Home » Cisco Manuals » Wireless » Cisco M10-RM » Manual Viewer

Cisco M10-RM Software Guide - Page 99

Controlling Access Point Access with RADIUS

Add to My Manuals
Save this manual to your list of manuals

Page 99 highlights

Chapter 5 Administering the Access PointWireless Device Access Controlling Access Point Access with RADIUS Step 3 Step 4 Step 5 Step 6 Command enable password level level password end show running-config or show privilege copy running-config startup-config Purpose Specify the enable password for the privilege level. • For level, the range is from 0 to 15. Level 1 is for normal user EXEC mode privileges. • For password, specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. By default, no password is defined. Note Characters TAB, ?, $, +, and [ are invalid characters for passwords. Return to privileged EXEC mode. Verify your entries. The first command displays the password and access level configuration. The second command displays the privilege level configuration. (Optional) Save your entries in the configuration file. When you set a command to a privilege level, all commands whose syntax is a subset of that command are also set to that level. For example, if you set the show ip route command to level 15, the show commands and show ip commands are automatically set to privilege level 15 unless you set them individually to different levels. To return to the default privilege for a given command, use the no privilege mode level level command global configuration command. This example shows how to set the configure command to privilege level 14 and define SecretPswd14 as the password users must enter to use level 14 commands: AP(config)# privilege exec level 14 configure AP(config)# enable password level 14 SecretPswd14 Logging Into and Exiting a Privilege Level Beginning in privileged EXEC mode, follow these steps to log in to a specified privilege level and to exit to a specified privilege level: Command Step 1 enable level Step 2 disable level Purpose Log in to a specified privilege level. For level, the range is 0 to 15. Exit to a specified privilege level. For level, the range is 0 to 15. Controlling Access Point Access with RADIUS This section describes how to control administrator access to the wireless device using Remote Authentication Dial-In User Service (RADIUS). For complete instructions on configuring the wireless device to support RADIUS, see Chapter 13, "Configuring RADIUS and TACACS+ Servers." OL-14209-01 Cisco IOS Software Configuration Guide for Cisco Aironet Access Points 5-9

Section	Page
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points	1
Preface	21
Audience	21
Purpose	21
Organization	22
Conventions	23
Related Publications	25
Obtaining Documentation, Obtaining Support, and Security Guidelines	26
1	27
Overview	27
Features	28
Features Introduced in This Release	28
Table 1-1 New Cisco IOS Software Features for Cisco IOS Release 12.4(10b)JA	28
Management Options	28
Roaming Client Devices	29
Network Configuration Examples	29
Root Access Point	29
Figure 1-1 Access Points as Root Units on a Wired LAN	30
Repeater Access Point	30
Figure 1-2 Access Point as Repeater	30
Bridges	31
Figure 1-3 Access Point as a Root Bridge with Clients	31
Figure 1-4 Access Points as Root and Non-root Bridges with Clients	31
Workgroup Bridge	31
Figure 1-5 Access Point as a Workgroup Bridge	32
Central Unit in an All-Wireless Network	32
Figure 1-6 Access Point as Central Unit in All-Wireless Network	32
2	33
Using the Web-Browser Interface	33
Using the Web-Browser Interface for the First Time	35
Step 1 Start the browser.	35
Step 2 Enter the wireless device’s IP address in the browser Location field (Netscape Communicator) or Address field (Internet Explorer) and press Enter. The Summary StatusHome page appears.	35
Using the Management Pages in the Web-Browser Interface	35
Figure 2-1 Web-Browser Interface Home Page	35
Using Action Buttons	36
Table 2-1 Common Buttons on Management Pages	36
Character Restrictions in Entry Fields	37
Enabling HTTPS for Secure Browsing	37
Step 1 If your browser uses popup-blocking software, disable the popup-blocking feature.	38
Step 2 Browse to the Express Setup page. Figure 2-2 shows the Express Setup page.	38
Figure 2-2 Express Setup Page	38
Step 3 Enter a name for the access point in the System Name field and click Apply.	38
Step 4 Browse to the Services - DNS page. Figure 2-3 shows the Services - DNS page.	38
Figure 2-3 Services - DNS Page	39
Step 5 Select Enable for Domain Name System.	39
Step 6 In the Domain Name field, enter your company’s domain name. At Cisco Systems, for example, the domain name is cisco.com.	39
Step 7 Enter at least one IP address for your DNS server in the Name Server IP Addresses entry fields.	39
Step 8 Click Apply. The access point’s FQDN is a combination of the system name and the domain name. For example, if your system name is ap1100 and your domain name is company.com, the FQDN is ap1100.company.com.	39
Step 9 Enter the FQDN on your DNS server.	39
Step 10 Browse to the Services: HTTP Web Server page. Figure 2-4 shows the HTTP Web Server page:	40
Figure 2-4 Services: HTTP Web Server Page	40
Step 11 Select the Enable Secure (HTTPS) Browsing check box and click Apply.	40
Step 12 Enter a domain name and click Apply.	40
Figure 2-5 HTTPS Warning Window	40
Step 13 Click OK. The address in your browser’s address line changes from http://ip-address to https://ip-address.	40
Step 14 Another warning window appears stating that the access point’s security certificate is valid but is not from a known sou...	41
Figure 2-6 Certificate Warning Window	41
Step 15 Click View Certificate to accept the certificate before proceeding. (To proceed without accepting the certificate, click Yes, and skip to Step 24 in these instructions.) Figure 2-7 shows the Certificate window.	41
Figure 2-7 Certificate Window	42
Step 16 On the Certificate window, click Install Certificate. The Microsoft Windows Certificate Import Wizard appears. Figure 2-8 shows the Certificate Import Wizard window.	42
Figure 2-8 Certificate Import Wizard Window	43
Step 17 Click Next. The next window asks where you want to store the certificate. Cisco recommends that you use the default storage area on your system. Figure 2-9 shows the window that asks about the certificate storage area.	43
Figure 2-9 Certificate Storage Area Window	43
Step 18 Click Next to accept the default storage area. A window appears that states that you successfully imported the certificate. Figure 2-10 shows the completion window.	43
Figure 2-10 Certificate Completion Window	44
Step 19 Click Finish. Windows displays a final security warning. Figure 2-11 shows the security warning.	44
Figure 2-11 Certificate Security Warning	44
Step 20 Click Yes. Windows displays another window stating that the installation is successful. Figure 2-12 shows the completion window.	44
Figure 2-12 Import Successful Window	45
Step 21 Click OK.	45
Step 22 On the Certificate window shown in Figure 2-7, which is still displayed, click OK.	45
Step 23 On the Security Alert window shown in Figure 2-6, click Yes.	45
Step 24 The access point login window appears and you must log into the access point again. The default user name is Cisco (case-sensitive) and the default password is Cisco (case-sensitive).	45
CLI Configuration Example	45
Deleting an HTTPS Certificate	45
Step 1 Browse to the Services: HTTP Web Server page.	45
Step 2 Uncheck the Enable Secure (HTTPS) Browsing check box to disable HTTPS.	45
Step 3 Click Delete Certificate to delete the certificate.	45
Step 4 Re-enable HTTPS. The access point generates a new certificate using the new FQDN.	45
Using Online Help	46
Figure 2-13 Help and Print Icons	46
Changing the Location of Help Files	46
Step 1 Download the help files from the Software Center on Cisco.com. Click this link to go to the Cisco Software Center home page:	46
Step 2 Unzip the help files on your network in a directory accessible to your access point. When you unzip the help files, the HTML help pages are stored in a folder named according to the help version number and access point model number.	46
Step 3 Browse to the Services: HTTP Web Server page in the access point web-browser interface.	46
Step 4 In the Default Help Root URL entry field, enter the complete path to the location where you unzipped the help files. When...	46
Table 2-2 Example Help Root URL and Help Location	47
Step 5 Click Apply.	47
Disabling the Web-Browser Interface	47
3	49
Using the Command-Line Interface	49
Cisco IOS Command Modes	50
Table 3-1 Command Mode Summary	50
Getting Help	51
Table 3-2 Help Summary	51
Abbreviating Commands	51
Using no and default Forms of Commands	52
Understanding CLI Messages	52
Table 3-3 Common CLI Error Messages	52
Using Command History	52
Changing the Command History Buffer Size	53
Recalling Commands	53
Table 3-4 Recalling Commands	53
Disabling the Command History Feature	53
Using Editing Features	54
Enabling and Disabling Editing Features	54
Editing Commands Through Keystrokes	54
Table 3-5 Editing Commands Through Keystrokes	54
Editing Command Lines that Wrap	55
Searching and Filtering Output of show and more Commands	56
Accessing the CLI	57
Opening the CLI with Telnet	57
Step 1 Select Start > Programs > Accessories > Telnet.	57
Step 2 When the Telnet window appears, click Connect and select Remote System.	57
Step 3 In the Host Name field, type the wireless device’s IP address and click Connect.	57
Step 4 At the username and password prompts, enter your administrator username and password. The default username is Cisco, and the default password is Cisco. The default enable password is also Cisco. Usernames and passwords are case-sensitive.	57
Opening the CLI with Secure Shell	57
4	59
Configuring the Access Point for the First Time	59
Before You Start	60
Resetting the Device to Default Settings	60
Resetting to Default Settings Using the MODE Button	60
Step 1 Disconnect power (the power jack for external power or the Ethernet cable for in-line power) from the access point.	60
Step 2 Press and hold the MODE button while you reconnect power to the access point.	60
Step 3 Hold the MODE button until the Status LED turns amber (approximately 1 to 2 seconds), and release the button. All access point settings return to factory defaults.	60
Resetting to Default Settings Using the GUI	60
Step 1 Open your Internet browser. The web-browser interface is fully compatible with Microsoft Internet Explorer version 6.0 on Windows 98, 2000 and XP platforms, and with Netscape version 7.0 on Windows 98, 2000, XP, and Solaris platforms.	60
Step 2 Enter the wireless device’s IP address in the browser address line and press Enter. An Enter Network Password window appears.	60
Step 3 Enter your username in the User Name field. The default username is Cisco.	60
Step 4 Enter the wireless device password in the Password field and press Enter. The default password is Cisco. The Summary Status page appears.	60
Step 5 Click System Software and the System Software screen appears.	61
Step 6 Click System Configuration and the System Configuration screen appears.	61
Step 7 Click the Reset to Defaults button to reset all settings, including the IP address, to factory defaults. To reset all settings except the IP address to defaults, click the Reset to Defaults (Except IP) button.	61
Resetting to Default Settings Using the CLI	61
Step 1 Enter erase nvram: to erase all NVRAM files including the startup configuration.	61
Step 2 Follow the step below to erase a static IP address and subnet mask. Otherwise, go to step 3.	61
Step 3 Enter Y when the following CLI message displays: Erasing the nvram filesystem will remove all configuration files! Continue? [confirm].	61
Step 4 Enter reload when the following CLI message displays: Erase of nvram: complete. This command reloads the operating system.	61
Step 5 Enter Y when the following CLI message displays: Proceed with reload? [confirm].	61
Step 6 After the access point/bridge reboots, you can reconfigure the access point by using the Web-browser interface if you previously assigned a static IP address, or the CLI if you did not.	61
Obtaining and Assigning an IP Address	62
Default IP Address Behavior	62
Connecting to the 1100 Series Access Point Locally	63
Step 1 Make sure that the PC you intend to use to configure the access point is configured with an IP address from 10.0.0.2 to 10.0.0.10.	63
Step 2 Connect your PC to the access point using a Category 5 Ethernet cable. You can use either a crossover cable or a straight-through cable.	63
Step 3 Power up the access point.	63
Step 4 Follow the steps in the “Assigning Basic Settings” section on page 4-8. If you make a mistake and need to start over, follow the steps in the “Resetting the Device to Default Settings” section on page 4-2.	63
Step 5 After configuring the access point, remove the Ethernet cable from your PC and connect the access point to your wired LAN.	63
Connecting to the 1130 Series Access Point Locally	64
Step 1 Open the access point cover.	64
Step 2 Connect a nine-pin, female DB-9 to RJ-45 serial cable to the RJ-45 serial port on the access point and to the COM port on...	64
Step 3 Set up a terminal emulator to communicate with the access point. Use the following settings for the terminal emulator connection: 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control.	64
Step 4 When connected, press enter or type en to access the command prompt. Pressing enter takes you to the user exec mode. ente...	64
I	64
Connecting to the 1200, 1230, 1240, and 1250 Series Access Points Locally	64
Step 1 Connect a nine-pin, female DB-9 to RJ-45 serial cable to the RJ-45 serial port on the access point and to the COM port on...	64
Step 2 Set up a terminal emulator to communicate with the access point. Use the following settings for the terminal emulator connection: 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control.	64
Step 3 When connected, press enter or type en to access the command prompt. Pressing enter takes you to the user exec mode. Ente...	64
Connecting to the 1300 Series Access Point/Bridge Locally	65
Step 1 Make sure that the PC you intend to use is configured to obtain an IP address automatically, or manually assign it an IP ...	65
Step 2 With the power cable disconnected from the power injector, connect your PC to the power injector using a Category 5 Ethernet cable. You can use either a crossover cable or a straight-through cable.	65
Step 3 Connect the power injector to the access point/bridge using dual coaxial cables.	65
Step 4 Connect the power injector power cable and power up the access point/bridge.	65
Step 5 Follow the steps in the “Assigning Basic Settings” section on page 4-8. If you make a mistake and need to start over, follow the steps in the “Resetting the Device to Default Settings” procedure on page 4-2.	65
Step 6 After configuring the access point/bridge, remove the Ethernet cable from your PC and connect the power injector to your wired LAN.	65
Default Radio Settings	65
Assigning Basic Settings	66
Step 1 Open your Internet browser. The wireless device web-browser interface is fully compatible with Microsoft Internet Explorer version 6.0 on Windows 98, 2000, XP platforms, and with Netscape version 7.0 on Windows 98, 2000, XP, and Solaris platforms.	66
Step 2 Enter the wireless device’s IP address in the browser address line and press Enter. An Enter Network Password screen appears.	66
Step 3 Press Tab to bypass the Username field and advance to the Password field.	66
Step 4 Enter the case-sensitive password Cisco and press Enter. The Summary Status page appears. A typical Summary Status page is shown in Figure 4-1. Your page may differ depending on the access point model you are using.	66
Figure 4-1 Summary Status Page	66
Step 5 Click Express Setup. The Express Setup screen appears. Figure 4-2 and Figure 4-3 shows the Express Setup page for the 1100 series access points. Your pages may differ depending on the access point model you are using.	67
Figure 4-2 Express Setup Page for 1100 Series Access Points	67
Figure 4-3 Express Setup Page for 1130, 1200, and 1240 Series Access Points	68
Figure 4-4 Express Setup Page for the 1250 Series Access Point	69
Figure 4-5 Express Setup Page for the 1300 Series Access Point/Bridge	70
Step 6 Enter the configuration settings you obtained from your system administrator. The configurable settings include:	70
Step 7 Click Apply to save your settings.	72
Step 8 Click Network Interfaces to browse to the Network Interfaces Summary page.	72
Step 9 Click the radio interface to browse to the Network Interfaces: Radio Status page.	72
Step 10 Click the Settings tab to browse to the Settings page for the radio interface.	72
Step 11 Click Enable to enable the radio.	72
Step 12 Click Apply.	72
Default Settings on the Express Setup Page	72
Table 4-1 Default Settings on the Express Setup Page	72
Configuring Basic Security Settings	74
Figure 4-6 Express Security Page	74
Understanding Express Security Settings	76
Using VLANs	76
Express Security Types	77
Table 4-2 Security Types on Express Security Setup Page	77
Express Security Limitations	79
Using the Express Security Page	79
Step 1 Type the SSID in the SSID entry field. The SSID can contain up to 32 alphanumeric characters.	79
Step 2 To broadcast the SSID in the wireless device beacon, check the Broadcast SSID in Beacon check box. When you broadcast the...	79
Step 3 (Optional) Check the Enable VLAN ID check box and enter a VLAN number (1 through 4095) to assign the SSID to a VLAN. You cannot assign an SSID to an existing VLAN.	79
Step 4 (Optional) Check the Native VLAN check box to mark the VLAN as the native VLAN.	79
Step 5 Select the security setting for the SSID. The settings are listed in order of robustness, from No Security to WPA, which ...	79
Step 6 Click Apply. The SSID appears in the SSID table at the bottom of the page.	79
CLI Configuration Examples	80
Example: No Security	80
Example: Static WEP	81
Example: EAP Authentication	82
Example: WPA	83
Configuring System Power Settings for 1130 and 1240 Series Access Points	85
Figure 4-7 Power Options on the System Software: System Configuration Page	85
Using the AC Power Adapter	85
Using a Switch Capable of IEEE 802.3af Power Negotiation	85
Using a Switch That Does Not Support IEEE 802.3af Power Negotiation	85
Using a Power Injector	86
dot11 extension power native Command	86
Assigning an IP Address Using the CLI	86
Using a Telnet Session to Access the CLI	86
Step 1 Select Start > Programs > Accessories > Telnet.	86
Step 2 When the Telnet window appears, click Connect and select Remote System.	86
Step 3 In the Host Name field, type the wireless device’s IP address and click Connect.	87
Configuring the 802.1X Supplicant	87
Creating a Credentials Profile	87
Applying the Credentials to an Interface or SSID	88
Applying the Credentials Profile to the Wired Port	88
Applying the Credentials Profile to an SSID Used For the Uplink	89
Creating and Applying EAP Method Profiles	90
5	91
Administering the Access PointWireless Device Access	91
Disabling the Mode Button	92
Preventing Unauthorized Access to Your Access Point	93
Protecting Access to Privileged EXEC Commands	93
Default Password and Privilege Level Configuration	94
Table 5-1 Default Password and Privilege Levels	94
Setting or Changing a Static Enable Password	94
Protecting Enable and Enable Secret Passwords with Encryption	96
Configuring Username and Password Pairs	97
Configuring Multiple Privilege Levels	98
Setting the Privilege Level for a Command	98
Logging Into and Exiting a Privilege Level	99
Controlling Access Point Access with RADIUS	99
Default RADIUS Configuration	100
Configuring RADIUS Login Authentication	100
Defining AAA Server Groups	102
Configuring RADIUS Authorization for User Privileged Access and Network Services	104
Displaying the RADIUS Configuration	105
Controlling Access Point Access with TACACS+	105
Default TACACS+ Configuration	105
Configuring TACACS+ Login Authentication	105
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services	107
Displaying the TACACS+ Configuration	107
Configuring Ethernet Speed and Duplex Settings	108
Configuring the Access Point for Wireless Network Management	108
Configuring the Access Point for Local Authentication and Authorization	109
Configuring the Authentication Cache and Profile	110
Configuring the Access Point to Provide DHCP Service	112
Setting up the DHCP Server	112
Monitoring and Maintaining the DHCP Server Access Point	114
Show Commands	114
Table 5-2 Show Commands for DHCP Server	114
Clear Commands	115
Table 5-3 Clear Commands for DHCP Server	115
Debug Command	115
Configuring the Access Point for Secure Shell	115
Understanding SSH	115
Configuring SSH	116
Configuring Client ARP Caching	116
Understanding Client ARP Caching	116
Optional ARP Caching	116
Configuring ARP Caching	117
Managing the System Time and Date	117
Understanding Simple Network Time Protocol	117
Configuring SNTP	118
Table 5-4 SNTP Commands	118
Configuring Time and Date Manually	118
Setting the System Clock	118
Displaying the Time and Date Configuration	119
Configuring the Time Zone	119
Configuring Summer Time (Daylight Saving Time)	120
Defining HTTP Access	122
Step 1 From the access point GUI, click Services > HTTP. The Service: HTTP-Web server window appears.	122
Step 2 On this window, enter the desired HTTP and HTTPS port number. If not values are entered in the port number fields, the default values are used.	122
Step 3 Click Apply.	122
Configuring a System Name and Prompt	122
Default System Name and Prompt Configuration	122
Configuring a System Name	122
Understanding DNS	123
Default DNS Configuration	123
Table 5-5 Default DNS Configuration	124
Setting Up DNS	124
Displaying the DNS Configuration	125
Creating a Banner	125
Default Banner Configuration	125
Configuring a Message-of-the-Day Login Banner	125
Configuring a Login Banner	127
Upgrading Autonomous Cisco Aironet Access Points to Lightweight Mode	127
Migrating to Japan W52 Domain	127
Verifying the Migration	129
Configuring Multiple VLAN and Rate Limiting for Point-to-Multipoint Bridging	129
CLI Command	130
6	131
Configuring Radio Settings	131
Enabling the Radio Interface	132
Configuring the Role in Radio Network	132
Table 6-1 Device Role in Radio Network Configuration	132
Universal Workgroup Bridge Mode	135
Configuring Dual-Radio Fallback	135
Figure 6-1 Dual-Radio Fallback	135
Radio Tracking	136
Fast Ethernet Tracking	136
MAC-Address Tracking	136
Bridge Features Not Supported	137
Configuring Radio Data Rates	137
Access Points Send Multicast and Management Frames at Highest Basic Rate	138
Configuring MCS Rates	140
Table 6-2 Data Rates Based on MCS Settings, Guard Interval, and Channel Width	140
Configuring Radio Transmit Power	141
Step 1 Browse to http://www.cisco.com.	141
Step 2 Click Technical Support & Documentation. A small window appears containing a list of technical support links.	141
Step 3 Click Technical Support & Documentation. The Technical Support and Documentation page appears.	141
Step 4 In the Documentation & Tools section, choose Wireless. The Wireless Support Resources page appears.	141
Step 5 In the Wireless LAN Access section, choose the device you are working with. An introduction page for the device appears.	142
Step 6 In the Install and Upgrade section, choose Install and Upgrade Guides. The Install and Upgrade Guides page for the device appears.	142
Step 7 Choose the hardware installation guide for the device. The home page for the guide appears.	142
Step 8 In the left frame, click Channels and Antenna Settings.	142
Table 6-3 Translation between mW and dBm	142
Limiting the Power Level for Associated Client Devices	143
Configuring Radio Channel Settings	144
802.11n Channel Widths	145
Dynamic Frequency Selection	146
Table 6-4 DFS Channel List	147
*Mar 6 07:37:30.423: %DOT11-6-DFS_SCAN_START: DFS: Scanning frequency 5500 MHz for 60 seconds	147
*Mar 6 07:37:30.385: %DOT11-6-DFS_SCAN_COMPLETE: DFS scan complete on frequency 5500 MHz	147
*Mar 6 12:35:09.750: %DOT11-6-DFS_TRIGGERED: DFS: triggered on frequency 5500 MHz	147
CLI Commands	148
Confirming that DFS is Enabled	148
Configuring a Channel	149
Blocking Channels from DFS Selection	149
Setting the 802.11n Guard Interval	150
Configuring Location-Based Services	151
Understanding Location-Based Services	151
Figure 6-2 Basic LBS Network Configuration	151
Configuring LBS on Access Points	151
Enabling and Disabling World Mode	152
Disabling and Enabling Short Radio Preambles	153
Configuring Transmit and Receive Antennas	154
Enabling and Disabling Gratuitous Probe Response	155
Disabling and Enabling Aironet Extensions	156
Configuring the Ethernet Encapsulation Transformation Method	157
Enabling and Disabling Reliable Multicast to Workgroup Bridges	158
Enabling and Disabling Public Secure Packet Forwarding	159
Configuring Protected Ports	160
Configuring the Beacon Period and the DTIM	160
Configure RTS Threshold and Retries	161
Configuring the Maximum Data Retries	162
Configuring the Fragmentation Threshold	162
Enabling Short Slot Time for 802.11g Radios	163
Performing a Carrier Busy Test	163
Configuring VoIP Packet Handling	163
Step 1 Using a browser, log in to the access point.	163
Step 2 Click Services in the task menu on the left side of the web-browser interface.	163
Step 3 When the list of Services expands, click Stream.	163
Step 4 Click the tab for the radio to configure.	163
Step 5 For both CoS 5 (Video) and CoS 6 (Voice) user priorities, choose Low Latency from the Packet Handling drop-down menu and enter a value for maximum retries for packet discard in the corresponding field.	163
Step 6 Click Apply.	164
Figure 6-3 Packet Handling Configuration	164
Viewing VoWLAN Metrics	164
Viewing Voice Reports	164
Step 1 Log in to a WLSE.	164
Step 2 Click the Reports tab.	164
Step 3 Click Voice.	165
Step 4 From the Report Name drop-down menu, choose AP Group Metrics Summary: Current.	165
Step 5 On the left-hand side, click an access point group.	165
Figure 6-4 Access Point Metrics Summary	165
Step 6 To view voice metrics for an access point or a group of access points, select the group or device from the Device Selector tree on the left-hand side and choose the report name to view from the Report Name drop-down menu:	165
Figure 6-5 % of Packets > 40 ms Queuing Delay	166
Figure 6-6 Voice Streaming Progress	166
Viewing Wireless Client Reports	167
Step 1 Log in to a WLSE.	167
Step 2 Click the Reports tab.	167
Step 3 Click Wireless Clients.	167
Step 4 From the Report Name drop-down menu, choose the type of report to view.	167
Step 5 On the left-hand side, use the Search field to search for clients whose MAC addresses match a certain criteria.	167
Step 6 On the left-hand side, click the MAC address of a client to display the corresponding VoWLAN metrics.	167
Figure 6-7 Wireless Client Metrics	167
Viewing Voice Fault Summary	168
Step 1 Log in to a WLSE.	168
Step 2 Click the Faults tab.	168
Step 3 Click Voice Summary.	168
Figure 6-8 Voice Fault Summary	168
Configuring Voice QoS Settings	168
Step 1 Log in to a WLSE.	169
Step 2 Click the Faults tab.	169
Step 3 Click Voice QoS Settings.	169
Step 4 To change a setting, choose a new value from the corresponding drop-down menu.	169
Step 5 Click Apply when done.	169
Figure 6-9 Voice QoS Settings	169
Configuring Voice Fault Settings	169
Step 1 Log in to a WLSE.	169
Step 2 Click the Faults tab.	169
Step 3 Click Manage Fault Settings.	169
Step 4 Choose the priority of the faults generated if QoS is red (fair) from the corresponding drop-down menu.	169
Step 5 Click Apply when done.	169
Figure 6-10 Fault Settings	170
7	171
Configuring Multiple SSIDs	171
Understanding Multiple SSIDs	172
Effect of Software Versions on SSIDs	172
Table 7-1 SSID Configuration Methods Supported in Cisco IOS Releases	172
Table 7-2 Example: SSID Configuration Converted to Global Mode after Upgrade	173
Configuring Multiple SSIDs	174
Default SSID Configuration	174
Creating an SSID Globally	174
Viewing SSIDs Configured Globally	176
Using Spaces in SSIDs	176
Using a RADIUS Server to Restrict SSIDs	177
a. If the SSID that the client used to associate to the access point matches an entry in the allowed list returned by the RADIUS server, the client is allowed network access after completing all authentication requirements.	177
b. If the access point does not find a match for the client in the allowed list of SSIDs, the access point disassociates the client.	177
c. If the RADIUS server does not return any SSIDs (no list) for the client, then the administrator has not configured the list, and the client is allowed to associate and attempt to authenticate.	177
Configuring Multiple Basic SSIDs	178
Requirements for Configuring Multiple BSSIDs	178
Guidelines for Using Multiple BSSIDs	178
Configuring Multiple BSSIDs	178
Step 1 Browse to the Global SSID Manager page on the access point GUI. (If you use the CLI instead of the GUI, refer to the CLI ...	178
Figure 7-1 Global SSID Manager Page	179
Step 2 Enter the SSID name in the SSID field.	179
Step 3 Use the VLAN drop-down menu to select the VLAN to which the SSID is assigned.	179
Step 4 Select the radio interfaces on which the SSID is enabled. The SSID remains inactive until you enable it for a radio interface.	179
Step 5 Enter a Network ID for the SSID in the Network ID field.	179
Step 6 Assign authentication, authenticated key management, and accounting settings to the SSID in the Authentication Settings, ...	179
Step 7 (Optional) In the Multiple BSSID Beacon Settings section, select the Set SSID as Guest Mode check box to include the SSID in beacons.	180
Step 8 (Optional) To increase the battery life for power-save clients that use this SSID, select the Set Data Beacon Rate (DTIM)...	180
Step 9 In the Guest Mode/Infrastructure SSID Settings section, select Multiple BSSID.	180
Step 10 Click Apply.	180
CLI Configuration Example	180
Displaying Configured BSSIDs	180
Assigning IP Redirection for an SSID	181
Figure 7-2 Processing Flow for IP Redirection	181
Guidelines for Using IP Redirection	182
Configuring IP Redirection	182
Including an SSID in an SSIDL IE	183
NAC Support for MBSSID	183
Configuring NAC for MBSSID	186
Figure 3 Typical NAC Network Setup	186
Step 1 Configure your network as shown in Figure 3.	186
Step 2 Configure standalone access points and NAC-enabled client-EAP authentication.	186
Step 3 Configure the local profiles on the ACS server for posture validation.	186
Step 4 Configure the client and access point to allow the client to successful authenticate using EAP-FAST.	186
Step 5 Ensure that the client posture is valid.	186
Step 6 Verify that the client associates to the access point and that the client is placed on the unrestricted VLAN after successful authentication and posture validation.	186
8	189
Configuring Spanning Tree Protocol	189
Understanding Spanning Tree Protocol	190
STP Overview	190
1300 and 350 Series Bridge Interoperability	191
Access Point/Bridge Protocol Data Units	191
Election of the Spanning-Tree Root	192
Spanning-Tree Timers	193
Table 8-1 Spanning-Tree Timers	193
Creating the Spanning-Tree Topology	193
Figure 8-1 Spanning-Tree Topology	193
Spanning-Tree Interface States	193
Figure 8-2 Spanning-Tree Interface States	194
Blocking State	195
Listening State	195
Learning State	195
Forwarding State	196
Disabled State	196
Configuring STP Features	196
Default STP Configuration	196
Table 8-2 Default STP Values When STP is Enabled	196
Configuring STP Settings	197
STP Configuration Examples	198
Root Bridge Without VLANs	198
Non-Root Bridge Without VLANs	199
Root Bridge with VLANs	199
Non-Root Bridge with VLANs	201
Displaying Spanning-Tree Status	202
Table 8-3 Commands for Displaying Spanning-Tree Status	202
9	203
Configuring an Access Point as a Local Authenticator	203
Understanding Local Authentication	204
Configuring a Local Authenticator	204
Guidelines for Local Authenticators	205
Configuration Overview	205
Configuring the Local Authenticator Access Point	205
Configuring Other Access Points to Use the Local Authenticator	208
Configuring EAP-FAST Settings	209
Configuring PAC Settings	209
PAC Expiration Times	209
Generating PACs Manually	209
Configuring an Authority ID	210
Configuring Server Keys	210
Possible PAC Failures Caused by Access Point Clock	210
Limiting the Local Authenticator to One Authentication Type	211
Unblocking Locked Usernames	211
Viewing Local Authenticator Statistics	211
Using Debug Messages	213
10	215
Configuring Cipher Suites and WEP	215
Understanding Cipher Suites and WEP	216
Configuring Cipher Suites and WEP	217
Creating WEP Keys	217
WEP Key Restrictions	219

Match case Limit results 1 per page

5-9

Cisco IOS Software Configuration Guide for Cisco Aironet Access Points

OL-14209-01

Chapter 5

Administering the Access PointWireless Device Access

Controlling Access Point Access with RADIUS

When you set a command to a privilege level, all commands whose syntax is a subset of that command

are also set to that level. For example, if you set the

show ip route

command to level 15, the

show

commands and

show ip

commands are automatically set to privilege level 15 unless you set them

individually to different levels.

To return to the default privilege for a given command, use the

no privilege

mode

level

command

global configuration command.

This example shows how to set the

configure

command to privilege level 14 and define

SecretPswd14

as the password users must enter to use level 14 commands:

AP(config)#

privilege exec level 14 configure

AP(config)#

enable password level 14 SecretPswd14

Logging Into and Exiting a Privilege Level

Beginning in privileged EXEC mode, follow these steps to log in to a specified privilege level and to exit

to a specified privilege level:

Controlling Access Point Access with RADIUS

This section describes how to control administrator access to the wireless device using Remote

Authentication Dial-In User Service (RADIUS). For complete instructions on configuring the wireless

device to support RADIUS, see

Chapter 13, “Configuring RADIUS and TACACS+ Servers.”

Step 3

enable password level

level

password

Specify the enable password for the privilege level.

•

For

level

, the range is from 0 to 15. Level 1 is for normal user EXEC

mode privileges.

•

For

password

, specify a string from 1 to 25 alphanumeric characters.

The string cannot start with a number, is case sensitive, and allows

spaces but ignores leading spaces. By default, no password is

defined.

Note

Characters TAB, ?, $, +, and [ are invalid characters for

passwords.

Step 4

end

Return to privileged EXEC mode.

Step 5

show running-config

show privilege

Verify your entries.

The first command displays the password and access level configuration.

The second command displays the privilege level configuration.

Step 6

copy running-config startup-config

(Optional) Save your entries in the configuration file.

Command

Purpose

Command

Purpose

Step 1

enable

level

For

level

, the range is 0 to 15.

Step 2

disable

level

Exit to a specified privilege level.

For

level

, the range is 0 to 15.