D-Link DWS-3160-24TC DWS-3160 Series Web UI Reference Guide - Page 503

DWS-3160 Series Gigabit Ethernet Unified Switch Web UI Reference Guide Since the Cluster Controller function may be disabled by setting the Cluster Priority to zero, it is possible that all wireless Switches in the network are configured to disable the Cluster Controller function and the network operates without the Cluster Controller. The Cluster priority is a global Switch configuration setting. When the global configuration is pushed from one peer Switch to another, the Cluster priority is not included in this configuration because its purpose is to differentiate the preference level for the Cluster Controller function for each Switch. There are two Switch status parameters that reflect the results of the Cluster Controller election process. The status parameters are the IP address of the elected Cluster Controller and a Boolean flag which indicates whether this Switch is the Cluster Controller. The flag does not provide extra information since it is derived from comparing the Switch's IP address with the Cluster address, but it offers a quick way for the administrator to know whether the local Switch is the Cluster Controller. After the Switch decides that it is the Cluster Controller, it sends an SNMP trap. X.509 Certification Mutual Authentication X.509 Certification Mutual Authentication: When the wireless system is configured to perform X.509 Mutual Certificate exchange the Switches and APs configure the TLS connection to perform mutual X.509 certificate exchange. Each device compares the certificate received from the remote end-point with the local copy of the remote device's certificate. If the certificates do not match, then the TLS connection is dropped. The X.509 certificates are auto-generated by the Switches and the APs, so the devices don't communicate with any trusted certificate authority and the administrator is not required to pay certificate maintenance fees. Each Switch holds a copy of the X.509 certificate for all other Switches and the APs it manages. Each AP holds a copy of the X.509 certificate of the Switches to which the AP may establish a connection. The certificates are distributed when the mutual authentication feature is enabled, during AP and Switch provisioning, and triggered by an administrator command. The X.509 mutual certificate exchange is the only mechanism for peer Switches to authenticate with each other because Switches don't support pass-phrase authentication. Note that if the wireless Switch is currently managed by a cluster controller, then any provisioning request toward this Switch will fail. When the X.509 mutual authentication is enabled the AP and peer Switch discovery is slower than when this feature is disabled because certificates are exchanged during the TLS connection setup. Certification Overview and Usage In the Wireless System: The TLS connection has two sides: a client side initiates the connection and the server side accepts the connection. In a Wireless System, the APs act only as TLS clients, and Switches act as either TLS clients or TLS servers. The Switch acts as a TLS client when it establishes a connection to a peer Switch. The TLS protocol supports client verification of server certificates and mutual certificate verification. The Wireless System configures the TLS session to use mutual certificate verification when the mutual authentication mode is enabled. When the mutual authentication mode is disabled, the Wireless System uses anonymous cipher and disables certificate exchange and verification. In order to verify the certificate each device generates a private key and an X.509 certificate. The private key is kept on the device and is not given out to other Switches or APs. The certificate contains a matching public key. The device certificate is given out to other devices in the wireless system. Data encrypted with the public key using the device's certificate can be decrypted with the device's private key. The certificates are encoded using PEM format, which is a Base64 encoded file. The Base64 encoding uses printable ASCII characters to represent binary data. Before the certificate files can be used for certificate validation they are loaded into the OpenSSL library. 498