MAC Address Filtering, Address Filters | Cisco Systems DL-2159-05

Chapter 5 Configuring Filters and QoS

Filter Setup

Step 3 Select the protocol filter set that you want to enable from the Ethertype, IP Protocol, or IP Port drop-down menu.

Step 4 Click OK. The filter set is enabled.

MAC Address Filtering

MAC address filters allow or disallow the forwarding of unicast and multicast packets either sent from or addressed to specific MAC addresses. You can create a filter that passes traffic to all MAC addresses except those you specify, or you can create a filter that blocks traffic to all MAC addresses except those you specify.

Note MAC address filters are powerful, and you can lock yourself out of the access point if you make a mistake setting up the filters. If you accidentally lock yourself out of your access point, follow the instructions in the “Using the Command-Line Interface” section on page 2-4to use the CLI to disable the filters.

Use the Address Filters page to create MAC address filters for the access point. Figure 5-6shows the Address Filters page.

Figure 5-6 Address Filters Page

Follow this link path to reach the Address Filters page:

1.On the Summary Status page, click Setup.

2.On the Setup page, click Address Filters under Associations.

Cisco Aironet 1200 Series Access Point Software Configuration Guide

5-6	OL-2159-05

Image 94

Cisco Systems DL-2159-05 manual MAC Address Filtering, Address Filters

Contents

Corporate Headquarters Text Part Number OL-2159-05 Copyright 2001-2003, Cisco Systems, Inc All rights reserved N T E N T S Iii Navigating Using the Map Windows Native Vlan ID WEP Not Set on the Wireless Phone Settings on the Authenticator Configuration Vii Event Notifications Setup Viii Setting Up Administrator Authorization Snmp Setup Ssid Xii Organization Audience and ScopeXiii Tip Means the following are useful tips ConventionsXiv Obtaining Documentation Related PublicationsCisco.com Documentation Feedback Documentation CD-ROMOrdering Documentation Xvi TAC Case Priority Definitions Obtaining Technical AssistanceCisco TAC Website Opening a TAC Case Xvii Obtaining Additional Publications and Information Xviii Overview A P T E R Key Features Management Options Quality of Service SupportRoaming Client Devices Related Documents What is QoS?Limitations and Restrictions These documents are available on Cisco.com What is a VLAN? Vlan Support Incorporating Wireless Devices into VLANs Level of Access Vlan Example Network Configuration Examples Root Unit on a Wired LAN Repeater Unit that Extends Wireless Range Access Points as Root Units on a Wired LAN Central Unit in an All-Wireless Network Access Point as Repeater Using the Management Interfaces Using the Management Pages in the Web-Browser Interface Using the Web-Browser InterfaceUsing the Web-Browser Interface for the First Time Button/Link Description Navigating Using the Map Windows Map Window with Network Ports Pages Expanded Using the Command-Line Interface Preparing to Use a Terminal Emulator Connecting the Serial Cable Changing Settings with the CLISetting Up the Terminal Emulator Selecting Pages and Settings Function Description Using a Telnet Session Using SnmpApplying Changes to the Configuration Supported MIBs Radio Configuration and Basic Settings Basic Settings Express Setup System Name Entering Basic SettingsExpress Setup page contains the following settings MAC Address Default IP Subnet Mask Configuration Server ProtocolDefault IP Address Default Gateway Root-Unit Access Points Security Setup Link Radio Network Optimization Optimize Radio Network For Snmp Admin. Community Radio ConfigurationRadio Network Compatibility Ensure Compatibility With Settings on the AP Radio Identification Entering Identity Information Default IP Subnet Mask Primary Port SettingsDefault IP Address Service Set ID Ssid Leap Password Entering Radio Hardware Information AP Radio Hardware page contains the following settings Settings on the AP Radio HardwareAllow Broadcast Ssid to Associate? Enable World Mode Data Rates RTS Threshold Transmit PowerFrag. Threshold Max. RTS Retries Search for Less-Congested Radio Channel Default Radio ChannelRestrict Searched Channels Entering Advanced Configuration Information Receive Antenna and Transmit Antenna AP Radio Advanced Page for Internal Radio Requested Status Settings on the AP Radio AdvancedAP Radio Advanced pages contain the following settings Packet Forwarding Radio Cell Role Default Multicast Address FiltersMaximum Multicast Packets/Second Ssid For Use By Infrastructure Stations Use Aironet Extensions Classify Workgroup Bridges as Network Infrastructure Require Use of Radio Firmware Quality of Service Setup LinkVlan Setup Link Ethernet Encapsulation Transform Temporal Key Integrity Protocol Advanced Primary Ssid Setup LinkPreferred Access Points Broadcast WEP Key rotation interval sec Radio Modulation Radio Preamble Ethernet Configuration Non-Root Mobility Settings on the Ethernet Identification Entering Ethernet Hardware Information Ethernet Hardware page contains the following settings Settings on the Ethernet HardwareSpeed Loss of Backbone Connectivity Action Loss of Backbone Connectivity # of SecsLoss of Backbone Connectivity Ssid Settings on the Ethernet Advanced Ethernet Advanced page contains the following settings Default Unicast and Multicast Address Filters Always Unblock Ethernet When STP is Disabled Default Unicast Address FilterOptimize Ethernet for OL-2159-05 Configuring VLANs Vlan setup page contains the following settings Settings on the Vlan SetupEntering Vlan Information Vlan Summary Status Link 802.1Q Encapsulation ModeMaximum Number of Enabled Vlan IDs Vlan 802.1Q Tagging Optionally allow Encrypted packets on the unencrypted Vlan Vlan Security PolicySingle Vlan ID which allows Unencrypted packets Vlan Name Parameter Native Vlan ConfigurationBroadcast Domain Segmentation TKIP/MIC Primary and Secondary SSIDs Deployment of Infrastructure and Non infrastructure Devices RADIUS-Based Vlan Access Control Vlan ID Criteria for Deploying Wireless VLANs Vlan Wireless Vlan Deployment Example 5shows the wireless Vlan deployment scenario described above Creating and Configuring VLANs on the Access Point Using the Configuration ScreensObtaining and Recording Vlan ID and Setup Information Creating the Native Vlan Vlan Setup Vlan ID #1 Setup Creating the Full- and Part-Time VLANs Creating the Maintenance Vlan Creating the Guest Vlan Creating and Configuring the SSIDs AP Radio Internal Service Sets Configuring VLANs Wireless Vlan Deployment Example Enabling Vlan 802.1Q Tagging and Identifying the Native Vlan 11 AP Radio Service Sets Guidelines for Wireless Vlan Deployment Creating an Ssid for Infrastructure Devices OL-2159-05 Configuring Filters and QoS Filter Setup Protocol Filtering Creating a Protocol Filter Enter a descriptive filter set name in the Set Name field Filter Set Enabling a Protocol Filter MAC Address Filtering Address Filters Creating a MAC Address Filter AP Radio Advanced AP Radio Primary Ssid QoS Configuration Use Symbol Extensions Settings on the Quality of Service SetupGenerate Qbss Element Send Igmp General Query Applying QoSBy Station Traffic Category 10 Protocol Filters Setup By Vlan 12 Vlan ID 13 Filters Priority Setting By Filter By CoS Value By Dscp Value Wireless QoS Deployment Example 17 Vlan Setup 18 Vlan ID #xx WEP Set on the Wireless Phone WEP Not Set on the Wireless Phone 20 AP Radio Internal Service Sets 21 AP Radio Internal Service Sets OL-2159-05 Configuring Proxy Mobile IP Proxy Mobile IP Introduction to Mobility in IP Mobile Approach Nomadic ApproachMobile IP Explained Mobile IP Environment Proxy Mobile IP Explained Mobile IP Traffic Pattern Before Deploying Proxy Mobile IP Issues to Consider While Deploying Proxy Mobile IP Components of a Proxy Mobile IP Network How Proxy Mobile IP Works Agent Discovery Subnet Map Exchange Home Agent Subnet Mask Registration Tunneling Proxy Mobile IP Setup Proxy Mobile IP Security Proxy Mobile IP Setup General Enable Proxy Mobile IP Authentication ServerSettings on the Proxy Mobile IP General Authoritative AP n Settings on the Authenticator Configuration Settings on the Local SA Bindings Local SA Bindings Settings on the Proxy Mobile IP Statistics Statistics Active AAP Authentication Failures for HAAuthentication Failures for FA MN IP Addresses Settings on the Subnet Map Table Configuring Proxy Mobile IPView Subnet Map Table Configuring Proxy Mobile IP on Your Wired LAN 11 a Sample Network 13 AP Radio Internal Service Sets 15 Proxy Mobile IP General 17 Subnet Map Table 18 Authenticator Configuration 20 Network Configuration Screen for an Access Point Client 22 Passed Authentication Screen Configuring Other Settings Server Setup Entering Time Server Settings Settings on the Time Server Setup Settings on the Boot Server Setup Entering Boot Server SettingsBoot Server Setup page contains the following settings Bootp Server Timeout sec Configuration Server ProtocolUse Previous Configuration Server Settings Dhcp Multiple-Offer Timeout sec Dhcp Client Identifier Type Dhcp Requested Lease Duration minDhcp Minimum Lease Duration min Option Definition Dhcp Client Identifier Value Settings on the Web Server SetupWeb Server Setup page contains the following settings Dhcp Class Identifier Allow Non-Console Browsing Default Help Root URLDefault Web Root URL Http Port Default Domain Entering Name Server SettingsSettings on the Name Server Setup Domain Name System FTP Setup page contains the following settings Entering FTP SettingsSettings on the FTP Setup Domain Name Servers Routing Setup New Network Route Settings Entering Routing SettingsRouting Setup page contains the following settings Installed Network Routes list Association Table Display SetupAssociation Table Filters Configuring Other Settings Association Table Display Setup Stations to Show Settings on the Association Table FiltersFields to Show Bytes To/From Station Association Table AdvancedPackets To/From Station Primary Sort Settings on the Association Table Advanced Association Table Advanced Maximum number of bytes stored per Station Alert packet Rogue AP Alert Timeout minutesHandle Station Alerts as Severity Level Maximum Number of Forwarding Table Entries Settings on the Event Display Setup Event Notification SetupEvent Display Setup Default Activity Timeout seconds Per Device Class Severity Level at which to display events How should time generally be displayed?How should Event Elapsed non-wall-clock Time be displayed? Severity Level Description Event Handling Setup 10 The Event Handling Setup Handle Station Events as Severity Level Settings on the Event Handling SetupDisposition of Events Maximum number of bytes stored per Alert packet Clear Alert Statistics Event Notifications SetupPurge Trace Buffer Snmp Trap Destination Settings on the Event Notifications SetupShould Notify-Disposition Events generate Snmp Traps? Snmp Trap Community Syslog Facility Number Should Syslog Messages use the Cisco Emblem Format?Syslog Destination Address Ieee Snmp Traps Should Generate the Following Notifications Security Setup Security Overview Encrypting Radio Signals with WEPLevels of Security Additional WEP Security Features Network Authentication Types Sequence for EAP Authentication Wired LAN Client Combining MAC-Based, EAP, and Open Authentication Sequence for Open Authentication Setting Up WEP Protecting the Access Point Configuration with User Manager Key Access Point Associated Device Transmit? Key Contents Not set Enabling Message Integrity Check MIC Enabling Additional WEP Security FeaturesUsing Snmp to Set Up WEP Snmp Variable WEP Full WEP Off AP Radio Advanced Page for Internal Radio Enabling Temporal Key Integrity Protocol Tkip Enabling Broadcast WEP Key Rotation Setting Up Open or Shared Key Authentication Setting Up EAP Authentication Enabling EAP on the Access Point Firmware Version Draft 802.1x-2001 Access Point EAP Settings for Various Client Configurations Click Add New Access Server Enabling EAP in Cisco Secure ACS Setting Up a Repeater Access Point As a Leap Client Setting a Session-Based WEP Key Timeout AP Radio Identification Page for Internal Radio Setting Up MAC-Based Authentication Enabling MAC-Based Authentication on the Access Point 11 Authenticator Configuration Security Setup Setting Up MAC-Based Authentication 12 AP Radio Advanced Authenticating Client Devices Using MAC Addresses or EAP Enabling MAC-Based Authentication in Cisco Secure ACS Authentication Types Required Settings Summary of Settings for Authentication TypesLeap EAP-TLS, EAP-MD5 Radius Attributes Sent by the Access Point Attribute ID Description Acct-Authentic Acct-Delay-TimeAcct-Session-Id VSA attribute Nas-location Vlan-id Auth-algo-type Setting Up Backup Authentication Servers Acct-Terminate-Cause Setting Up Administrator Authorization 14 Security Setup Creating a List of Authorized Management System Users 16 User Management Window Click Add New User. The User Management window appears Setting up Centralized Administrator AuthenticationClick User Information. The User Information page appears Click Apply. You are returned to the User Information 18 Authenticator Configuration System Flow Notes Authorization Parameters Network Management Setting the Display Options Using the Association TableBrowsing to Network Devices Using Station Pages Station Information on Station Pages Station Identification and Status To Station Information Rate, Signal, and Status InformationFrom Station Information Hops and Timing Information Performing Pings and Link TestsPerforming a Ping Performing a Link Test Click Link Test Deauthenticating and Disassociating Client Devices Using the Network Map WindowClearing and Updating Statistics Using Cisco Discovery Protocol Settings on the CDP Setup MIB for CDP Assigning Network Ports Port Assignments Enabling Wireless Network Accounting Settings on the Port Assignments Settings on the Accounting Setup Accounting Setup Accounting Attributes Attribute Definition Radiusipadr OL-2159-05 Managing Firmware and Configurations 10-1 Updating with the Browser from a Local Drive Full Update of the Firmware ComponentsUpdating Firmware 10-2 Selective Update of the Firmware Components 10-3 Updating from a File Server 10-4 Update All Firmware From File Server 10-5 Update Firmware From File Server 10-6 Retrieving Firmware and Web Page Files 10-7 Distributing Firmware 10-8 Distributing a Configuration 10-9 Limiting Distributions 10-10 Downloading the Current Configuration 10-11 Uploading from a File Server Uploading a ConfigurationUploading from a Local Drive 10-12 Resetting the Configuration 10-13 Restarting the Access Point 10-14 Management System Setup 11-1 Settings on the Snmp Setup Snmp Setup11-2 Settings on the Database Query Using the Database Query11-3 Changing Settings with the Database Query Console and Telnet Setup11-4 Using Secure Shell Settings on the Console/Telnet11-5 11-6 Special Configurations 12-1 Setting Up a Repeater Access Point 12-2 12-3 12-4 Using Hot Standby Mode 12-5 12-6 12-7 12-8 Sections in this chapter include 13-1 Selections on the Network Diagnostics Using Diagnostic PagesNetwork Diagnostics 13-2 Radio Diagnostics Tests 13-3 SSIDs Int, Mod Vlan Summary Status13-4 Network Ports 13-5 Data Received Identifying Information and Status13-6 Ethernet Port Data Transmitted13-7 Receive Statistics Configuration Information13-8 Transmit Statistics AP Radio13-9 13-10 AP Radio Port 13-11 Display Options 13-12 Event Log Display Settings13-13 Event Log Summary Log HeadingsSaving the Log 13-14 Command Information Displayed Using Command-Line Diagnostics13-15 Entering Diagnostic Commands 13-16 Eapdiag1on Diagnostic Command Results13-17 Vxdiagarpshow Eapdiag2on13-18 13-19 Vxdiagcheckstack 13-20 Vxdiaghostshow 13-21 Vxdiagi 13-22 Vxdiagipstatshow 13-23 Vxdiagmemshow 13-24 Vxdiagmuxshow 13-25 Vxdiagrouteshow 13-26 Vxdiagtcpstatshow 13-27 Vxdiagudpstatshow Reserving Access Point Memory for a Packet Trace Log FileTracing Packets 13-28 Tracing Packets for Specific Devices 13-29 Packets Stored in a Log File Tracing Packets for Ethernet and Radio PortsViewing Packet Trace Data 13-30 Packets Displayed on the CLI Checking the Top Panel Indicators13-31 Message Ethernet Status Radio Meaning Type Indicator 13-32 Finding an Access Point by Blinking the Top Panel Indicators 13-33 WEP Keys Checking Basic SettingsEAP Authentication Requires Matching 802.1x Protocol Drafts 13-34 Firmware Version Draft 13-35 Resetting to the Default Configuration 13-36 13-37 13-38 Channels, Power Levels, and Antenna Gains Ieee 802.11a ChannelsRegulatory Domains Maximum Power Levels and Antenna Gains Ieee 802.11b Regulatory Domain With 6-dBi Antenna Gain Maximum Power Level mWRegulatory Domain Antenna Gain dBi Maximum Power Level mW Americas -A 100 Eirp maximum 13.5 Emea -E MW Eirp maximum Regulatory Domain Antenna Gain dBi Maximum Power Level mW OL-2159-05 Protocol Filter Lists Protocol ISO Designator SVP UDP XNS-IDP ISO-TP4 ISO-CNLP CnlpVines Smtp Tsap TftpHttp POP2 IRC CmotBGP RIP CVS RadiusRFE Event Log Messages Cisco Emblem Format Default FormatMessage Formats With a timestamp, messages look like this example Logemerg LoginfoSyslog Severity Emblem Severity Logalert Severity Event Description Mnemonic Recommended Action Message DescriptionsPossible Cause or Reason Device Host Srchost NewaddrIfDescr Desthost length pktLen Srchost to port ifDescr Reqlen bytes Packet from srchost to desthost IfDescr error= errornumDesthost on port ifDescr Srchost to desthost on port IfDescr error=erronumFor procedure on port ifDescr From srchost to desthost on port Srchost on port ifDescr Srchost to desthost of unknown VersionDesthost Admin SysrebootRebootinf Prtrarpip Port device Status IfDescr errno=errno PktLen Xidexp ENC WEPUnenc Ethercon Media port Frame bytes Frame Port devName unit Username FailedUsername Unit Assoclost 1XVERHstndbyen Hstndbyeth Amngrreq InstkeyAcctcon Nulses Noaserv NorbufNosbuf Open VlanID IfIndex MIB IfIndex Awcmib Taskfailed NomibdkeyBadsize Taskstarted SsidIdx Statuses and Reasons Appendix C Event Log Messages Statuses and Reasons OL-2159-05 Numerics IN-1 CLI CDP MIBDhcp Dtim IN-3 Radio traffic Ethernet Locate unit by flashing LEDsIN-4 Pspf IN-5 Vlan SSHIN-6 Warm restart IN-7 IN-8