Manuals / Cisco Systems / Communications / Wireless Office Headset

Cisco Systems 3.2 manual OL-8335-02

Models: 3.2

1 256

Download 256 pages 1.83 Kb

Page 126

Chapter 5 Configuring Security Solutions

Configuring Identity Networking

Cisco Wireless LAN Controller Configuration Guide

5-20	OL-8335-02

Image 126

Cisco Systems 3.2 manual OL-8335-02

Contents

Cisco Wireless LAN Controller Configuration Guide Corporate HeadquartersCisco Wireless LAN Controller Configuration Guide N T E N T S IiiClient Location Enabling Web and Secure Web Modes Configuring Ports Configuring the System for SpectraLink NetLink Telephones ViiQoS-Level5-17 ACL-Name5-17 Interface-Name5-18 VLAN-Tag5-18 ViiiUsing Dhcp Option 43 Radio Resource Monitoring Prerequisites Series Wireless LAN Controllers B-8 XiiPreface XiiiOrganization AudiencePurpose XivConventions Xvi Cisco.com Related PublicationsObtaining Documentation XviiOrdering Documentation Documentation FeedbackProduct Documentation DVD XviiiReporting Security Problems in Cisco Products Cisco Product Security OverviewXix Submitting a Service Request Obtaining Technical AssistanceCisco Technical Support & Documentation Website Definitions of Service Request Severity Obtaining Additional Publications and InformationXxi Xxii Overview Cisco Wireless LAN Solution Overview Cisco Wlan Solution Components Single-Controller DeploymentsMultiple-Controller Deployments Single-Controller DeploymentOperating System Software Operating System SecurityCisco Wlan Solution Wired Security Layer 2 and Layer 3 Lwapp Operation Cisco Wireless LAN ControllersConfiguration Requirements Operational RequirementsSame-Subnet Layer 2 Roaming Client RoamingPrimary, Secondary, and Tertiary Controllers Inter-Controller Layer 2 RoamingInter-Subnet Layer 3 Roaming Client LocationSpecial Case Voice Over IP Telephone Roaming Per-Interface Assignment Per-Wireless LAN AssignmentExternal Dhcp Servers Security ConsiderationsCisco Wlan Solution Wired Connections Cisco Wlan Solution Wireless LANsAccess Control Lists Identity NetworkingFile Transfers Enhanced Integration with Cisco Secure ACSPower over Ethernet Pico Cell FunctionalityIntrusion Detection Service IDS Wireless LAN Controller PlatformsCisco 2000 Series Wireless LAN Controllers Cisco 4100 Series Wireless LAN ControllersCisco 4400 Series Wireless LAN Controllers Cisco 2000 Series Wireless LAN Controller Model NumbersCisco 4100 Series Wireless LAN Controller Model Numbers Cisco 4400 Series Wireless LAN Controller Model NumbersStartup Wizard Cisco Wireless LAN Controller Memory Cisco Wireless LAN Controller Failover ProtectionCisco Wireless LAN Controller Automatic Time Setting Network Connections to Cisco Wireless LAN ControllersCisco Wireless LAN Controller Time Zones Cisco 2000 Series Wireless LAN Controllers Cisco 4100 Series Wireless LAN ControllersCisco 4400 Series Wireless LAN Controllers 6shows connections to the 4100 series controllerRogue Access Points Rogue Access Point Location, Tagging, and Containment Web User Interface and the CLIWeb User Interface Command Line Interface Using the Web-Browser and CLI Interfaces Configuring the GUI for Https Using the Web-Browser InterfaceGuidelines for Using the GUI Enabling Web and Secure Web ModesLoading an Externally Generated Https Certificate Show certificate summaryWeb Administration Certificate file webadmincertname.pem Disabling the GUI Using the CLIUsing Online Help Logging into the CLIUsing a Local Serial Connection Using a Remote Ethernet ConnectionCommand Action Logging Out of the CLINavigating the CLI Enter config network mgmt-via-wireless enable Configuring Ports and Interfaces Overview of Ports and Interfaces PortsDistribution System Ports Service Port Interfaces Management InterfaceAP-Manager Interface Virtual InterfaceService-Port Interface Dynamic InterfaceWLANs Ports, Interfaces, and WLANsConfiguring Ports and Interfaces Management Interface InterfacesService-Port Interface AP-Manager InterfaceVirtual Interface Using the CLI to Configure the Management Interface Using the CLI to Configure the AP-Manager InterfaceConfig interface acl management access-control-list-name Using the CLI to Configure the Virtual Interface Config interface acl ap-manager access-control-list-nameConfiguring Dynamic Interfaces Using the GUI to Configure Dynamic InterfacesUsing the CLI to Configure the Service-Port Interface Interfaces New Using the CLI to Configure Dynamic Interfaces Configuring Ports PortsParameter Description Controller Available Data RatesDefault Enable Default AutoController Supported Data Rates Configuring Port Mirroring Configuring Spanning Tree Protocol Using the GUI to Configure Spanning Tree Protocol STP State DescriptionDefault Off STP Mode DescriptionDefault 10 Controller Spanning Tree Configuration Default Disable Range DefaultRange Using the CLI to Configure Spanning Tree Protocol Default 2 secondsEnabling Link Aggregation 11illustrates LAG12 Link Aggregation with Catalyst 6500 Neighbor Switch Link Aggregation GuidelinesUsing the GUI to Enable Link Aggregation 13 GeneralUsing the CLI to Enable Link Aggregation Configuring Neighbor Devices to Support LAGUsing Link Aggregation Using Multiple AP-Manager InterfacesExamples 14 Two AP-Manager Interfaces15 Three AP-Manager Interfaces 16 Four AP-Manager Interfaces 17 Interfaces New Connecting Additional Ports Configuring Controller Settings Using the Configuration Wizard Before You StartResetting to Default Settings Using the GUI Resetting the Device to Default SettingsResetting to Default Settings Using the CLI Browse to the Commands/Reset to Factory DefaultsRunning the Configuration Wizard on the CLI Configuring NTP Configuring a Country CodeConfiguring Time and Date Manually Managing the System Time and DateEnabling and Disabling 802.11 Bands Country Code Bands AllowedConfiguring Administrator Usernames and Passwords Configuring Radius SettingsConfiguring Snmp Settings Enabling 802.3x Flow Control Enabling Dynamic Transmit Power ControlConfig 802.11a 802.11bg dtpc enable disable Enabling System LoggingConfiguring Multicast Mode Understanding Multicast ModeGuidelines for Using Multicast Mode Configuring the Supervisor 720 to Support the WiSM Enabling Multicast ModeCommand Multicast Mode Configuring the Supervisor Command PurposeGeneral WiSM Guidelines Interface GigabitEthernet9/1-4 Switchport mode trunk Channel-group 1 mode onWism service-vlan vlan Interface GigabitEthernet9/5-8Using the Wireless LAN Controller Network Module Service-module wlan-controller 1/0 resetOL-8335-02 Configuring Security Solutions Layer 2 Solutions Cisco Wlan Solution SecurityLayer 1 Solutions Security OverviewRogue Access Point Challenges Layer 3 SolutionsRogue Access Point Solutions Tagging and Containing Rogue Access PointsConfiguring the System for SpectraLink NetLink Telephones Integrated Security SolutionsUsing the GUI to Enable Long Preambles Using the CLI to Enable Long PreamblesUsing Management over Wireless Using the GUI to Enable Management over WirelessConfiguring Dhcp Using the CLI to Enable Management over WirelessUsing the GUI to Configure Dhcp Config wlan disable wlan-id Customizing the Web Authentication Login ScreenUsing the CLI to Configure Dhcp Config wlan enable wlan-idDefault Web Authentication Operation Typical Web-Browser Security AlertTypical Web Authentication Login Window Customizing Web Authentication Operation Hiding and Restoring the Cisco Wlan Solution LogoChanging the Web Authentication Login Window Title Changing the Logo Config custom-web webmessage messageChanging the Web Message Clear webmessageDownloading the Logo or Graphic Verifying Web Authentication Changes Config custom-web redirecturl urlCreating a Custom URL Redirect Example Sample Customized Web Authentication Login Window Example of a Customized Web Authentication Login WindowConfiguring Identity Networking Identity Networking OverviewRadius Attributes Used in Identity Networking QoS-LevelACL-Name Interface-Name VLAN-TagTunnel Attributes OL-8335-02 Configuring WLANs Wireless LAN Overview Configuring Wireless LANsDisplaying, Creating, Disabling, and Deleting Wireless LANs Configuring MAC Filtering for Wireless LANs Activating Wireless LANsAssigning a Wireless LAN to a Dhcp Server Enabling MAC FilteringConfiguring a Timeout for Disabled Clients Assigning Wireless LANs to VLANsConfiguring Layer 2 Security Dynamic 802.1X Keys and AuthorizationWEP Keys Dynamic WPA Keys and EncryptionIPSec Authentication Configuring Layer 3 SecurityConfiguring a Wireless LAN for Both Static and Dynamic WEP IPSecIKE Lifetime Timeout IKE AuthenticationIKE Phase 1 Aggressive and Main Modes IKE Diffie-Hellman GroupIPSec Passthrough Configuring Quality of ServiceWeb-Based Authentication Local NetuserTraffic Type Configuring QoS Enhanced BSS QbssConfig wlan wmm disabled allowed required wlan-id Ieee 802.11e UPEnabling 7920 Support Mode Config wlan 7920-support client-cac-limit enable wlan-idControlling Lightweight Access Points Lightweight Access Point Overview Cisco 1000 Series Ieee 802.11a/b/g Lightweight Access PointsCisco 1030 Remote Edge Lightweight Access Points Typical 1030 Lightweight Access Point ConfigurationCisco 1000 Series Lightweight Access Point Part Numbers Cisco 1000 Series Lightweight Access Point LEDs External Antenna ConnectorsAntenna Sectorization Cisco 1000 Series Lightweight Access Point Connectors Using the DNS for Controller Discovery Cisco 1000 Series Lightweight Access Point Mounting OptionsCisco 1000 Series Lightweight Access Point Monitor Mode Dynamic Frequency Selection Autonomous Access Points Converted to Lightweight Mode Reverting from Lightweight Mode to Autonomous ModeUsing a Controller to Return to a Previous Release Using Dhcp Option Access Point VCI StringDisplay of MAC Addresses for Converted Access Points Converted Access Points Send Radio Core Dumps to ControllerEnabling Memory Core Dumps from Converted Access Points Config ap get-radio-core-dump slot ap-nameConfig ap reset-button enable disable ap-nameall Config ap static-ip enable ap-name ip-address mask gatewayOL-8335-02 Managing Controller Software Configurations Transferring Files to and from a Controller Upgrading Controller SoftwareTransfer download path absolute-tftp-server-path-to-file Saving Configurations Clearing the Controller ConfigurationErasing the Controller Configuration Resetting the Controller OL-8335-02 Configuring Radio Resource Management Overview of Radio Resource Management Radio Resource MonitoringDynamic Channel Assignment Dynamic Transmit Power Control Coverage Hole Detection and CorrectionClient and Network Load Balancing Overview of RF Groups RRM BenefitsRF Group Leader Configuring an RF Group RF Group NameUsing the GUI to Configure an RF Group GeneralUsing the CLI to Configure RF Groups Using the GUI to View RF Group StatusViewing RF Group Status Global Parameters Global Parameters Auto RF Using the CLI to View RF Group Status AutoEnabling Rogue Access Point Detection Using the GUI to Enable Rogue Access Point DetectionAll APs Details AP Authentication Policy Configuring Dynamic RRM Using the CLI to Enable Rogue Access Point DetectionUsing the GUI to Configure Dynamic RRM Default EnabledRF Group RF Channel Assignment Default AutomaticYou click Invoke Channel Update Now Channel Assignment Method DescriptionDefault Disabled Tx Power Level Assignment Click Invoke Power Update NowAssignment Method Description Default 80% Default 10%Default -70 dBm Default 25%Default Noise/Interference/Rogue Monitoring Channels Monitor IntervalsUsing the CLI to Configure Dynamic RRM Config 802.11a disable Config 802.11b disableOverriding Dynamic RRM Radios Cisco APs Configure Config 802.11a txPower AP1 Config 802.11a disable Config 802.11b disable Viewing Additional RRM Settings Using the CLI Configuring Mobility Groups 10-1Overview of Mobility 10-210-3 Inter-Controller Roaming10-4 Inter-Subnet RoamingOverview of Mobility Groups 10-510-6 Two Mobility GroupsPrerequisites Configuring Mobility GroupsDetermining When to Include Controllers in a Mobility Group 10-7Using the GUI to Configure Mobility Groups 10-810-9 Mobility Group Member New10-10 Mobility Group Members Edit AllConfiguring Auto-Anchor Mobility Using the CLI to Configure Mobility Groups10-11 Guidelines for Using Auto-Anchor Mobility Using the GUI to Configure Auto-Anchor Mobility10-12 10-13 WLANsUsing the CLI to Configure Auto-Anchor Mobility 10-14Safety Considerations Translated Safety Warnings Safety Considerations Bewaar Deze InstructiesWarnung Wichtige Sicherheitshinweise Avvertenza Importanti Istruzioni Sulla SicurezzaAviso Instruções Importantes DE Segurança Guarde Estas InstruçõesClass 1 Laser Product Warning Aviso Produto a laser de classe Ground Conductor Warning Cisco Wireless LAN Controller Configuration Guide Chassis Warning for Rack-Mounting and Servicing Cisco Wireless LAN Controller Configuration Guide Cisco Wireless LAN Controller Configuration Guide OL-8335-02 Cisco Wireless LAN Controller Configuration Guide Page OL-8335-02 Page OL-8335-02 Page Battery Handling Warning for 4400 Series Controllers Cisco Wireless LAN Controller Configuration Guide OL-8335-02 Equipment Installation Warning Cisco Wireless LAN Controller Configuration Guide OL-8335-02 OL-8335-02 Cisco Wireless LAN Controller Configuration Guide OL-8335-02 Cisco Wireless LAN Controller Configuration Guide Cisco Wireless LAN Controller Configuration Guide OL-8335-02 OL-8335-02 Declarations of Conformity and Regulatory Information FCC Certification number Regulatory Information for 1000 Series Access PointsModel ManufacturerDepartment of Communications-Canada Canadian Compliance StatementCertification number EMC Declaration of Conformity for RF Exposure 03-5549-6500 Access Points with Ieee 802.11a Radios All Access PointsDeclaration of Conformity Statements Cisco Wireless LAN Controller Configuration Guide OL-8335-02 OL-8335-02 End User License and Warranty End User License Agreement Cisco Wireless LAN Controller Configuration Guide OL-8335-02 Limited Warranty Appendix C End User License and Warranty Limited Warranty Disclaimer of Warranty Additional Open Source Terms OL-8335-02 System Messages and Access Point LED Patterns Error Message Description System MessagesLradifcurrentchannelchanged Using Client Reason and Status Codes in Trap Logs Client Reason CodesClient Reason Code Description Meaning Client Status Codes Client Status Code Description MeaningUsing Lightweight Access Point LEDs LED Conditions StatusNumerics IN-1IN-2 DFS Dhcp IN-3Help Hold Time parameter IN-4IN-5 IN-6 IN-7 IN-8