Manuals / Cisco Systems / Computer Equipment / Network Router

Cisco Systems OL-6415-04 manual World-mode command, WPA migration mode Wpa-psk command

Models: OL-6415-04

1 188

Download 188 pages 52.52 Kb

Page 180

Index

world-mode command 21

WPA 6

WPA migration mode 12

wpa-psk command 13

Cisco Wireless ISR and HWIC Access Point Configuration Guide

	IN-6	OL-6415-04

Image 180

Cisco Systems OL-6415-04 manual World-mode command, WPA migration mode Wpa-psk command

Contents

Corporate Headquarters Text Part Number 0L-6415-04Page N T E N T S Ssid Configuration Methods Supported by Cisco IOS Releases Creating Cipher Suites Protocol Filters Local Authenticator Messages Contents Cisco Wireless Router and Hwic Configuration Guide Preface AudiencePurpose Preface provides information on the following topicsOrganization ConventionsPreface Conventions Related Publications Cisco Product Document TitleObtaining Documentation Cisco.comDocumentation Feedback Product Documentation DVDOrdering Documentation Reporting Security Problems in Cisco Products Cisco Product Security OverviewSubmitting a Service Request Obtaining Technical AssistanceCisco Technical Support & Documentation Website Definitions of Service Request Severity Obtaining Additional Publications and InformationPreface Obtaining Additional Publications and Information Wireless Device Management OverviewNetwork Configuration Example Root Unit on a Wired LANFeatures Overview Features Overview Overview Cisco Wireless Router and Hwic Configuration Guide Configuring Radio Settings Command Purpose Enabling the Radio InterfaceRoles in Radio Network Cisco Role in Radio Network Eries ISRsConfiguring Network or Fallback Role Bridge Features Not Supported Sample Bridging ConfigurationFollowing is a sample of a Root Bridge Configuration Following is a sample of Non-Root Bridge Configuration Interface Dot11Radio0/1/0 no ip address Universal Client Mode Configuring Universal Client ModeFollowing configuration is supported on NAT NAT Network Address TranslationVirtual interface to aid NAT translation No service password-encryption Hostname C1803WUC Configuring Radio Data Rates Configuring Radio Settings Configuring Radio Data RatesThroughput ofdm default Speed11.0 2.0 5.5 basic-1.0 2.0 5.5 6.0 9.0Configuring Radio Transmit Power End Return to privileged Exec modeDBm 100 125 150 200 250Limiting the Power Level for Associated Client Devices Power local5 6 7 10 13 15 17 MaximumConfiguring Radio Channel Settings Power client20 30 50 100 maximum 10 20 30 50 MaximumRegulatory Domains Center ChannelIdentifier MHz 2412 2417 2422 2427 2432 2437 2442 2447 2452 2457 2462 24672472 2484 Channel DFS Automatically Enabled on Some 5-GHz Radio Channels GHz Channels on Which DFS is Automatically EnabledEnabling and Disabling World Mode Confirming that DFS is EnabledThis example shows how to unblock all frequencies for DFS Blocking Channels from DFS SelectionEnabling and Disabling Short Radio Preambles Configuring Transmit and Receive Antennas Antenna receiveDiversity left right Antenna transmitDisabling and Enabling Access Point Extensions Disable Access Point extensionsNo dot11 extension aironet Snap or 802.1h dot1h, the default setting Payload-encapsulationSet the encapsulation transformation method to RFC1042 Snap dot1hConfigure terminal Enter global configuration mode Enable PspfBridge-group group port-protected Configuring Beacon Period and Dtim Configuring Protected PortsConfiguring RTS Threshold and Retries Configuring Maximum Data RetriesRts threshold value Rts retries valueConfiguring Fragmentation Threshold Bytes for the 2.4-GHz radio. Enter a setting from 256 toEnabling Short Slot Time for 802.11g Radios Fragment-threshold valuePerforming a Carrier Busy Test OL-6415-04 Configuring Multiple SSIDs Ssid Configuration Methods Supported by Cisco IOS Releases Understanding Multiple SSIDsVlan Configuring Multiple SSIDs Creating an Ssid GloballyCommand Purpose Using a Radius Server to Restrict SSIDs Viewing SSIDs Configured GloballyUsing Spaces in SSIDs Configuring Multiple Basic SSIDs Requirements for Configuring Multiple BSSIDsGuidelines for Using Multiple BSSIDs CLI Configuration Example Displaying Configured BSSIDsEnabling Mbssid and Ssidl at the same time Information-element ssidlSample Configuration for Enabling Mbssid and Ssidl Use the no form of the command to disable Ssidl IEsBelow is a sample configuration for enabling Mbssid Below is a sample configuration for enabling SsidlInterface Dot11Radio0/0/0 no ip address OL-6415-04 Configuring an Access Point as a Local Authenticator Understand Local Authentication Configure a Local AuthenticatorGuidelines for Local Authenticators Configuration OverviewConfiguring the Local Authenticator Access Point Aaa new-model Enable AAAReauthentication time seconds Radius-server localVlan vlan Ssid ssidPassword nthash password Mac-auth-onlyThis example shows how to set up EAP-FAST authentication End Routerconfig# aaa new-model Configuring EAP-FAST Settings Configuring PAC SettingsConfiguring an Authority ID Configuring Server KeysPossible PAC Failures Caused by Access Point Clock Limiting the Local Authenticator to One Authentication Type Viewing Local Authenticator StatisticsThis example shows local authenticator statistics Unblocking Locked UsernamesUsing Debug Messages Configuring Encryption Types Understand Encryption Types, Configure Encryption Types,Understand Encryption Types Configure Encryption Types Creating WEP KeysSecurity Configuration WEP Key Restriction WEP Key RestrictionsEncryption KeyExample WEP Key Setup Access Point Associated Device Slot Transmit? Key ContentsCreating Cipher Suites Cipher Suites Compatible with WPA Enabling and Disabling Broadcast Key Rotation Compatible Cipher SuitesWPA Security Type in Universal Client Mode SecurityUniversal client configuration Tkip AES TKIP+AESWEP 40-bit WEP 128-bit Debugging CaveatsWEP OL-6415-04 Configuring Authentication Types Understand Authentication Types Open Authentication to Access PointShared Key Authentication to Access Point Traffic from clientEAP Authentication to Network Sequence for EAP AuthenticationMAC Address Authentication to the Network Combining MAC-Based, EAP, and Open Authentication Using WPA Key Management5shows the WPA key management process WPA-PSK Mode Windows XP Yes Software and Firmware Requirements for WPA and WPA-TKIPThird Party Host Supplicant Protocol Required? SystemsConfigure Authentication Types Assigning Authentication Types to an SsidAuthentication open Optional Set the authentication type to open for this SsidMac-address list-name alternate Optional eap list-nameAuthentication shared Authentication network-eapAuthentication key-management Mac-address list-nameConfiguring WPA Migration Mode Configuring Additional WPA Settings Wpa-psk hex ascii 0Configuring MAC Authentication Caching Dot1x client-timeout seconds Dot11 holdoff-time secondsDot1x reauth-period seconds ServerSecurity Feature Client Setting Access Point Setting Detects two MIC failures within 60 seconds, it blocks allTkip clients on that interface for the holdtime period WPA-PSK Security Feature Client Setting Access Point Setting Configuring Radius Servers Configuring and Enabling Radius Understanding RadiusRadius Operation Configuring Radius Default Radius ConfigurationIdentifying the Radius Server Host Acct-port port-number timeout Port for authentication requests.Optional For acct-portRadius-server timeout command is used Radius-server host hostnameConfiguring Radius Login Authentication Show running-config Verify your entriesAaa authentication login default Login authentication defaultAuthentication login command Include-in-access-req format %hDefining AAA Server Groups Port for authentication requests Port for accounting requestsAaa group server radius group-name Define the AAA server-group with a group nameRadius Starting Radius Accounting Configuring Settings for All Radius Servers Selecting the Csid FormatOption MAC Address Example Show running-config Verify your settings Authentication Radius-server vsa send accountingRadius-server host hostname ip-address non-standard Configuring WISPr Radius Attributes Radius-server key stringDisplaying the Radius Configuration Snmp-server location locationRadius Attributes Sent by the Access Point Attribute ID DescriptionVLAN-ID Acct-Terminate-Cause VSA attribute NAS-Location Disc-Cause-ExtConfiguring VLANs Understanding VLANs LAN and Vlan Segmentation with Wireless Devices Related DocumentsConfiguring VLANs Incorporating Wireless Devices into VLANsConfiguring a Vlan Interface dot11radio 0.xEncapsulation dot1q vlan-id Using a Radius Server to Assign Users to VLANs Guidelines for Using Vlan NamesAssigning Names to VLANs Creating a Vlan NameViewing VLANs Configured on the Access Point Vlan Configuration Example Ssid Vlan IDConfiguring Vlan Vlan 1 Interfaces Vlan 2 Interfaces Vlan 3 InterfacesConfiguring VLANs Vlan Configuration Example OL-6415-04 Configuring QoS Understanding QoS for Wireless LANs, Configuring QoS,Understanding QoS for Wireless LANs QoS for Wireless LANs Versus QoS on Wired LANsImpact of QoS on a Wireless LAN Precedence of QoS Settings Upstream and Downstream Traffic FlowUsing Wi-Fi Multimedia Mode Configuring QoS Configuration GuidelinesAdjusting Radio Access Categories Fixed Slot TimeSample Configuration Using the CLI Disabling Igmp Snooping HelperChannel Settings Ieee 802.11b 2.4-GHz BandCenter Frequency Americas JapanIeee 802.11g 2.4-GHz Band Ieee 802.11a 5-GHz BandCenter Regulatory Domains Americas -A Emea -E Japan -J FrequencyFrequency North America OL-6415-04 Protocol Filters Protocol Icmp IgmpTCP EGP PUP ChaosISO Designator Tsap POP2POP3 IMAP2RIP RPCUucp CVSSupported MIBs MIB ListIEEE802dot11-MIB Using FTP to Access the MIB Files RFC1213-MIB RFC1398-MIB SNMPv2-MIB SNMPv2-SMI SNMPv2-TCError and Event Messages How to Read System MessagesThis appendix lists the CLI error and event messages Level DescriptionExplanation a station associated to an access point Explanation a station disassociated from an access pointMessage Traceback Reports Association Management MessagesSubsystem Messages Recommended Action None Explanation The device has begun its DFS scanning process Recommended Action None Error Message DOT11-4-RMINCAPABLE Interface interface Recommended Action Reload the system Error Message DOT11-4-CANTASSOC Cannot associate characters Recommended Action None Recommended Action Local Authenticator Messages Network with wireless stations Wireless network composed of stations without Access PointsAccess Point Operating in the 2.4-GHz bandHoc mode GL-2LAN 802.11 specifications Wired Ethernet networkAn antenna that radiates its signal in a spherical pattern Corresponding IP addressesTransmission at 6, 9, 12, 18, 24, 36, 48, and 54 Mbps Transmission at 2 MbpsWhile maintaining an unbroken connection to the LAN That of a cableWireless MultiMedia Computing device with an installed client adapter802.1X for authenticated key management EAP AES-CCMPEAP-FAST 1 IN-2FTP LeapNames, Vlan Network-EAP OfdmQbss Guest mode Multiple SSIDs Support Using spaces Local authentication Names Ssid 4 Vlan command 4Regulatory Domains Radius RFCWorld-mode command WPA migration mode Wpa-psk commandIN-7 IN-8 IN-9 IN-10 IN-11 IN-12 IN-13 IN-14