other channels, use the channel option when you configure the filter, to
specify the channel on which you want to snoop.
All snooped traffic is sent in the clear
Traffic that matches a snoop filter is copied after it is decrypted. The decrypted (clear) version is sent to the observer.
Best practices for remote traffic monitoring
•
Do not specify an observer that is associated with the AP where the snoop filter is running. This configuration
causes an endless cycle of snoop traffic.
•
If the snoop filter is running on a AP, and the AP used a DHCP server in its local subnet to configure its IP
information, and the AP did not receive a default router (gateway) address as a result, the observer must also be in
the same subnet. Without a default router the AP cannot find the observer.
•
The AP that is running a snoop filter forwards snooped packets directly to the observer. This is a one-way
communication, from the AP to the observer. If the observer is not present, the AP still sends the snoop packets,
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
784 Appendix A:Troubleshooting a WSS
which use bandwidth. If the observer is present but is not listening to TZSP traffic, the observer continuously sends
ICMP error indications back to the AP. These ICMP messages can affect network and AP performance.
To inform you of this condition, WSS Software generates a log message such as the following the first
time an ICMP error message is received following the start of a snoop filter:
AP Mar 25 13:15:21.681369 ERROR AP 3 ap_network: Observer
10.10.101.2 is not accepting TZSP packets
To prevent ICMP error messages from the observer, Nortel recommends using the Netcat application on
the observer to listen to UDP packets on the TZSP port.
Configuring a snoop filter
To configure a snoop filter, use the following command:
set snoop filter-name [condition-list] [observer ip-addr]
[snap-length num]
The filter-name can be up to 15 alphanumeric characters.
The condition-list specifies the match criteria for packets. Conditions in the list are ANDed. Therefore, to be copied and
sent to an observer, a packet must match all criteria in the condition-list. You can specify up to eight of the following
conditions in a filter, in any order or combination:
frame-type {eq | neq} {beacon | control | data | management | probe}
channel {eq | neq} channel
bssid {eq | neq} bssid
src-mac {eq | neq | lt | gt} mac-addr
dest-mac {eq | neq | lt | gt} mac-addr
host-mac {eq | neq | lt | gt} mac-addr
mac-pair mac-addr1 mac-addr2
direction {eq | neq} {transmit | receive}
To match on packets to or from a specific MAC address, use the dest-mac or src-mac option. To match on both send
and receive traffic for a host address, use the host-mac option. To match on a traffic flow (source and destination MAC
addresses), use the mac-pair option. This option matches for either direction of a flow, and either MAC address can be
the source or destination address.
If you omit a condition, all packets match that condition. For example, if you omit frame-type, all frame types match the
filter.
For most conditions, you can use eq (equal) to match only on traffic that matches the condition value. Use neq (not
equal) to match only on traffic that is not equal to the condition value. The src-mac, dest-mac, and host-mac conditions
also support lt (less than) and gt (greater than).
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 785
The observer ip-addr option specifies the IP address of the station where the protocol analyzer is located. If you do not
specify an observer, the AP radio still counts the packets that match the filter. (See “Displaying remote traffic moni-
The snap-length num option specifies the maximum number of bytes to capture. If you do not specify a length, the
entire packet is copied and sent to the observer. Nortel recommends specifying a snap length of 100 bytes or less.
The following command configures a snoop filter named snoop1 that matches on all traffic, and copies the traffic to the
device that has IP address 10.10.30.2:
WSS# set snoop snoop1 observer 10.10.30.2 snap-length 100
The following command configures a snoop filter named snoop2 that matches on all data traffic between the device with
MAC address aa:bb:cc:dd:ee:ff and the device with MAC address 11:22:33:44:55:66, and copies the traffic to the device
that has IP address 10.10.30.3:
WSS# set snoop snoop2 frame-type eq data mac-pair aa:bb:cc:dd:ee:ff 11:22:33:44:55:66
observer 10.10.30.3 snap-length 100
Displaying configured snoop filters
To display the snoop filters configured on the WSS, use the following command:
show snoop info [filter-name]
The following command shows the snoop filters configured in the examples above:
WSS# show snoop info
snoop1:
observer 10.10.30.2 snap-length 100
all packets
snoop2:
observer 10.10.30.3 snap-length 100
frame-type eq data
mac-pair (aa:bb:cc:dd:ee:ff, 11:22:33:44:55:66)
Editing a snoop filter
To edit a snoop filter, you can use the show configuration area snoop command to display the filter’s configuration
command, then use cut-and-paste to reconstruct the command.
Deleting a snoop filter
To delete a snoop filter, use the following command:
clear snoop filter-name
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
786 Appendix A:Troubleshooting a WSS
Mapping a snoop filter to a radio
You can map a snoop filter to a radio on a AP. To map a snoop filter to a radio, use the following command:
set snoop map filter-name ap ap-num radio {1 | 2}
You can map the same filter to more than one radio. You can map up to eight filters to the same radio. If more
than one filter has the same observer, the AP sends only one copy of a packet that matches a filter to the
observer. After the first match, the AP sends the packet and stops comparing the packet against other filters for
the same observer.
If the filter does not have an observer, the AP still maintains a counter of the number of packets that match the
The following command maps snoop filter snoop1 to radio 2 on AP 3:
WSS# set snoop map snoop1 ap 3 radio 2
success: change accepted.
Displaying the snoop filters mapped to a radio
To display the snoop filters that are mapped to a radio, use the following command:
show snoop map filter-name
The following command shows the mapping for snoop filter snoop1:
WSS# show snoop map snoop1
filter 'snoop1' mapping
ap: 3
Radio: 2
Displaying the snoop filter mappings for all radios
To display all snoop filter mappings, use the following command:
WSS# show snoop
ap: 3
Radio: 2
snoop1
snoop2
Radio: 2
snoop2
ap: 2
Removing snoop filter mappings
To remove a snoop filter from a specific radio, use the following command:
clear snoop map filter-name ap ap-num radio {1 | 2}
The following command removes snoop filter snoop2 from radio 2 on AP 3:
WSS# clear snoop map snoop2 ap 3 radio 2
success: change accepted.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 787
To remove all snoop filter mappings from all radios, use the following command:
clear snoop map all
Enabling or disabling a snoop filter
A snoop filter does not take effect until you enable it. To enable or disable a snoop filter, use the following command:
set snoop {filter-name | all}
mode {enable | disable}
Note. The filter mode is retained even if you disable and reenable the radio,
or restart the AP or the WSS. Once the filter is enabled, you must use the
disable option to disable it.
The following command enables snoop filter snoop1, and configures the filter to stop after 5000 packets match the filter:
WSS# set snoop snoop1 mode enable stop-after 5000
success: filter 'snoop1' enabled
Displaying remote traffic monitoring statistics
The AP collects statistics for packets that match the enabled snoop filters mapped to its radios. The AP retains statistics
for a snoop filter until the filter is changed or disabled. The AP then clears the statistics.
To display statistics for packets matching a snoop filter, use the following command:
show snoop stats [filter-name [ap-num [radio {1 | 2}]]]
The following command shows statistics for snoop filter snoop1:
WSS# show snoop stats snoop1
Filter
====== =====
snoop1
ap
Radio
====== ======== ========
96
Rx Match
Tx Match
Dropped
======== ========
stopped
Stop-After
3
1
4
0
Preparing an observer and capturing traffic
To observe monitored traffic, install the following applications on the observer:
•
•
Ethereal or Tethereal Version 0.10.8 or later
Netcat (any version), if not already installed
Ethereal and Tethereal decode 802.11 packets embedded in TZSP without any configuration.
Use Netcat to listen to UDP packets on the TZSP port. This avoids a constant flow of ICMP destination unreachable
messages from the observer back to the radio. You can obtain Netcat through the following link:
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
788 Appendix A:Troubleshooting a WSS
If the observer is a PC, you can use a Tcl script instead of Netcat if preferred.
1
2
3
Install the required software on the observer.
Configure and map snoop filters in WSS Software.
Start Netcat:
●
On Linux, use a command such as the following:
nc -l -u -p 37008 ip-addr > /dev/null &
On Windows, use the following command:
●
netcat -l -u -p 37008 -v -v
Where ip-addr is the IP address of the AP to which the snoop filter is mapped. (To display the AP’s IP
address, use the show ap status command.)
4
5
Start the capture application:
●
●
For Ethereal capture, use ethereal filter port 37008.
For Tethereal capture, use tethereal -V port 37008.
Disable the option to decrypt 802.11 payloads. Because the AP always decrypts the data before sending it
to the observer, the observer does not need to perform any decryption. In fact, if you leave decryption
enabled on the observer, the payload data becomes unreadable.
To disable the decryption option in Ethereal:
a
b
c
In the decode window, right-click on the IEEE 802.11 line.
Select Protocol Preferences to display the 802.11 Protocol Preferences dialog.
Click next to Ignore the WEP bit to deselect the option. This option is applicable for any type of
data encryption used by AP radios.
6
7
Enable the snoop filter on the AP, using the following command:
set snoop {filter-name | all} mode {enable [stop-after num-pkts] | disable}
Stop the Ethereal capture and view the monitored packets.
The source IP address of a monitored packet identifies the AP that copied the packet’s payload and sent it
to the observer.
Capturing system information and sending it to
technical support
If you need help from the Nortel Enterprise Technical Support (NETS) to diagnose a system problem, you can make
troubleshooting the problem easier by providing the following:
•
•
•
•
show tech-support output
Core files
Debug messages
Description of the symptoms and network conditions when the problem occurred
The following sections show how to gather system information and send it to NETS.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 789
The show tech-support command
The show tech-support command combines a group of show commands to provide an in-depth snapshot of the status of
the WSS. The output displays details about the system image and configuration used after the last reboot, the version,
ports, AAA settings, and other configuration values, and the last 100 log messages.
To save the output in a file to send to TAC, use the following syntax:
show tech-support [file [subdirname/]filename]
The following command saves the output in a file named fortechsupport and copies the file to a TFTP server.
WSS# show tech-support file fortechsupport
success: results saved to fortechsupport.gz
WSS# copy fortechsupport.gz tftp://192.168.0.233/fortechsupport.gz
success: sent 8259 bytes in 0.246 seconds [ 33573 bytes/sec]
success: copy complete.
Core files
If a WSS restarts due to an error condition (crashes), the switch generates a core file in the temporary file area. The name
of the file indicates the system area where the problem occurred. Core files are saved in tarball (tar) format.
Core files are erased when you restart the switch. You must copy the files to a TFTP server or to the nonvolatile part of
file storage before restarting the switch.
To copy core files, use the dir command to list them, then use the copy command to copy them. The following example
shows how to list the files and copy them to a TFTP server.
WSS# dir
===============================================================================
file:
Filename
Size
Created
file:configuration
file:sysa_bak
48 KB Jul 12 2005, 15:02:32
12 KB Mar 15 2005, 19:18:44
Total:
60 Kbytes used, 207762 Kbytes free
===============================================================================
Boot:
Filename
Size
Created
boot0:mx040100.020
*boot1:mx040100.020
9780 KB Aug 23 2005, 15:54:08
9796 KB Aug 28 2005, 21:09:56
Boot0: Total:
Boot1: Total:
9780 Kbytes used, 2460 Kbytes free
9796 Kbytes used, 2464 Kbytes free
===============================================================================
temporary files:
Filename
Size
Created
core:command_audit.cur
core:netsys.core.217.tar
37 bytes Aug 28 2005, 21:11:41
560 KB May 06 2005, 21:48:33
Total:
560 Kbytes used, 91147 Kbytes free
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
790 Appendix A:Troubleshooting a WSS
In this example, the core file is netsys.core.217.tar. (The command_audit.cur file is not a core file and is
created as part of normal system operation.)
The following command copies the core file onto a TFTP server.
WSS# copy core:netsys.core.217.tar tftp://192.168.0.233/netsys.core.217.tar
...........success: sent 573440 bytes in 1.431 seconds [ 400726 bytes/sec]
success: copy complete.
If the switch’s network interfaces to the TFTP server have gone down, copy the core file to the nonvolatile file
area before restarting the switch. The following commands copy netsys.core.217.tar to the nonvolatile file area
and verify the result:
WSS# copy core:netsys.core.217.tar file:netsys.core.217.tar
success: copy complete.
WSS# dir
==============================================================================
=
file:
Filename
Size
Created
core:netsys.core.217.tar
file:configuration
file:sysa_bak
560 KB May 06 2005, 21:48:33
48 KB Jul 12 2005, 15:02:32
12 KB Mar 15 2005, 19:18:44
Total:
620 Kbytes used, 207202 Kbytes free
==============================================================================
=
Boot:
Filename
Size
Created
boot0:mx040100.020
*boot1:mx040100.020
9780 KB Aug 23 2005, 15:54:08
9796 KB Aug 28 2005, 21:09:56
Boot0: Total:
Boot1: Total:
9780 Kbytes used, 2460 Kbytes free
9796 Kbytes used, 2464 Kbytes free
==============================================================================
=
temporary files:
Filename
Size
Created
core:command_audit.cur
core:netsys.core.217.tar
37 bytes Aug 28 2005, 21:11:41
560 KB May 06 2005, 21:48:33
Total:
560 Kbytes used, 91147 Kbytes free
Debug messages
In addition to generating a core file, the switch also sends debug messages to the serial console during a
system crash. To capture the messages, attach a PC to the port (if one is not already attached) and use the
terminal emulation application on the PC to capture a log of the messages. (For information about connecting
to the serial console port, see the Nortel WLAN—Security Switch 2300 Series Installation and Basic Configu-
ration Guide.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix A:Troubleshooting a WSS 791
Sending information to NETS
After you save the show tech-support output, as well as core files and debug messages (if applicable), you can send
them to NETS.
Nortel has an external FTP server for use by customers to upload WSS Software debugging information, WLAN
Management Software plans, and core dumps relating to active cases in NETS.
Additionally, NETS uses this FTP server as a place for customers to download private images and other case-related
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
792 Appendix A:Troubleshooting a WSS
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
793
Appendix B: Enabling and logging
onto Web View
System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 793
Logging onto Web View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794
Web View is a web-based management application available on WSSs. You can use Web View for common configura-
tion and management tasks. On most WSS models (2382, 2360/2361, or 2350), you also can use Web View to perform
initial configuration of a new switch.
System requirements
Browser requirements
Web View is supported on the following browsers:
•
•
Mozilla Firefox Version 1.0 or later
Microsoft Internet Explorer Version 6.0 or later
TLS 1.0, SSL 2.0, or SSL 3.0 must be enabled in the browser. To enable TLS 1.0, SSL 2.0, or SSL 3.0 in Microsoft
Internet Explorer:
1
2
3
4
Select Tools > Internet Options to display the Internet Options dialog box.
Select the Advanced tab.
Scroll to the bottom of the list of options and select the TLS 1.0, SSL 2.0, or SSL 3.0 option to enable it.
Click OK.
WSS requirements
•
The WSS’s HTTPS server must be enabled. (This option is enabled by default.) If HTTPS is disabled, you can
enable it using the following command:
set ip https server enable
•
The switch must have an IP interface that can be reached by the PC where the browser is installed.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
794 Appendix B:Enabling and logging onto Web View
Note. If you are configuring a new 2382, 2360/2361, or 2350, you can access Web View
without any preconfiguration. Attach your PC directly to any 10/100 Ethernet port on a 2382
2360/2361 or 2350. Then enter http://192.168.100.1 in the web browser’s Location or
Address field.
Logging onto Web View
1
Type https://ip-addr in the Web browser’s Address or Location field and press Enter.
For ip-addr, type an IP address you configured on the switch.
2
If your browser displays a certificate warning, select an option to accept the certificate.
The certificate is presented to your browser by the WSS to authenticate the switch’s identify. You can
select to accept the certificate for the current web management session or for all web management
sessions.
After you accept the certificate, the browser might display another dialog asking whether you want to
view the certificate. You can view the certificate or continue without viewing it.
3
4
5
In the User Name field, type admin.
In the Password field, type the enable password configured on the switch.
Click OK.
Note. If your web browser has the Google toolbar installed, one of the toolbar’s options
can cause some of the fields in Web View to be highlighted in yellow. If you want to turn off
the yellow highlighting, disable the Automatically highlight fields that Autofill can fill
option, which is one of the toolbar’s options.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
795
Appendix C: Supported RADIUS
attributes
Supported standard and extended attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795
Nortel vendor-specific attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 799
Nortel WLAN Security Switch 2300 Series (WSS Software) supports the standard and extended RADIUS authentication
and accounting attributes listed in Table 49 on page 796. Also supported are Nortel vendor-specific attributes (VSAs),
An attribute is sent to RADIUS accounting only if the table listing it shows Yes or Optional in the column marked Sent
in Accounting-Request for the attribute and the attribute is applied to the client’s session configuration. Attribute values
have the following characteristics unless otherwise stated:
•
•
•
Strings can contain a maximum of 253 characters.
Integers are 4 bytes.
IP addresses are 4 bytes.
The RADIUS attributes WSS Software supports are based on these IETF RFCs and drafts:
•
•
•
•
•
RFC 2865, Remote Authentication Dial-in User Service (RADIUS)
RFC 2866, RADIUS Accounting
RFC 2868, RADIUS Attributes for Tunnel Protocol Support
RFC 2869, RADIUS Extensions
draft-congdon-radius-8021x-29.txt (IEEE 802.1X RADIUS Usage Guidelines)
Supported standard and extended attributes
The RADIUS attributes shown in Table 49 are sent by WSSs to RADIUS servers during authentication and accounting.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
796 Appendix C:Supported RADIUS attributes
Table 49: 802.1X attributes
Rcv in
Sent in Sent in
Attribute
Type Access Access Acct
Description and Values
Resp?
Reqst? Reqst?
User-Name
1
No
Yes
Yes
String. Name of the user to be
authenticated. Used only in Request
packets.
User-Password
2
3
4
5
No
No
No
No
Yes
Yes
Yes
Yes
No
No
Yes
Yes
Password of the user to be authenticated,
unless a CHAP-Password is used.
CHAP-
Password
Password of the user to be authenticated,
unless a User-Password is used.
NAS-IP-
Address
IP address sent by the WSS.
Service-Type
Access type, which can be one of the
following:
•
•
2—Framed; for network user access
6—Administrative; for
administrative access to the WSS,
with authorization to access the
enabled (configuration) mode. The
user must enter the enable command
and the correct enable password to
access the enabled mode.
•
7—NAS-Prompt; for administrative
access to the nonenabled mode only.
In this mode, the user can still enter
the enable command and the correct
enable password to access the
enabled mode.
For administrative sessions, the WSS
always sends 6 (Administrative).
The RADIUS server can reply with one
of the values listed above.
If the service-type is not set on the
RADIUS server, administrative users
receive NAS-Prompt access, and network
users receive Framed access.
Note: WSS Software will quietly
accept Callback Framed but you
cannot select this access type in
WSS Software.
Filter-Id
11
Yes
No
Optional
Name of an access control list (ACL) to
filter outbound or inbound traffic. Use the
form ACL name.in and ACL name.out.
(For details, see “Configuring and
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix C:Supported RADIUS attributes 797
Table 49: 802.1X attributes (continued)
Rcv in
Sent in Sent in
Attribute
Type Access Access Acct
Description and Values
Resp?
Reqst? Reqst?
Reply-
18
24
Yes
No
No
String. Text that can be displayed to the
user. Multiple Reply-Messages can be
included. If any are displayed, they must
appear in the order in which they appear
in the packet.
Message
State
Class
Yes
Yes
No
Can be sent by a RADIUS server in an
Access-Challenge message to the WSS.
If the WSS receives an Access-Challenge
with this attribute, it returns the same
State value in an Access-Request
response to the RADIUS server, when a
response is required. (For details, see
RFC 2865.)
25
Yes
No
Yes
If received, this information must be sent
on, without interpretation, in all
subsequent packets sent to the RADIUS
server for that client session.
Vendor-
Specific
26
27
Yes
Yes
No
No
Yes
String. Allows WSS Software to support
Nortel VSAs. (See Table 50 on
page 800.)
Session-
Timeout
Optional
Maximum number of seconds of service
allowed the user before reauthentication
of the session.
Note: If the global
reauthentication timeout (set by
the set dot1x reauth-period
command) is shorter than the
session-timeout, WSS Software
uses the global timeout instead.
Called-Station-
Id
30
No
Yes
Yes
For IEEE 802.1X authenticators, stores
the AP MAC address in uppercase ASCII
format, with octet values separated by
hyphens (for example,
00-10-A4-23-19-C0).
Calling-Station-Id 31
No
No
Yes
Yes
Yes
No
For IEEE 802.1X authenticators, stores
the supplicant MAC address in uppercase
ASCII format, with octet values
separated by hyphens (for example,
00-10-A4-23-19-C0).
NAS-Identifier
32
Name of the RADIUS client originating
an Access-Request. The value in the
current release is nortel and cannot be
changed.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
798 Appendix C:Supported RADIUS attributes
Table 49: 802.1X attributes (continued)
Rcv in
Sent in Sent in
Attribute
Type Access Access Acct
Description and Values
Resp?
Reqst? Reqst?
Acct-Status-
Type
40
No
No
Yes
Valid values:
•
•
•
Acct-Start
Acct-Interim-Update
Acct-Stop
Acct-Delay-
Time
41
42
No
No
No
No
Yes
Yes
Time in seconds for which the client has
been trying to send the record.
Acct-Input-
Octets
Number of octets received from the port
over the course of this service being
provided. Can be present only in
Accounting-Request records in which
Acct-Status-Type is set to Acct-Stop or
Acct-Interim-Update.
Acct-Output-
Octets
43
44
No
No
No
No
Yes
Yes
Number of octets sent on the port in the
course of this service being provided.
Can be present only in
Accounting-Request records in which
Acct-Status-Type is set to Acct-Stop or
Acct-Interim-Update.
Acct-Session-
Id
Unique accounting ID to facilitate
matching start and stop records in a log
file. The start and stop records for a given
session must have the same
Acct-Session-Id.
Acct-Authentic
45
46
No
No
No
No
Yes
Yes
Valid values:
•
•
RADIUS
Local
Acct-Session-
Time
Number of seconds for which the user
has received service. Can be present only
in Accounting-Request records in which
Acct-Status-Type is set to Acct-Stop or
Acct-Interim-Update.
Acct-Input-
Packets
47
48
No
No
No
No
Yes
Yes
Number of packets received in the course
of this service being provided. Can be
present only in Accounting-Request
records in which Acct-Status-Type is set
to Acct-Stop or Acct-Interim-Update.
Acct-Output-
Packets
Number of packets sent in the course of
this service being provided. Can be
present only in Accounting-Request
records in which Acct-Status-Type is set
to Acct-Stop or Acct-Interim-Update.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix C:Supported RADIUS attributes 799
Table 49: 802.1X attributes (continued)
Rcv in
Sent in Sent in
Attribute
Type Access Access Acct
Description and Values
Resp?
Reqst? Reqst?
Acct-Multi-
Session-Id
50
52
No
No
No
Yes
Yes
Unique accounting ID that facilitates
linking together multiple related sessions
in a log file. Each linked session has a
unique Acct-Session-Id but the same
Acct-Multi-Session-
Id.
Acct-Input-
Gigawords
No
Number of times the Acct-Input-Octets
32
counter has wrapped around 2 over the
course of this service being provided.
Can be present only in
Accounting-Request records in which
Acct-Status-Type is set to Acct-Stop or
Acct-Interim-Update. (For details, see
RFC 2869.)
Acct-Output-
Gigawords
53
55
No
No
No
No
Yes
Yes
Number of times the Acct-Output-Octets
32
counter has wrapped around 2 over the
course of this service being provided.
Can be present only in
Accounting-Request records in which
Acct-Status-Type is set to Acct-Stop or
Acct-Interim-Update. (For details, see
RFC 2869.)
Event-
Timestamp
Time that the user session started,
stopped, or was updated, in seconds since
January 1, 1970.
Tunnel-
81
87
Yes
No
No
No
Same as VLAN-Name.
Private-Group-ID
NAS-Port-Id
Yes
Yes
WSS physical port that authenticates the
user, in the form AP port number/radio.
Nortel vendor-specific attributes
The vendor-specific attributes (VSAs) created by Nortel are embedded according to the procedure recommended in
RFC 2865, with Vendor-ID set to 562. Table 50 describes the Nortel VSAs, listed in order by vendor type number.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
800 Appendix C:Supported RADIUS attributes
Table 50: Nortel VSAs
Type,
Vendor
ID,
Rcv in
Access Access Acct
Sent in Sent in
Attribute
Description
Vendor
Type
Resp?
Reqst? Reqst?
VLAN-Name
Mobility-Profile
Encryption-Type
Time-Of-Day
SSID
26, 562,
231
Yes
Yes
Yes
Yes
Yes
No
No
No
No
No
Yes
No
No
No
Yes
Name of the VLAN to which the
client belongs.
26, 562,
232
Name of the Mobility Profile used
by the authorized client.
26, 562,
3233
Type of encryption used to
authenticate the client.
26, 562,
234
Day(s) and time(s) during which a
user can log into the network.
26, 562,
235
Name of the SSID you want the user
to use. The SSID must be
configured in a service profile, and
the service profile must be used by a
radio profile assigned to Nortel
radios in the Mobility Domain.
End-Date
Start-Date
URL
26, 562,
236
Yes
Yes
Yes
No
No
No
No
No
No
Date and time after which the user is
no longer allowed to be on the
network. Use the following format:
YY/MM/DD-HH:MM
26, 562,
237
Date and time at which the user
becomes eligible to access the
network. Use the following format:
YY/MM/DD-HH:MM
26, 562,
238
URL to which the user is redirected
after successful Web-based AAA.
Use the following format:
http://www.example.com
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
801
Appendix D: Traffic ports used by
WSS software
When deploying a Nortel wireless network, you might attach Nortel equipment to subnets that have firewalls or access
controls between them. Nortel equipment uses various protocol ports to exchange information. To ensure full operation
Table 51: Traffic ports used by WSS software
Protocol
Port
Function
IP/TCP (6)
IP/TCP (6)
23
Telnet management
443
SSL management of a WSS via Web View
Port 443 is also the default port used by WLAN
Management Software clients to communicate with a
WLAN Management Software server.
IP/TCP (6)
IP/TCP (6)
8821
8889
Network Domain and Mobility Domain management
The originating WSS makes a connection from a
random TCP port that is equal to or higher than 4096.
The target WSS listens for the traffic on TCP port
8821.
SSL management via WLAN Management Software or
GuestPass
WLAN Management Software or GuestPass originates
the SSL connection on TCP port 8889.
IP/UDP (17)
IP/UDP (17)
IP/UDP (17)
IP/UDP (17)
IP/UDP (17)
IP/UDP (17)
IP/UDP (17)
53
DNS
123
161
162
1812
1813
5000
NTP
SNMP get and set operations
SNMP traps
RADIUS authentication (default setting)
RADIUS accounting (default setting)
WSS-AP communication. This applies to WSS
communication with Distributed APs and with directly
connected APs.
IP/ICMP (1)
N/A
Several types (for example, ping)
Roaming traffic uses IP tunnels, encapsulated with IP protocol 4.
To list the TCP port numbers in use on a WSS, including those for the other end of a connection, use the show tcp
command.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
802 Appendix D:Traffic ports used by WSS software
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
803
Appendix E: DHCP server
How the WSS software DHCP server works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804
Configuring the DHCP server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804
Displaying DHCP server information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 805
WSS Software has a DHCP server that the switch uses to allocate IP addresses to the following:
•
•
Directly connected APs
Host connected to a new (unconfigured) 2350, 2360/2361, or 2382 to configure the switch using the Web Quick
Start
DHCP service for these items is enabled by default.
Optionally, you can configure the DHCP server to also provide IP addresses to APs and to clients.
Configuration is supported on an individual VLAN basis. When you configure the DHCP server on a VLAN, the server
can serve addresses only from the subnet that contains the host address assigned to the VLAN. By default, the VLAN
can serve any unused address in the subnet except the VLAN’s host address and the network and broadcast addresses.
You can specify the address range.
You can configure the DHCP server on more than one VLAN. You can configure a DHCP client and DHCP server on
the same VLAN, but only the client or the server can be enabled. The DHCP client and DHCP server cannot both be
enabled on the same VLAN at the same time.
The WSS Software DHCP server is implemented according to “RFC 2131: Dynamic Host Configuration Protocol” and
“RFC 2132: DHCP Options and BOOTP Vendor Extensions”, with the following exceptions:
•
•
If the switch is powered down or restarted, WSS Software does not retain address allocations or lease times.
The WSS Software DHCP server will not operate properly when another DHCP server is present on the same
subnet.
•
The WSS Software DHCP server is configurable on an individual VLAN basis only, and operates only on the
subnets for which you configure it.
Note. Use of the WSS Software DHCP server to allocate client addresses is intended for
temporary, demonstration deployments and not for production networks. Nortel
recommends that you do not use the WSS Software DHCP server to allocate client
addresses in a production network.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
804 Appendix E:DHCP server
How the WSS software DHCP server works
When WSS Software receives a DHCP Discover packet, the DHCP server allocates an address from the configured
range according to RFC 2131 and ARPs the address to ensure that it is not already in use. If the address is in use, the
server allocates the next address in the range, and ARPs again. The process continues until WSS Software finds an
address that is not in use. WSS Software then offers the address to the Distributed AP or client that sent the DHCP
Discover. If there are no unused addresses left in the range, WSS Software ignores the DHCP Discover and generates a
log message.
If the client does not respond to the DHCP Offer from the WSS Software DHCP server within 2 minutes, the offer
becomes invalid and WSS Software returns the address to the pool.
The siaddr value in the DHCP exchanges is the IP address of the VLAN. The yiaddr value is an unused address within
the range the server is allowed to use.
In addition to an IP address, the Offer message from the WSS Software DHCP server also contains the following
options:
•
•
•
•
Option 54—Server Identifier, which has the same value as siaddr.
Option 51—Address Lease, which is 12 hours and cannot be configured.
Option 1—Subnet Mask of the VLAN’s IP interface.
Option 15—Domain Name. If this option is not set with the set interface dhcp-server command’s dns-domain
option, the WSS Software DHCP server uses the value set by the set ip dns domain command.
•
Option 3—Default Router. If this option is not set with the set interface dhcp-server command’s default-router
option, the WSS Software DHCP server can use the value set by the set ip route command. A default route
configured by set ip route can be used if the route is in the DHCP client’s subnet. Otherwise, the WSS Software
DHCP server does not specify a router address.
•
Option 6—Domain Name Servers. If these options are not set with the set interface dhcp-server command’s
primary-dns and secondary-dns options, the WSS Software DHCP server uses the values set by the set ip dns
server command.
Configuring the DHCP server
You can configure the DHCP server on an individual VLAN basis. To configure the server, use the following command:
set interface vlan-id ip dhcp-server [enable | disable] [start ip-addr1 stop ip-addr2]
[dns-domain domain-name] [primary-dns ip-addr [secondary-dns ip-addr]]
[default-router ip-addr]
The vlan-id can be the VLAN name or number.
The start ip-addr1 and stop ip-addr2 options specify the beginning and ending addresses of the address range (also
called the address pool). By default, all addresses except the host address of the VLAN, the network broadcast address,
and the subnet broadcast address are included in the range. If you specify the range, the start address must be lower than
the stop address, and all addresses must be in the same subnet. The IP interface of the VLAN must be within the same
subnet but is not required to be within the range.
(For information about the other options, see the Nortel WLAN Security Switch 2300 Series Command Line Reference.)
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix E:DHCP server 805
The following command enables the DHCP server on VLAN red-vlan to serve addresses from the 192.168.1.5 to
192.168.1.25 range:
WSS# set interface red-vlan ip dhcp-server enable start 192.168.1.5 stop 192.168.1.25
success: change accepted.
To remove all IP information from a VLAN, including the DHCP client and user-configured DHCP server, use the
following command:
clear interface vlan-id ip
Note. This command clears all IP configuration information from the interface.
Displaying DHCP server information
To display information about the WSS Software DHCP server, use the following command:
show dhcp-server [interface vlan-id] [verbose]
If you enter the command without the interface or verbose option, the command displays a table of all the IP addresses
leased by the server. You can use the interface option to display addresses leased by a specific VLAN.
If you use the verbose option, configuration and status information is displayed instead.
The following command displays the addresses leased by the DHCP server:
WSS# show dhcp-server
VLAN Name
Address
MAC
Lease Remaining (sec)
---- -------------- --------------- ----------------- --------------------
1 default
1 default
2 red-vlan
2 red-vlan
10.10.20.2 00:01:02:03:04:05
10.10.20.3 00:01:03:04:06:07
192.168.1.5 00:01:03:04:06:08
192.168.1.7 00:01:03:04:06:09
12345
2103
102
16789
The following command displays configuration and status information for each VLAN on which the DHCP server is
configured:
WSS# show dhcp-server
Interface:
Status:
0 (Direct AP)
UP
Address Range: 10.0.0.1-10.0.0.253
Interface:
Status:
default(1)
UP
Address Range:
10.10.20.2-10.10.20.254
Hardware Address: 00:01:02:03:04:05
State: BOUND
Lease Allocation: 43200 seconds
Lease Remaining: 12345 seconds
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
806 Appendix E:DHCP server
IP Address:
10.10.20.2
255.255.255.0
10.10.20.1
10.10.20.4 10.10.20.5
mycorp.com
Subnet Mask:
Default Router:
DNS Servers:
DNS Domain Name:
In addition to information for addresses leased from the VLANs where you configured the server, information for the
Direct AP interface is also displayed. The Direct AP interface is an internal VLAN interface for directly connected APs.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
807
Appendix F: Glossary
3DES A three-round application of the Data Encryption Standard (DES) that uses a 168-bit encryption key.
802.1D The IEEE LAN specification for the operation of media access control (MAC) bridges.
802.1p An IEEE LAN standard method for classifying packets in bridged virtual LANs (VLANs). As part
of 802.1Q protocol, 802.1p defines a field in the VLAN tag of a frame header that provides class-of-service
802.1Q The IEEE LAN standard that defines a protocol for filtering and forwarding services at Layer 2.
Ethernet frames are directed by means of a tag inserted into the frame header. A virtual LAN (VLAN)
identifier (VID) field in the tag identifies the VLAN with which the frame is associated.
802.1X The primary IEEE standard for port-based network access control. The 802.1X standard, which is
based on the Extensible Authentication Protocol (EAP), provides an authentication framework that supports a
variety of methods for authenticating and authorizing network access for wired or wireless users. See also
802.2 An IEEE LAN specification that defines the logical link control (LLC) sublayer, the upper portion of
the Data Link layer. LLC encapsulation can be used by any lower-layer LAN technology. Compare 802.3;
802.3 An IEEE LAN specification for a Carrier Sense Multiple Access with Collision Detection
(CSMA-CD) network, a type of network related to Ethernet. In general, 802.3 specifies the physical media and
the working characteristics of LANs. An 802.3 frame uses source and destination media access control (MAC)
802.3z An extension to the IEEE 802.3 LAN specification, describing gigabit Ethernet (1000 Mbps)
transmission. The extension includes specifications for the media access control (MAC), physical layer,
repeater, and management characteristics of gigabit Ethernet.
802.11 An IEEE LAN specification that defines the mobile (wireless) network access link layer. The
specification includes the 802.11 media access control (MAC) sublayer of the Data Link layer, and two
sublayers of the Physical (PHY) layer—a frequency-hopping spread-spectrum (FHSS) physical layer and a
direct-sequence spread-spectrum (DSSS) link layer. Later additions to 802.11 include additional physical
802.11a A supplement to the IEEE 802.11 wireless LAN (WLAN) specification, describing transmission
through the Physical layer (PHY) based on orthogonal frequency division multiplexing (OFDM), at a
frequency of 5 GHz and data rates of up to 54 Mbps.
802.11b A supplement to the IEEE 802.11 wireless LAN (WLAN) specification, describing transmission
through the Physical layer (PHY) based on direct-sequence spread-spectrum (DSSS), at a frequency of
2.4 GHz and data rates of up to 11 Mbps.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
808 Appendix F:Glossary
802.11b/g radio A radio that can receive and transmit signals at IEEE 802.11b and 802.11g data rates.
Nortel 802.11b/g radios allow associations from 802.11b clients as well as 802.11g clients by default, for
networks that have a mixture of both client types. However, association by any 802.11b clients restricts the
maximum data transmit rate for all clients. To allow the radios to operate at the higher 802.11g data rates, you
can set 802.11b/g radios to reject association attempts by 802.11b clients.
802.11g A supplement to the IEEE 802.11 wireless LAN (WLAN) specification, describing transmission
through the Physical layer (PHY) based on orthogonal frequency division multiplexing (OFDM), at a
frequency of 2.4 GHz and data rates of up to 54 Mbps.
802.11i A draft supplement to the IEEE 802.11 wireless LAN (WLAN) specification, for enhanced security
through the use of stronger encryption protocols such as the Temporal Key Integrity Protocol (TKIP) and AES
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). These
protocols provide replay protection, cryptographically keyed integrity checks, and key derivation based on the
AAA Authentication, authorization, and accounting. A framework for configuring services that provide a
secure network connection and a record of user activity, by identifying who the user is, what the user can
access, and what services and resources the user is consuming. In a Nortel WLAN 2300 system, the
WLAN—Security Switch (WSS) can use a RADIUS server or its own local database for AAA services.
Access Point (AP) A small hardware unit that functions as a wireless AP in a Nortel WLAN 2300
system. Using one or more radio transmitters, an AP transmits and receives information as radio frequency
(RF) signals to and from a wireless user (client). The AP transmits and receives information over a 10/
100BASE-T Ethernet connection to and from a WLAN—Security Switch (WSS). The switch also supplies
electrical power to the access point by means of Power over Ethernet (PoE). An optional dual-homed
connection to a second WSS provides redundancy. An AP communicates with a WSS by means of the Nortel
Access Point Access (NAPA) protocol.
access point (AP) A hardware unit that acts as a communication hub by linking wireless mobile IEEE
802.11 stations such as PCs to a wired backbone network. A Nortel WLAN 2300 system has Access Point
ACE A rule in a security access control list (ACL) that grants or denies a set of network access rights based
on one or more criteria. ACEs use criteria such as a protocol and a source or destination IP address to
determine whether to permit or deny packets that match the criteria. ACEs are processed in the order in which
ad hoc network One of two IEEE 802.11 network frameworks. In an ad hoc network, a set of wireless
stations communicate directly with one another without using an AP or any connection to a wired network.
With an ad hoc network, also known as a peer-to-peer network or independent basic service set (IBSS), you
can set up a wireless network in which a wireless infrastructure does not exist or is not required for services (in
a classroom, for example), or through which access to the wired network is prevented (for consultants at a
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 809
AES Advanced Encryption Standard. One of the Federal Information Processing Standards (FIPS). The
AES, documented in FIPS Publication 197, specifies a symmetric encryption algorithm for use by
association The process defined in IEEE 802.11 by which an authenticated mobile (wireless) station
establishes a relationship with a wireless AP to gain full network access. The access point assigns the mobile
station an association identifier (AID), which the wireless LAN (WLAN) uses to track the mobile station as it
roams. After associating with an AP in a Nortel WLAN 2300 system, a mobile station can send and receive
traffic through any AP within the same Mobility Domain™ group.
attribute In authentication, authorization, and accounting (AAA), a property used to identify (authenticate)
a user or to configure (authorize) or record (account for) a user’s administrative or network session. A user’s
AAA attributes are stored in a user profile in the local database on a WLAN—Security Switch (WSS), or on a
authenticated identity In a Nortel WLAN 2300 system, the correspondence established between a
user and his or her authentication attributes. User authentication attributes are linked to the user, rather than to
a physical port or device, regardless of the user’s location or type of network connection. Because the
authenticated identity follows the user, he or she requires no reauthentication when roaming.
authentication mobility The ability of a user (client) authenticated via Extensible Authentication
Protocol (EAP)—plus an appropriate subprotocol and back-end authentication, authorization, and accounting
(AAA) service—to roam to different APs without reauthentication.
authentication server An entity that provides an authentication service to an authenticator. From the
credentials provided by a client (or supplicant), the authentication service determines whether the supplicant is
authorized to access the services of the authenticator. In a Nortel WLAN 2300 system, one or more RADIUS
servers can act as authentication servers.
authenticator A device that authenticates a client. In a Nortel WLAN 2300 system, the authenticator is a
WLAN—Security Switch (WSS).
baseline association rate A value set in Nortel WLAN Management Software to help plan Access
Point (AP) coverage in a network. The baseline association rate is the average data transmission rate at which
you want typical mobile clients in the coverage area to associate with the access point(s).
bias The priority of one WLAN—Security Switch (WSS) over other WSSs for booting, configuring, and
providing data transfer for a Access Point (AP). Bias can be set to either low or high on each WSS and is high
by default. Bias applies only to WSSs that are indirectly attached to the AP through an intermediate Layer 2 or
Layer 3 network. An AP always attempts to boot on AP port 1 first, and if the AP is directly attached to a WSS
on AP port 1, the AP uses the directly attached WSS to boot from regardless of the bias settings. See also
BSS Basic service set. A set of wireless stations that communicate with one another through an AP.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
810 Appendix F:Glossary
BSSID Basic service set identifier. The 48-bit media access control (MAC) address of the radio in the AP
that serves the stations in a basic service set (BSS).
CCI Co-channel interference. Obstruction that occurs when one signal on a particular frequency intrudes into
a cell that is using that same frequency for transmission. In multicell networks, systems are designed to
minimize CCI through appropriate transmission power and channel selection.
CCMP Counter-Mode with Cipher Block Chaining Message Authentication Code Protocol. A wireless
encryption protocol based on the Advanced Encryption Standard (AES) and defined in the IEEE 802.11i
specification. CCMP uses a symmetric key block cipher mode that provides privacy by means of counter mode
and data origin authenticity by means of cipher block chaining message authentication code (CBC-MAC). See
cell The geographical area covered by a wireless transmitter.
certificate authority (CA) Network software that issues and manages security credentials and public
keys for authentication and message encryption. As part of a public-key infrastructure (PKI), which enables
secure exchanges of information over a network, a certificate authority checks with a registration authority
(RA) to verify information provided by the requestor of a digital certificate. If the registration authority
verifies the requestor’s information, the certificate authority can issue a certificate. Based on the PKI
implementation, the certificate content can include the certificate’s expiration date, the owner’s public key, the
owner’s name, and other information about the public-key owner. See also registration authority (RA).
CHAP Challenge Handshake Authentication Protocol. An authentication protocol that defines a three-way
handshake to authenticate a user (client). CHAP uses the MD5 hash algorithm to generate a response to a
challenge that can be checked by the authenticator. For wireless connections, CHAP is not secure and must be
protected by the cryptography in such authentication methods as the Protected Extensible Authentication
Protocol (PEAP) and Tunneled Transport Layer Security (TTLS).
client The requesting program or device in a client-server relationship. In a wireless LAN (WLAN), the
client (or supplicant) requests access to the services provided by the authenticator. See also supplicant.
collision domain A single half-duplex IEEE 802.3 Carrier Sense Multiple Access with Collision
Detection (CSMA-CD) network. A collision occurs when two or more Layer 2 devices in the network transmit
at the same time. Ethernet segments separated by a Layer 2 switch are within different collision domains.
coverage area In Nortel WMS, the smallest unit of floor space within which to plan access point
coverage for a wireless LAN (WLAN). The number of access points required for a coverage area depends on
the type of IEEE 802.11 transmission used, and the area’s physical features and user density.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 811
CRC Cyclic redundancy check. A primitive message integrity check.
cryptography The science of information security. Modern cryptography is typically concerned with the
processes of scrambling ordinary text (known as plain text or clear text) into encrypted text at the sender’s end
of a connection, and decrypting the encrypted text back into clear text at the receiver’s end. Because its
security is independent of the channels through which the text passes, cryptography is the only way of
protecting communications over channels that are not under the user’s control. The goals of cryptography are
confidentiality, integrity, nonrepudiation, and authentication. The encrypted information cannot be understood
by anyone for whom it is not intended, or altered in storage or transmission without the alteration being
detected. The sender cannot later deny the creation or transmission of the information, and the sender and
receiver can confirm each other’s identity and the information’s origin and destination.
CSR Certificate Signing Request. A message sent by an administrator to request a security certificate from a
certificate authority (CA). A CSR is a text string formatted by Privacy-Enhanced Mail (PEM) protocol
according to Public Key Cryptography Standard (PKCS) #10. The CSR contains the information needed by
the certificate authority to generate the certificate.
CSV file Comma-separated values file. A text file that displays tabular data in a comma-delimited format,
as a list of rows in which each column’s value is separated from the next by a comma. A CSV file is useful for
transferring data between database applications.
dBm Decibels referred to 1 milliwatt (mW). A measurement of relative power related to 1 mW. For
20 dBm/10
example, 20 dBm corresponds to 10
= 100 mW.
DES Data Encryption Standard. A federally approved symmetric encryption algorithm in use for many years
DHCP Dynamic Host Configuration Protocol. A protocol that dynamically assigns IP addresses to stations,
from a centralized server. DHCP is the successor to the Bootstrap Protocol (BOOTP).
dictionary attack An attempt to gain illegal access to a computer or network by logging in repeatedly
with passwords that are based on a list of terms in a dictionary.
Diffie-Hellman A key exchange algorithm that was the first public-key algorithm ever published.
Diffie-Hellman can be used anonymously (without authentication). Anonymous Diffie-Hellman is used to
establish the connection between the Nortel WLAN 2300 system WLAN Management Software tool suite and
a WLAN—Security Switch (WSS).
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
812 Appendix F:Glossary
Diffserv Differentiated services. An architecture for providing different types or levels of service for
network traffic. Diffserv aggregates flows in the network so that routers and switches need to distinguish only
a relatively small number of aggregated flows, even if those flows contain thousands or millions of individual
flows.
digital certificate A document containing the name of a user (client) or server, a digital signature, a
digital signature The result of encrypting a hash of a message or document with a private key. A digital
signature is used to verify the authenticity of the sender and the integrity (unaltered condition) of the message
domain (1) On the Internet, a set of network addresses that are organized in levels. (2) In Microsoft
Windows NT and Windows 2000, a set of network resources (applications, printers, and so forth) for a group
of users (clients). Clients log into the domain to access the resources, which can be located on a number of
different servers in the network.
domain policy A collection of configuration settings that you can define once in WLAN Management
Software and apply to many WLAN—Security Switch (WSSs). Each Mobility Domain group in the network
has a default domain policy that applies to every WSS in the Mobility Domain. See also Policy Manager.
DSA Digital Signature Algorithm. The public-key algorithm used to sign X.509 certificates.
DSSS Direct-sequence spread-spectrum. One of two types of spread-spectrum radio technology used in
wireless LAN (WLAN) transmissions. To increase a data signal’s resistance to interference, the signal at the
sending station is combined with a higher-rate bit sequence that spreads the user data in frequency by a factor
DTIM Delivery traffic indication map. A special type of traffic indication map (TIM) element in a beacon
frame that occurs only when a station in a basic service set (BSS) is in power-save mode. A DTIM indicates
that any buffered broadcast or multicast frames are immediately transmitted by an AP.
DXF format A tagged data representation, in ASCII format, of the information contained in an AutoCAD
drawing file.
dual-homed connection A redundant, resilient connection between an AP and one or more
WLAN—Security Switches (WSSs). The connection can consist of two direct physical links from both AP
ports to one or two WSSs, one or more distributed links through an intermediate Layer 2 or Layer 3 network,
or a combination of one direct physical link and one or more distributed links. The AP uses one link for
booting, configuration, and data transfer and uses the other link(s) as backups in case the active link fails. If the
AP has two direct physical links to one or more WSSs, the Power over Ethernet (PoE) load is shared across
both links. If the active data link fails, the other link provides uninterrupted power to the AP.
After changing its active link, the access point reboots and loads new configuration information to ensure proper config-
uration and security. Mobility Domain services are temporarily disrupted by the link change. Dual-homed connections
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 813
EAP Extensible Authentication Protocol. A general point-to-point protocol that supports multiple
authentication mechanisms. Defined in RFC 2284, EAP has been adopted by IEEE 802.1X in an encapsulated
form for carrying authentication messages in a standard message exchange between a user (client) and an
authenticator. The encapsulated EAP, also known as EAP over LAN (EAPoL) and EAP over Wireless (EAPoW),
enables the authenticator’s server to authenticate the client with an authentication protocol agreed upon by
EAPoL EAP over LAN. An encapsulated form of the Extensible Authentication Protocol (EAP), defined in
the IEEE 802.1X standard, that allows EAP messages to be carried directly by a LAN media access control
(MAC) service between a wireless client (or supplicant) and an authenticator. EAPoL is also known as EAP
EAP-TLS Extensible Authentication Protocol with Transport Layer Security. An EAP subprotocol for
802.1X authentication. EAP-TLS supports mutual authentication and uses digital certificates to fulfill the
mutual challenge. When a user (client) requests access, the authentication server responds with a server
certificate. The client replies with its own certificate and also validates the server certificate. From the
certificate values, the EAP-TLS algorithm can derive session encryption keys. After validating the client
certification, the authentication server sends the session encryption keys for a particular session to the client.
EAP type A specific Extensible Authentication Protocol (EAP) authentication mechanism. Both the
wireless client (or supplicant) and the authenticator must support the same EAP type for successful
authentication to occur. EAP types supported in a Nortel WLAN 2300 system wireless LAN (WLAN) include
EAP-MD5, EAP-TLS, PEAP-TLS, PEAP-MS-CHAP, and Tunneled Transport Layer Security (TTLS). See
enabled access Permission to use all WLAN Security Switch 2300 Series (WSS Software)
command-line interface (CLI) commands required for configuration and troubleshooting. Enabled access
encryption Any procedure used in cryptography to translate data into a form that can be read by only its
ESS Extended service set. A logical connection of multiple basic service sets (BSSs) connected to the same
network. Roaming within an ESS is guaranteed by the Nortel WLAN 2300 system.
Ethernet II The original Ethernet specification produced by Digital, Intel, and Xerox (DIX) that served as
the basis of the IEEE 802.3 standard.
ETSI European Telecommunications Standards Institute. A nonprofit organization that establishes
telecommunications and radio standards for Europe.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
814 Appendix F:Glossary
failover In a redundant system, an operation by which a standby (or secondary) system component
automatically takes over the functions of an active (or primary) system component when the active component
fails or is temporarily shut down or removed for servicing. During and after failover, the system continues its
normal operations with little or no interruption in service.
FCC Federal Communications Commission. The United States’ governing body for telecommunications,
radio, television, cable, and satellite communications.
FHSS Frequency-hopping spread-spectrum. One of two types of spread-spectrum radio technology used in
wireless LAN (WLAN) transmissions. The FHSS technique modulates the data signal with a narrowband
carrier signal that “hops” in a predictable sequence from frequency to frequency as a function of time over a
wide band of frequencies. Interference is reduced, because a narrowband interferer affects the spread-spectrum
signal only if both are transmitting at the same frequency at the same time. The transmission frequencies are
determined by a spreading (hopping) code. The receiver must be set to the same hopping code and must listen
forwarding database (FDB) A database maintained on a WLAN—Security Switch (WSS) for the
purpose of making Layer 2 forwarding and filtering decisions. Each entry consists of the media access control
(MAC) address of a source or destination device, an identifier for the port on which the source or destination
station is located, and an identifier for the virtual LAN (VLAN) to which the device belongs. FDB entries are
either permanent (never deleted), static (not aged, but deleted when the WSS is restarted or loses power), or
dynamic (learned dynamically and removed through aging or when the WSS is restarted or loses power).
GBIC Gigabit interface converter. A hot-swappable input/output device that plugs into a gigabit Ethernet
port, to link the port with a fiber-optic or copper network. The data transfer rate is 1 gigabit per second (Gbps)
or more. Typically employed as high-speed interfaces, GBICs allow you to easily configure and upgrade
communications networks.
GMK Group master key. A cryptographic key used to derive a group transient key (GTK) for the Temporal
Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES).
greenfield network An original deployment of a telecommunications network.
GRE tunnel A virtual link between two remote points on a network, created by means of the Generic
Routing Encapsulation (GRE) tunneling protocol. GRE encapsulates packets within a transport protocol
supported by the network.
GTK Group transient key. A cryptographic key used to encrypt broadcast and multicast packets for
transmissions using the Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES).
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 815
H.323 A set of International Telecommunications Union Telecommunication Standardization Sector
(ITU-T) standards that define a framework for the transmission of real-time voice signals over IP
packet-switched networks.
hash A one-way algorithm from whose output the input is computationally infeasible to determine. With a
good hashing algorithm you can produce identical output from two identical inputs, but finding two different
inputs that produce the same output is computationally infeasible. Hash functions are used widely in
authentication algorithms and for key derivation procedures.
HiperLAN High-performance radio local area network. A set of wireless LAN (WLAN) communication
standards used primarily in European countries and adopted by the European Telecommunications Standards
Institute (ETSI).
HMAC Hashed message authentication code. A function, defined in RFC 2104, for keyed hashing for
message authentication. HMAC is used with MD5 and the secure hash algorithm (SHA).
homologation The process of certifying a product or specification to verify that it meets regulatory
standards.
HPOV Hewlett-Packard Open View. The umbrella network management system (NMS) family of products
from Hewlett-Packard. The Nortel WLAN 2300 system WLAN Management Software tool suite interacts
with the HPOV Network Node Manager (NNM).
HTTPS Hypertext Transfer Protocol over Secure Sockets Layer. An Internet protocol developed by
Netscape to encrypt and decrypt network connections to Web servers. Built into all secure browsers, HTTPS
uses the Secure Sockets Layer (SSL) protocol as a sublayer under the regular HTTP application layer, and uses
IAS Internet Authentication Service. Microsoft’s RADIUS server.
IC Industry Canada. The Canadian governing body for telecommunications.
ICV Integrity check value. The output of a message integrity check.
IEEE Institute of Electrical and Electronic Engineers. An American professional society whose standards for
the computer and electronics industry often become national or international standards. In particular, the IEEE
802 standards for LANs are widely followed.
IGMP Internet Group Management Protocol. An Internet protocol, defined in RFC 2236, that enables an
Internet computer to report its multicast group membership to neighboring multicast routers. Multicasting
allows a computer on the Internet to send content to other computers that have identified themselves as
interested in receiving it.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
816 Appendix F:Glossary
IGMP snooping A feature that prevents the flow of multicast stream packets within a virtual LAN
(VLAN) and forwards the multicast traffic through a path to only the clients that want to receive it. A
WLAN—Security Switch (WSS) uses IGMP snooping to monitor the Internet Group Management Protocol
(IGMP) conversation between hosts and routers. When the WSS detects an IGMP report from a host for a
given multicast group, it adds the host’s port number to the list for that group. When it detects an IGMP host
leaving a group, the WSS removes the port number from the group list.
infrastructure network One of two IEEE 802.11 network frameworks. In an infrastructure network,
all communications are relayed through an AP. Wireless devices can communicate with each other or with a
wired network. The network is defined by the distance of mobile stations from the access point, but no
restriction is placed on the distance between stations. Stations must request association with the access point to
obtain network services, which the access point can grant or deny based on the contents of the association
request. Like most corporate wireless LANs (WLANs), which must access a wired LAN for file servers and
initialization vector (IV) In encryption, random data used to make a message unique.
interface A place at which independent systems meet and act on or communicate with each other, or the
means by which the interaction or communication is accomplished.
ISL Interswitch Link. A proprietary Cisco protocol for interconnecting multiple switches and maintaining
virtual LAN (VLAN) information as traffic travels between switches. Working in a way similar to VLAN
trunking, described in the IEEE 802.1Q standard, ISL provides VLAN capabilities while maintaining full
wire-speed performance on Ethernet links in full-duplex or half-duplex mode. ISL operates in a point-to-point
environment and supports up to 1000 VLANs.
ISO International Organization for Standardization. An international organization of national standards
bodies from many countries. ISO has defined a number of computer standards, including the Open Systems
Interconnection (OSI) standardized architecture for network design.
jumbo frame In an Ethernet network, a frame whose data field exceeds 1500 bytes.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 817
LDAP Lightweight Directory Access Protocol. A protocol defined in RFC 1777 for management and
browser applications that require simple read-write access to an X.500 directory without incurring the resource
requirements of Directory Access Protocol (DAP). Protocol elements are carried directly over TCP or other
transport, bypassing much of the session and presentation overhead. Many protocol data elements are encoded
as ordinary strings, and all protocol elements are encoded with lightweight basic encoding rules (BER).
location policy An ordered list of rules that overrides the virtual LAN (VLAN) assignment and security
ACL filtering applied to users during normal authentication, authorization, and accounting (AAA)—or assigns
a VLAN or security ACL to users without these assignments. Defining location policy rules creates a location
policy for local access within a WLAN—Security Switch (WSS). Each WSS can have only one location
location policy rule A rule in the location policy on a WLAN—Security Switch (WSS) that grants or
denies a set of network access rights based on one or more criteria. Location policy rules use a username or
VLAN membership to determine whether to override—or supply—authorization attributes during
authentication and to redirect traffic. Location policy rules are processed in the order in which they appear in
MAC (1) Media access control. See MAC address. (2) Message authentication code. A keyed hash used to
verify message integrity. In a keyed hash, the key and the message are inputs to the hash algorithm. See also
MIC.
MAC address Media access control address. A 6-byte hexadecimal address that a manufacturer assigns
to the Ethernet controller for a port. Higher-layer protocols use the MAC address at the MAC sublayer of the
Data Link layer (Layer 2) to access the physical media. The MAC function determines the use of network
capacity and the stations that are allowed to use the medium for transmission.
MAC address wildcard A Nortel convention for matching media access control (MAC) addresses or
sets of MAC addresses by means of known characters plus a “wildcard” asterisk (*) character that stands for
managed device In a Nortel WLAN 2300 system wireless LAN (WLAN), a WLAN—Security Switch
(WSS) or Access Point (AP) under the control of the WLAN Management Software tool suite.
master secret A code derived from the pre-master secret. A master secret is used to encrypt Transport
Layer Security (TLS) authentication exchanges and also to derive a pairwise master key (PMK). See also
MD5 Message-digest algorithm 5. A one-way hashing algorithm used in many authentication algorithms and
also to derive cryptographic keys in many algorithms. MD5 takes a message of an arbitrary length and creates
a 128-bit message digest.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
818 Appendix F:Glossary
Microsoft Challenge Handshake Authentication
minimum data transmit rate The lowest rate at which an AP can transmit data to its associated
mobile clients. If the data rate to a client drops below the minimum, the AP increases power, if Auto-RF is
enabled.
Mobility Domain™ A collection of WLAN—Security Switches (WSSs) working together to support a
roaming user (client).
Mobility Profile™ A user (client) authorization attribute that specifies the Access Point (AP) or wired
authentication ports the client can use in a Mobility Domain™ group.
MPDU MAC protocol data unit. In IEEE 802.11 communications, the data unit (or frame) that two peer
media access control (MAC) service access points (SAPs) exchange through the services of the Physical layer
MS-CHAP-V2 Microsoft Challenge Handshake Authentication Protocol version 2. Microsoft’s extension
to CHAP. MS-CHAP-V2 is a mutual authentication protocol, defined in RFC 2759, that also permits a single
MSDU MAC service data unit. In IEEE 802.11 communications, the data payload encapsulated within a
MAC protocol data unit (MPDU).
MTU Maximum transmission unit. The size of the largest packet that can be transmitted over a particular
medium. Packets exceeding the MTU value in size are fragmented or segmented, and then reassembled at the
receiving end. If fragmentation is not supported or possible, a packet that exceeds the MTU value is dropped.
NAPA Nortel Access Point Access protocol. A point-to-point datagram protocol, developed by Nortel, that
defines the way each AP communicates with a WLAN—Security Switch (WSS) in a Nortel WLAN 2300
system. By means of NAPA, APs announce their presence to the WSS, accept configuration from it, relay
traffic to and from it, announce the arrival and departure of users (clients), and provide statistics to the WSS on
command.
NAT Network address translation. The capability, defined in RFC 3022, of using one set of reusable IP
addresses for internal traffic on a LAN, and a second set of globally unique IP addresses for external traffic.
network plan A design for network deployment and settings for network configuration, stored in the
Nortel WLAN 2300 system WLAN Management Software tool suite.
nonvolatile storage A way of storing images and configurations so that they are maintained in a unit’s
memory whether power to the unit is on or off.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 819
Odyssey An 802.1X security and access control application for wireless LANs (WLANs), developed by
Funk Software, Inc.
OFDM Orthogonal frequency division multiplexing. A modulation technique that sends data across a
number of narrow subcarriers within a specified frequency band. The wireless networking standards IEEE
802.11a and IEEE 802.11g are based on OFDM.
PAT Port address translation. A type of network address translation (NAT) in which each computer on a LAN
PEAP Protected Extensible Authentication Protocol. A draft extension to the Extensible Authentication
Protocol with Transport Layer Security (EAP-TLS), developed by Microsoft Corporation, Cisco Systems, and
RSA Data Security, Inc. TLS is used in PEAP Part 1 to authenticate the server only, and thus avoids having to
distribute user certificates to every client. PEAP Part 2 performs mutual authentication between the EAP client
PEM Privacy-Enhanced Mail. A protocol, defined in RFC 1422 through RFC 1424, for transporting digital
certificates and certificate signing requests over the Internet. PEM format encodes the certificates on the basis
of an X.509 hierarchy of certificate authorities (CAs). Base64 encoding is used to convert the certificates to
ASCII text, and the encoded text is enclosed between BEGIN CERTIFICATE and END CERTIFICATE
delimiters.
PIM Protocol Independent Multicast protocol. A protocol-independent multicast routing protocol that
supports thousands of groups, a variety of multicast applications, and existing Layer 2 subnetwork
technologies. PIM can be operated in two modes: dense and sparse. In PIM dense mode (PIM-DM), packets
are flooded on all outgoing interfaces to many receivers. PIM sparse mode (PIM-SM) limits data distribution
to a minimal number of widely distributed routers. PIM-SM packets are sent only if they are explicitly
requested at a rendezvous point (RP).
PKCS Public-Key Cryptography Standards. A group of specifications produced by RSA Laboratories and
secure systems developers, and first published in 1991. Among many other features and functions, the
standards define syntax for digital certificates, certificate signing requests, and key transportation.
PKI Public-key infrastructure. Software that enables users of an insecure public network such as the Internet
to exchange information securely and privately. The PKI uses public-key cryptography (also known as
asymmetric cryptography) to authenticate the message sender and encrypt the message by means of a pair of
cryptographic keys, one public and one private. A trusted certificate authority (CA) creates both keys
simultaneously with the same algorithm. A registration authority (RA) must verify the certificate authority
before a digital certificate is issued to a requestor.
The PKI uses the digital certificate to identify an individual or an organization. The private key is given only to
the requesting party and is never shared, and the public key is made publicly available (as part of the digital
certificate) in a directory that all parties can access. You use the private key to decrypt text that has been
encrypted with your public key by someone else. The certificates are stored (and, when necessary, revoked) by
directory services and managed by a certificate management system. See also certificate authority (CA);
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
820 Appendix F:Glossary
plenum A compartment or chamber to which one or more air ducts are connected.
plenum-rated cable A type of cable approved by an independent test laboratory for installation in
ducts, plenums, and other air-handling spaces.
PMK Pairwise master key. A code derived from a master secret and used as an encryption key for IEEE
802.11 encryption algorithms. A PMK is also used to derive a pairwise transient key (PTK) for IEEE 802.11i
PoE Power over Ethernet. A technology, defined in the developing IEEE 802.3af standard, to deliver DC
power over twisted-pair Ethernet data cables rather than power cords. The electrical current, which enters the
data cable at the power-supply end and comes out at the device end, is kept separate from the data signal so
neither interferes with the other.
policy A formal set of statements that define the way a network’s resources are allocated among its
clients—individual users, departments, host computers, or applications. Resources are statically or
dynamically allocated by such factors as time of day, client authorization priorities, and availability of
resources.
Policy Manager A WLAN Management Software feature that allows you to apply a collection of
configuration settings known as a domain policy, or part of the policy, to one or more Access Point (WSSs).
With Policy Manager, you can also merge some or all of the configuration changes you make to a single WSS
pre-master secret A key generated during the handshake process in Transport Layer Security (TLS)
protocol negotiations and used to derive a master secret.
PRF Pseudorandom function. A function that produces effectively unpredictable output. A PRF can use
multiple iterations of one or more hash algorithms to achieve its output. The Transport Layer Security (TLS)
protocol defines a specific PRF for deriving keying material.
private key In cryptography, one of a pair of keys, one public and one private, that are created with the
same algorithm for encrypting and decrypting messages and digital signatures. The private key is provided to
only the requestor and never shared. The requestor uses the private key to decrypt text that has been encrypted
PRNG Pseudorandom number generator. An algorithm of predictable behavior that generates a sequence of
numbers with little or no discernible order, except for broad statistical patterns.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 821
PSK Preshared key. The IEEE 802.11 term for a shared secret, also known as a shared key. See shared secret.
PTK Pairwise transient key. A value derived from a pairwise master key (PMK) and split into multiple
encryption keys and message integrity code (MIC) keys for use by a client and server as temporal session keys
public key In cryptography, one of a pair of keys, one public and one private, that are created with the
same algorithm for encrypting and decrypting messages and digital signatures. The public key is made
PVST+ Per-VLAN Spanning Tree protocol. A proprietary Cisco protocol that supports a separate instance
of the Spanning Tree Protocol (STP) for each virtual LAN (VLAN) in a network and maps the multiple
QoS Quality of service. A networking technology that seeks to measure, improve, and guarantee
transmission rates, error rates, and other performance characteristics, based on priorities, policies, and
reservation criteria arranged in advance. Some protocols allow packets or streams to include QoS
requirements.
radio profile A group of parameters, such as the beacon interval, fragmentation threshold, and security
policies, that you configure in common across a set of radios in one or more Access Point (AP). A few
parameters, such as the radio name and channel number, must be set separately for each radio.
RADIUS Remote Authentication Dial-In User Service. A client-server security protocol described in
RFC 2865 and RFC 2866. RADIUS extensions, including RADIUS support for the Extensible Authentication
Protocol (EAP), are described in RFC 2869. Originally developed by Livingston Enterprises, Inc., to
authenticate, authorize, and account for dial-up users, RADIUS has been widely extended to broadband and
enterprise networking. The RADIUS server stores user profiles, which include passwords and authorization
attributes.
RC4 A common encryption algorithm, designed by RSA Data Security, Inc., used by the Wired-Equivalent
Privacy (WEP) protocol and Temporal Key Integrity Protocol (TKIP).
registration authority (RA) Network software that verifies a user (client) request for a digital
certificate and instructs the certificate authority (CA) to issue the certificate. Registration authorities are part of
a public-key infrastructure (PKI), which enables secure exchanges of information over a network. The digital
certificate contains a public key for encrypting and decrypting messages and digital signatures.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
822 Appendix F:Glossary
restricted access Permission to use most WLAN Security Switch 2300 Series (WSS Software)
command-line interface (CLI) commands required for viewing status information (show commands), except
those that list security information in clear text. Users with restricted access can clear ARP requests and ping
RF detection sweep A comprehensive search for radio frequency (RF) signals within a Mobility
Domain™ group, to locate rogue clients, rogue access points, and ad hoc users. A sweep can be either a
scheduled sweep or a continuous SentrySweep™ search. During a scheduled sweep, each included Access
Point (AP) radio sweeps all channels in the IEEE 802.11b/g and 802.11a spectrum. In contrast, SentrySweep
operates only on the disabled radios in a Mobility Domain and does not disrupt service.
WLAN Management Software™ A tool suite for planning, configuring, deploying, and managing
a Nortel WLAN 2300 system wireless LAN (WLAN). Based on site and user requirements, WLAN
Management Software determines the location of WLAN—Security Switches (WSSs) and Access Point (AP)
and can store and verify configuration information before installation. After installation, WLAN Management
Software deploys the settings on the equipment and manages and verifies configuration changes. To monitor
network performance, WLAN Management Software collects WSS and AP information, calculates and
displays AP neighbor relationships, and detects anomalous events—for example, rogue access points.
roaming The ability of a wireless user (client) to maintain network access when moving between APs.
rogue access point An AP that is not authorized to operate within a wireless network. Rogue access
points subvert the security of an enterprise network by allowing potentially unchallenged access to the
enterprise network by any wireless user (client) in the physical vicinity.
rogue client A user (client) who is not recognized within a network, but who gains access to it by
intercepting and modifying transmissions to circumvent the normal authorization and authentication
processes.
RSA A public-key algorithm developed in 1977 by RSA Data Security, Inc., used for encryption, digital
signatures, and key exchange.
RSN Robust security network. A secure wireless LAN (WLAN) based on the developing IEEE 802.11i
standard.
RSSI Received signal strength indication. The received strength of an incoming radio frequency (RF) signal,
typically measured in decibels referred to 1 milliwatt (dBm).
scalability The ability to adapt easily to increased or decreased requirements without impairing
performance.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 823
security ACL Security access control list. An ordered list of rules to control access to and from a network
by determining whether to forward or filter packets that are entering or exiting it. Associating a security ACL
with a particular user, port, virtual LAN (VLAN), or virtual port on a WLAN—Security Switch (WSS)
controls the network traffic to or from the user, port, VLAN, or virtual port. The rules in an ACL are known as
seed (1) An input to a pseudorandom number generator (PRNG), that is generally the combination of two or
more inputs. (2) The WLAN—Security Switch (WSS) that distributes information to all the WSSs in a
Mobility Domain™ group.
SentrySweep™ A radio frequency (RF) detection sweep that runs continuously on the disabled radios
session A related set of communication transactions between an authenticated user (client) and the
specific station to which the client is bound.
SHA Secure hashing algorithm. A one-way hashing algorithm used in many authentication algorithms and
also for key derivation in many algorithms. A SHA produces a 160-bit hash.
shared secret A static key distributed by an out-of-band mechanism to both the sender and receiver.
Also known as a shared key or preshared key (PSK), a shared secret is used as input to a one-way hash
algorithm. When a shared secret is used for authentication, if the hash output of both sender and receiver is the
same, they share the same secret and are authenticated. A shared secret can also be used for encryption key
generation and key derivation.
SIP Session Initialization Protocol. A signaling protocol that establishes real-time calls and conferences over
IP networks.
SSH Secure Shell protocol. A Telnet-like protocol that establishes an encrypted session.
SSID Service set identifier. The unique name shared among all computers and other devices in a wireless
LAN (WLAN).
SSL Secure Sockets Layer protocol. A protocol developed by Netscape for managing the security of
message transmission over the Internet. SSL has been succeeded by Transport Layer Security (TLS) protocol,
which is based on SSL. The sockets part of the term refers to the sockets method of passing data back and forth
between a client and a server program in a network or between program layers in the same computer. SSL uses
the public-and-private key encryption system from RSA Data Security, Inc., which also includes the use of a
station Any device with a media access control (MAC) address and a Physical layer (PHY) interface to the
wireless medium that comply with the standards for all IEEE 802 networks. Wireless clients and Access Point
(AP) are stations in a Nortel WLAN 2300 system.
STP Spanning Tree Protocol. A link management protocol, defined in the IEEE 802.1D standard, that
provides path redundancy while preventing undesirable loops in a network. STP is also known as Spanning
Tree Bridge Protocol.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
824 Appendix F:Glossary
subnet mobility The ability of a wireless user (client) to roam across Access Point (AP) and
WLAN—Security Switch (WSS) switches in a virtual LAN (VLAN) while maintaining a single IP address
and associated data sessions.
supplicant A client that is attempting to access a network.
syslog server A remote repository for log messages. Nortel WLAN Security Switch 2300 Series (WSS
Software) supports up to four syslog servers on virtual LANs (VLANs) whose locations are configurable.
WSS Software log protocol complies with RFC 3164.
TKIP Temporal Key Integrity Protocol. A wireless encryption protocol that fixes the known problems in the
Wired-Equivalent Privacy (WEP) protocol for existing IEEE 802.11 products. Like WEP, TKIP uses RC4
ciphering, but adds functions such as a 128-bit encryption key, a 48-bit initialization vector, a new message
integrity code (MIC), and initialization vector (IV) sequencing rules to provide better protection. See also
TLS Transport Layer Security protocol. An authentication and encryption protocol that is the successor to
the Secure Sockets Layer (SSL) protocol for private transmission over the Internet. Defined in RFC 2246, TLS
provides mutual authentication with nonrepudiation, encryption, algorithm negotiation, secure key derivation,
and message integrity checking. TLS has been adapted for use in wireless LANs (WLANs) and is used widely
TLV Type, length, and value. A methodology for coding parameters within a frame. Type indicates a
parameter’s type, length indicates the length of its value, and value indicates the parameter’s value.
TTLS Tunneled Transport Layer Security. An Extensible Authentication Protocol (EAP) method developed
by Funk Software, Inc., and Certicom for 802.1X authentication. TTLS uses a combination of certificates and
password challenge and response for authentication. The entire EAP subprotocol exchange of attribute-value
pairs takes place inside an encrypted transport layer security (TLS) tunnel. TTLS supports authentication
methods defined by EAP, as well as the older Challenge Handshake Authentication Protocol (CHAP),
Password Authentication Protocol (PAP), Microsoft CHAP (MS-CHAP), and MS-CHAPV2. Compare
tunneling The transmission of data by one network through the connections of another network by
encapsulating its data and protocol information within the other network’s transmission units. To forward
traffic for a roaming user within a Mobility Domain™ group, a WLAN—Security Switch (WSS) that is not a
member of the user’s virtual LAN (VLAN) creates a tunnel to another WSS on which the user’s VLAN is
configured.
U-NII Unlicensed National Information Infrastructure. Three unlicensed frequency bands of 100 MHz each
in the 5 GHz band, designated by the U.S. Federal Communications Commission (FCC) to provide high-speed
wireless networking. The three frequency bands—5.15 GHz through 5.25 GHz (for indoor use only),
5.25 GHz through 5.35 GHz, and 5.725 GHz through 5.825 GHz—were allocated in 1997.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 825
user A person who uses a client. In a Nortel WLAN 2300 system, users are indexed by username and
associated with authorization attributes such as user group membership.
user wildcard A Nortel convention for matching fully qualified structured usernames or sets of
usernames during authentication by means of known characters plus two special “wildcard” characters.
Double asterisks (**) represent all usernames. A single asterisk (*) can appear either before or after the
delimiter in a user wildcard and can represent any number of characters up to the next delimiter. A delimiter
user group A collection of users with the same authorization attributes.
VLAN Virtual LAN. A set of ports that share a single Layer 2 network. Because the ports that constitute a
VLAN can be on a single network device or multiple devices, VLANs enable you to partition a physical
network into logical networks that meet the needs of your organization. You can divide a single device into
multiple logical Layer 2 switches, with each VLAN operating as a separate switch, or make multiple devices
members of multiple logical Layer 2 networks. By default, all WLAN—Security Switch (WSS) ports are
members of VLAN 1, which is named default.
VLAN wildcard A Nortel convention for applying the authentication, authorization, and accounting
(AAA) attributes in the location policy on a WSS to one or more users, based on a virtual LAN (VLAN)
attribute. To specify all VLANs, use the double-asterisk (**) wildcard characters. To match any number of
characters up to, but not including a delimiter character in the wildcard, use the single-asterisk wildcard. Valid
VLAN wildcard delimiter characters are the at (@) sign and the dot (.). See also location policy; MAC address
VoIP Voice over IP. The ability of an IP network to carry telephone voice signals as IP packets in compliance
with International Telecommunications Union Telecommunication Standardization Sector (ITU-T)
specification H.323. VoIP enables a router to transmit telephone calls and faxes over the Internet with no loss
in functionality, reliability, or voice quality.
VSA Vendor-specific attribute. A type of RADIUS attribute that enables a vendor to extend RADIUS
operations to fit its own products, without conflicting with existing RADIUS attributes or the VSAs of other
companies. Companies can create new authentication and accounting attributes as VSAs.
watch list A WLAN Management Software method for monitoring user location and activity. After
initially finding a user through WLAN Management Software, you can add the user to the watch list for
continued monitoring. WLAN Management Software tracks and displays such information as the AP that a
user is associated with during a session, the server that authenticated the user, and the session start and stop
times.
Web View A Web-based application for configuring and managing a single WLAN—Security Switch
(WSS) and its attached Access Point (AP) through a Web browser. Web View uses a secure connection that
implements Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS).
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
826 Appendix F:Glossary
WEP Wired-Equivalent Privacy protocol. A security protocol, specified in the IEEE 802.11 standard, that
attempts to provide a wireless LAN (WLAN) with a minimal level of security and privacy comparable to a
typical wired LAN. WEP encrypts data transmitted over the WLAN to protect the vulnerable wireless
connection between users (clients) and APs. Although appropriate for most home use, WEP is weak and
Wi-Fi Alliance An organization formed by leading wireless equipment and software providers, for
certifying all IEEE 802.11 wireless LAN (WLAN) products for interoperability and promoting the term Wi-Fi
as their global brand name. Only products that pass Wi-Fi Alliance testing can be certified. Certified products
are required to carry an identifying seal on their packaging stating that the product is Wi-Fi certified and
indicating the radio frequency band used (2.4 GHz for 802.11b and 5 GHz for 802.11a, for example). The
Wi-Fi Alliance was formerly known as the Wireless Ethernet Compatibility Alliance (WECA).
wildcard mask A 32-bit quantity used with an IP address to determine which bits in the address to
ignore in a comparison with another IP address. When setting up security access control lists (ACLs), you
specify source and destination IP addresses and corresponding wildcard masks by which the WSS determines
whether to forward or filter packets. The security ACL checks the bits in IP addresses that correspond to any 0s
(zeros) in the mask, but does not check the bits that correspond to 1s (ones) in the mask.
wired authentication port An Ethernet port that has 802.1X authentication enabled for access
control.
WISP Wireless Internet service provider. A company that provides public wireless LAN (WLAN) services.
WLAN Wireless LAN. A LAN to which mobile users (clients) can connect and communicate by means of
high-frequency radio waves rather than wires. WLANs are defined in the IEEE 802.11 standard.
WLAN Security Switch 2300 Series (WSS Software) The Nortel operating system,
accessible through a command-line interface (CLI) or the WLAN Management Software tool suite, that
enables Nortel WLAN 2300 system products to operate as a single system. WLAN Security Switch 2300
Series (WSS Software) performs authentication, authorization, and accounting (AAA) functions; manages
WLAN—Security Switches (WSSs) and Access Points (APs); and maintains the wireless LAN (WLAN) by
means of such network structures as Mobility Domain™ groups, virtual LANs (VLANs), tunnels, spanning
trees, and link aggregation.
WLAN—Security Switch (WSS) A switch in a Nortel WLAN 2300 system. A WSS provides
forwarding, queuing, tunneling, and some security services for the information it receives from its directly
attached Access Point (APs). In addition, the WSS coordinates, provides power to, and manages the
configuration of each attached AP, by means of the Nortel Access Point Access (NAPA) protocol.
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Appendix F:Glossary 827
WPA Wi-Fi Protected Access. The Wi-Fi Alliance’s version of the Temporal Key Integrity Protocol (TKIP)
that also includes a message integrity code (MIC) known as Michael. Although WPA provides greater wireless
security than the Wired-Equivalent Privacy protocol (WEP), WPA is not as secure as IEEE 802.11i, which
includes both the RC4 encryption used in WEP and Advanced Encryption Standard (AES) encryption, but is
WPA IE A set of extra fields in a wireless frame that contain Wi-Fi Protected Access (WPA) information for
the access point or client. For example, an AP uses the WPA IE in a beacon frame to advertise the cipher suites
and authentication methods that the AP supports for its encrypted SSID.
X.500 A standard of the International Organization for Standardization (ISO) and International
Telecommunications Union Telecommunication Standardization Sector (ITU-T), for systematically collecting
the names of people in an organization into an electronic directory that can be part of a global directory
available to anyone in the world with Internet access.
X.509 An International Telecommunications Union Telecommunication Standardization Sector (ITU-T)
Recommendation and the most widely used standard for defining digital certificates.
XML Extensible Markup Language. A simpler and easier-to-use subset of the Standard Generalized Markup
Language (SGML), with unlimited, self-defining markup symbols (tags). Developed by the World Wide Web
Consortium (W3C), the XML specification provides a flexible way to create common information formats and
share both the format and the data on the Internet, intranets, and elsewhere. Designers can create their own
customized tags to define, transmit, validate, and interpret data between applications and between
organizations.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
828 Appendix F:Glossary
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 829
Index
Access Point (AP)
Symbols
(Access Points (APs)
access points
Numerics
802.1X
A
AAA (authentication, authorization, and
accounting)
access
administrative access mode
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
830 Index
administrators
asterisks. See double asterisks (**); single asterisks
attributes
Telnet client sessions, displaying and clearing
authentication
aging timeout
AP (Access Point)
ARP entries
authentication, authorization, and accounting. See
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 831
authorization attributes
Catalyst switch, interoperating with load-sharing
authorization password
certificate authority
Auto-RF
certificates
channel
B
before editbuffer-index
bridge priority
channels
CIDR format for subnet masks in command entries
cipher suites, RSN
broadcast
buffer
CLI
C
CLI (command-line interface)
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
832 Index
connections
console
clients
conventions
CoS (class of service)
command-line interface. See CLI (command-line
counters
committed security ACLs
configuration
D
database, local
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 833
dynamic entries
dynamic security ACLs. See user-based security
default configuration
delivery traffic indication map (DTIM) interval
Distributed APs
Domain Name Service. See DNS (Domain Name
double asterisks (**)
DTIM (delivery traffic indication map) interval
E
EAP (Extensible Authentication Protocol)
edit buffer
encryption
encryption keys
End-Date attribute
dual homing
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
834 Index
eq (equal to) operator
forwarding database. See FDB (forwarding
forwarding delay
Extensible Authentication Protocol (EAP). See EAP
G
F
factory default configuration
fallthru authentication type
H
hello interval
hits, security ACLs
I
files
fingerprint
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 835
image
Internet Control Message Protocol (ICMP) ACLs
Internet Group Management Protocol. See IGMP
K
key transmission
keys
L
last-resort authentication
last-resort username
load balancing
IP addresses
local authentication
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
836 Index
local override and backup authentication, scenario
M
MAC address wildcards
MAC addresses
MAC authentication
mapping security ACLs
masks
location policy
location policy rules
logging
members
Mobility Domain
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 837
neq (not equal to) operator
NETS (Nortel Enterprise Technical Support)
network access mode
Network Domain
Mobility-Profile attribute
network sessions
modify editbuffer-index
monitoring
monitors
multicast
Network Time Protocol. See NTP (Network Time
network users
nonvolatile storage
N
names
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
838 Index
notifications
PEAP-MS-CHAP-V2
PEAP-MS-CHAP-V2 offload authentication
peer, Network Domain
permanent entries
O
offload authentication
PEAP-MS-CHAP-V2 configuration scenario
operating system
Personal Information Exchange Syntax Standard
ping
P
packets
pass-through authentication
PoE (Power over Ethernet)
password
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 839
power
Power over Ethernet. See PoE (Power over
port lists
profile
port types
ports
public-private key pair
Q
querier
R
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
840 Index
radios
RADIUS attributes
reauthentication
RADIUS
redundancy
pass-through authentication, configuration
roaming
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 841
S
scenarios
PEAP-MS-CHAP-V2 offload authentication
PEAP-MS-CHAP-V2 with pass-through
RADIUS pass-through authentication
Secure Sockets Layer protocol (SSL), management
rogue access points
RSN
running configuration
security
security ACLs
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
842 Index
servers
service set identifiers. See SSIDs (service set
session IDs
seed, Mobility Domain
Simple Network Time Protocol. See NTP (Network
seed, Network Domain
self-signed certificates
single asterisks (*)
server groups
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 843
SNMP ports
snooping
software
Spanning Tree Protocol. See STP (Spanning Tree
SSH
SSID attribute
SSL management ports
Start-Date attribute
static entries
syslog server
static IP information
system configuration
statistics
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
844 Index
template
system logs
Time-Of-Day attribute
timeout
timers
T
target
TCP ports
technical support
Telnet
administrative sessions, displaying and clearing
traces
idle timeout
console
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 845
URL attribute
troubleshooting
user wildcards
user-based security ACLs
TTY sessions, current, logging system messages to
usernames
tunnels
type-of-service (TOS) level, filtering packets by
users
U
UDP ports
V
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
846 Index
vendor-specific attributes. See VSAs
virtual ports
VSAs (vendor-specific attributes)
VLAN names
W
VLAN wildcards
Web View
Web-based AAA
WEP (Wired-Equivalent Privacy)
WEP 802.1X keys
overriding assignment with the location policy
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Index 847
wildcards
WSS ports
wildcards. See MAC address wildcards; user
WSS Software CLI. See CLI (command-line
X
Wired-Equivalent Privacy. See WEP
WLAN 2300 System Software CLI. See CLI
WLAN—Security Switch. See WSS
WMS
WPA (Wi-Fi Protected Access)
WPA2
WSS (WLAN—Security Switch)
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
848 Index
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Command Index 851
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
852 Command Index
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Command Index 853
Nortel WLAN Security Switch 2300 Series Configuration Guide
Download from Www.Somanuals.com. All Manuals Search And Download.
854 Command Index
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
856 Command Index
NN47250-500 (Version 03.01)
Download from Www.Somanuals.com. All Manuals Search And Download.
Download from Www.Somanuals.com. All Manuals Search And Download.
Nortel WLAN—Security Switch 2300 Series Configuration Guide
Nortel WLAN—Security Switch 2300 Series
Release 7.0
Sourced in Canada, the United States of America, and India
Document Number: NN47250-500
Document Status: Standard
Document Version: 03.01
Release Date: November 2008
Copyright © Nortel Networks Limited 2007-2008 All Rights Reserved
The information in this document is subject to change without notice. The statements, configurations,
technical data, and recommendations in this document are believed to be accurate and reliable, but are
presented without express or implied warranty. Users must take full responsibility for their applications
of any products specified in this document. The information in this document is proprietary to Nortel
Networks.
*Nortel, Nortel Networks, the Nortel logo, and the Globemark are trademarks of Nortel Networks.
*Microsoft, MS, MS-DOS, Windows, and Windows NT are registered trademarks of Microsoft
Corporation.
All other trademarks and registered trademarks are the property of their respective owners.
To provide feedback, or to report a problem in this document, go to
Download from Www.Somanuals.com. All Manuals Search And Download.
|
Miele Cooktop KM360G User Manual
Milwaukee Saw 6268 21 User Manual
Minolta Digital Camera X 700 User Manual
Nikon Binoculars 7x50IF HP WP User Manual
Nikon Camera Lens 1000MM User Manual
Nortec Humidifier NHPC User Manual
Omron Healthcare Blood Pressure Monitor HEM 790IT User Manual
Oregon Scientific Weather Radio BAR986HGA User Manual
OWI Portable Speaker LGS474 User Manual
Panasonic All in One Printer KX PW501DL User Manual