Cisco IOS Configuration Guide for
Autonomous Cisco Aironet Access Points
Cisco IOS Release 15.3(3)JAB
Cisco Systems, Inc.
www.cisco.com
Cisco has more than 200 offices worldwide.
Addresses, phone numbers, and fax numbers
are listed on the Cisco website at
www.cisco.com/go/offices.
Text Part Number: OL-31535-01
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
Cisco IOS Configuration Guide for Autonomous Cisco Aironet Access Points
Obtaining Documentation, Obtaining Support, and Security Guidelinesi-xxiii
1Overview of Access Point Features1-1
Radios in Access Points1-1
New Features and Platforms in this Release1-2
New Access Point Platforms Supported1-2
Support for Cisco Aironet 3700 Series access point1-2
Support for Cisco Aironet 2700 Series access point1-2
Support for Cisco Aironet 1700 Series access point1-3
New Features1-3
Multiple Port Support for Cisco Aironet 1550 Series Outdoor Access Points1-3
Automatic Configuring of the Access Point1-4
Support for L2TPv31-4
Configuration and CLI Changes in this Release1-4
Management Options1-4
Roaming Client Devices1-5
Network Configuration Examples1-5
Root Access Point1-5
Repeater Access Point1-6
Bridges1-7
Workgroup Bridge1-7
Central Unit in an All-Wireless Network1-8
CHAPTER
OL-29225-01
2Using the Web-Browser Interface2-1
Using the Web-Browser Interface for the First Time2-2
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
1
Contents
Using the Management Pages in the Web-Browser Interface2-2
Using Action Buttons2-3
Character Restrictions in Entry Fields2-4
Enabling HTTPS for Secure Browsing2-5
Deleting an HTTPS Certificate2-7
Using Online User Guides2-7
Disabling the Web-Browser Interface2-7
CHAPTER
3Using the Command-Line Interface3-1
Cisco IOS Command Modes3-2
Getting Help3-3
Abbreviating Commands3-3
Using the no and Default Forms of Commands3-4
Understanding CLI Messages3-4
Using Command History3-4
Changing the Command History Buffer Size3-5
Recalling Commands3-5
Disabling the Command History Feature3-5
Using Editing Features3-6
Enabling and Disabling Editing Features3-6
Editing Commands Through Keystrokes3-6
Editing Command Lines that Wrap3-7
Searching and Filtering Output of show and more Commands3-8
Accessing the CLI3-9
Opening the CLI with Telnet3-9
Opening the CLI with Secure Shell3-9
CHAPTER
2
4Configuring the Access Point for the First Time4-1
Before You Start4-1
Resetting the Device to Default Settings4-2
Resetting to Default Settings Using the MODE Button4-2
Resetting to Default Settings Using the GUI4-2
Resetting to Default Settings Using the CLI4-3
Logging into the Access Point4-3
Obtaining and Assigning an IP Address4-4
Default IP Address Behavior4-5
Connecting to the 1040, 1140, 1240, 1250, 1260, and 2600 Series Access Points Locally4-5
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-29225-01
Connecting to the 1550 Series Access Point Locally4-5
Default Radio Settings4-6
Assigning Basic Settings4-6
Default Settings on the Easy Setup Page4-10
Understanding the Security Settings4-11
Using VLANs4-12
Security Types for an SSID4-12
Limitations of Security Settings4-14
CLI Configuration Examples4-15
Configuring System Power Settings Access Points4-21
Using the AC Power Adapter4-21
Using a Switch Capable of IEEE 802.3af Power Negotiation4-21
Using a Switch That Does Not Support IEEE 802.3af Power Negotiation4-22
Using a Power Injector4-22
dot11 extension power native Command4-22
Contents
Support for 802.11n Performance on 1250 Series Access Points with Standard 802.3af PoE4-22
1250 Series Power Modes4-22
Support for 802.11ac4-23
Channel Widths for 802.11ac4-23
Power Management for 802.11ac4-24
Assigning an IP Address Using the CLI4-25
Using a Telnet Session to Access the CLI4-25
Configuring the 802.1X Supplicant4-26
Creating a Credentials Profile4-26
Applying the Credentials to an Interface or SSID4-27
Applying the Credentials Profile to the Wired Port4-27
Applying the Credentials Profile to an SSID Used For the Uplink4-27
Creating and Applying EAP Method Profiles4-28
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
3
Contents
Prepare a Configuration Information File4-34
Enable environmental variables4-35
Schedule the Configuration Information File Download4-35
Enabling Autoconfig via a Boot File4-36
Checking the Autoconfig Status4-36
Debugging Autoconfig4-37
CHAPTER
5Administrating the Access Point5-1
Disabling the Mode Button5-2
Preventing Unauthorized Access to Your Access Point5-3
Protecting Access to Privileged EXEC Commands5-3
Default Password and Privilege Level Configuration5-4
Setting or Changing a Static Enable Password5-4
Protecting Enable and Enable Secret Passwords with Encryption5-6
Configuring Username and Password Pairs5-7
Configuring Multiple Privilege Levels5-8
Setting the Privilege Level for a Command5-9
Logging Into and Exiting a Privilege Level5-9
Configuring Easy Setup5-10
Configuring Spectrum Expert Mode5-11
Controlling Access Point Access with RADIUS5-12
Default RADIUS Configuration5-12
Configuring RADIUS Login Authentication5-12
Defining AAA Server Groups5-14
Configuring RADIUS Authorization for User Privileged Access and
Network Services
5-16
Displaying the RADIUS Configuration5-17
Controlling Access Point Access with TACACS+5-17
Default TACACS+ Configuration5-17
Configuring TACACS+ Login Authentication5-17
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services5-19
Displaying the TACACS+ Configuration5-19
Configuring Ethernet Speed and Duplex Settings5-20
Configuring the Access Point for Wireless Network Management5-20
Configuring the Access Point for Local Authentication and Authorization5-21
Configuring the Authentication Cache and Profile5-22
Configuring the Access Point to Provide DHCP Service5-24
Setting up the DHCP Server5-24
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4
OL-29225-01
Monitoring and Maintaining the DHCP Server Access Point5-26
Show Commands5-26
Clear Commands5-26
Debug Command5-27
Configuring the Access Point for Secure Shell5-27
Understanding SSH5-27
Configuring SSH5-27
Support for Secure Copy Protocol5-28
Configuring Client ARP Caching5-28
Understanding Client ARP Caching5-28
Optional ARP Caching5-29
Configuring ARP Caching5-29
Managing the System Time and Date5-29
Understanding Simple Network Time Protocol5-30
Configuring SNTP5-30
Configuring Time and Date Manually5-30
Setting the System Clock5-31
Displaying the Time and Date Configuration5-32
Configuring the Time Zone 5-32
Configuring Summer Time (Daylight Saving Time)5-33
Contents
CHAPTER
Defining HTTP Access5-35
Configuring a System Name and Prompt5-35
Default System Name and Prompt Configuration5-35
Configuring a System Name5-36
Understanding DNS5-36
Default DNS Configuration5-37
Setting Up DNS5-37
Displaying the DNS Configuration5-38
Creating a Banner5-38
Default Banner Configuration5-38
Configuring a Message-of-the-Day Login Banner5-38
Configuring a Login Banner5-40
Upgrading Autonomous Cisco Aironet Access Points to Lightweight Mode5-41
6Configuring Radio Settings6-1
Enabling the Radio Interface6-2
Configuring the Role in Radio Network6-3
Universal Workgroup Bridge Mode6-6
Point-to-point and Multi Point bridging support for 802.11n platforms6-6
OL-29225-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
5
Contents
Configuring Dual-Radio Fallback6-7
Radio Tracking6-8
Fast Ethernet Tracking6-8
MAC-Address Tracking6-8
Configuring Radio Data Rates6-9
Access Points Send Multicast and Management Frames at Highest Basic Rate6-9
Configuring MCS Rates6-12
Configuring Radio Transmit Power6-13
Limiting the Power Level for Associated Client Devices6-15
Configuring Radio Channel Settings6-15
Channel Widths for 802.11n6-16
Dynamic Frequency Selection6-17
Radar Detection on a DFS Channel6-19
CLI Commands6-19
Confirming that DFS is Enabled6-19
Configuring a Channel6-20
Blocking Channels from DFS Selection6-20
Setting the 802.11n Guard Interval6-21
Enabling and Disabling World Mode6-22
Disabling and Enabling Short Radio Preambles6-22
Configuring Transmit and Receive Antennas6-23
Enabling and Disabling Gratuitous Probe Response6-25
Disabling and Enabling Aironet Extensions6-25
Configuring the Ethernet Encapsulation Transformation Method6-26
Enabling and Disabling Reliable Multicast to Workgroup Bridges6-27
Enabling and Disabling Public Secure Packet Forwarding6-29
Configuring Protected Ports6-30
Configuring the Beacon Period and the DTIM6-31
Configure RTS Threshold and Retries6-31
Configuring the Maximum Data Packet Retries6-32
Configuring the Fragmentation Threshold6-33
Enabling Short Slot Time for 802.11g Radios6-33
Performing a Carrier Busy Test6-34
Configuring VoIP Packet Handling6-34
Configuring ClientLink6-37
Using the CLI to Configure ClientLink6-38
Debugging Radio Functions6-38
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
6
OL-29225-01
802.11r Configuration6-39
Contents
CHAPTER
7Configuring Multiple SSIDs7-1
Understanding Multiple SSIDs7-2
Configuring Multiple SSIDs7-3
Creating an SSID Globally7-3
Viewing SSIDs Configured Globally7-5
Using a RADIUS Server to Restrict SSIDs7-5
Configuring Multiple Basic SSIDs7-6
Requirements for Configuring Multiple BSSIDs7-6
Guidelines for Using Multiple BSSIDs7-6
Configuring Multiple BSSIDs7-7
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
7
Contents
Non-Root Bridge Without VLANs8-11
Root Bridge with VLANs8-12
Non-Root Bridge with VLANs8-14
Displaying Spanning-Tree Status8-16
CHAPTER
CHAPTER
9Configuring an Access Point as a Local Authenticator9-1
Understanding Local Authentication9-2
Configuring a Local Authenticator9-2
Guidelines for Local Authenticators9-3
Configuration Overview9-3
Configuring the Local Authenticator Access Point9-3
Configuring Other Access Points to Use the Local Authenticator9-6
Configuring EAP-FAST Settings9-7
Configuring PAC Settings9-7
Configuring an Authority ID9-8
Configuring Server Keys9-8
Possible PAC Failures Caused by Access Point Clock9-8
Limiting the Local Authenticator to One Authentication Type9-9
Unblocking Locked Usernames9-9
Viewing Local Authenticator Statistics9-9
Using Debug Messages9-10
10Configuring WLAN Authentication and Encryption10-1
CHAPTER
8
Understanding Authentication and Encryption Mechanisms10-2
Understanding Encryption Modes10-6
Configuring Encryption Modes10-7
Creating Static WEP Keys10-8
WEP Key Restrictions10-9
Example WEP Key Setup10-9
Enabling Cipher Suites10-10
Matching Cipher Suites with WPA or CCKM10-11
Enabling and Disabling Broadcast Key Rotation10-13
11Configuring Authentication Types11-1
Understanding Authentication Types11-2
Open Authentication to the Access Point11-2
WEP Shared Key Authentication to the Access Point11-3
EAP Authentication to the Network11-4
MAC Address Authentication to the Network11-5
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-29225-01
Combining MAC-Based, EAP, and Open Authentication11-6
Using CCKM for Authenticated Clients11-6
Using WPA Key Management11-7
Configuring MAC Authentication Caching11-15
Configuring Authentication Holdoffs, Timeouts, and Intervals11-16
Creating and Applying EAP Method Profiles for the 802.1X Supplicant11-17
Creating an EAP Method Profile11-18
Applying an EAP Profile to the Fast Ethernet Interface11-18
Applying an EAP Profile to an Uplink SSID11-20
Matching Access Point and Client Device Authentication Types11-20
Guest Access Management11-23
Guest Account Creation11-24
Customized Guest Access Pages11-25
Contents
CHAPTER
12Configuring WDS, Fast Secure Roaming, Radio Management, and Wireless Intrusion Detection
Services
12-1
Understanding WDS12-2
Role of the WDS Device12-2
Role of Access Points Using the WDS Device12-3
Guidelines for WDS12-6
Requirements for WDS12-6
Configuration Overview12-6
Configuring Access Points as Potential WDS Devices12-7
CLI Configuration Example12-9
Configuring Access Points to use the WDS Device12-10
CLI Configuration Example12-11
Configuring the Authentication Server to Support WDS12-12
Configuring WDS Only Mode12-14
Viewing WDS Information12-15
Using Debug Messages12-16
OL-29225-01
Configuring Fast Secure Roaming12-17
Requirements for Fast Secure Roaming12-17
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
9
Contents
Configuring Access Points to Support Fast Secure Roaming12-18
CLI Configuration Example12-20
Support for 802.11r12-20
Configuring Management Frame Protection12-21
Management Frame Protection12-21
Client MFP Overview12-21
Client MFP For Access Points in Root mode12-22
Configuring Client MFP12-23
Protection of Management Frames with 802.11w12-24
Configuring Radio Management12-25
CLI Configuration Example12-25
Configuring Access Points to Participate in WIDS12-26
Configuring the Access Point for Scanner Mode12-26
Configuring the Access Point for Monitor Mode12-26
Displaying Monitor Mode Statistics12-27
Configuring Monitor Mode Limits12-28
Default RADIUS Configuration13-4
Identifying the RADIUS Server Host 13-5
Configuring RADIUS Login Authentication13-7
Defining AAA Server Groups13-9
Configuring RADIUS Authorization for User Privileged Access and Network Services13-11
Configuring Packet of Disconnect13-12
Selecting the CSID Format13-13
Starting RADIUS Accounting13-14
Configuring Settings for All RADIUS Servers13-15
Configuring the Access Point to Use Vendor-Specific RADIUS Attributes13-16
Configuring the Access Point for Vendor-Proprietary RADIUS Server Communication13-17
Configuring WISPr RADIUS Attributes13-18
Displaying the RADIUS Configuration13-19
RADIUS Attributes Sent by the Access Point13-20
10
Configuring and Enabling TACACS+13-23
Understanding TACACS+13-23
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-29225-01
TACACS+ Operation13-24
Configuring TACACS+13-24
Default TACACS+ Configuration13-25
Identifying the TACACS+ Server Host and Setting the Authentication Key13-25
Configuring TACACS+ Login Authentication13-26
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services13-27
Starting TACACS+ Accounting13-28
Displaying the TACACS+ Configuration13-29
Contents
CHAPTER
CHAPTER
14Configuring VLANs14-1
Understanding VLANs14-2
Incorporating Wireless Devices into VLANs14-3
Configuring VLANs14-4
Configuring a VLAN14-5
Assigning Names to VLANs14-7
Guidelines for Using VLAN Names14-7
Creating a VLAN Name14-7
Using a RADIUS Server to Assign Users to VLANs14-8
Viewing VLANs Configured on the Access Point14-8
VLAN Configuration Example14-10
15Configuring QoS15-1
Understanding QoS for Wireless LANs15-2
QoS for Wireless LANs Versus QoS on Wired LANs15-2
Impact of QoS on a Wireless LAN15-2
Precedence of QoS Settings15-3
Using Wi-Fi Multimedia Mode15-4
Using Band Select15-5
OL-29225-01
Configuring QoS15-6
Configuration Guidelines15-6
Configuring QoS Using the Web-Browser Interface15-7
The QoS Policies Advanced Page15-10
QoS Element for Wireless Phones15-10
IGMP Snooping15-11
AVVID Priority Mapping15-11
WiFi Multimedia (WMM)15-11
Rate Limiting15-12
Adjusting Radio Access Categories15-12
Configuring Nominal Rates15-13
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
11
Contents
Optimized Voice Settings15-14
CHAPTER
CHAPTER
16Configuring Filters16-1
Understanding Filters16-2
Configuring Filters Using the CLI16-2
Configuring Filters Using the Web-Browser Interface16-3
Configuring and Enabling MAC Address Filters16-3
Creating a MAC Address Filter16-4
Using MAC Address ACLs to Block or Allow Client Association to the Access Point16-6
Configuring MAC Address Authentication16-8
Determining the source of MAC Authentication16-9
Configuring the SSID for MAC Authentication16-11
Creating a Time-Based ACL16-12
ACL Logging16-13
Configuring and Enabling IP Filters16-13
Creating an IP Filter16-14
Configuring and Enabling EtherType Filters16-15
Creating an EtherType Filter16-16
17Configuring CDP17-1
CHAPTER
Understanding CDP17-2
Configuring CDP17-2
Default CDP Configuration17-2
Configuring the CDP Characteristics17-2
Disabling and Enabling CDP17-3
Disabling and Enabling CDP on an Interface17-4
Monitoring and Maintaining CDP17-5
Enabling CDP Logging17-7
18Configuring SNMP18-1
Understanding SNMP18-2
SNMP Versions18-2
SNMP Manager Functions18-3
SNMP Agent Functions18-4
SNMP Community Strings18-4
Using SNMP to Access MIB Variables 18-4
Configuring SNMP18-5
Default SNMP Configuration18-5
12
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-29225-01
Enabling the SNMP Agent18-6
Configuring Community Strings18-6
Specifying SNMP-Server Group Names18-8
Configuring SNMP-Server Hosts18-8
Configuring SNMP-Server Users18-8
Configuring Trap Managers and Enabling Traps18-8
Setting the Agent Contact and Location Information18-10
Using the snmp-server view Command18-11
SNMP Examples18-11
Displaying SNMP Status18-12
Contents
CHAPTER
19Configuring Repeater and Standby Access Points and Workgroup Bridge Mode19-1
Understanding Repeater Access Points19-2
Configuring a Repeater Access Point19-3
Default Configuration19-4
Guidelines for Repeaters19-4
Setting Up a Repeater19-5
Aligning Antennas19-6
Verifying Repeater Operation19-7
Setting Up a Repeater As a WPA2 Client19-7
Setting Up a Repeater As a EAP-FAST Client19-8
Understanding Hot Standby19-9
Configuring a Hot Standby Access Point19-10
Verifying Standby Operation19-12
Understanding Workgroup Bridge Mode19-13
Treating Workgroup Bridges as Infrastructure Devices or as Client Devices19-14
Configuring a Workgroup Bridge for Roaming19-15
Configuring a Workgroup Bridge for Limited Channel Scanning19-16
Configuring the Limited Channel Set19-16
Ignoring the CCX Neighbor List19-16
Configuring a Client VLAN19-17
OL-29225-01
Workgroup Bridge VLAN Tagging19-17
Configuring Workgroup Bridge Mode19-17
Using Workgroup Bridges in a Lightweight Environment19-21
Guidelines for Using Workgroup Bridges in a Lightweight Environment19-22
Sample Workgroup Bridge Association Verification19-23
Enabling VideoStream Support on Workgroup Bridges19-23
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
13
Contents
CHAPTER
20Managing Firmware and Configurations20-1
Working with the Flash File System20-1
Displaying Available File Systems20-2
Setting the Default File System20-3
Displaying Information About Files on a File System20-4
Changing Directories and Displaying the Working Directory20-4
Creating and Removing Directories20-4
Copying Files20-5
Deleting Files20-6
Creating, Displaying, and Extracting tar Files20-6
Creating a tar File20-6
Displaying the Contents of a tar File20-7
Extracting a tar File20-8
Displaying the Contents of a File20-8
Working with Configuration Files20-8
Guidelines for Creating and Using Configuration Files20-9
Configuration File Types and Location20-10
Creating a Configuration File by Using a Text Editor20-10
Copying Configuration Files by Using TFTP20-10
Preparing to Download or Upload a Configuration File by Using TFTP20-11
Downloading the Configuration File by Using TFTP20-11
Uploading the Configuration File by Using TFTP20-11
Copying Configuration Files by Using FTP20-12
Preparing to Download or Upload a Configuration File by Using FTP20-13
Downloading a Configuration File by Using FTP20-13
Uploading a Configuration File by Using FTP20-14
Copying Configuration Files by Using RCP20-15
Preparing to Download or Upload a Configuration File by Using RCP20-16
Downloading a Configuration File by Using RCP20-16
Uploading a Configuration File by Using RCP20-17
Clearing Configuration Information20-18
Deleting a Stored Configuration File20-18
14
Working with Software Images20-18
Image Location on the Access Point20-19
tar File Format of Images on a Server or Cisco.com20-19
Copying Image Files by Using TFTP20-20
Preparing to Download or Upload an Image File by Using TFTP20-20
Downloading an Image File by Using TFTP20-20
Uploading an Image File by Using TFTP20-22
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-29225-01
Copying Image Files by Using FTP20-22
Preparing to Download or Upload an Image File by Using FTP20-23
Downloading an Image File by Using FTP20-24
Uploading an Image File by Using FTP20-26
Copying Image Files by Using RCP20-27
Preparing to Download or Upload an Image File by Using RCP20-27
Downloading an Image File by Using RCP20-29
Uploading an Image File by Using RCP20-31
Reloading the Image Using the Web Browser Interface20-32
Browser HTTP Interface20-32
Browser TFTP Interface20-33
Contents
CHAPTER
CHAPTER
21Configuring L2TPv3 Over UDP/IP21-1
Prerequisites21-1
Configuring L2TP Class21-2
Configuring Pseudowire Class21-3
Relationship between L2TP Class and Pseudowire Class21-4
Configuring the Tunnel interface21-4
Configure Tunnel management Interface21-4
Mapping SSID to the Tunnel/Xconnect21-5
Configuring TCP mss adjust21-6
Configuring UDP checksum21-6
22Configuring System Message Logging22-1
Understanding System Message Logging22-2
Configuring System Message Logging22-2
System Log Message Format22-2
Default System Message Logging Configuration22-3
Disabling and Enabling Message Logging22-4
Setting the Message Display Destination Device22-5
Enabling and Disabling Timestamps on Log Messages22-6
Enabling and Disabling Sequence Numbers in Log Messages22-6
Defining the Message Severity Level22-7
Limiting Syslog Messages Sent to the History Table and to SNMP22-8
Setting a Logging Rate Limit22-9
Configuring the System Logging Facility22-10
OL-29225-01
Displaying the Logging Configuration22-11
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
15
Contents
CHAPTER
23Troubleshooting23-1
Checking the LED Indicators23-2
Checking Power23-2
Low Power Condition23-2
Checking Basic Settings23-3
SSID23-3
WEP Keys23-3
Security Settings23-3
Resetting to the Default Configuration23-4
Using the MODE Button23-4
Using the Web Browser Interface23-5
Using the CLI23-5
Reloading the Access Point Image23-6
Using the MODE button23-7
Using the Web Browser Interface23-7
Browser HTTP Interface23-8
Browser TFTP Interface23-8
Using the CLI23-9
Obtaining the Access Point Image File23-11
Obtaining TFTP Server Software23-11
APPENDIX
APPENDIX
APPENDIX
Image Recovery on the 1520 Access Point23-11
AProtocol FiltersA-1
BSupported MIBsB-1
MIB ListB-1
Using FTP to Access the MIB FilesB-2
CError and Event MessagesC-1
ConventionsC-2
Software Auto Upgrade MessagesC-3
Association Management MessagesC-5
Unzip MessagesC-6
System Log MessagesC-7
802.11 Subsystem MessagesC-8
Inter-Access Point Protocol MessagesC-21
Local Authenticator MessagesC-21
16
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-29225-01
G
LOSSARY
Contents
WDS MessagesC-24
Mini IOS MessagesC-25
Access Point/Bridge MessagesC-26
Cisco Discovery Protocol MessagesC-26
External Radius Server Error MessagesC-26
LWAPP Error MessagesC-27
Sensor MessagesC-28
SNMP Error MessagesC-29
SSH Error MessagesC-30
OL-29225-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
17
Contents
18
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-29225-01
Audience
Preface
This guide is for the networking professional who installs and manages Cisco Aironet Access Points in
Autonomous mode. To use this guide, you should have experience working with the Cisco IOS software
and be familiar with the concepts and terminology of wireless local area networks.
The guide covers Cisco IOS Releases 15.3(3)JAB. The following access point platforms are supported:
• AP 802
• AP 1040
• AP 1140
• AP 1260
• AP 1530
• AP 1550
• AP 1600
• AP 1700
• AP 2600
• AP 2700
• AP 3500
• AP 3600
• AP 3700
NoteThis guide does not cover lightweight access points. Configuration for these devices can be found in the
appropriate installation and configuration guides on Cisco.com.
Purpose
OL-30644-01
This guide provides the information you need to install and configure your access point. This guide
provides procedures for using the Cisco IOS software commands that have been created or changed for
use with the access point. It does not provide detailed information about these commands. For detailed
information about these commands, refer to the Cisco IOS Command Reference for Cisco Aironet Access
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
-xix
Configuration Procedures and Examples
Points and Bridges for this release. For information about the standard Cisco IOS software commands,
refer to the Cisco IOS software documentation set available from the Cisco.com home page at Support > Documentation.
This guide also includes an overview of the access point web-based interface (APWI), which contains
all the functionality of the command-line interface (CLI). This guide does not provide field-level
descriptions of the APWI windows nor does it provide the procedures for configuring the access point
from the APWI. For all APWI window descriptions and procedures, refer to the access point online help,
which is available from the Help buttons on the APWI pages.
Configuration Procedures and Examples
The procedures and examples given in this guide have been documented as seen on the Cisco Aironet
3600 Series Access Points.
To view the latest configuration examples, visit Cisco Tech Zone(https://techzone.cisco.com). In the
Tech Zone Navigator, browse to Wireless LAN > Autonomous APs (IOS) - Knowledge base for
Autonomous (IOS) Wireless Deployments.
NoteYou need to have an account on Cisco.com to access Cisco Tech Zone. If you do not have an account,
you can create one by clicking Register Now on the Log In page.
Organization
This guide is organized into these chapters:
Chapter 1, “Overview of Access Point Features,” lists the software and hardware features of the access
point and describes the access point role in your network.
Chapter 2, “Using the Web-Browser Interface,” describes how to use the web-browser interface to
configure the access point.
Chapter 3, “Using the Command-Line Interface,” describes how to use the command-line interface (CLI)
to configure the access point.
Chapter 4, “Configuring the Access Point for the First Time,”describes how to configure basic settings
on a new access point.
Chapter 5, “Administrating the Access Point,” describes how to perform one-time operations to
administer your access point, such as preventing unauthorized access to the access point, setting the
system date and time, and setting the system name and prompt.
Chapter 6, “Configuring Radio Settings,” describes how to configure settings for the access point radio
such as the role in the radio network, transmit power, channel settings, and others.
Chapter 7, “Configuring Multiple SSIDs,” describes how to configure and manage multiple Service Set
Identifiers (SSIDs) and multiple basic SSIDs (BSSIDs) on your access point. You can configure up to
16 SSIDs and up to eight BSSIDs on your access point.
Chapter 8, “Configuring Spanning Tree Protocol,”describes how to configure Spanning Tree Protocol
(STP) on your access point, bridge, or access point operating in a bridge mode. STP prevents bridge
loops from occurring in your network.
-xx
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Organization
Chapter 9, “Configuring an Access Point as a Local Authenticator,” describes how to configure the
access point to act as a local RADIUS server for your wireless LAN. If the WAN connection to your
main RADIUS server fails, the access point acts as a backup server to authenticate wireless devices.
Chapter 10, “Configuring WLAN Authentication and Encryption,” describes how to configure the cipher
suites required to use authenticated key management, Wired Equivalent Privacy (WEP), and WEP
features including MIC, CMIC, TKIP, CKIP, and broadcast key rotation.
Chapter 11, “Configuring Authentication Types,” describes how to configure authentication types on the
access point. Client devices use these authentication methods to join your network.
Chapter 12, “Configuring WDS, Fast Secure Roaming, Radio Management, and Wireless Intrusion
Detection Services,” describes how to configure the access point to participate in WDS, to allow fast
reassociation of roaming client services, and to participate in radio management.
Chapter 13, “Configuring RADIUS and TACACS+ Servers,” describes how to enable and configure the
RADIUS and Terminal Access Controller Access Control System Plus (TACACS+), which provide
detailed accounting information and flexible administrative control over authentication and
authorization processes.
Chapter 14, “Configuring VLANs,” describes how to configure your access point to interoperate with
the VLANs set up on your wired LAN.
Chapter 15, “Configuring QoS,” describes how to configure and manage MAC address, IP, and
EtherType filters on the access point using the web-browser interface.
Chapter 16, “Configuring Filters,” describes how to configure and manage MAC address, IP, and
EtherType filters on the access point using the web-browser interface.
Chapter 17, “Configuring CDP,” describes how to configure Cisco Discovery Protocol (CDP) on your
access point. CDP is a device-discovery protocol that runs on all Cisco network equipment.
Chapter 18, “Configuring SNMP,” describes how to configure the Simple Network Management
Protocol (SNMP) on your access point.
Chapter 19, “Configuring Repeater and Standby Access Points and Workgroup Bridge Mode,” describes
how to configure your access point as a hot standby unit or as a repeater unit.
Chapter 20, “Managing Firmware and Configurations,” describes how to manipulate the Flash file
system, how to copy configuration files, and how to archive (upload and download) software images.
Chapter 21, “Configuring L2TPv3 Over UDP/IP,” describes how to configure the Layer 2 Tunneling
Protocol (L2TPv3), which is a tunneling protocol that enables tunneling of Layer 2 packets over IP core
networks.
Chapter 22, “Configuring System Message Logging,” describes how to configure system message
logging on your access point.
Chapter 23, “Troubleshooting,”provides troubleshooting procedures for basic problems with the access
point.
Appendix A, “Protocol Filters,” lists some of the protocols that you can filter on the access point.
Information Bases (MIBs) that the access point supports for this software release.
Appendix C, “Error and Event Messages,” lists the CLI error and event messages and provides an
explanation and recommended action for each message.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
-xxi
Conventions
Conventions
This publication uses these conventions to convey instructions and information:
Command descriptions use these conventions:
Interactive examples use these conventions:
Notes, cautions, and timesavers use these conventions and symbols:
• Commands and keywords are in boldface text.
• Arguments for which you supply values are in italic.
• Square brackets ([ ]) mean optional elements.
• Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements.
• Braces and vertical bars within square brackets ([{ | }]) mean a required choice within an optional
element.
• Terminal sessions and system displays are in screen font.
• Information you enter is in boldface screen font.
• Nonprinting characters, such as passwords or tabs, are in angle brackets (< >).
NoteMeans reader take note. Notes contain helpful suggestions or references to materials not contained in
this manual.
CautionMeans reader be careful. In this situation, you might do something that could result equipment damage
or loss of data.
TipMeans the following will help you solve a problem. The tips information might not be troubleshooting
or even an action, but could be useful information.
Related Publications
• Release Notes for Cisco Aironet Access Points and Bridges for Cisco IOS Release 15.3(3)JAB.
• For each of the supported access points, the following types of guides have been provided as
required on its respective support page on Cisco.com:
–
Access Point Getting Started Guide
–
Access Point Hardware Installation Guide (Only in cases where hardware installation is not
covered in the Getting Started Guide)
–
Installation Instructions for Cisco Aironet Power Injectors
–
Access Point Deployment Guide
-xxii
–
Cisco Aironet 802.11 a/b/g/n/ac Radio Installion and Upgrade Instructions
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Obtaining Documentation, Obtaining Support, and Security Guidelines
Obtaining Documentation, Obtaining Support, and Security
Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback,
security guidelines, and also recommended aliases and general Cisco documents, see the monthly
What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical
documentation, at:
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
-xxiii
Obtaining Documentation, Obtaining Support, and Security Guidelines
-xxiv
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
CHA P T ER
1
Overview of Access Point Features
Cisco Aironet Access Points (hereafter called access points, or abbreviated as APs) provide a secure,
affordable, and easy-to-use wireless LAN solution that combines mobility and flexibility with the
enterprise-class features required by networking professionals. With a management system based on
Cisco IOS software, Cisco Aironet access points are Wi-Fi certified, and depending on the specific
model are 802.11a-compliant, 802.11b-compliant, 802.11g-compliant, 802.11n-compliant, and
802.11ac-compliant wireless LAN transceivers.
NoteWhen booting up a 1530, 1700, or a 2700 series AP for the first time, it will boot up with a unified mode
software image. To deploy the AP in an autonomous network, use following command from the AP
console or telnet to force AP to reboot using autonomous mode software image.
capwap ap autonomous
For more information on software images on the AP, see Working with Software Images, page 20-18.
You can configure and monitor the wireless device using the command-line interface (CLI), the
browser-based management system, or Simple Network Management Protocol (SNMP).
This chapter contains the following sections:
• Radios in Access Points, page 1-1
• New Features and Platforms in this Release, page 1-2
• Management Options, page 1-4
• Roaming Client Devices, page 1-5
• Network Configuration Examples, page 1-5
Radios in Access Points
An access point serves as the connection point between wireless and wired networks or as the center
point of a stand-alone wireless network. In large installations, wireless users within the radio range of
an access point can roam throughout a facility while maintaining seamless, uninterrupted access to the
network.
Each access point platform contains one, two, or three radios. For more information on the radios
supported by each access point model, see the corresponding Access Point Data Sheet.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
1-1
New Features and Platforms in this Release
New Features and Platforms in this Release
For full information on the new features and updates to existing features in this release, see the Release
Notes for Autonomous Cisco Aironet Access Points and Bridges for Cisco IOS Release 15.3(3)JA.
For the full list of CLI commands supported in this release, see the Cisco IOS Command Reference for
Autonomous Cisco Aironet Access Points and Bridges, Cisco IOS Release 15.3(3)JA.
NoteThe proxy Mobile-IP feature is not supported in Cisco IOS Release 12.3(2)JA and later.
New Access Point Platforms Supported
This release supports the following new access point platforms:
Support for Cisco Aironet 3700 Series access point
Chapter 1 Overview of Access Point Features
• This access point is built on 4x4:3(2.4GHz), 4x4:3(5GHz) MIMO technology, with integrated and
external antenna options, and supports 802.11a,b,g,n,ac.
• Supported models are 3700E and 3700I
• Supported operating modes are:
–
Root
–
Root Bridge
–
Non Root Bridge
–
Workgroup Bridge
–
Scanner
–
Spectrum
–
Repeater
Support for Cisco Aironet 2700 Series access point
• This access point is built on 3x4:3(2.4GHz), 4x4:3(5GHz) MIMO technology, with integrated and
external antenna options, and supports 802.11a,b,g,n,ac. This access point has both primary and
secondary gigabit Ethernet ports. The primary port is gigabit Ethernet 0 and is the backhaul port.
The primary port can be set as trunk port. The secondary port is gigabitEthernet 1, and is the access
port. You can configure the secondary port to a VLAN ID using the interface configuration
command bridge multiple-port client-vlanvlan-id
• Supported models are 2700E and 2700I
1-2
• Supported operating modes are:
–
Root
–
Root Bridge
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 1 Overview of Access Point Features
–
Non Root Bridge
–
Workgroup Bridge
–
Scanner
–
Spectrum
–
Repeater
Support for Cisco Aironet 1700 Series access point
• This access point is built on 3x4:3(2.4GHz), 4x4:3(5GHz) MIMO technology, and comes with
integrated antennas, and supports 802.11a,b,g,n,ac. This access point has both primary and
secondary gigabit Ethernet ports. The primary port is gigabit Ethernet 0 and is the backhaul port.
The primary port can be set as trunk port. The secondary port is gigabitEthernet 1, and is the access
port. You can configure the secondary port to a VLAN ID using the interface configuration
command bridge multiple-port client-vlanvlan-id
• Supported model is 1700I
• Supported operating modes are:
New Features and Platforms in this Release
–
Root
–
Root Bridge
–
Non Root Bridge
–
Workgroup Bridge
–
Scanner
–
Spectrum
–
Repeater
New Features
Multiple Port Support for Cisco Aironet 1550 Series Outdoor Access Points
The 1550 series has four Ethernet ports – PoE-In port, PoE-Out port, Auxiliary port, and SFP Port. All
four ports are supported in the current release. This series also has an internal cable modem in the 1552C
and 1552CU models. The cable modem connects to the Auxiliary port.
You can set the PoE-In port, SFP port, or the Auxiliary port as the primary Ethernet port. You can set the
primary Ethernet port using the configuration command:
dot11 primary-ethernet-port port-number-0to3
You can set the primary Ethernet port as a trunk and handle multiple VLANs, but the secondary ports
can be set as access ports only. To configure the vlan-id in secondary ports, use the interface
configuration command bridge multiple-port client-vlan vlan-id
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
1-3
Management Options
Automatic Configuring of the Access Point
The Autoconfig feature of autonomous access points allows the AP to download its configuration,
periodically, from a Secure Copy Protocol (SCP) server. For more information, see Automatic
Configuring of the Access Point, page 4-34
Support for L2TPv3
Layer 2 Tunneling Protocol (L2TPv3), is a tunneling protocol that enables tunneling of Layer 2 packets
over IP core networks.
For detailed information, see Chapter 21, “Configuring L2TPv3 Over UDP/IP.”
Configuration and CLI Changes in this Release
The following updates and new additions have been made:
• For Cisco Aironet 2700 series access points, you can configure the secondary port to a VLAN ID
using the interface configuration command bridge multiple-port client-vlan vlan-id
• For Cisco Aironet 1550 series outdoor access points:
Chapter 1 Overview of Access Point Features
–
You can set the PoE-In port, SFP port, or the Auxiliary port as the primary Ethernet port. You
can set the primary Ethernet port using the configuration command:
dot11 primary-ethernet-port port-number-0to3
–
You can set the primary Ethernet port as a trunk and handle multiple VLANs, but the secondary
ports can be set as access ports only. To configure the vlan-id in secondary ports, use the
interface configuration command bridge multiple-port client-vlan vlan-id
• Removal of WPA/TKIP Configuration—Wi-Fi certified access points no longer support a
WPA/TKIP configuration. TKIP is only allowed in combination with WPA2/AES for backward
compatibility to allow older TKIP-only devices to associate.
–
Authentication key-management WPA version 1 will be changed to authentication
key-management WPA. The following message will be displayed:
Warning: WPA Version 1 no longer permitted by itself - WPA2 has been enabled
–
WPA version 1 option has been removed from the authentication key-management WPA CLI
and configuring TKIP only under this interface is not supported. It will be changed to aes-ccm
tkip to work on mixed mode with the following message on the ap console:
Warning: TKIP encryption no longer permitted by itself - AES-CCM has been enabled
Management Options
1-4
You can use the wireless device management system through the following interfaces:
• The Cisco IOS command-line interface (CLI), which you use through a console port or Telnet
session. Use the interface dot11radio global configuration command to place the wireless device
into the radio configuration mode. Most of the examples in this manual are taken from the CLI.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 1 Overview of Access Point Features
Chapter 3, “Using the Command-Line Interface,” provides a detailed description of the CLI.
• A web-browser interface, which you use through a Web browser. Chapter 2, “Using the
Web-Browser Interface,” provides a detailed description of the web-browser interface.
• Simple Network Management Protocol (SNMP). Chapter 18, “Configuring SNMP,” explains how to
configure the wireless device for SNMP management.
Roaming Client Devices
If you have more than one wireless device in your wireless LAN, wireless client devices can roam
seamlessly from one wireless device to another. The roaming functionality is based on signal quality, not
proximity. When signal quality drops from a client, it roams to another access point.
Wireless LAN users are sometimes concerned when a client device stays associated to a distant access
point instead of roaming to a closer access point. However, if a client signal to a distant access point
remains strong and the signal quality is high, the client will not roam to a closer access point. Checking
constantly for closer access points would be inefficient, and the extra radio traffic would slow throughput
on the wireless LAN.
Roaming Client Devices
Using Cisco Centralized Key Management (CCKM) or 802.11r, with a device providing wireless
distribution system (WDS), client devices can roam from one access point to another so quickly that
there is no perceptible delay in voice or other time-sensitive applications.
Network Configuration Examples
This section describes the role of an access point in common wireless network configurations. The
access point default configuration is as a root unit connected to a wired LAN or as the central unit in an
all-wireless network. Access points can also be configured as repeater access points, bridges, and
workgroup bridges. These roles require specific configurations.
Root Access Point
An access point connected directly to a wired LAN provides a connection point for wireless users. If
more than one access point is connected to the LAN, users can roam from one area of a facility to another
without losing their connection to the network. As users move out of range of one access point, they
automatically connect to the network (associate) through another access point. The roaming process is
seamless and transparent to the user. Figure 1-1 shows access points acting as root units on a wired LAN.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
1-5
Network Configuration Examples
Access pointRepeater
135444
Figure 1-1Access Points as Root Units on a Wired LAN
Chapter 1 Overview of Access Point Features
Access point
Access point
135445
Repeater Access Point
An access point can be configured as a stand-alone repeater to extend the range of your infrastructure or
to overcome an obstacle that blocks radio communication. The repeater forwards traffic between
wireless users and the wired LAN by sending packets to either another repeater or to an access point
connected to the wired LAN. The data is sent through the route that provides the best performance for
the client. Figure 1-2 shows an access point acting as a repeater. Consult the “Configuring a Repeater
Access Point” section on page 19-3 for instructions on setting up an access point as a repeater.
NoteNon-Cisco client devices might have difficulty communicating with repeater access points.
Figure 1-2Access Point as Repeater
1-6
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 1 Overview of Access Point Features
Root bridgeNon-root bridge
135447
Root bridgeNon-root bridge
135446
Bridges
Access points can be configured as root or non-root bridges. In this role, an access point establishes a
wireless link with a non-root bridge. Traffic is passed over the link to the wired LAN. Access points in
root and non-root bridge roles can be configured to accept associations from clients. Figure 1-3 shows
an access point configured as a root bridge with clients. Figure 1-4 shows two access points configured
as a root and non-root bridge, both accepting client associations. Consult the “Configuring the Role in
Radio Network” section on page 6-3 for instructions on setting up an access point as a bridge.
When wireless bridges are used in a point-to-multipoint configuration the throughput is reduced
depending on the number of non-root bridges that associate with the root bridge. With a link data rate at
54 Mbps, the maximum throughput is about 25 Mbps in a point-to-point link. The addition of three
bridges to form a point-to-multipoint network reduces the throughput to about 12.5 Mbps.
Figure 1-3Access Point as a Root Bridge with Clients
Network Configuration Examples
Figure 1-4Access Points as Root and Non-root Bridges with Clients
Workgroup Bridge
You can configure access points as workgroup bridges. In workgroup bridge mode, the unit associates
to another access point as a client and provides a network connection for the devices connected to its
Ethernet port. For example, if you need to provide wireless connectivity for a group of network printers,
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
1-7
Network Configuration Examples
Access point
Workgroup bridge
135448
Access point
135443
you can connect the printers to a hub or to a switch, connect the hub or switch to the access point Ethernet
port, and configure the access point as a workgroup bridge. The workgroup bridge associates to an access
point on your network.
If your access point has multiple radios, either radio can function in workgroup bridge mode..
Figure 1-5 shows an access point configured as a workgroup bridge. Consult the “Understanding
Workgroup Bridge Mode” section on page 19-13 and the “Configuring Workgroup Bridge Mode”
section on page 19-17 for information on configuring your access point as a workgroup bridge.
Figure 1-5Access Point as a Workgroup Bridge
Chapter 1 Overview of Access Point Features
Central Unit in an All-Wireless Network
In an all-wireless network, an access point acts as a stand-alone root unit. The access point is not
attached to a wired LAN; it functions as a hub linking all stations together. The access point serves as
the focal point for communications, increasing the communication range of wireless users. Figure 1-6
shows an access point in an all-wireless network.
Figure 1-6Access Point as Central Unit in All-Wireless Network
1-8
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
CHA P T ER
2
Using the Web-Browser Interface
This chapter describes the web-browser interface that you can use to configure the wireless device. This
chapter contains the following sections:
• Using the Web-Browser Interface for the First Time, page 2-2
• Using the Management Pages in the Web-Browser Interface, page 2-2
• Enabling HTTPS for Secure Browsing, page 2-5
• Using Online User Guides, page 2-7
• Disabling the Web-Browser Interface, page 2-7
The web-browser interface contains management pages that you use to change the wireless device
settings, upgrade firmware, and monitor and configure other wireless devices on the network.
NoteThe wireless device web-browser interface is fully compatible with Microsoft Internet Explorer version
9.0 and Mozilla Firefox version 17.
OL-30644-01
NoteAvoid using both the CLI and the web-browser interfaces to configure the wireless device. If you
configure the wireless device using the CLI, the web-browser interface might display an inaccurate
interpretation of the configuration. However, the inaccuracy does not necessarily mean that the wireless
device is misconfigured.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
2-1
Chapter 2 Using the Web-Browser Interface
Using the Web-Browser Interface for the First Time
Using the Web-Browser Interface for the First Time
Use the wireless device IP address to browse to the management system. See the “Logging into the
Access Point” section on page 4-3 for instructions on assigning an IP address to the wireless device.
Follow these steps to begin using the web-browser interface:
Step 1Start the browser.
Step 2Enter the wireless device IP address in the address bar of the and press Enter.
The Summary Status page appears.
Using the Management Pages in the Web-Browser Interface
The system management pages use consistent techniques to present and save configuration information.
You can use the navigation bar present at the top of a page to select the main menu options. Another
navigation bar is present on the left side of the page, to use for navigating through the sub menus. You
can use the navigation bar to browse to other management pages, and use the configuration action
buttons to save or cancel changes to the configuration.
NoteIt is important to remember that clicking your web-browser Back button returns you to the previous page
without saving any changes you have made. Clicking Cancel cancels any changes you made in the page
and keeps you on that page. Changes are only applied when you click Apply.
Figure 2-1 shows the web-browser interface home page.
2-2
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 2 Using the Web-Browser Interface
Figure 2-1Web-Browser Interface Home Page
Using the Management Pages in the Web-Browser Interface
Using Action Buttons
Table 2-1 lists the page links and buttons that appear on the management page.
Table 2-1Buttons and Links on the Management Page
Button/LinkDescription
Navigation Links
HomeDisplays wireless device status page with information on the number of radio
Easy SetupDisplays the Easy Setup page that includes basic settings such as system name,
NetworkDisplays a list of infrastructure devices on your wireless LAN. Provides
AssociationDisplays a list of all devices on your wireless LAN, listing their system names,
WirelessDisplays a summary of wireless Domain services configuration and devices,
SecurityDisplays a summary of security settings and provides links to security
devices associated to the wireless device, the status of the Ethernet and radio
interfaces, and a list of recent wireless device activity.
IP address, and role in radio network.
configuration submenus for the access point interfaces (radio and Ethernet).
network roles, and parent-client relationships.
and provides links to WDS configuration pages.
configuration pages.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
2-3
Using the Management Pages in the Web-Browser Interface
Table 2-1Buttons and Links on the Management Page (continued)
Button/LinkDescription
ServicesDisplays status for several wireless device features and links to configuration
pages for Telnet/SSH, CDP, domain name server, filters, QoS, SNMP, SNTP,
and VLANs.
ManagementDisplays a list of current guest users and provides links to configuration pages
for guest users and web authentication pages.
SoftwareDisplays the Version number of the firmware that the wireless device is
running and provides links to configuration pages for upgrading and managing
firmware.
Event LogDisplays the wireless device event log and provides links to configuration
pages where you can select events to be included in traps, set event severity
levels, and set notification methods.
Configuration Action Buttons
ApplySaves changes made on the page and remains on the page.
RefreshUpdates status information or statistics displayed on a page.
CancelDiscards changes to the page and remains on the page.
BackDiscards any changes made to the page and returns to the previous page.
LogoutExits the AP configuration web interface without saving.
PingPings an IPv4 or IPv6 address
Save ConfigurationSaves the AP’s current configuration to NVRAM.
Chapter 2 Using the Web-Browser Interface
Character Restrictions in Entry Fields
You cannot use the following characters in the entry fields on the web-browser interface. This is true for
all access points using Cisco IOS software.
“
]
+
/
Tab
Trailing space
2-4
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 2 Using the Web-Browser Interface
Enabling HTTPS for Secure Browsing
You can protect the communication with the access point web-browser interface by enabling HTTPS.
HTTPS protects HTTP browser sessions by using the Secure Socket Layer (SSL) protocol.
NoteWhen you enable HTTPS, your browser might lose its connection to the access point. If you lose the
connection, change the URL in your browser address line from http://ip_address to https://ip_address
and log into the access point again.
NoteWhen you enable HTTPS, most browsers prompt you for approval each time you browse to a device that
does not have a fully qualified domain name (FQDN). To avoid the approval prompts, create an FQDN
for the access point as detailed in the following procedure.
Follow these steps to create an FQDN and enable HTTPS:
Step 1If your browser uses popup-blocking software, disable the popup-blocking feature.
Step 2Choose Easy Setup > Network Configuration.
The Network Configuration page appears.
Enabling HTTPS for Secure Browsing
Step 3Enter a name for the access point in the Host Name field, and then click Apply.
Step 4Choose Services > DNS page.
The Services: DNS - Domain Name Service page appears.
Step 5In the Domain Name System (DNS) field, click the Enable radio button.
Step 6In the Domain Name field, enter your company’s domain name.
Step 7Enter at least one IP address for your DNS server in the Name Server IPv4/IPv6 Addresses fields.
Step 8Click Apply.
The access point FQDN is a combination of the system name and the domain name. For example, if your
system name is ap3600 and your domain name is company.com, the FQDN is ap3600.company.com.
Step 9Enter the FQDN on your DNS server.
TipIf you do not have a DNS server, you can register the access point FQDN with a dynamic DNS service.
Search the Internet for dynamic DNS to find a fee-based DNS service.
Step 10Choose Services > HTTP.
The Services: HTTP - Web Server page is displayed.
Step 11In the Web-based Configuration Management field, select the Enable Secure (HTTPS) Browsing
check box.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
2-5
Enabling HTTPS for Secure Browsing
Step 12In the Domain Name field, enter a domain name, and then click Apply.
NoteEnabling HTTPS automatically disables HTTP. To maintain HTTP access with HTTPS enabled,
check the Enable Secure (HTTPS) Browsing check box, and then check the Enable Standard
(HTTP) Browsing check box. Although you can enable both standard HTTP and HTTPS, we
recommend that you enable only one.
A warning appears stating that you will now use secure HTTP to browse to the access point. The warning
also displays the new URL containing https, which you will need to use to browse to the access point.
Step 13In the warning box, click OK.
The address in your browser address line changes from http://<ip-address> to https://<ip-address>.
Step 14Another warning appears stating that the access point security certificate was not issued by a trusted
certificate authority. However, you can ignore this warning. Click Continue to this Website (not
recommended).
NoteThe following steps assume that you are using Microsoft Internet Explorer. If you are not, please
refer to your browser documentation for more information on how to access web sites using self
signed certificates.
Chapter 2 Using the Web-Browser Interface
Step 15The access point login window appears and you must log in to the access point again. The default
username is Cisco (case-sensitive) and the default password is Cisco (case-sensitive).
Step 16To display the access point’s security certificate, click the Certificate error icon in the address bar.
Step 17Click View Certificates.
Step 18In the Certificate window, click Install Certificate.
The Microsoft Windows Certificate Import Wizard appears.
Step 19Click Next.
The next screen asks where you want to store the certificate. We recommend that you use the default
storage area on your system.
Step 20Click Next to accept the default storage area.
You have now successfully imported the certificate.
Step 21Click Finish.
A security warning is displayed.
Step 22Click Ye s.
A message box stating that the installation is successful is displayed.
Step 23Click OK.
CLI Configuration Example
This example shows the CLI commands that are equivalent to the steps listed in the “Enabling HTTPS
for Secure Browsing” section on page 2-5:
AP# configure terminal
AP(config)# hostname ap3600
AP(config)# ip domain name company.com
AP(config)# ip name-server 10.91.107.18
AP(config)# ip http secure-server
2-6
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 2 Using the Web-Browser Interface
AP(config)# end
In this example, the access point system name is ap3600, the domain name is company.com, and the IP
address of the DNS server is 10.91.107.18.
For complete descriptions of the commands used in this example, consult the Cisco IOS Commands
Master List, Release 12.4. Click this link to browse to the master list of commands:
The access point generates a certificate automatically when you enable HTTPS. However, if you need to
change the fully qualified domain name (FQDN) for an access point, or you need to add an FQDN after
enabling HTTPS, you might need to delete the certificate. Follow these steps:
Step 1Browse to the Services: HTTP Web Server page.
Step 2Uncheck the Enable Secure (HTTPS) Browsing check box to disable HTTPS.
Step 3Click Delete Partial SSL certificate to delete the certificate.
Step 4Click Apply. The access point generates a new certificate using the new FQDN.
Using Online User Guides
CLI Commands for Deleting an HTTPS Certificate
In the global configuration mode, use the following commands for deleting an HTTPS certificate.
CommandPurpose
Step 1
Step 2
no ip http secure-serverDisables HTTPS
crypto key zeroize rsa name-of-rsa-keyDeletes the RSA key for the http server. Along with
this all the router certificates (HTTPS certificates)
issued using these keys will also be removed.
Using Online User Guides
In the web-browser interface, click the help icon at the top of the Home page to the online version of this
guide (Cisco IOS Configuration Guide for Autonomous Cisco Aironet Access Points). You can choose
view the guide online or you can also download a PDF version of the guide for offline reference. The
online guide is periodically updated and hence will give you more up to date information.
Disabling the Web-Browser Interface
To prevent all use of the web-browser interface, select the Disable Web-Based Management check box
on the Services: HTTP-Web Server page and click Apply.
OL-30644-01
To re-enable the web-browser interface, enter this global configuration command on the access point
CLI:
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
2-7
Disabling the Web-Browser Interface
ap(config)# ip http server
Chapter 2 Using the Web-Browser Interface
2-8
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
CHA P T ER
3
Using the Command-Line Interface
This chapter describes the Cisco IOS command-line interface (CLI) that you can use to configure the
wireless device. It contains the following sections:
• Cisco IOS Command Modes, page 3-2
• Getting Help, page 3-3
• Abbreviating Commands, page 3-3
• Using the no and Default Forms of Commands, page 3-4
• Understanding CLI Messages, page 3-4
• Using Command History, page 3-4
• Using Editing Features, page 3-6
• Searching and Filtering Output of show and more Commands, page 3-8
• Accessing the CLI, page 3-9
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
3-1
Cisco IOS Command Modes
Cisco IOS Command Modes
The Cisco IOS user interface is divided into many different modes. The commands available to you
depend on which mode you are currently in. Enter a question mark (?) at the system prompt to obtain a
list of commands available for each command mode.
When you start a session on the wireless device, you begin in user mode, often called user EXEC mode.
A subset of the Cisco IOS commands are available in user EXEC mode. For example, most of the user
EXEC commands are one-time commands, such as show commands, which show the current
configuration status, and clear commands, which clear counters or interfaces. The user EXEC
commands are not saved when the wireless device reboots.
To have access to all commands, you must enter privileged EXEC mode. Normally, you must enter a
password to enter privileged EXEC mode. From this mode, you must enter privileged EXEC mode
before you can enter the global configuration mode.
Using the configuration modes (global, interface, and line), you can make changes to the running
configuration. If you save the configuration, these commands are stored and used when the wireless
device reboots. To access the various configuration modes, you must start at global configuration mode.
From global configuration mode, you can enter interface configuration mode and line configuration
mode.
Tabl e 3-1 describes the main command modes, how to access each one, the prompt you see in that mode, and
how to exit the mode. The examples in the table use the host name ap.
Chapter 3 Using the Command-Line Interface
Table 3-1Command Mode Summary
ModeAccess MethodPromptExit MethodAbout This Mode
User EXECBegin a session with
the wireless device.
ap>
Enter logout or quit.Use this mode to:
• Change terminal settings
• Perform basic tests
• Display system
information
Privileged EXECWhile in user EXEC
mode, enter the
enable command.
Global configurationWhile in privileged
EXEC mode, enter
the configure
ap#
ap(config)#
Enter disable to exit.Use this mode to verify
commands. Use a password to
protect access to this mode.
To exit to privileged
EXEC mode, enter exit or
end, or press Ctrl-Z.
Use this mode to configure
parameters that apply to the
entire wireless device.
command.
Interface
configuration
While in global
configuration mode,
enter the interface
command (with a
specific interface).
ap(config-if)
#
To exit to global
configuration mode, enter
exit. To return to
privileged EXEC mode,
press Ctrl-Z or enter end.
Use this mode to configure
parameters for the Ethernet and
radio interfaces.
The 2.4-GHz radio and the
802.11n 2.4-GHz radio is radio
0,
The 5-GHz radio and the
802.11n 5-GHz radio is radio 1.
3-2
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 3 Using the Command-Line Interface
Getting Help
You can enter a question mark (?) at the system prompt to display a list of commands available for each
command mode. You can also obtain a list of associated keywords and arguments for any command, as
shown in Table 3-2 .
Table 3-2Help Summary
CommandPurpose
helpObtains a brief description of the help system in any command mode.
abbreviated-command-entry?Obtains a list of commands that begin with a particular character string.
For example:
ap# di?
dir disable disconnect
abbreviated-command-entry<Tab >Completes a partial command name.
For example:
ap# sh conf<tab>
ap# show configuration
?Lists all commands available for a particular command mode.
For example:
ap> ?
command ?Lists the associated keywords for a command.
Getting Help
For example:
ap> show ?
command keyword?Lists the associated arguments for a keyword.
For example:
ap(config)# cdp holdtime ?
<10-255> Length of time (in sec) that receiver must keep this packet
Abbreviating Commands
You have to enter only enough characters for the wireless device to recognize the command as unique.
This example shows how to enter the show configuration privileged EXEC command:
ap# show conf
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
3-3
Chapter 3 Using the Command-Line Interface
Using the no and Default Forms of Commands
Using the no and Default Forms of Commands
Most configuration commands also have a no form. In general, use the no form to disable a feature or
function or reverse the action of a command. For example, the no shutdown interface configuration
command reverses the shutdown of an interface. Use the command without the keyword no to re-enable
a disabled feature or to enable a feature that is disabled by default.
Configuration commands can also have a default form. The default form of a command returns the
command setting to its default. Most commands are disabled by default, so the default form is the same
as the no form. However, some commands are enabled by default and have variables set to certain default
values. In these cases, the default command enables the command and sets variables to their default
values.
Understanding CLI Messages
Table 3-3 lists some error messages that you might encounter while using the CLI to configure the
wireless device.
Table 3-3Common CLI Error Messages
Error MessageMeaningHow to Get Help
% Ambiguous command:
"show con"
% Incomplete command.
% Invalid input detected
at ‘^’ marker.
You did not enter enough characters
for the wireless device to recognize
the command.
You did not enter all the keywords or
values required by this command.
You entered the command
incorrectly. The caret (^) marks the
point of the error.
Re-enter the command followed by a question mark (?)
with a space between the command and the question
mark.
The possible keywords that you can enter with the
command are displayed.
Re-enter the command followed by a question mark (?)
with a space between the command and the question
mark.
The possible keywords that you can enter with the
command are displayed.
Enter a question mark (?) to display all the commands
that are available in this command mode.
The possible keywords that you can enter with the
command are displayed.
Using Command History
The CLI provides a history or record of commands that you have entered. This feature is particularly
useful for recalling long or complex commands or entries, including access lists. You can customize the
command history feature to suit your needs as described in these sections:
• Changing the Command History Buffer Size, page 3-5
• Recalling Commands, page 3-5
3-4
• Disabling the Command History Feature, page 3-5
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 3 Using the Command-Line Interface
Changing the Command History Buffer Size
By default, the wireless device records ten command lines in its history buffer. Beginning in privileged
EXEC mode, enter this command to change the number of command lines that the wireless device
records during the current terminal session:
ap# terminal history [sizenumber-of-lines]
The range is from 0 to 256.
Beginning in line configuration mode, enter this command to configure the number of command lines
the wireless device records for all sessions on a particular line:
ap(config-line)# history[sizenumber-of-lines]
The range is from 0 to 256.
Recalling Commands
To recall commands from the history buffer, perform one of the actions listed in Tab l e 3-4.
Using Command History
Table 3-4Recalling Commands
1
Action
Press Ctrl-P or the up arrow key.Recall commands in the history buffer, beginning with the most recent command.
Press Ctrl-N or the down arrow key.Return to more recent commands in the history buffer after recalling commands
show historyWhile in privileged EXEC mode, list the last several commands that you just
1. The arrow keys function only on ANSI-compatible terminals such as VT100s.
Result
Repeat the key sequence to recall successively older commands.
with Ctrl-P or the up arrow key. Repeat the key sequence to recall successively
more recent commands.
entered. The number of commands that are displayed is determined by the setting
of the terminal history global configuration command and history line
configuration command.
Disabling the Command History Feature
The command history feature is automatically enabled.
To disable the feature during the current terminal session, enter the terminal no history privileged
EXEC command.
To disable command history for the line, enter the no history line configuration command.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
3-5
Using Editing Features
Using Editing Features
This section describes the editing features that can help you manipulate the command line. It contains
these sections:
• Enabling and Disabling Editing Features, page 3-6
• Editing Commands Through Keystrokes, page 3-6
• Editing Command Lines that Wrap, page 3-7
Enabling and Disabling Editing Features
Although enhanced editing mode is automatically enabled, you can disable it.
To re-enable the enhanced editing mode for the current terminal session, enter this command in
privileged EXEC mode:
ap# terminal editing
To reconfigure a specific line to have enhanced editing mode, enter this command in line configuration
mode:
ap(config-line)# editing
Chapter 3 Using the Command-Line Interface
To globally disable enhanced editing mode, enter this command in line configuration mode:
ap(config-line)# no editing
Editing Commands Through Keystrokes
Table 3-5 shows the keystrokes that you need to edit command lines.
Table 3-5Editing Commands Through Keystrokes
CapabilityKeystroke
Move around the command line to
make changes or corrections.
Recall commands from the buffer and
paste them in the command line. The
wireless device provides a buffer
with the last ten items that you
deleted.
Ctrl-B or the left arrow
key
Ctrl-F or the right arrow
key
Ctrl-AMove the cursor to the beginning of the command line.
Ctrl-EMove the cursor to the end of the command line.
Esc BMove the cursor back one word.
Esc FMove the cursor forward one word.
Ctrl-TTranspose the character to the left of the cursor with the
Ctrl-YRecall the most recent entry in the buffer.
Esc YRecall the next buffer entry.
1
Purpose
Move the cursor back one character.
Move the cursor forward one character.
character located at the cursor.
The buffer contains only the last 10 items that you have
deleted or cut. If you press Esc Y more than ten times, you
cycle to the first buffer entry.
3-6
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 3 Using the Command-Line Interface
Table 3-5Editing Commands Through Keystrokes (continued)
Using Editing Features
CapabilityKeystroke
Delete entries if you make a mistake
or change your mind.
Delete or BackspaceErase the character to the left of the cursor.
Ctrl-DDelete the character at the cursor.
1
Ctrl-KDelete all characters from the cursor to the end of the
Ctrl-U or Ctrl-XDelete all characters from the cursor to the beginning of
Ctrl-WDelete the word to the left of the cursor.
Esc DDelete from the cursor to the end of the word.
Capitalize or lowercase words or
capitalize a set of letters.
Esc CCapitalize at the cursor.
Esc LChange the word at the cursor to lowercase.
Esc UCapitalize letters from the cursor to the end of the word.
Designate a particular keystroke as
Ctrl-V or Esc Q
an executable command, perhaps as a
shortcut.
Scroll down a line or screen on
displays that are longer than the
terminal screen can display.
NoteThe More prompt appears for
ReturnScroll down one line.
SpaceScroll down one screen.
output that has more lines
than can be displayed on the
terminal screen, including
show command output. You
can use the Return and
Space bar keystrokes
whenever you see the
More
prompt.
Redisplay the current command line
Ctrl-L or Ctrl-RRedisplay the current command line.
if the wireless device suddenly sends
a message to your screen.
1. The arrow keys function only on ANSI-compatible terminals such as VT100s.
Purpose
command line.
the command line.
Editing Command Lines that Wrap
You can use a wraparound feature for commands that extend beyond a single line on the screen. When
the cursor reaches the right margin, the command line shifts ten spaces to the left. You cannot see the
first ten characters of the line, but you can scroll back and check the syntax at the beginning of the
command.
To scroll back to the beginning of the command entry, press Ctrl-B or the left arrow key repeatedly. You
can also press Ctrl-A to immediately move to the beginning of the line.
NoteThe arrow keys function only on ANSI-compatible terminals such as VT100s.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
3-7
Searching and Filtering Output of show and more Commands
In this example, the access-list global configuration command entry extends beyond one line. When the
cursor first reaches the end of the line, the line is shifted ten spaces to the left and redisplayed. The dollar
sign ($) shows that the line has been scrolled to the left. Each time the cursor reaches the end of the line,
the line is again shifted ten spaces to the left.
After you complete the entry, press Ctrl-A to check the complete syntax before pressing the Return key
to execute the command. The dollar sign ($) appears at the end of the line to show that the line has been
scrolled to the right:
The software assumes you have a terminal screen that is 80 columns wide. If you have a width other than
that, use the terminal width privileged EXEC command to set the width of your terminal.
Use line wrapping with the command history feature to recall and modify previous complex command
entries. For information about recalling previous command entries, see the “Editing Commands Through
Keystrokes” section on page 3-6.
Chapter 3 Using the Command-Line Interface
Searching and Filtering Output of show and more Commands
You can search and filter the output for show and more commands. This is useful when you need to sort
through large amounts of output or if you want to exclude output that you do not need to see.
To use this functionality, enter a show or more command followed by the pipe character (|), one of the
keywords begin, include, or exclude, and an expression that you want to search for or filter out:
command| {begin | include | exclude} regular-expression
Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output
are not displayed, but the lines that contain Output are displayed.
This example shows how to include in the output display only lines where the expression protocol
appears:
ap# show interfaces | include protocol
Vlan1 is up, line protocol is up
Vlan10 is up, line protocol is down
GigabitEthernet0/1 is up, line protocol is down
GigabitEthernet0/2 is up, line protocol is up
3-8
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 3 Using the Command-Line Interface
Accessing the CLI
You can open the wireless device CLI using Telnet or Secure Shell (SSH).
Opening the CLI with Telnet
Follow these steps to open the CLI with Telnet. These steps are for a PC running Microsoft Windows
with a Telnet terminal application. Check your PC operating instructions for detailed instructions for
your operating system.
If Telnet is not listed in your Accessories menu, select Start > Run, type Tel ne t in the entry field, and
press Enter.
Step 2In the Telnet window, type open followed by the wireless device IP address, and press Enter.
Step 3At the username and password prompts, enter your administrator username and password. The default
username is Cisco, and the default password is Cisco. The default enable password is also Cisco.
Usernames and passwords are case-sensitive.
Accessing the CLI
Opening the CLI with Secure Shell
Secure Shell Protocol is a protocol that provides a secure, remote connection to networking devices set
up to use it. Secure Shell (SSH) is a software package that provides secure login sessions by encrypting
the entire session. SSH features strong cryptographic authentication, strong encryption, and integrity
protection. For detailed information on SSH, visit the homepage of SSH Communications Security, Ltd.
at this URL: http://www.ssh.com/
SSH provides more security for remote connections than Telnet by providing strong encryption when a
device is authenticated. SSH versions 1 and 2 are supported in this release. See the “Configuring the
Access Point for Secure Shell” section on page 5-27 for detailed instructions on setting up the wireless
device for SSH access.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
3-9
Accessing the CLI
Chapter 3 Using the Command-Line Interface
3-10
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
CHA P T ER
4
Configuring the Access Point for the First Time
This chapter describes how to configure basic settings on the wireless device for the first time. The
contents of this chapter are similar to the instructions in the quick start guide that shipped with the
wireless device. You can configure all the settings described in this chapter using the CLI, but it might
be simplest to browse to the wireless device web-browser interface to complete the initial configuration
and then use the CLI to enter additional settings for a more detailed configuration.
This chapter contains the following sections:
• Before You Start, page 4-1
• Logging into the Access Point, page 4-3
• Obtaining and Assigning an IP Address, page 4-4
• Connecting to the 1040, 1140, 1240, 1250, 1260, and 2600 Series Access Points Locally, page 4-5
• Connecting to the 1550 Series Access Point Locally, page 4-5
• Default Radio Settings, page 4-6
• Assigning Basic Settings, page 4-6
• CLI Configuration Examples, page 4-15
• Configuring System Power Settings Access Points, page 4-21
• Assigning an IP Address Using the CLI, page 4-25
• Assigning an IP Address Using the CLI, page 4-25
• Using a Telnet Session to Access the CLI, page 4-25
• Configuring the 802.1X Supplicant, page 4-26
• Configuring IPv6, page 4-28
• Automatic Configuring of the Access Point, page 4-34
NoteIn this release, the access point radio interfaces are disabled by default.
Before You Start
Before you install the wireless device, make sure you are using a computer connected to the same
network as the wireless device, and obtain the following information from your network administrator:
• A system name for the wireless device
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-1
Before You Start
• The case-sensitive wireless service set identifier (SSID) for your radio network
• If not connected to a DHCP server, a unique IP address for the wireless device (such as
172.17.255.115)
• If the wireless device is not on the same subnet as your PC, a default gateway address and subnet
mask
• A Simple Network Management Protocol (SNMP) community name and the SNMP file attribute (if
SNMP is in use)
• If you use IPSU to find the wireless device IP address, the access point MAC address. The MAC
address can be found on the label on the bottom of the access point (such as 00164625854c).
Resetting the Device to Default Settings
If you need to start over during the initial setup process, you can reset the access point to factory default
settings.
Resetting to Default Settings Using the MODE Button
Chapter 4 Configuring the Access Point for the First Time
NoteUsing the MODE button for resetting to default settings applies only to autonomous mode access points
and not to lightweight mode access points.
Follow these steps to reset the access point to factory default settings using the access point MODE
button:
Step 1Disconnect power (the power jack for external power or the Ethernet cable for in-line power) from the
access point.
Step 2Press and hold the MODE button while you reconnect power to the access point.
Step 3Hold the MODE button until the Status LED turns amber (approximately 1 to 2 seconds), and release the
button. All access point settings return to factory defaults.
Resetting to Default Settings Using the GUI
Follow these steps to return to the default settings using the access point GUI:
Step 1Open your Internet browser.
The wireless device web-browser interface is fully compatible with Microsoft Internet Explorer version
9.0 and Mozilla Firefox version 17.
Step 2Enter the wireless device IP address in the browser address line and press Enter. An Enter Network
Password window appears.
Step 3Enter your username in the User Name field. The default username is Cisco.
4-2
Step 4Enter the wireless device password in the Password field and press Enter. The default password is Cisco.
The Summary Status page appears.
Step 5Click Software and the System Software screen appears.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Step 6Click System Configuration and the System Configuration screen appears.
Step 7Click the Reset toDefaults button to reset all settings, including the IP address, to factory defaults. To
reset all settings except the IP address to defaults, click the Reset to Defaults (Except IP) button.
Resetting to Default Settings Using the CLI
CautionYou should never delete any of the system files prior to resetting defaults or reloading software.
If you want to reset the access point to its default settings and a static IP address, use the write erase or
erase /all nvram command. If you want to erase everything including the static IP address, in addition
to the above commands, use the erase and erase boot static-ipaddr static-ipmask command.
From the privileged EXEC mode, you can reset the access point/bridge configuration to factory default
values using the CLI by following these steps:
Step 1Enter erase nvram: to erase all NVRAM files including the startup configuration.
Logging into the Access Point
NoteThe erase nvram command does not erase a static IP address.
Step 2Follow the step below to erase a static IP address and subnet mask. Otherwise, go to step 3.
a. Enter write default-config.
Step 3Enter Y when the following CLI message displays: Erasing the nvram filesystem will remove all
configuration files! Continue? [confirm].
Step 4Enter reload when the following CLI message displays: Erase of nvram: complete. This command
reloads the operating system.
Step 5Enter Y when the following CLI message displays: Proceed with reload? [confirm].
CautionDo not interrupt the boot process to avoid damaging the configuration file. Wait until the access
point/bridge Install Mode LED begins to blink green before continuing with CLI configuration changes.
You can also see the following CLI message when the load process has finished: Line protocal on Interface Dot11Radio0, changed state to up.
Step 6After the access point/bridge reboots, you can reconfigure the access point by using the Web-browser
interface if you previously assigned a static IP address, or the CLI if you did not.
The access point is configured with the factory default values including the IP address (set to receive an
IP address using DHCP), from privileged EXEC mode. To obtain the new IP address for an access
point/bridge, you can use the show interface bvi1 CLI command.
Logging into the Access Point
A user can login to the access point using one of the following methods:
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
4-3
Obtaining and Assigning an IP Address
• graphical user interface (GUI)
• Telnet (if the AP is configured with an IP address)
• console port
NoteNot all models of Cisco Aironet Access Points have the console port. If the access point does not have
a console port, use either the GUI or the Telnet for access.
For information on logging into the AP through the GUI, refer to Using the Web-Browser Interface for
the First Time, page 2-2.
For information on logging into the AP through the CLI refer to Accessing the CLI, page 3-9.
For information on logging into the AP through a console port refer to Connecting to the 1040, 1140,
1240, 1250, 1260, and 2600 Series Access Points Locally, page 4-5.
Obtaining and Assigning an IP Address
Chapter 4 Configuring the Access Point for the First Time
To browse to the wireless device Express Setup page, you must either obtain or assign the wireless device
IP address using one of the following methods:
• If you have a 1040, 1130AG, 1240, 1250, 1260 series access point or a 1300 series access
point/bridge, connect to the access point console port and assign a static IP address. Follow the steps
in the appropriate section to connect to the device console port:
–
Connecting to the 1040, 1140, 1240, 1250, 1260, and 2600 Series Access Points Locally,
page 4-5.
–
Connecting to the 1550 Series Access Point Locally, page 4-5
NoteIn some terminal emulator applications you may need to set the Flow control parameter to
Xon/Xoff. If you are not able to console into the device with the flow control value set to none,
try changing the flow control value to Xon/Xoff.
• Use a DHCP server (if available) to automatically assign an IP address. You can find out the
DHCP-assigned IP address using one of the following methods:
–
Connect to the wireless device console port and use the show ip interface brief command to
display the IP address.
Follow the steps in the “Connecting to the 1040, 1140, 1240, 1250, 1260, and 2600 Series
Access Points Locally” section on page 4-5 to connect to the console port.
–
Provide your network administrator with the wireless device Media Access Control (MAC)
address. Your network administrator will query the DHCP server using the MAC address to
identify the IP address. The access point MAC address is on label attached to the bottom of the
access point.
4-4
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Connecting to the 1040, 1140, 1240, 1250, 1260, and 2600 Series Access Points Locally
Default IP Address Behavior
When you connect a 1040, 1130AG, 1140, 1240, 1250, 1260, 2600 access point, or 1300 series access
point/bridge with a default configuration to your LAN, the access point requests an IP address from your
DHCP server and, if it does not receive an address, continues to send requests indefinitely.
The 1300 series access point/bridge assumes a radio network role of a root access point. To configure it
as a bridge, you must manually place it in install mode in order to align the antennas and establish a link.
To establish the link you must have two access point/bridges configured in the install mode. In the install
mode, one access point/bridge must be configured as a root bridge and the other a non-root bridge. To
facilitate the configuration, an automatic option is available when the access point/bridge is in the install
mode. After the wireless link is established and the bridge antennas are aligned, you take both access
point/bridges out of install mode and place them on your LAN as root and non-root bridges.
Connecting to the 1040, 1140, 1240, 1250, 1260, and 2600 Series
Access Points Locally
If you need to configure the access point locally (without connecting the access point to a wired LAN),
you can connect a PC to its console port using a DB-9 to RJ-45 serial cable. Follow these steps to open
the CLI by connecting to the access point console port:
Step 1Connect a nine-pin, female DB-9 to RJ-45 serial cable to the RJ-45 serial port on the access point and
to the COM port on a computer. The Cisco part number for the DB-9 to RJ-45 serial cable is
AIR-CONCAB1200. Browse to http://www.cisco.com/go/marketplace to order a serial cable.
Step 2Set up a terminal emulator to communicate with the access point. Use the following settings for the
terminal emulator connection: 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control.
NoteIf xon/xoff flow control does not work, use no flow control.
Step 3When connected, press enter or type en to access the command prompt. Pressing enter takes you to the
user exec mode. Entering en prompts you for a password, then takes you to the privileged exec mode.
The default password is Cisco and is case-sensitive.
NoteWhen your configuration changes are completed, you must remove the serial cable from the
access point.
Connecting to the 1550 Series Access Point Locally
If you need to configure the access point locally (without connecting to a wired LAN), you can connect
a PC to the Ethernet port on the long-reach power injector using a Category 5 Ethernet cable. You can
use a local connection to the power injector Ethernet port the same as you would use a serial port
connection.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
4-5
Default Radio Settings
NoteYou do not need a special crossover cable to connect your PC to the power injector; you can use either
Step 1Make sure that the PC you intend to use is configured to obtain an IP address automatically, or manually
Step 2With the power cable disconnected from the power injector, connect your PC to the power injector using
Step 3Connect the power injector to the access point/bridge using dual coaxial cables.
Step 4Connect the power injector power cable and power on the access point/bridge.
Step 5Follow the steps in the “Assigning Basic Settings” section on page 4-6. If you make a mistake and need
Step 6After configuring the access point/bridge, remove the Ethernet cable from your PC and connect the
Chapter 4 Configuring the Access Point for the First Time
a straight-through cable or a crossover cable.
Follow these steps to connect to the bridge locally:
assign it an IP address within the same subnet as the access point/bridge IP address. For example, if you
assigned the access point/bridge an IP address of 10.0.0.1, assign the PC an IP address of 10.0.0.20.
a Category 5 Ethernet cable. You can use either a crossover cable or a straight-through cable.
NoteCommunication takes place between the power injector and the access point/bridge using
Ethernet Port 0. Do not attempt to change any of the Ethernet Port 0 settings.
to start over, follow the steps in the “Resetting the Device to Default Settings” procedure on page 4-2.
power injector to your wired LAN.
NoteWhen you connect your PC to the access point/bridge or reconnect your PC to the wired LAN,
you might need to release and renew the IP address on the PC. On most PCs, you can perform a
release and renew by rebooting your PC or by entering ipconfig /release and ipconfig /renew
commands in a command prompt window. Consult your PC operating instructions for detailed
instructions.
Default Radio Settings
Beginning with Cisco IOS Release 12.3(8)JA, access point radios are disabled and no default SSID is
assigned. This was done in order to prevent unauthorized users to access a customer wireless network
through an access point having a default SSID and no security settings. You must create an SSID before
you can enable the access point radio interfaces.
Assigning Basic Settings
After you determine or assign the wireless device IP address, you can browse to the wireless device
Express Setup page and perform an initial configuration:
4-6
Step 1Open your Internet browser.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Step 2Enter the wireless device IP address in the browser address line and press Enter.
An Enter Network Password screen appears.
Step 3Press Ta b to bypass the Username field and advance to the Password field.
Step 4Enter the case-sensitive password Cisco and press Enter.
The Summary Status page appears.
Step 5Click Easy Setup.
The Express Setup screen appears.
Step 6Click Network Configuration.
Step 7Enter the Network Configuration settings which you obtained from your system administrator.
The configurable settings include:
• Host Name—The host name, while not an essential setting, helps identify the wireless device on
your network. The host name appears in the titles of the management system pages.
NoteYou can enter up to 32 characters for the system name. However, when the wireless device
identifies itself to client devices, it uses only the first 15 characters in the system name. If it
is important for client users to distinguish between wireless devices, make sure that a unique
portion of the system name appears in the first 15 characters.
Assigning Basic Settings
NoteWhen you change the system name, the wireless device resets the radios, causing associated
client devices to disassociate and quickly reassociate.
• Server Protocol—Click the radio button that matches the network method of IP address assignment.
–
DHCP—IP addresses are automatically assigned by your network DHCP server.
–
Static IP—The wireless device uses a static IP address that you enter in the IP address field.
• IP Address—Use this setting to assign or change the wireless device IP address. If DHCP is enabled
for your network, leave this field blank.
NoteIf the wireless device IP address changes while you are configuring the wireless device using the
web-browser interface or a Telnet session over the wired LAN, you lose your connection to the
wireless device. If you lose your connection, reconnect to the wireless device using its new IP
address. Follow the steps in the “Resetting the Device to Default Settings” section on page 4-2
if you need to start over.
• IP Subnet Mask—Enter the IP subnet mask provided by your network administrator so the IP
address can be recognized on the LAN. If DHCP is enabled, leave this field blank.
• Default Gateway—Enter the default gateway IP address provided by your network administrator.
If DHCP is enabled, leave this field blank.
• IPv6 ProtocolP—Specify the protcols to be applied, by selecting the required check boxes. You can
select:
–
DHCP
OL-30644-01
–
Autoconfig
–
Static IP
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-7
Assigning Basic Settings
Step 8Enter the following Radio Configuration settings for the radio bands supported by the access point.
Chapter 4 Configuring the Access Point for the First Time
• IPv6 Address—Enter the IPv6 address
• Username—Enter the username required to access the network.
• Password—Enter the password corresponding to the username required to access the network.
• SNMP Community—If your network is using SNMP, enter the SNMP Community name provided
by your network administrator and select the attributes of the SNMP data (also provided by your
network administrator).
• Current SSID List (Read Only)
Both the 2.4 GHz and 5 GHz radios have the following options:
• SSID—Type the SSID in the SSID entry field. The SSID can contain up to 32 alphanumeric
characters.
–
Broadcast SSID in Beacon—To allow devices without a specified SSID to associate with the
access point, select this check box. If this check box is selected, the access point will respond
to Broadcast SSID probe requests and also broadcast its own SSID with its Beacons.
When you broadcast the SSID, devices that do not specify an SSID can associate to the wireless
device. This is a useful option for an SSID used by guests or by client devices in a public space.
If you do not broadcast the SSID, client devices cannot associate to the wireless device unless
their SSID matches this SSID. Only one SSID can be included in the wireless device beacon.
• VLAN—To enableVLAN for the radio, click the Enable VLAN ID radio button and then enter a
VLAN identifier ranging from 1- 4095. To specify this as the native VLAN, check the Native VLAN
check box. To disable VLAN, click the No VLAN radio button.
• Security—Select the security setting for the SSID. The settings are listed in order of robustness,
from No Security to WPA, which is the most secure setting. If you select EAP Authentication or
WPA, enter the IP address (the RADIUS Server IP address) and shared secret (RADIUS Server
Secret) for the authentication server on your network.
NoteIf you do not use VLANs on your wireless LAN, the security options that you can assign to
multiple SSIDs are limited. See the “Using VLANs” section on page 4-12 for details.
–
No Security—This security setting does not use an encryption key or key management, and
uses open authentication.
–
WEP Key—This security setting uses mandatory WEP encryption, no key management and
open authentication. You can specify up to four WEP keys, i.e. Key 1, 2, 3, and 4. Enter each
key value, and specify whether it is 128 bit or 40 bit.
–
EAP Authentication—The Extensible Authentication Protocols (EAP) Authentication permits
wireless access to users authenticated against a database through the services of an
authentication server then encrypts the authenticated and authorized traffic. Use this setting for
LEAP, PEAP, EAP-TLS, EAP-TTLS, EAP-GTC, EAP-SIM, and other 802.1x/EAP based
protocols. This setting uses mandatory encryption WEP, open authentication + EAP, network
EAP authentication, no key management, RADIUS server authentication port 1645. Specify the
RADIUS Server and the RADIUS Server Secret.
–
WPA—The Wi-Fi Protected Access (WPA) security setting permits wireless access to users
authenticated against a database through the services of an authentication server, then encrypts
their authenticated and authorized IP traffic with stronger algorithms than those used in WEP.
Make sure clients are WPA certified before selecting this option. This setting uses encryption
4-8
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
ciphers tkip, open authentication + EAP, network EAP authentication, key management WPA
mandatory, and RADIUS server authentication port 1645. Specify the RADIUS Server and the
RADIUS Server Secret.
NoteTo better understand the security settings used here, see “Understanding the Security Settings”
section on page 4-11.
• Role in Radio Network—Click the button that describes the role of the wireless device on your
network. Select Access Point (Root) if the wireless device is connected to the wired LAN. Select
Repeater (Non-Root) if it is not connected to the wired LAN. The only role supported on the
Airlink is root. For information on the roles supported by different APs in a radio network, see
Configuring the Role in Radio Network, page 6-3. The following roles are available in a radio
network:
–
Access Point—A root device. Accepts associations from clients and bridges wireless traffic
from the clients to the wireless LAN. This setting can be applied to any access point.
–
Repeater—A non-root device. Accepts associations from clients and bridges wireless traffic
from the clients to root access point connected to the wireless LAN. This setting can be applied
to any access point.
Assigning Basic Settings
–
Root Bridge—Establishes a link with a non-root bridge. In this mode, the device also accepts
associations from clients.
–
Non-Root Bridge—In this mode, the device establishes a link with a root bridge.
–
Install Mode—Places the 1300 series access point/bridge in auto installation mode so you can
align and adjust a bridge link for optimum efficiency.
–
Workgroup Bridge—In the Workgroup bridge mode, the access point functions as a client
device that associates with a Cisco Aironet access point or bridge. A workgroup bridge can have
a maximum of 254 clients, presuming that no other wireless clients are associated to the root
bridge or access point.
–
Universal Workgroup Bridge—Configures the access point as a workgroup bridge capable of
associating with non-Cisco access points.
–
Client MAC:—The Ethernet MAC address of the client connected to the universal workgroup
bridge. This field appears only in the universal workgroup bridge mode.
–
Scanner—Functions as a network monitoring device. In the Scanner mode, the access point
does not accept associations from clients. It continuously scans and reports wireless traffic it
detects from other wireless devices on the wireless LAN. All access points can be configured
as a scanner.
• Optimize Radio Network for—Use this setting to select either preconfigured settings for the
wireless device radio or customized settings for the wireless device radio.
–
Throughput—Maximizes the data volume handled by the wireless device, but might reduce its
range.
–
Range—Maximizes the wireless device range but might reduce throughput.
–
Default—Sets the default values for the access point.
OL-30644-01
–
Custom—The wireless device uses the settings you enter on the Network Interfaces. Clicking
Custom takes you to the Network Interfaces.
• Aironet Extensions—Enable this setting if there are only Cisco Aironet wireless devices on your
wireless LAN.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-9
Assigning Basic Settings
Step 9Click Apply to save your settings.
Step 10Click Network Interfaces to browse to the Network Interfaces Summary page.
Step 11Click the radio interface to browse to the Network Interfaces: Radio Status page.
Step 12Click the Settings tab to browse to the Settings page for the radio interface.
Step 13Click Enable to enable the radio.
Chapter 4 Configuring the Access Point for the First Time
• Channel—The default channel setting for the wireless device radios is least congested; at startup,
the wireless device scans for and selects the least-congested channel. For the most consistent
performance after a site survey, however, we recommend that you assign a static channel setting for
each access point.
–
For the 2.4 GHz radio, the relevant options are Least-Congested, channel 1-2412, channel
2-2417, channel 3-2422, channel 4-2427, channel 5-2432, channel 6-2437, channel 7-2442,
channel 8-2447, channel 9-2452, channel 10-2457, and channel 11-2462.
–
For the 5 GHz radio, the relevant options are Dynamic Frequency selection, channel 36-5180,
channel 40-5200, channel 44-5220, channel 48-5240, channel 149-5745, channel 153-5765,
channel 157-5785, channel 161-5805, and channel 165-5825.
• Power—Choose the power level from the Power drop-down list.
–
For the 2.4 GHz radio, the relevant options are Maximum, 22, 19, 16, 13, 10, 7, and 4.
–
For the 5 GHz radio, the relevant options are Maximum, 14, 11, 8, 5, and 2.
Step 14Click Apply.
Your wireless device is now running but probably requires additional configuring to conform to your
network operational and security requirements. Consult the chapters in this manual for the information
you need to complete the configuration.
NoteYou can restore access points to factory defaults by unplugging the power jack and plugging it
back in while holding down the Mode button for a few seconds, or until the Status LED turns
amber.
Default Settings on the Easy Setup Page
Table 4-1 lists the default settings for the settings on the Express Setup page.
Table 4-1Default Settings on the Express Setup Page
SettingDefault
Host Nameap
Configuration Server ProtocolDHCP
IP AddressAssigned by DHCP by default; see the “Default IP Address
Behavior” section on page 4-5 for a description of default IP
address behavior on the access point
IP Subnet MaskAssigned by DHCP by default; if DHCP is disabled, the default
setting is 255.255.255.224
4-10
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Table 4-1Default Settings on the Express Setup Page (continued)
SettingDefault
Default GatewayAssigned by DHCP by default; if DHCP is disabled, the default
IPv6 ProtocolDHCP and Autoconfig
SNMP CommunitydefaultCommunity (Read-only)
VLANNo VLAN
SecurityNo Security
Role in Radio Network (for each
radio installed)
Optimize Radio Network forDefault
Aironet ExtensionsEnable
ChannelLeast-Congested (for 2.4GHz) and Dynamic Frequency Selection
PowerMaximum
Assigning Basic Settings
setting is 0.0.0.0
Access point
(for 5GHz)
Understanding the Security Settings
You can configure basic security settings in the Easy Setup > Radio Configuration section. You can
use the options given in this section to create unique SSIDs and assign one of four security types to them.
You can create up to 16 SSIDs on the wireless device. The created SSIDs appear in the Current SSID List. On dual-radio wireless devices, the SSIDs that you create are enabled by default on both radio
interfaces.
NoteIn Cisco IOS Release 12.4(23c)JA and 12.xxx, there is no default SSID. You must configure an
SSID before client devices can associate to the access point.
The SSID can consist of up to 32 alphanumeric, case-sensitive, characters.
The first character can not contain the following characters:
• Exclamation point (!)
• Pound sign (#)
• Semicolon (;)
The following characters are invalid and cannot be used in an SSID:
• Plus sign (+)
• Right bracket (])
• Front slash (/)
• Quotation mark (")
• Tab
OL-30644-01
• Trailing spaces
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-11
Assigning Basic Settings
Using VLANs
If you use VLANs on your wireless LAN and assign SSIDs to VLANs, you can create multiple SSIDs
using any of the four security settings on the Express Security page. However, if you do not use VLANs
on your wireless LAN, the security options that you can assign to SSIDs are limited because on the
Express Security page encryption settings and authentication types are linked. Without VLANs,
encryption settings (WEP and ciphers) apply to an interface, such as the 2.4-GHz radio, and you cannot
use more than one encryption setting on an interface. For example, when you create an SSID with static
WEP with VLANs disabled, you cannot create additional SSIDs with WPA authentication because they
use different encryption settings. If you find that the security setting for an SSID conflicts with another
SSID, you can delete one or more SSIDs to eliminate the conflict.
Security Types for an SSID
Table 4-2 describes the four security types that you can assign to an SSID.
Table 4-2Security Types on Express Security Setup Page
Security TypeDescriptionSecurity Features Enabled
No SecurityThis is the least secure option. You
Static WEP KeyThis option is more secure than no
Chapter 4 Configuring the Access Point for the First Time
should use this option only for SSIDs
used in a public space and assign it to
a VLAN that restricts access to your
network.
security. However, static WEP keys
are vulnerable to attack. If you
configure this setting, you should
consider limiting association to the
wireless device based on MAC
address (see the Chapter 16, “Using
MAC Address ACLs to Block or
Allow Client Association to the
Access Point” or, if your network
does not have a RADIUS server,
consider using an access point as a
local authentication server (see
Chapter 9, “Configuring an Access
Point as a Local Authenticator”).
None.
Mandatory WEP. Client devices
cannot associate using this SSID
without a WEP key that matches the
wireless device key.
4-12
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Table 4-2Security Types on Express Security Setup Page (continued)
Security TypeDescriptionSecurity Features Enabled
EAP AuthenticationThis option enables 802.1X
authentication (such as LEAP, PEAP,
EAP-TLS, EAP-FAST, EAP-TTLS,
EAP-GTC, EAP-SIM, and other
802.1X/EAP based products)
This setting uses mandatory
encryption, WEP, open authentication
+ EAP, network EAP authentication,
no key management, RADIUS server
authentication port 1645.
You are required to enter the IP
address and shared secret for an
authentication server on your network
(server authentication port 1645).
Because 802.1X authentication
provides dynamic encryption keys,
you do not need to enter a WEP key.
Assigning Basic Settings
Mandatory 802.1X authentication.
Client devices that associate using this
SSID must perform 802.1X
authentication.
If radio clients are configured to
authenticate using EAP-FAST, open
authentication with EAP should also
be configured. If you do not configure
open authentication with EAP, the
following GUI warning message
appears:
WA R NI N G:
Network EAP is used for LEAP
authentication only. If radio clients
are configured to authenticate using
EAP-FAST, Open Authentication
with EAP should also be configured.
If you are using the CLI, this warning
message appears:
WPAWi-Fi Protected Access (WPA)
permits wireless access to users
authenticated against a database
through the services of an
authentication server, then encrypts
their IP traffic with stronger
algorithms than those used in WEP.
This setting uses encryption ciphers,
TKIP, open authentication + EAP,
network EAP authentication, key
management WPA mandatory, and
RADIUS server authentication port
1645.
As with EAP authentication, you
must enter the IP address and shared
secret for an authentication server on
your network (server authentication
port 1645).
SSID CONFIG WARNING: [SSID]:
If radio clients are using EAP-FAST,
AUTH OPEN with EAP should also
be configured.
Mandatory WPA authentication.
Client devices that associate using this
SSID must be WPA-capable.
If radio clients are configured to
authenticate using EAP-FAST, open
authentication with EAP should also
be configured. If you do not configure
open authentication with EAP, the
following GUI warning message
appears:
WA R NI N G:
Network EAP is used for LEAP
authentication only. If radio clients
are configured to authenticate using
EAP-FAST, Open Authentication
with EAP should also be configured.
If you are using the CLI, this warning
message appears:
SSID CONFIG WARNING: [SSID]:
If radio clients are using EAP-FAST,
AUTH OPEN with EAP should also
be configured.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-13
Assigning Basic Settings
Limitations of Security Settings
The security settings in the Easy Setup Radio Configuration section are designed for simple
configuration of basic security. The options available are a subset of the wireless device security
capabilities. Keep these limitations in mind when using the Express Security page:
• If the No VLAN option is selected, the static WEP key can be configured once. If you select Enable
VLAN, the static WEP key should be disabled.
• You cannot edit SSIDs. However, you can delete SSIDs and re-create them.
• You cannot configure multiple authentication servers. To configure multiple authentication servers,
use the Security Server Manager page.
• You cannot configure multiple WEP keys. To configure multiple WEP keys, use the Security
Encryption Manager page.
• You cannot assign an SSID to a VLAN that is already configured on the wireless device. To assign
an SSID to an existing VLAN, use the Security SSID Manager page.
• You cannot configure combinations of authentication types on the same SSID (for example, MAC
address authentication and EAP authentication). To configure combinations of authentication types,
use the Security SSID Manager page.
Chapter 4 Configuring the Access Point for the First Time
4-14
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
CLI Configuration Examples
The examples in this section show the CLI commands that are equivalent to creating SSIDs using each
security type. This section contains these example configurations:
• Example: No Security for Radio 2.4GHz, page 4-15
• Example: Static WEP for Radio 2.4 GHz, page 4-16
• Example: EAP Authentication, page 4-17
• Example: WPA2 for Radio 2.4GHz, page 4-19
Example: No Security for Radio 2.4GHz
This example shows a part of the resulting configuration when an SSID called no_security_ssid is
created, the SSID is included in the beacon, assigned to VLAN 10, and then VLAN 10 is selected as the
native VLAN:
!
dot11 ssid no_security_ssid
vlan 10
authentication open
guest-mode
!
interface Dot11Radio0
no ip address
no ip route-cache
shutdown
!
ssid no_security_ssid
!
antenna gain 0
station-role root
!
interface Dot11Radio0.10
encapsulation dot1Q 10 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
antenna gain 0
peakdetect
dfs band 3 block
channel dfs
station-role root
!
interface Dot11Radio1.10
encapsulation dot1Q 10 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
CLI Configuration Examples
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-15
CLI Configuration Examples
no bridge-group 1 unicast-flooding
!
Example: Static WEP for Radio 2.4 GHz
This example shows a part of the configuration that results from creating an SSID called
static_wep_ssid, excluding the SSID from the beacon, assigning the SSID to VLAN 20, selecting 3 as
the key slot, and entering a 128-bit key:
!
dot11 ssid static_wep_ssid
vlan 20
authentication open
!
!
!
encryption vlan 20 key 3 size 128bit 7 76031220D71D63394A6BD63DE57F transmit-key
encryption vlan 20 mode wep mandatory
!
ssid static_wep_ssid
!
!
interface Dot11Radio0.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
bridge-group 20 subscriber-loop-control
bridge-group 20 spanning-disabled
bridge-group 20 block-unknown-source
no bridge-group 20 source-learning
no bridge-group 20 unicast-flooding
!
interface Dot11Radio0.31
encapsulation dot1Q 31 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio1
no ip address
no ip route-cache
!
encryption vlan 20 key 3 size 128bit 7 E55F05382FE2064B7C377B164B73 transmit-key
encryption vlan 20 mode wep mandatory
!
ssid static_wep_ssid
!
!
interface Dot11Radio1.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
bridge-group 20 subscriber-loop-control
bridge-group 20 spanning-disabled
bridge-group 20 block-unknown-source
no bridge-group 20 source-learning
no bridge-group 20 unicast-flooding
!
interface Dot11Radio1.31
encapsulation dot1Q 31 native
Chapter 4 Configuring the Access Point for the First Time
4-16
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
!
interface GigabitEthernet0.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
bridge-group 20 spanning-disabled
no bridge-group 20 source-learning
!
interface GigabitEthernet0.31
encapsulation dot1Q 31 native
no ip route-cache
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
!
CLI Configuration Examples
Example: EAP Authentication
This example shows a part of the configuration that results from creating an SSID called eap_ssid,
excluding the SSID from the beacon, and assigning the SSID to VLAN 30:
NoteThe following warning message appears if your radio clients are using EAP-FAST and you do not
include open authentication with EAP as part of the configuration:
SSID CONFIG WARNING: [SSID]: If radio clients are using EAP-FAST, AUTH OPEN with EAP
should also be configured.
dot11 ssid eap_ssid
vlan 30
authentication open eap eap_methods
authentication network-eap eap_methods
!
dot11 guest
!
username apuser password 7 096F471A1A0A
!
bridge irb
!
interface Dot11Radio0
no ip address
no ip route-cache
shutdown
!
encryption vlan 30 mode wep mandatory
!
ssid eap_ssid
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-17
CLI Configuration Examples
!
antenna gain 0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.30
encapsulation dot1Q 30
no ip route-cache
bridge-group 30
bridge-group 30 subscriber-loop-control
bridge-group 30 spanning-disabled
bridge-group 30 block-unknown-source
no bridge-group 30 source-learning
no bridge-group 30 unicast-flooding
!
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
antenna gain 0
peakdetect
dfs band 3 block
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.30
encapsulation dot1Q 30
no ip route-cache
bridge-group 30
bridge-group 30 subscriber-loop-control
bridge-group 30 spanning-disabled
bridge-group 30 block-unknown-source
no bridge-group 30 source-learning
no bridge-group 30 unicast-flooding
!
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
!
interface GigabitEthernet0.30
encapsulation dot1Q 30
no ip route-cache
bridge-group 30
bridge-group 30 spanning-disabled
no bridge-group 30 source-learning
!
interface BVI1
ip address dhcp client-id GigabitEthernet0
no ip route-cache
ipv6 address dhcp
Chapter 4 Configuring the Access Point for the First Time
4-18
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
ipv6 address autoconfig
ipv6 enable
!
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
!
!
radius-server attribute 32 include-in-access-req format %h
radius-server vsa send accounting
!
radius server 10.10.11.100
address ipv4 10.10.11.100 auth-port 1645 acct-port 1646
key 7 00271A150754
!
bridge 1 route ip
Example: WPA2 for Radio 2.4GHz
This example shows a part of the configuration that results from creating an SSID called wpa_ssid,
excluding the SSID from the beacon, and assigning the SSID to VLAN 40:
CLI Configuration Examples
aaa new-model
!
aaa group server radius rad_eap
server name 10.10.11.100
!
aaa group server radius rad_mac
!
aaa group server radius rad_acct
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
!
aaa session-id common
!
dot11 ssid wpa_ssid
vlan 40
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa version 2
!
interface Dot11Radio0
no ip address
no ip route-cache
shutdown
!
encryption vlan 40 mode ciphers aes-ccm
!
ssid wpa_ssid
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-19
CLI Configuration Examples
!
antenna gain 0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.40
encapsulation dot1Q 40
no ip route-cache
bridge-group 40
bridge-group 40 subscriber-loop-control
bridge-group 40 spanning-disabled
bridge-group 40 block-unknown-source
no bridge-group 40 source-learning
no bridge-group 40 unicast-flooding
!
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
antenna gain 0
peakdetect
dfs band 3 block
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.40
encapsulation dot1Q 40
no ip route-cache
bridge-group 40
bridge-group 40 subscriber-loop-control
bridge-group 40 spanning-disabled
bridge-group 40 block-unknown-source
no bridge-group 40 source-learning
no bridge-group 40 unicast-flooding
!
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
!
interface GigabitEthernet0.40
encapsulation dot1Q 40
no ip route-cache
bridge-group 40
bridge-group 40 spanning-disabled
no bridge-group 40 source-learning
!
interface BVI1
ip address dhcp client-id GigabitEthernet0
no ip route-cache
ipv6 address dhcp
Chapter 4 Configuring the Access Point for the First Time
4-20
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Configuring System Power Settings Access Points
ipv6 address autoconfig
ipv6 enable
!
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
!
!
radius-server attribute 32 include-in-access-req format %h
radius-server vsa send accounting
!
radius server 10.10.11.100
address ipv4 10.10.11.100 auth-port 1645 acct-port 1646
key 7 01300F175804
!
Configuring System Power Settings Access Points
The AP 1040, AP 802, AP 1140, AP 1550, AP 1600, AP 2600, AP 3500, AP 3600 and AP 1260 disable
the radio interfaces when the unit senses that the power source to which it is connected does not provide
enough power. Depending on your power source, you might need to enter the power source type in the
access point configuration. Choose the Software > System Configuration page on the web-browser
interface, and then select a power option. Figure 4-1 shows the System Power Settings section of the
System Configuration page.
Figure 4-1Power Options on the System Software: System Configuration Page
Using the AC Power Adapter
If you use the AC power adapter to provide power access point, you do not need to adjust the access point
configuration.
Using a Switch Capable of IEEE 802.3af Power Negotiation
If you use a switch to provide Power over Ethernet (PoE) to the 1040, 1130, 1140, 1240, 1250, and 1260
access point, and the switch supports the IEEE 802.3af power negotiation standard, select Power Negotiation on the System Software: System Configuration page.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
4-21
Chapter 4 Configuring the Access Point for the First Time
Support for 802.11n Performance on 1250 Series Access Points with Standard 802.3af PoE
Using a Switch That Does Not Support IEEE 802.3af Power Negotiation
If you use a switch to provide Power over Ethernet (PoE) to the 1040, 1130, or 1140 access point, and
the switch does not support the IEEE 802.3af power negotiation standard, select Pre-Standard Compatibility on the System Software: System Configuration page.
Using a Power Injector
If you use a power injector to provide power to the 1040, 1130, 1140, 1240, 1250, or 1260 access point,
select Power Injector on the System Software: System Configuration page and enter the MAC address
of the switch port to which the access point is connected.
dot11 extension power native Command
When enabled, the dot11 extension power native shifts the power tables the radio uses from the IEEE
802.11 tables to the native power tables. The radio derives the values for this table from the
NativePowerTable and NativePowerSupportedTable of the CISCO-DOT11-1F-MIB. The Native Power
tables were designed specifically to configure powers as low as -1dBm for Cisco Aironet radios that
support these levels.
Support for 802.11n Performance on 1250 Series Access Points
with Standard 802.3af PoE
The Cisco Aironet 1250 Series access points requires 20W of power for optimum performance of
802.11n on both the 2.4- and 5-GHz bands. This allows you to configure one radio to operate using
802.3af. This allows full functionality under 802.3af on one radio while the other radio is disabled. Once
you upgrade to a powering solution that provides 20W of power to the access point, you can configure
the second radio so that both radios are fully functional with 2x3 multiple input multiple output (MIMO)
technology.
1250 Series Power Modes
The 1250 series access point can be powered by either inline power or by an optional AC/DC power
adapter. Certain radio configurations may require more power than can be provided by the inline power
source. When insufficient inline power is available, you can select several options (based upon your
access point radio configuration) as shown in Tabl e 4- 3 .
4-22
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Table 4-3Inline Power Options based on Access Point Radio Configuration
802.3af
Mode
(15.4W)
17
Disabled1714 (17 per Tx)
17
Disabled1720 (17 per Tx)1720 (17 per Tx)
Radio
BandData Rate
802.11b1N/A202020
802.11g1N/A171717
2.4 GHz
802.11n (MCS 0-7)1
802.11n (MCS 8-15) 2N/ADisabled14 (17 per Tx)20 (17 per Tx)
802.11a1N/A171717
5 GHz
802.11n (MCS 0-7)1
802.11n (MCS 8-15) 2N/ADisabled20 (17 per Tx)20 (17 per Tx)
Number
of Transmitters
2
2
Cyclic Shift
Diversity
(CSD)
Disabled
Enabled
(default)
Disabled
Enabled
(default)
Support for 802.11ac
Maximum Transmit Power (dBm)
Enhanced PoE
Power
Optimized
Mode (16.8 W)
Enhanced PoE
Mode
(20 W)
17
2
20 (17 per Tx)
1
1. Maximum transmit power will vary by channel and according to individual country regulations. Refer to the product
documentation for specific details.
2. Tx—Transmitter.
Support for 802.11ac
802.11ac is the next generation wireless standard of 802.11. It is designed to provide high throughput
and operate in the 5 GHz band. 802.11ac is supported on the 3700, 2700, and 1700 series access points.
The 802.11ac radio depends on the 802.11n radio to be fully functional. Shutting down the 802.11n radio
will affect the 802.11ac functionalities.
Channel Widths for 802.11ac
802.11n and 802.11ac radios operate in the same band. However the channel widths can be
independently configured with the restriction that it should be above the channel width configured on
802.11n. Please see Table 4-4 for more details on the supported channel width combinations.
The 3700, 2700, and 1700 802.11ac series access points can be powered by a Power-over-Ethernet (PoE)
sources, local power, or a power injector. If the AP is powered by PoE, based on the whether the source
is PoE+ (802.3at) or PoE (802.3af), the AP will adjust certain radio configurations as it may require more
power than provided by the inline power source.
For example, a 3700 series AP which is powered by PoE+ (802.3at) will provide 4x4:3 configuration on
both radios, and when powered by PoE (802.3af) it will provide a 3x3:3 configuration on both radios.
Please refer to the below table.
Chapter 4 Configuring the Access Point for the First Time
TipRadio configurations such as 4x4:3 imply 4 transmitters and 4 receivers capable of 3 spatial streams
NoteTo determine whether the AP is running at high PoE power or reduced (15.4W) power, in the AP's GUI,
got to the Home page. If the AP is running on reduced power, under Home:Summary Status, the
following warning is displayed:
Due to insufficient inline power. Upgrade inline power source or install power injector.
All access points except outdoor mesh products can be powered over Ethernet. Access points with two
radios powered over Ethernet are fully functional and support all the features. See Tab l e 4-5 for the
various power management options available.
Table 4-5Inline Power Options based on Power Sources
Power DrawDescriptionAP FunctionalityPoE
Budget
(Watts)
PoE +
802.3at
PoE
802.3af
PoE
802.3at
PoE
802.3af
1. This is the power required at the PSE, which is either a switch or an injector.
AP3700
Out of the box
AP3700
Out of the box
AP2700
Out of the Box
AP2700
Out of the Box
4x4:3 on 2.4/5 GHz16.1NoYesYes
3x3:3 on 2.4/5 GHz15.4YesN/AN/A
3x4:3 on 2.4/5 GHz and Auxillary
16.8NoNoYes
Ethernet Port Enabled
3x4:3 on 5 GHz and 2x2:2 on 2.4 GHz
15.4YesYesN/A
and Auxiliary Ethernet Port Enabled
802.3afE-PoE802.3at
1
PoE+
PWRINJ4
4-24
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
802.11n and 802.11ac use the power levels configured on 802.11n. You cannot configure power levels
independently for 802.11ac.
Assigning an IP Address Using the CLI
When you connect the wireless device to the wired LAN, the wireless device links to the network using
a bridge virtual interface (BVI) that it creates automatically. Instead of tracking separate IP addresses
for the wireless device Ethernet and radio ports, the network uses the BVI.
When you assign an IP address to the wireless device using the CLI, you must assign the address to the
BVI. Beginning in privileged EXEC mode, follow these steps to assign an IP address to the wireless
device BVI:
CommandPurpose
Step 1
Step 2
Step 3
configure terminalEnters global configuration mode.
interface bvi1Enters interface configuration mode for the BVI.
ip address address
mask
Assigns an IP address and address mask to the BVI.
NoteIf you are connected to the wireless device using a
Telnet session, you lose your connection to the wireless
device when you assign a new IP address to the BVI. If
you need to continue configuring the wireless device
using Telnet, use the new IP address to open another
Telnet session to the wireless device.
Assigning an IP Address Using the CLI
Using a Telnet Session to Access the CLI
Follow these steps to access the CLI by using a Telnet session. These steps are for a PC running
Microsoft Windows with a Telnet terminal application. Check your PC operating instructions for
detailed instructions for your operating system.
If Telnet is not listed in your Accessories menu, select Start > Run, type Tel ne t in the entry field, and
press Enter.
Step 2When the Telnet window appears, click Connect and select Remote System.
NoteIn Windows 2000, the Telnet window does not contain drop-down lists. To start the Telnet
session in Windows 2000, type open followed by the wireless device IP address.
Step 3In the Host Name field, type the wireless device IP address and click Connect.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-25
Configuring the 802.1X Supplicant
Configuring the 802.1X Supplicant
Traditionally, the dot1x authenticator/client relationship has always been a network device and a PC
client respectively, as it was the PC user that had to authenticate to gain access to the network. However,
wireless networks introduce unique challenges to the traditional authenticator/client relationship. First,
access points can be placed in public places, inviting the possibility that they could be unplugged and
their network connection used by an outsider. Second, when a repeater access point is incorporated into
a wireless network, the repeater access point must authenticate to the root access point in the same way
as a client does.
The supplicant is configured in two phases:
• Create and configure a credentials profile
• Apply the credentials to an interface or SSID
You can complete the phases in any order, but they must be completed before the supplicant becomes
operational.
Creating a Credentials Profile
Chapter 4 Configuring the Access Point for the First Time
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Beginning in privileged EXEC mode, follow these steps to create an 802.1X credentials profile:
CommandPurpose
configure terminalEnter global configuration mode.
dot1x credentials profileCreates a dot1x credentials profile and enters the dot1x
credentials configuration submode.
anonymous-id description(Optional)—Enter the anonymous identity to be used.
description description(Optional)—Enter a description for the credentials profile
username usernameEnter the authentication user id.
password {0 | 7 | LINE}Enter an unencrypted password for the credentials.
0—An unencrypted password will follow.
7—A hidden password will follow. Hidden passwords are used
when applying a previously saved configuration.
LINE—An unencrypted (clear text) password.
NoteUnencrypted and clear text are the same. You can enter a
0 followed by the clear text password, or omit the 0 and
enter the clear text password.
pki-trustpointpki-trustpoint(Optional and only used for EAP-TLS)—Enter the default
pki-trustpoint.
endReturn to the privileged EXEC mode.
copy running config
startup-config
(Optional) Save your entries in the configuration file.
4-26
Use the no form of the dot1x credentials command to negate a parameter.
The following example creates a credentials profile named test with the username Cisco and a the
unencrypted password Cisco:
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
ap1240AG>enable
Password:xxxxxxx
ap1240AG#config terminal
Enter configuration commands, one per line. End with CTRL-Z.
ap1240AG(config)# dot1x credentials test
ap1240AG(config-dot1x-creden)#username Cisco
ap1240AG(config-dot1x-creden)#password Cisco
ap1240AG(config-dot1x-creden)#exit
ap1240AG(config)#
Applying the Credentials to an Interface or SSID
Credential profiles are applied to an interface or an SSID in the same way.
Applying the Credentials Profile to the Wired Port
Beginning in the privileged EXEC mode, follow these steps to apply the credentials to the access point
wired port:
Configuring the 802.1X Supplicant
Step 1
Step 2
Step 3
Step 4
Step 5
CommandPurpose
configure terminalEnter global configuration mode.
interface gigabitethernet 0Enter the interface configuration mode for the access point
Gigabit Ethernet port.
NoteYou can also use interface fa0 to enter the Gigabit
Ethernet configuration mode.
dot1x credentials profile nameEnter the name of a previously created credentials profile.
endReturn to the privileged EXEC mode
copy running config
(Optional) Save your entries in the configuration file.
startup-config
The following example applies the credentials profile test to the access point gigabit Ethernet port:
ap1240AG>enable
Password:xxxxxxx
ap1240AG#config terminal
Enter configuration commands, one per line. End with CTRL-Z.
ap1240AG(config)#interface Gig0
ap1240AG(config-if)#dot1x credentials test
ap1240AG(config-if)#end
ap1240AG#
Applying the Credentials Profile to an SSID Used For the Uplink
If you have a repeater access point in your wireless network and are using the 802.1X supplicant on the
root access point, you must apply the 802.1X supplicant credentials to the SSID the repeater uses to
associate with and authenticate to the root access point.
Beginning in the privileged EXEC mode, follow these steps to apply the credentials to an SSID used for
the uplink:
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
4-27
Configuring IPv6
Step 1
Step 2
Step 3
Step 4
Step 5
Chapter 4 Configuring the Access Point for the First Time
CommandPurpose
configure terminalEnter global configuration mode.
dot11 ssid ssidEnter the 802.11 SSID. The SSID can consist of up to 32
alphanumeric characters. SSIDs are case sensitive.
NoteThe first character cannot contain the !, #, or; character.
+,], /, “, TAB, and trailing spaces are invalid characters for SSIDs.
dot1x credentials profileEnter the name of a preconfigured credentials profile.
endExits the dot1x credentials configuration submode
copy running config
startup-config
The following example applys the credentials profile test to the ssid testap1 on a repeater access point.
repeater-ap>enable
Password:xxxxxxx
repeater-ap#config terminal
Enter configuration commands, one per line. End with CTRL-Z.
repeater-ap(config-if)#dot11 ssid testap1
repeater-ap(config-ssid)#dot1x credentials test
repeater-ap(config-ssid)#end
repeater-ap(config)
(Optional) Save your entries in the configuration file.
Creating and Applying EAP Method Profiles
You can optionally configure an EAP method list to enable the supplicant to recognize a particular EAP
method. See the “Creating and Applying EAP Method Profiles for the 802.1X Supplicant” section on
page 11-17.
Configuring IPv6
IPv6 is the latest Internet protocol for IPv, developed to provide an extremely large number of addresses.
It uses 128 bit addresses instead of the 32 bit addresses that are used in IPv4.
As deployments in wireless networks use greater number of IP wireless devices and smart phones, IPv6
with its 128-bit address format can support 3.4 x 1038 address space.
IPv6 addresses are represented as a series of 16-bit hexadecimal fields separated by colons (:) in the
format: x:x:x:x:x:x:x:x.
There are three types of IPv6 address types:
• Unicast
The Cisco IOS software supports these IPv6 unicast address types:
–
Aggregatable Global Address
Aggregatable global unicast addresses are globally routable and reachable on the IPv6 portion
of the Internet. These global addresses are identified by the format prefix of 001.
4-28
–
Link-Local Address
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Link-Local Addressses are automatically configured on interface using link-local prefix
FE80::/10 (1111 1110 10). The interface identifier is in the modified EUI-64 format.
• Anycast can be used only by a router and not the host. Anycast addresses must not be used as the
source address of an IPv6 packet.
• Multicast address is a logical identifier for a group of hosts that process frames intended to be
multicast for a designated network service. Multicast addresses in IPv6 use a prefix of FF00::/8
(1111 1111)
IPv6 configuration uses these multicast groups:
–
Solicited-node multicast group FF02:0:0:0:0:1:FF00::/104
–
All-nodes link-local multicast group FF02::1
–
All-routers link-local multicast group FF02::2
Table 4-6 lists the IPv6 address types and formats.
Table 4-6IPv6 Address Formats
IPv6 Address Type Preferred Format Compressed Format
Beginning in privileged EXEC mode, use these commands to enable tie ipv6 address
–
ap(config)# int bv1
–
ap(config-if)# ipv6 address
A link-local address, based on the Modified EUI-64 interface ID, is automatically generated for the
interface when stateless autoconfiguration is enabled.
Beginning in privileged EXEC mode, use the following command to enable stateless autoconfiguration:
ap(config-if)# ipv6 address autoconfig
Beginning in privileged EXEC mode, use the following command to configure a link local addreess
without assigning any other IPv6 addressesto the interface:
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-29
Configuring IPv6
Beginning in privileged EXEC mode, use the following command to assign a site-local or global address
to the interface:
ap(config-if)# ipv6 address ipv6-address [eui-64]
NoteThe optional eui-64 keyword is used to utilize the Modified EUI-64 interface ID in the low order 64 bits
of the address.
Configuring DHCPv6 address
DHCPv6 is a network protocol that is used for configuring IPv6 hosts with IP addresses, IP prefixes and
other configuration required to operate on an IPv6 network. The DHCPv6 client obtains configuration
parameters from a server either through a rapid two-message exchange (solicit, reply), or through a
normal four-message exchange (solicit, advertise, request, reply). By default, the four-message
exchange is used. When the rapid-commit option is enabled by both client and server, the two-message
exchange is used.
Beginning in privileged EXEC mode, use these commands to enable the DHCPv6 client in an Access
Point:
–
ap# conf t
–
ap(config)# int bv1
Chapter 4 Configuring the Access Point for the First Time
Autonomous AP supports both DHCPv6 stateful and stateless addressing.
Stateful addressing
Stateful addressing uses a DHCP server. DHCP clients use stateful DHCPv6 addressing to obtain an IP
address.
Beginning in privileged EXEC mode, use this command to configure stateful addressing:
ap(config)# ipv6 address dhcp
Stateless addressing
Stateless addressing does not use a DHCP server to obtain IP addresses. The DHCP clients autoconfigure
their own IP addresses based on router advertisments.
Beginning in privileged EXEC mode, use this command to configure stateless addressing:
ap(config)# ipv6 address autoconfig
IPv6 Neighbor Discovery
The IPv6 neighbor discovery process uses ICMP messages and solicited-node multicast addresses to
determine the link-layer address of a neighbor on the same network.
Beginning in privileged EXEC mode, use these commands to configure IPv6 neighbor discovery:
4-30
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Configuring IPv6
CommandPurpose
ipv6 nd ?Configures neighbor discovery protocol.
ipv6 nd ns-interval valueThis command is available only on bridge group virtual interface
(BVI).
Sets the interval between IPv6 neighbor solicitation retransmissions on
an interface.
ipv6 nd reachable-time valueSets the amount of time that a remote IPv6 node is reachable.
ipv6 nd dad attempts valueThis command is available only on bridge group virtual interface
(BVI).
Configures the number of consecutive neighbor solicitation messages
sent when duplicate address detection is performed on the unicast IPv6
addresses.
ipv6 nd dad timevalueConfigures the interval between IPv6 neighbor solicit transmissions
for duplicate address detection.
ipv6 nd autoconfig default-routerThis command is available only on bridge group virtual interface
(BVI).
Configures a default route to the Neighbor Discovery-derived default
router.
ipv6 nd autoconfig prefixThis command is available only on bridge group virtual interface
(BVI).
Configures router solicitation message to solicit a router advertisement
to eliminate any delay in waiting for the next periodic router
advertisement.
ipv6 nd cache expire expire-time-in-secondsConfigures the length of time before the IPv6 neighbor discovery cache
entry expires.
ipv6 nd cache interface-limit size [log rate] Configures a neighbor discovery cache limit on a specified interface.
ipv6 nd na gleanThis command is available only on bridge group virtual interface
(BVI).
Configures neighbor discovery to glean an entry from an unsolicited
neighbor advertisement.
ipv6 nd nsf {convergence time-in-seconds| dad
[suppress]| throttle resolutions}
Configures IPv6 neighbor discovery non-stop forwarding. You can
specify the covergence time in seconds (10 to 600 seconds), suppress
duplicate address detection (DAD), or set the number of resolutions to
use with non-stop forwarding (NSF).
ipv6 nd nud limit limitConfigures the number of neighbor unreachability detection (NUD)
resends, and set a limit to the number of unresolved resends.
ipv6 nd resolution data limit limit-in-packetsConfigures a limit to the number of data packets in queue awaiting
neighbor discovery (ND) resolution.
ipv6 nd route-ownerInserts Neighbor Discovery-learned routes into the routing table with
"ND" status and enables ND autoconfiguration behavior.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-31
Configuring IPv6
Configuring IPv6 Access Lists
IPv6 access lists (ACL) are used to filter traffic and restrict access to the router. IPv6 prefix lists are used
to filter routing protocol updates.
Beginning in privileged EXEC mode, use these commands to to configure the access list globally and
assign it to interface:
–
ap(config)# ipv6 access-list acl-name
Beginning in privileged EXEC mode, you can use the command given in Tabl e 4- 7 for IPv6 Access List
configuration.
Table 4-7IPv6 Access List configuration commands
CommandPurpose
defaultSet a command to its defaults.
denySpecify packets to reject.
evaluateEvaluate an access list.
exitExit from access-list configuration mode.
noNegate a command or set its defaults.
permitSpecify packets to forward.
remarkSet an access list entry comment.
sequenceSet a sequence number for this entry.
Chapter 4 Configuring the Access Point for the First Time
Beginning in privileged EXEC mode, use these commands to assign the globally configured ACL to the
outbound and inbound traffic on layer3 interface:
–
ap(config)# interface interface
–
ap(config)# ipv6 traffic-filter acl-name in/out
RADIUS Configuration
RADIUS server is a background process serving three functions:
• Authenticate users before granting them access to the network
• Authorize users for certain network services
• Account for the usage of certain network services
See Controlling Access Point Access with RADIUS, page 5-12.
IPv6 WDS Support
The WDS and the infrastructure access points communicate over a multicast protocol called WLAN
Context Control Protocol (WLCCP).
Cisco IOS Release 15.2(4)JA supports communication between the WDS and Access Point through IPv6
addresses. The WDS works on a Dual Stack; that is, it accepts both IPv4 and IPv6 registeration.
4-32
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
IPv6 WDS AP registration
The first active IPv6 address is used to register the WDS. Table 4-8 shows different scenarios in the IPv6
WDS AP registration process.
Table 4-8IPv6 WDS–AP Registration
Configuring IPv6
WDSAP
Scenario
Mode of
CommunicationDual IPv6IPv4 DualIPv6IPv4
1YesyesIPv6
2Yesyes IPv6
3YesyesIPv4
4yesyes IPv6
5yesyesIPv6
6yesyesFails
7yesyesIPv4
8yesyesFails
9yesyesIPv4
Note11r roaming between IPv4 and IPv6 access points is not supported because the MDIE is different. Both
AP and WDS use the first active IPv6 address in BV1 to register and advertise. Link-local is not used
for registration.
CDPv6 Support:
CDP is a layer2 protocol used to get information on the immediate neighbor’s device-ID, capabilities,
mac address, ip address or duplex. Each CDP enabled device sends information about itself to its
immediate neighbor. As part of native IPv6, the access point sends its IPv6 address as well as part of the
address TLV in the cdp message; it also parses the IPv6 address information it gets from the neighboring
switch.
This command shows the connected IPv6 neighbor:
ap# show cdp neighbors detail
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-33
Chapter 4 Configuring the Access Point for the First Time
Automatic Configuring of the Access Point
RA filtering
RA filtering increases the security of the IPv6 network by dropping RAs coming from wireless clients.
RA filtering prevents misconfigured or malicious IPv6 clients from connecting to the network, often
with a high priority that takes precedence over legitimate IPv6 routers. In all cases, the IPv6 RA is
dropped at some point, protecting other wireless devices and upstream wired network from malicious or
misconfigured IPv6 devices.
However, RA filtering is not supported in the uplink direction.
Automatic Configuring of the Access Point
The Autoconfig feature of autonomous access points allows the AP to download its configuration,
periodically, from a Secure Copy Protocol (SCP) server. If the Autoconfig feaure is enabled, the AP
downloads a configuration information file from the server at a pre-configured time and applies this
configuration. The next configuration download is also scheduled along with this.
NoteThe AP does not apply a configuration if it is the same as the last downloaded configuration.
Enabling Autoconfig
To enable Autoconfig:
Step 1Prepare a Configuration Information File
Step 2Enable environmental variables
Step 3Schedule the Configuration Information File Download
Prepare a Configuration Information File
An Autoconfig-enabled AP downloads the configuration information file from the SCP server. The
configuration information file is an XML file, containing the following information:
• The new startup-configuration.
• An Absolute time and a Range value. The AP schedules the next information file download at this
absolute time plus a random value between 0 and the range value.
The configuration information file has the following format:
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
</l2tp_cfg>
The xml tags used in the configuration information file are described below.
XML TagsPurpose
cfg_fetch_start_timeThis tag contains the Absolute Time in the format DAY HH:MM, where:
cfg_fetch_time_rangeA random number of seconds between 0 to this value is added to the start
cfg_fetch_configThis tag contains the AP’s next startup configuration.
Automatic Configuring of the Access Point
• DAY can be any of these values–Sun, Mon, Tue, Wed, Thu, Fri, Sat,
All.
• HH, indicates the hour, and can be a number from 0 to 23.
• MM, indicates the minute, and can be a number from 0 to 59.
Example: “Sun 10:30”, “Thu 00:00”, “All 12:40”
time, to randomize the time when next information file is downloaded.
Enable environmental variables
After you have the configuration information file ready and hosted on the SCP server, you need to
configure the following environmental variables.
Environmental VariablePurpose
AUTO_CONFIG_AP_FUNCTIONALITYTo enable Autoconfig, this variable must be set
AUTO_CONFIG_USERUsername for accessing the SCP server
AUTO_CONFIG_PASSWDPassword for accessing the SCP server
AUTO_CONFIG_SERVERHostname/IP of SCP server
AUTO_CONFIG_INF_FILEName of the configuration information file to be
You can configure the environmental variables by using the following command in global configuration
mode:
dot11 autoconfig add environment-variable-name val value.
For example:
dot11 autoconfig add AUTO_CONFIG_SERVER val 206.59.246.199
‘YES’.
fetched from the SCP server
Schedule the Configuration Information File Download
After setting the environmental variables, you need to schedule the download of the configuration
information file from the SCP server. Follow these steps:
Step 1The AP's clock time must be in sync with a SNTP (Simple Network Time Protocol) server. You can set
the SNTP server using the command, sntp server sntp-server-ip, where sntp-server-ip is the IP address
of the SNTP server.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
4-35
Automatic Configuring of the Access Point
Step 2You need to set the correct time zone for the AP to have the correct time, This can be done using the
command clock timezone TIMEZONE HH MM, where:
–
TIMEZONE is name of timezone like IST, UTC, or others.
–
HH is the Hours offset from the timezone
–
MM is the Minutes offset from timezone
Step 3For instances where the download of the configuration information file from the SCP server fails, you
can set a time interval after which the AP retries to download it again. This retry interval can be set using
the command dot11 autoconfig download retry interval min MIN max MAX, where:
–
MIN is minimum number of seconds
–
MAX is maximum number of seconds between retries. After every failed download, the retry
interval doubles, but the retires stop the interval when becomes larger than MAX.
Enabling Autoconfig via a Boot File
Chapter 4 Configuring the Access Point for the First Time
You can enable Autoconfig by also providing the following commands in a boot file as a part of the
DHCP IP configuration.
The format of the contents of the boot file returned by the DHCP/BootTP server should be as shown in
the following example:
dot11 autoconfig add env var AUTO_CONFIG_AP_FUNCTIONALITY val YES
dot11 autoconfig add env var AUTO_CONFIG_USER val someusername
dot11 autoconfig add env var AUTO_CONFIG_PASSWD val somepasswd
dot11 autoconfig add env var AUTO_CONFIG_SERVER val scp.someserver.com
dot11 autoconfig add env var AUTO_CONFIG_INF_FILE val some_inf_file.xml
sntp server 208.210.12.199
clock timezone IST 5 30
dot11 autoconfig download retry interval min 100 max 400
end
Checking the Autoconfig Status
To know the Autoconfig status, use the show dot11 autoconfig status command.
Examples
AP1600-ATT# show dot11 autoconfig status
Dot11 l2tp auto config is disabled
1600-89-absim# show dot11 autoconfig status
Auto configuration download will occur after
45 seconds
4-36
1600-89-absim# show dot11 autoconfig status
Trying to download information file from server
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 4 Configuring the Access Point for the First Time
Debugging Autoconfig
You can use the following debugging commands as required:
• Debug commands to see Autoconfig state machine transition:
Deb dot11 autoconfigsm
• Debug commands to see Autoconfig events:
Deb dot11 autoconfigev
Automatic Configuring of the Access Point
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
4-37
Automatic Configuring of the Access Point
Chapter 4 Configuring the Access Point for the First Time
4-38
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
CHA P T ER
5
Administrating the Access Point
This chapter describes how to administrate the wireless device. This chapter contains the following
sections:
• Disabling the Mode Button, page 5-2
• Preventing Unauthorized Access to Your Access Point, page 5-3
• Protecting Access to Privileged EXEC Commands, page 5-3
• Configuring Easy Setup, page 5-10
• Configuring Spectrum Expert Mode, page 5-11
• Controlling Access Point Access with RADIUS, page 5-12
• Controlling Access Point Access with TACACS+, page 5-17
• Configuring Ethernet Speed and Duplex Settings, page 5-20
• Configuring the Access Point for Wireless Network Management, page 5-20
• Configuring the Access Point for Local Authentication and Authorization, page 5-21
• Configuring the Authentication Cache and Profile, page 5-22
OL-30644-01
• Configuring the Access Point to Provide DHCP Service, page 5-24
• Configuring the Access Point for Secure Shell, page 5-27
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
5-1
Disabling the Mode Button
Disabling the Mode Button
You can disable the mode button on access points having a console port by using the global configuration
[no] boot mode-button command. This command prevents password recovery and is used to prevent
unauthorized users from gaining access to the access point CLI.
CautionThis command disables password recovery. If you lose the privileged EXEC mode password for the
access point after entering this command, you will need to contact the Cisco Technical Assistance Center
(TAC) to regain access to the access point CLI.
The mode button is enabled by default. Beginning in the privilege EXEC mode, follow these steps to
disable the access point mode button.
CommandPurpose
Step 1
Step 2
Step 3
configure terminalEnter global configuration mode.
no boot mode-buttonDisables the access point mode button.
endNoteIt is not necessary to save the configuration.
Chapter 5 Administrating the Access Point
You can check the status of the mode-button by executing the show boot or show boot mode-button
commands in the privileged EXEC mode. The status does not appear in the running configuration. The
following shows a typical response to the show boot and show boot mode-button commands:
ap#show boot
BOOT path-list: flash:/ap3g2-k9w7-mx.152-4.JA1/ap3g2-k9w7-mx.152-4.JA1
Config file: flash:/config.txt
Private Config file: flash:/private-config
Enable Break: yes
Manual Boot: no
Enable IOS Break: no
HELPER path-list:
NVRAM/Config file
buffer size: 32768
Mode Button: on
Radio Core TFTP:
ap#
NoteAs long as the privileged EXEC password is known, you can restore the mode button to normal operation
using the global configuration boot mode-button command.
5-2
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 5 Administrating the Access Point
Preventing Unauthorized Access to Your Access Point
Preventing Unauthorized Access to Your Access Point
You can prevent unauthorized users from reconfiguring the wireless device and viewing configuration
information. Typically, you want network administrators to have access to the wireless device while you
restrict access to users who connect through a terminal or workstation from within the local network.
To prevent unauthorized access to the wireless device, you should configure one of these security
features:
• Username and password pairs, which are locally stored on the wireless device. These pairs
authenticate each user before that user can access the wireless device. You can also assign a specific
privilege level (read only or read/write) to each username and password pair. For more information,
see the “Configuring Username and Password Pairs” section on page 5-7. The default username is
Cisco, and the default password is Cisco. Usernames and passwords are case-sensitive.
NoteCharacters TAB, ?, $, +, and [ are invalid characters for passwords.
• Username and password pairs stored centrally in a database on a RADIUS or TACACS+ security
server. For more information, see the “Controlling Access Point Access with RADIUS” section on
page 5-12 and the “Controlling Access Point Access with TACACS+” section on page 5-17.
Protecting Access to Privileged EXEC Commands
A simple way of providing terminal access control in your network is to use passwords and assign
privilege levels. Password protection restricts access to a network or network device. Privilege levels
define what commands users can issue after they have logged into a network device.
NoteFor complete syntax and usage information for the commands used in this section, refer to the Cisco IOS
Security Command Reference for Release 12.3.
This section describes how to control access to the configuration file and privileged EXEC commands.
It contains this configuration information:
• Default Password and Privilege Level Configuration, page 5-4
• Setting or Changing a Static Enable Password, page 5-4
• Protecting Enable and Enable Secret Passwords with Encryption, page 5-6
• Configuring Username and Password Pairs, page 5-7
• Configuring Multiple Privilege Levels, page 5-8
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
5-3
Chapter 5 Administrating the Access Point
Protecting Access to Privileged EXEC Commands
Default Password and Privilege Level Configuration
Table 5-1 shows the default password and privilege level configuration.
Table 5-1Default Password and Privilege Levels
FeatureDefault Setting
Username and passwordDefault username is Cisco and the default password is Cisco.
Enable password and privilege levelDefault password is Cisco. The default is level 15 (privileged EXEC
level). The password is encrypted in the configuration file.
Enable secret password and privilege levelThe default enable password is Cisco. The default is level 15 (privileged
EXEC level). The password is encrypted before it is written to the
configuration file.
Line passwordDefault password is Cisco. The password is encrypted in the configuration
file.
Setting or Changing a Static Enable Password
Step 1
Step 2
The enable password controls access to the privileged EXEC mode.
NoteThe no enable password global configuration command removes the enable password, but you should
use extreme care when using this command. If you remove the enable password, you are locked out of
the EXEC mode.
Beginning in privileged EXEC mode, follow these steps to set or change a static enable password:
CommandPurpose
configure terminalEnter global configuration mode.
enable password passwordDefine a new password or change an existing password for access to
privileged EXEC mode.
The default password is Cisco.
For password, specify a string from 1 to 25 alphanumeric characters. The
string cannot start with a number, is case sensitive, and allows spaces but
ignores leading spaces. It can contain the question mark (?) character if
you precede the question mark with the key combination Crtl-V when you
create the password; for example, to create the password abc?123, do this:
1. Enter abc.
2. Enter Crtl-V.
5-4
3. Enter ?123.
When the system prompts you to enter the enable password, you need not
precede the question mark with the Ctrl-V; you can simply enter abc?123
at the password prompt.
NoteCharacters TAB, ?, $, +, and [ are invalid characters for
passwords.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 5 Administrating the Access Point
CommandPurpose
Step 3
Step 4
Step 5
endReturn to privileged EXEC mode.
show running-configVerify your entries.
copy running-config startup-config(Optional) Save your entries in the configuration file.
This example shows how to change the enable password to l1u2c3k4y5. The password is not encrypted
and provides access to level 15 (traditional privileged EXEC mode access):
AP(config)# enable password l1u2c3k4y5
Protecting Access to Privileged EXEC Commands
The enable password is not encrypted and can be read in the wireless
device configuration file.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
5-5
Chapter 5 Administrating the Access Point
Protecting Access to Privileged EXEC Commands
Protecting Enable and Enable Secret Passwords with Encryption
To provide an additional layer of security, particularly for passwords that cross the network or that are
stored on a Trivial File Transfer Protocol (TFTP) server, you can use either the enable password or
enable secret global configuration commands. Both commands accomplish the same thing; that is, you
can establish an encrypted password that users must enter to access privileged EXEC mode (the default)
or any privilege level you specify.
We recommend that you use the enable secret command because it uses an improved encryption
algorithm.
If you configure the enable secret command, it takes precedence over the enable password command;
the two commands cannot be in effect simultaneously.
Beginning in privileged EXEC mode, follow these steps to configure encryption for enable and enable
secret passwords:
CommandPurpose
Step 1
Step 2
configure terminalEnter global configuration mode.
enable password [level level] {password |
encryption-type encrypted-password}
Define a new password or change an existing password for
access to privileged EXEC mode.
Define a secret password, which is saved using a
nonreversible encryption method.
• (Optional) For level, the range is from 0 to 15. Level 1 is
normal user EXEC mode privileges. The default level is
15 (privileged EXEC mode privileges).
• For password, specify a string from 1 to 25
alphanumeric characters. The string cannot start with a
number, is case sensitive, and allows spaces but ignores
leading spaces. By default, no password is defined.
• (Optional) For encryption-type, both type 0 and type 7
are available. Encryption type 0 is for providing an
unencrypted password. Encryption type 7 is for
providing an encrypted password. Both types are taken
and the password string is converted into an encryption
type 5, a Cisco proprietary encryption algorithm. .
NoteIf you specify an encryption type and then enter a
clear text password, you can not re-enter privileged
EXEC mode. You cannot recover a lost encrypted
password by any method.
service password-encryption(Optional) Encrypt the password when the password is
defined or when the configuration is written.
Encryption prevents the password from being readable in the
configuration file.
endReturn to privileged EXEC mode.
copy running-config startup-config(Optional) Save your entries in the configuration file.
5-6
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 5 Administrating the Access Point
If both the enable and enable secret passwords are defined, users must enter the enable secret password.
Use the level keyword to define a password for a specific privilege level. After you specify the level and
set a password, give the password only to users who need to have access at this level. Use the privilege level global configuration command to specify commands accessible at various levels. For more
information, see the “Configuring Multiple Privilege Levels” section on page 5-8.
If you enable password encryption, it applies to all passwords including username passwords,
authentication key passwords, the privileged command password, and console and virtual terminal line
passwords.
To remove a password and level, use the no enable password [levellevel] or no enable secret [level
level] global configuration command. To disable password encryption, use the no service
password-encryption global configuration command.
This example shows how to configure the encrypted password $1$FaD0$Xyti5Rkls3LoyxzS8 for
privilege level 2:
You can configure username and password pairs, which are locally stored on the wireless device. These
pairs are assigned to lines or interfaces and authenticate each user before that user can access the wireless
device. If you have defined privilege levels, you can also assign a specific privilege level (with associated
rights and privileges) to each username and password pair.
Beginning in privileged EXEC mode, follow these steps to establish a username-based authentication
system that requests a login username and a password:
CommandPurpose
configure terminalEnter global configuration mode.
login localEnable local password checking at login time. Authentication is based on
Enter the username, privilege level, and password for each user.
• For name, specify the user ID as one word. Spaces and quotation
marks are not allowed.
• (Optional) For level, specify the privilege level the user has after
gaining access. The range is 0 to 15. Level 15 gives privileged EXEC
mode access. Level 1 gives user EXEC mode access.
• For encryption-type, enter 0 to specify that an unencrypted password
will follow. Enter 7 to specify that a hidden password will follow.
• For password, specify the password the user must enter to gain access
to the wireless device. The password must be from 1 to 25 characters,
can contain embedded spaces, and must be the last option specified
in the username command.
endReturn to privileged EXEC mode.
show running-configVerify your entries.
copy running-config startup-config(Optional) Save your entries in the configuration file.
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
5-7
Protecting Access to Privileged EXEC Commands
To disable username authentication for a specific user, use the no usernamename global configuration
command.
To disable password checking and allow connections without a password, use the no login line
configuration command.
NoteYou must have at least one username configured and you must have login local set to open a Telnet
session to the wireless device. If you enter the only username for the no username command, you can
be locked out of the wireless device.
Alternatively, you can disable username verification for telnet with the line configuration command no login. You can then login to the AP with user verification, and then you will need the enable password
(or enable secret) commands to gain privilege exec level. You can also grant this level by default to the
telnet line with the command privilege level 15.
NoteIf you use both the no login and privilege level 15 commands, any telnet client connecting to the AP will
have full privilege access to the AP.
Chapter 5 Administrating the Access Point
ap(config)# line vty 0 4
ap(config-line)# no login
ap(config-line)# privilege level 15
Configuring Multiple Privilege Levels
By default, Cisco IOS software has two modes of password security: user EXEC and privileged EXEC.
You can configure up to 16 hierarchical levels of commands for each mode. By configuring multiple
passwords, you can allow different sets of users to have access to specified commands.
For example, if you want many users to have access to the clear line command, you can assign it
level 2 security and distribute the level 2 password fairly widely. But if you want more restricted access
to the configure command, you can assign it level 3 security and distribute that password to a more
restricted group of users.
This section includes this configuration information:
• Setting the Privilege Level for a Command, page 5-9
• Logging Into and Exiting a Privilege Level, page 5-9
5-8
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter 5 Administrating the Access Point
Setting the Privilege Level for a Command
Beginning in privileged EXEC mode, follow these steps to set the privilege level for a command mode:
CommandPurpose
Step 1
Step 2
Step 3
configure terminalEnter global configuration mode.
privilege mode level levelcommandSet the privilege level for a command.
enable password level level passwordSpecify the enable password for the privilege level.
Protecting Access to Privileged EXEC Commands
• For mode, enter configure for global configuration mode, exec for
EXEC mode, interface for interface configuration mode, or line for
line configuration mode.
• For level, the range is from 0 to 15. Level 1 is for normal user EXEC
mode privileges. Level 15 is the level of access permitted by the
enable password.
• For command, specify the command to which you want to restrict
access.
Step 4
Step 5
Step 6
• For level, the range is from 0 to 15. Level 1 is for normal user EXEC
mode privileges.
• For password, specify a string from 1 to 25 alphanumeric characters.
The string cannot start with a number, is case sensitive, and allows
spaces but ignores leading spaces. By default, no password is
defined.
NoteCharacters TAB, ?, $, +, and [ are invalid characters for
passwords.
endReturn to privileged EXEC mode.
show running-config
or
show privilege
Verify your entries.
The first command displays the password and access level configuration.
The second command displays the privilege level configuration.
copy running-config startup-config(Optional) Save your entries in the configuration file.
When you set a command to a privilege level, all commands whose syntax is a subset of that command
are also set to that level. For example, if you set the show ip route command to level 15, the show
commands and show ip commands are automatically set to privilege level 15 unless you set them
individually to different levels.
To return to the default privilege for a given command, use the no privilegemodelevellevelcommand
global configuration command.
This example shows how to set the configure command to privilege level 14 and define SecretPswd14
as the password users must enter to use level 14 commands:
Beginning in privileged EXEC mode, follow these steps to log in to a specified privilege level and to exit
to a specified privilege level:
OL-30644-01
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
5-9
Configuring Easy Setup
CommandPurpose
Step 1
Step 2
enable levelLog in to a specified privilege level.
disable levelExit to a specified privilege level.
Configuring Easy Setup
You can now configure a network and radio in a single screen using the Easy Setup.
Network Configuration
To configure an access point using the network configuration, enter the values for the following fields:
• Hostname
• Server protocol (DHCP / Static)
• IP Address
Chapter 5 Administrating the Access Point
For level, the range is 0 to 15.
For level, the range is 0 to 15.
• IP Subnet
• Default Gateway
• IPv6 Protocol (DHCP / Autoconfig / Static IP)
• IPV6 address
• Username
• Password
• SNMP Community
• Current SSID list (list SSIDs configured to the access point)
Radio Configuration
To configure an access point using Radio Configuration, configure the following fields:
• SSID—a 32 byte string.
• Broadcast SSID in beacon
• Security
• Role in Radio Network
–
Access point—Root device. This setting can be applied to any access point.
–
Repeater—Nonroot device. This setting also can be applied to any access point.
–
Root Bridge—This setting can be applied to any access point.
–
Non-Root Bridge—This setting can be applied to any access point.
5-10
–
Workgroup Bridge—This setting can be applied to any access point.
–
Universal Workgroup Bridge
–
Scanner—Access point functions as a network monitoring device. It continuously scans and
reports wireless traffic that it detects from other wireless devices on the wireless LAN in this
mode. All access points can be configured as a scanner.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Loading...
+ hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.