Cisco SD2008T-NA, SFE2000P, 4402, 4404, 2000 Series Configuration Manual

Cisco Wireless LAN Controller
Configuration Guide

Software Release 4.0
January 2007

Corporate Headquarters

Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]

800 553-NETS (6387)

Fax: [phone]

Text Part Number: OL-9141-03

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn,
and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco
Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel,
EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard,
LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect,
RateMUX, ScriptShare, SlideCast, SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or
its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0601R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

Cisco Wireless LAN Controller Configuration Guide

Copyright © 2007 Cisco Systems, Inc.
All rights reserved.

Preface 17

Audience 18

Purpose 18

Organization 18

Conventions 19

Related Publications 21

Obtaining Documentation 22

Cisco.com 22
Product Documentation DVD 22
Ordering Documentation 22

Documentation Feedback 22

CONTENTS

CHAPTER

Cisco Product Security Overview 23

Reporting Security Problems in Cisco Products 23

Obtaining Technical Assistance 24

Cisco Technical Support & Documentation Website 25
Submitting a Service Request 25
Definitions of Service Request Severity 26

Obtaining Additional Publications and Information 26

1 Overview 1

Cisco Unified Wireless Network Solution Overview 2

Single-Controller Deployments 3
Multiple-Controller Deployments 4

Operating System Software 5

Operating System Security 6

Cisco WLAN Solution Wired Security 6

Layer 2 and Layer 3 LWAPP Operation 7

Operational Requirements 7
Configuration Requirements 7

Cisco Wireless LAN Controllers 7

Primary, Secondary, and Tertiary Controllers 8
Client Location 8

Controller Platforms 9

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

3

Contents

Cisco 2000 and 2100 Series Controllers 9

Features Not Supported 9
Cisco 4400 Series Controllers 10
Catalyst 6500 Series Wireless Services Module 10
Cisco 28/37/38xx Series Integrated Services Router 11
Catalyst 3750G Integrated Wireless LAN Controller Switch 11

Cisco UWN Solution Wired Connections 11

Cisco UWN Solution WLANs 12

Identity Networking 12

Enhanced Integration with Cisco Secure ACS 13

File Transfers 14

Power over Ethernet 14

Pico Cell Functionality 14

Startup Wizard 15
Cisco Wireless LAN Controller Memory 16
Cisco Wireless LAN Controller Failover Protection 16
Network Connections to Cisco Wireless LAN Controllers 17

Cisco 2000 and 2100 Series Wireless LAN Controllers 17

Cisco 4400 Series Wireless LAN Controllers 18

CHAPTER

Rogue Access Points 19

Rogue Access Point Location, Tagging, and Containment 19

2 Using the Web-Browser and CLI Interfaces 1

Using the Web-Browser Interface 2

Guidelines for Using the GUI 2
Opening the GUI 2

Enabling Web and Secure Web Modes 3

Configuring the GUI for HTTPS 3

Loading an Externally Generated HTTPS Certificate 4
Disabling the GUI 5
Using Online Help 5

Using the CLI 5

Logging into the CLI 7

Using a Local Serial Connection 7

Using a Remote Ethernet Connection 7
Logging Out of the CLI 8
Navigating the CLI 8

Cisco Wireless LAN Controller Configuration Guide

4

OL-9141-03

Enabling Wireless Connections to the Web-Browser and
CLI Interfaces

9

Contents

CHAPTER

3 Configuring Ports and Interfaces 1

Overview of Ports and Interfaces 2

Ports 2

Distribution System Ports 3
Service Port 5

Interfaces 5

Management Interface 6
AP-Manager Interface 6
Virtual Interface 7
Service-Port Interface 8
Dynamic Interface 8

WLANs 8

Configuring the Management, AP-Manager, Virtual, and Service-Port Interfaces 10

Using the GUI to Configure the Management, AP-Manager, Virtual, and Service-Port Interfaces 10
Using the CLI to Configure the Management, AP-Manager, Virtual, and Service-Port Interfaces 12

Using the CLI to Configure the Management Interface 12
Using the CLI to Configure the AP-Manager Interface 13
Using the CLI to Configure the Virtual Interface 14
Using the CLI to Configure the Service-Port Interface 15

Configuring Dynamic Interfaces 15

Using the GUI to Configure Dynamic Interfaces 15
Using the CLI to Configure Dynamic Interfaces 17

Configuring Ports 19

Configuring Port Mirroring 22
Configuring Spanning Tree Protocol 23

Using the GUI to Configure Spanning Tree Protocol 24
Using the CLI to Configure Spanning Tree Protocol 28

Enabling Link Aggregation 29

Link Aggregation Guidelines 33
Using the GUI to Enable Link Aggregation 34
Using the CLI to Enable Link Aggregation 35
Verifying LAG Settings Using the CLI 35
Configuring Neighbor Devices to Support LAG 35

Configuring a 4400 Series Controller to Support More Than 48 Access Points 36

Using Link Aggregation 36
Using Multiple AP-Manager Interfaces 36

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

5

Contents

Connecting Additional Ports 41

CHAPTER

4 Configuring Controller SettingsWireless Device Access 1

Using the Configuration Wizard 2

Before You Start 2
Resetting the Device to Default Settings 3

Resetting to Default Settings Using the CLI 3

Resetting to Default Settings Using the GUI 3
Running the Configuration Wizard on the CLI 4

Managing the System Time and Date 5

Configuring the Time and Date Manually 5
Configuring an NTP Server 5

Configuring a Country Code 6

Enabling and Disabling 802.11 Bands 7

Configuring Administrator Usernames and Passwords 7

Configuring RADIUS Settings 8

Configuring SNMP 8

Changing the Default Values of SNMP Community Strings 9

Using the GUI to Change the SNMP Community String Default Values 9
Using the CLI to Change the SNMP Community String Default Values 11

Changing the Default Values for SNMP v3 Users 11

Using the GUI to Change the SNMP v3 User Default Values 12
Using the CLI to Change the SNMP v3 User Default Values 13

Enabling 802.3x Flow Control 13

Enabling System Logging 13

Using the GUI to Enable System Logging 13
Using the CLI to Enable System Logging 15

Enabling Dynamic Transmit Power Control 16

Configuring Multicast Mode 16

Understanding Multicast Mode 16
Guidelines for Using Multicast Mode 16
Enabling Multicast Mode 17

Configuring Client Roaming 17

Intra-Controller Roaming 18
Inter-Controller Roaming 18
Inter-Subnet Roaming 18
Voice-over-IP Telephone Roaming 18
CCX Layer 2 Client Roaming 19

Cisco Wireless LAN Controller Configuration Guide

6

OL-9141-03

Using the GUI to Configure CCX Client Roaming Parameters 20
Using the CLI to Configure CCX Client Roaming Parameters 21

Configuring Voice and Video Parameters 22

Call Admission Control 22
U-APSD 23
Traffic Stream Metrics 23
Using the GUI to Configure Voice Parameters 23
Using the GUI to Configure Video Parameters 25
Using the GUI to View Voice and Video Settings 26
Using the CLI to Configure Voice Parameters 30
Using the CLI to Configure Video Parameters 31
Using the CLI to View Voice and Video Settings 32

Configuring the Supervisor 720 to Support the WiSM 34

General WiSM Guidelines 34
Configuring the Supervisor 35

Contents

CHAPTER

Using the Wireless LAN Controller Network Module 35

5 Configuring Security Solutions 1

Cisco UWN Solution Security 2

Security Overview 2
Layer 1 Solutions 2
Layer 2 Solutions 2
Layer 3 Solutions 3
Rogue Access Point Solutions 3

Rogue Access Point Challenges 3
Tagging and Containing Rogue Access Points 3

Integrated Security Solutions 4

Configuring the System for SpectraLink NetLink Telephones 4

Using the GUI to Enable Long Preambles 4
Using the CLI to Enable Long Preambles 5
Using the CLI to Configure Enhanced Distributed Channel Access 6

Using Management over Wireless 6

Using the GUI to Enable Management over Wireless 6
Using the CLI to Enable Management over Wireless 7

Configuring DHCP Option 82 7

Configuring Access Control Lists 8

Using the GUI to Configure Access Control Lists 9
Using the CLI to Configure Access Control Lists 12

Configuring Management Frame Protection 13

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

7

Contents

Using the GUI to Configure MFP 14
Using the GUI to View MFP Settings 15
Using the CLI to Configure MFP 17
Using the CLI to View MFP Settings 18

Configuring Identity Networking 20

Identity Networking Overview 21
RADIUS Attributes Used in Identity Networking 22

QoS-Level 22

ACL-Name 22

Interface-Name 23

VLAN-Tag 23

Tunnel Attributes 24
Configuring AAA Override 25

Using the GUI to Configure AAA Override 25

Using the CLI to Configure AAA Override 26

CHAPTER

Configuring IDS 26

Configuring IDS Sensors 26

Using the GUI to Configure IDS Sensors 26

Using the CLI to Configure IDS Sensors 28

Viewing Shunned Clients 29
Configuring IDS Signatures 30

Using the GUI to Configure IDS Signatures 31

Using the CLI to Configure IDS Signatures 37

Using the CLI to View IDS Signature Events 38

Configuring AES Key Wrap 39

Using the GUI to Configure AES Key Wrap 39
Using the CLI to Configure AES Key Wrap 40

Configuring Maximum Local Database Entries 41

Using the GUI to Specify the Maximum Number of Local Database Entries 41
Using the CLI to Specify the Maximum Number of Local Database Entries 41

6 Configuring WLANsWireless Device Access 1

WLAN Overview 2

Configuring WLANs 2

Displaying, Creating, Disabling, and Deleting WLANs 2
Activating WLANs 3
Configuring DHCP 3

Internal DHCP Server 3

External DHCP Servers 4

Cisco Wireless LAN Controller Configuration Guide

8

OL-9141-03

Using the GUI to Configure DHCP 5
Using the CLI to Configure DHCP 5

Configuring MAC Filtering for WLANs 6

Enabling MAC Filtering 6
Creating a Local MAC Filter 6

Configuring a Timeout for Disabled Clients 6
Assigning WLANs to VLANs 6
Configuring Layer 2 Security 7

Static WEP Keys 7

Dynamic 802.1X Keys and Authorization 7

Configuring a WLAN for Both Static and Dynamic WEP 8

WPA1 and WPA2 8

CKIP 12
Configuring Layer 3 Security 14

VPN Passthrough 15

Web-Based Authentication 16

Local Netuser 16
Configuring 802.3 Bridging 17
Configuring Quality of Service 17

Configuring QoS Enhanced BSS (QBSS) 18

Configuring Quality of Service Profiles 19
Configuring Cisco Client Extensions 22

Using the GUI to Configure CCX Aironet IEs 22

Using the GUI to View a Client’s CCX Version 24

Using the CLI to Configure CCX Aironet IEs 24

Using the CLI to View a Client’s CCX Version 25
Enabling WLAN Override 25

Using the GUI to Enable WLAN Override 25

Using the CLI to Enable WLAN Override 25
Configuring Access Point Groups 26

Creating Access Point Groups 27

Assigning Access Points to Access Point Groups 29
Configuring Multiple WLANs with the Same SSID 30

Additions to the Controller GUI 30

Addition to the Controller CLI 31
Configuring Conditional Web Redirect with 802.1X Authentication 32

Configuring the RADIUS Server 32

Using the GUI to Configure Conditional Web Redirect 34

Using the CLI to Configure Conditional Web Redirect 34
Disabling Accounting Servers per WLAN 35

Contents

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

9

Contents

CHAPTER

7 Controlling Lightweight Access Points 1

The Controller Discovery Process 2

Verifying that Access Points Join the Controller 3

Verifying that Access Points Join the Controller Using the GUI 3
Verifying that Access Points Join the Controller Using the CLI 3

Cisco 1000 Series Lightweight Access Points 4

Cisco 1030 Remote Edge Lightweight Access Points 5
Cisco 1000 Series Lightweight Access Point Models 6
Cisco 1000 Series Lightweight Access Point External and Internal Antennas 6

External Antenna Connectors 6

Antenna Sectorization 7
Cisco 1000 Series Lightweight Access Point LEDs 7
Cisco 1000 Series Lightweight Access Point Connectors 7
Cisco 1000 Series Lightweight Access Point Power Requirements 8

Cisco 1000 Series Lightweight Access Point External Power Supply 8
Cisco 1000 Series Lightweight Access Point Mounting Options 8
Cisco 1000 Series Lightweight Access Point Physical Security 9
Cisco 1000 Series Lightweight Access Point Monitor Mode 9

Cisco Aironet 1510 Series Lightweight Outdoor Mesh Access Points 9

Wireless Mesh 10
Configuring and Deploying the AP1510 11

Adding the MAC Address of the Access Point to the Controller Filter List 12

Configuring Mesh Parameters 14

Configuring the Mesh Security Timer 16

Configuring Bridging Parameters 16

Autonomous Access Points Converted to Lightweight Mode 19

Guidelines for Using Access Points Converted to Lightweight Mode 20
Reverting from Lightweight Mode to Autonomous Mode 20

Using a Controller to Return to a Previous Release 20

Using the MODE Button and a TFTP Server to Return to a Previous Release 21
Access Point Authorization 21

Controllers Accept SSCs from Access Points Converted to Lightweight Mode 21
Using DHCP Option 43 22
Using a Controller to Send Debug Commands to Access Points Converted to Lightweight Mode 22
Converted Access Points Send Crash Information to Controller 22
Converted Access Points Send Radio Core Dumps to Controller 23
Enabling Memory Core Dumps from Converted Access Points 23
Display of MAC Addresses for Converted Access Points 23
Disabling the Reset Button on Access Points Converted to Lightweight Mode 24

Cisco Wireless LAN Controller Configuration Guide

10

OL-9141-03

Configuring a Static IP Address on an Access Point Converted to Lightweight Mode 24

Dynamic Frequency Selection 24

Retrieving the Unique Device Identifier on Controllers and Access Points 25

Using the GUI to Retrieve the Unique Device Identifier on Controllers and Access Points 26
Using the CLI to Retrieve the Unique Device Identifier on Controllers and Access Points 27

Performing a Link Test 27

Using the GUI to Perform a Link Test 29
Using the CLI to Perform a Link Test 30

Configuring Cisco Discovery Protocol 31

Configuring Power over Ethernet 33

Using the GUI to Configure Power over Ethernet 33
Using the CLI to Configure Power over Ethernet 35

Configuring Flashing LEDs 36

Authorizing Access Points Using MICs 36

Contents

CHAPTER

CHAPTER

8 Managing Controller Software and Configurations 1

Transferring Files to and from a Controller 2

Upgrading Controller Software 2

Updating Controller Software 3

Saving Configurations 4

Clearing the Controller Configuration 5

Erasing the Controller Configuration 5

Resetting the Controller 5

9 Managing User Accounts 1

Creating Guest User Accounts 2

Creating a Lobby Ambassador Account 2

Using the GUI to Create a Lobby Ambassador Account 2

Using the CLI to Create a Lobby Ambassador Account 4
Creating Guest User Accounts as a Lobby Ambassador 4
Viewing Guest User Accounts 6

Using the GUI to View Guest Accounts 6

Using the CLI to View Guest Accounts 7

Web Authentication Process 7

Choosing the Web Authentication Login Window 9

Choosing the Default Web Authentication Login Window 9

Using the GUI to Choose the Default Web Authentication Login Window 9

Using the CLI to Choose the Default Web Authentication Login Window 10

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

11

Contents

Modified Default Web Authentication Login Window Example 12

Using a Customized Web Authentication Login Window from an External Web Server 13

Using the GUI to Choose a Customized Web Authentication Login Window from an External Web
Server

Using the CLI to Choose a Customized Web Authentication Login Window from an External Web
Server

Downloading a Customized Web Authentication Login Window 14

Using the GUI to Download a Customized Web Authentication Login Window 15
Using the CLI to Download a Customized Web Authentication Login Window 16
Customized Web Authentication Login Window Example 17
Using the CLI to Verify the Web Authentication Login Window Settings 17

13

14

CHAPTER

10 Configuring Radio Resource ManagementWireless Device Access 1

Overview of Radio Resource Management 2

Radio Resource Monitoring 2
Dynamic Channel Assignment 3
Dynamic Transmit Power Control 4
Coverage Hole Detection and Correction 4
Client and Network Load Balancing 4
RRM Benefits 5

Overview of RF Groups 5

RF Group Leader 5
RF Group Name 6

Configuring an RF Group 6

Using the GUI to Configure an RF Group 7
Using the CLI to Configure RF Groups 8

Viewing RF Group Status 8

Using the GUI to View RF Group Status 8
Using the CLI to View RF Group Status 11

Enabling Rogue Access Point Detection 12

Using the GUI to Enable Rogue Access Point Detection 12
Using the CLI to Enable Rogue Access Point Detection 14

Configuring Dynamic RRM 15

Using the GUI to Configure Dynamic RRM 15
Using the CLI to Configure Dynamic RRM 22

Overriding Dynamic RRM 23

Statically Assigning Channel and Transmit Power Settings to Access Point Radios 24

Using the GUI to Statically Assign Channel and Transmit Power Settings 24
Using the CLI to Statically Assign Channel and Transmit Power Settings 26

Cisco Wireless LAN Controller Configuration Guide

12

OL-9141-03

Disabling Dynamic Channel and Power Assignment Globally for a Controller 27

Using the GUI to Disable Dynamic Channel and Power Assignment 27

Using the CLI to Disable Dynamic Channel and Power Assignment 27

Viewing Additional RRM Settings Using the CLI 28

Configuring CCX Radio Management Features 29

Broadcast Location Measurement Requests 29
Location Calibration 29
Using the GUI to Configure CCX Radio Management 30
Using the CLI to Configure CCX Radio Management 31
Using the CLI to Obtain CCX Radio Management Information 32

Contents

CHAPTER

CHAPTER

11 Configuring Mobility GroupsWireless Device Access 1

Overview of Mobility 2

Overview of Mobility Groups 5

Determining When to Include Controllers in a Mobility Group 7

Configuring Mobility Groups 7

Prerequisites 7
Using the GUI to Configure Mobility Groups 8
Using the CLI to Configure Mobility Groups 11

Configuring Auto-Anchor Mobility 11

Guidelines for Using Auto-Anchor Mobility 12
Using the GUI to Configure Auto-Anchor Mobility 13
Using the CLI to Configure Auto-Anchor Mobility 14

Running Mobility Ping Tests 15

12 Configuring Hybrid REAPWireless Device Access 1

Overview of Hybrid REAP 2

Hybrid-REAP Authentication Process 2
Hybrid REAP Guidelines 4

Configuring Hybrid REAP 5

Configuring the Switch at the Remote Site 5
Configuring the Controller for Hybrid REAP 6

Using the GUI to Configure the Controller for Hybrid REAP 6

Using the CLI to Configure the Controller for Hybrid REAP 12
Configuring an Access Point for Hybrid REAP 12

Using the GUI to Configure an Access Point for Hybrid REAP 12

Using the CLI to Configure an Access Point for Hybrid REAP 15
Connecting Client Devices to the WLANs 16

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

13

Contents

APPENDIX

APPENDIX

A Safety Considerations and

Translated Safety Warnings

1

Safety Considerations 2

Warning Definition 2

Class 1 Laser Product Warning 5

Ground Conductor Warning 7

Chassis Warning for Rack-Mounting and Servicing 9

Battery Handling Warning for 4400 Series Controllers 18

Equipment Installation Warning 20

More Than One Power Supply Warning for 4400 Series Controllers 23

B Declarations of Conformity and Regulatory Information 1

Regulatory Information for 1000 Series Access Points 2

Manufacturers Federal Communication Commission Declaration of Conformity Statement 2
Department of Communications—Canada 3

Canadian Compliance Statement 3

European Community, Switzerland, Norway, Iceland, and Liechtenstein 4

Declaration of Conformity with Regard to the R&TTE Directive 1999/5/EC 4
Declaration of Conformity for RF Exposure 5
Guidelines for Operating Cisco Aironet Access Points in Japan 6
Administrative Rules for Cisco Aironet Access Points in Taiwan 7

Access Points with IEEE 802.11a Radios 7

All Access Points 7
Declaration of Conformity Statements 8

FCC Statement for Cisco 2000 Series Wireless LAN Controllers 8

FCC Statement for Cisco 4400 Series Wireless LAN Controllers 9

APPENDIX

C End User License and Warranty 1

End User License Agreement 2

Limited Warranty 4

Disclaimer of Warranty 6

General Terms Applicable to the Limited Warranty Statement and End User License Agreement 6

Additional Open Source Terms 7

APPENDIX

D System Messages and LED Patterns 1

System Messages 2

Interpreting LEDs 5

Cisco Wireless LAN Controller Configuration Guide

14

OL-9141-03

Interpreting Controller LEDs 5
Interpreting Lightweight Access Point LEDs 5

Contents

APPENDIX

I

NDEX

E Logical Connectivity Diagrams 1

Cisco WiSM 3

Cisco 28/37/38xx Integrated Services Router 5

Catalyst 3750G Integrated Wireless LAN Controller Switch 6

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

15

Contents

Cisco Wireless LAN Controller Configuration Guide

16

OL-9141-03

Preface

This preface provides an overview of the Cisco Wireless LAN Controller Configuration Guide, Release

4.0, references related publications, and explains how to obtain other documentation and technical

assistance, if necessary. It contains these sections:

• Audience, page 18

• Purpose, page 18

• Organization, page 18

• Conventions, page 19

• Related Publications, page 21

• Obtaining Documentation and Submitting a Service Request, page 22

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

17

Audience

Audience

This guide describes Cisco Wireless LAN Controllers and Cisco Lightweight Access Points. This guide
is for the networking professional who installs and manages these devices. To use this guide, you should
be familiar with the concepts and terminology of wireless LANs.

Purpose

This guide provides the information you need to set up and configure wireless LAN controllers.

Note This version of the Cisco Wireless LAN Controller Configuration Guide pertains specifically to

controller software release 4.0. If you are using an earlier version of software, you will notice differences
in features, functionality, and GUI pages.

Organization

Preface

This guide is organized into these chapters:

Chapter 1, “Overview,” provides an overview of the network roles and features of wireless LAN

controllers.

Chapter 2, “Using the Web-Browser and CLI Interfaces,” describes how to use the controller GUI and

CLI.

Chapter 3, “Configuring Ports and Interfaces,” describes the controller’s physical ports and interfaces

and provides instructions for configuring them.

Chapter 4, “Configuring Controller SettingsWireless Device Access,” describes how to configure

settings on the controllers.

Chapter 5, “Configuring Security Solutions,” describes application-specific solutions for wireless

LANs.

Chapter 6, “Configuring WLANsWireless Device Access,” describes how to configure wireless LANs

and SSIDs on your system.

Chapter 7, “Controlling Lightweight Access Points,” explains how to connect access points to the

controller and manage access point settings.

Chapter 8, “Managing Controller Software and Configurations,” describes how to upgrade and manage

controller software and configurations.

Chapter 9, “Managing User Accounts,” explains how to create and manage guest user accounts,

describes the web authentication process, and provides instructions for customizing the web
authentication login window.

Chapter 10, “Configuring Radio Resource ManagementWireless Device Access,” describes radio

resource management (RRM) and explains how to configure it on the controllers.

Chapter 11, “Configuring Mobility GroupsWireless Device Access,” describes mobility groups and

explains how to configure them on the controllers.

Chapter 12, “Configuring Hybrid REAPWireless Device Access,” describes hybrid REAP and explains

how to configure this feature on controllers and access points.

Cisco Wireless LAN Controller Configuration Guide

18

OL-9141-03

Preface

Appendix A, “Safety Considerations and Translated Safety Warnings,” lists safety considerations and

translations of the safety warnings that apply to the Cisco Unified Wireless Network Solution products.

Appendix B, “Declarations of Conformity and Regulatory Information,” provides declarations of

conformity and regulatory information for the products in the Cisco Unified Wireless Network Solution.

Appendix C, “End User License and Warranty,” describes the end user license and warranty that apply

to the Cisco Unified Wireless Network Solution products.

Appendix D, “System Messages and LED Patterns,” lists system messages that can appear on the Cisco

Unified Wireless Network Solution interfaces and describes the LED patterns on controllers and
lightweight access points.

Appendix E, “Logical Connectivity Diagrams,”provides logical connectivity diagrams and related

software commands for controllers that are integrated into other Cisco products.

Conventions

This publication uses these conventions to convey instructions and information:

Command descriptions use these conventions:

Conventions

• Commands and keywords are in boldface text.

• Arguments for which you supply values are in italic.

• Square brackets ([ ]) mean optional elements.

• Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements.

• Braces and vertical bars within square brackets ([{ | }]) mean a required choice within an optional

element.

Interactive examples use these conventions:

• Terminal sessions and system displays are in screen font.

• Information you enter is in boldface screen font.

• Nonprinting characters, such as passwords or tabs, are in angle brackets (< >).

Notes, cautions, and timesavers use these conventions and symbols:

Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in

this manual.

Caution Means reader be careful. In this situation, you might do something that could result equipment damage

or loss of data.

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

19

Conventions

Preface

Warning

Waarschuwing

Varoitus

Attention

Warnung

This warning symbol means danger. You are in a situation that could cause bodily injury. Before you
work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar
with standard practices for preventing accidents. (To see translations of the warnings that appear
in this publication, refer to the appendix “Translated Safety Warnings.”)

Dit waarschuwingssymbool betekent gevaar. U verkeert in een situatie die lichamelijk letsel kan
veroorzaken. Voordat u aan enige apparatuur gaat werken, dient u zich bewust te zijn van de bij
elektrische schakelingen betrokken risico’s en dient u op de hoogte te zijn van standaard
maatregelen om ongelukken te voorkomen. (Voor vertalingen van de waarschuwingen die in deze
publicatie verschijnen, kunt u het aanhangsel “Translated Safety Warnings” (Vertalingen van
veiligheidsvoorschriften) raadplegen.)

Tämä varoitusmerkki merkitsee vaaraa. Olet tilanteessa, joka voi johtaa ruumiinvammaan. Ennen
kuin työskentelet minkään laitteiston parissa, ota selvää sähkökytkentöihin liittyvistä vaaroista ja
tavanomaisista onnettomuuksien ehkäisykeinoista. (Tässä julkaisussa esiintyvien varoitusten
käännökset löydät liitteestä "Translated Safety Warnings" (käännetyt turvallisuutta koskevat
varoitukset).)

Ce symbole d’avertissement indique un danger. Vous vous trouvez dans une situation pouvant
entraîner des blessures. Avant d’accéder à cet équipement, soyez conscient des dangers posés par
les circuits électriques et familiarisez-vous avec les procédures courantes de prévention des
accidents. Pour obtenir les traductions des mises en garde figurant dans cette publication, veuillez
consulter l’annexe intitulée « Translated Safety Warnings » (Traduction des avis de sécurité).

Dieses Warnsymbol bedeutet Gefahr. Sie befinden sich in einer Situation, die zu einer
Körperverletzung führen könnte. Bevor Sie mit der Arbeit an irgendeinem Gerät beginnen, seien Sie
sich der mit elektrischen Stromkreisen verbundenen Gefahren und der Standardpraktiken zur
Vermeidung von Unfällen bewußt. (Übersetzungen der in dieser Veröffentlichung enthaltenen
Warnhinweise finden Sie im Anhang mit dem Titel “Translated Safety Warnings” (Übersetzung der
Warnhinweise).)

20

Avvertenza

Questo simbolo di avvertenza indica un pericolo. Si è in una situazione che può causare infortuni.
Prima di lavorare su qualsiasi apparecchiatura, occorre conoscere i pericoli relativi ai circuiti
elettrici ed essere al corrente delle pratiche standard per la prevenzione di incidenti. La traduzione
delle avvertenze riportate in questa pubblicazione si trova nell’appendice, “Translated Safety
Warnings” (Traduzione delle avvertenze di sicurezza).

Advarsel

Dette varselsymbolet betyr fare. Du befinner deg i en situasjon som kan føre til personskade. Før du
utfører arbeid på utstyr, må du være oppmerksom på de faremomentene som elektriske kretser
innebærer, samt gjøre deg kjent med vanlig praksis når det gjelder å unngå ulykker. (Hvis du vil se
oversettelser av de advarslene som finnes i denne publikasjonen, kan du se i vedlegget "Translated
Safety Warnings" [Oversatte sikkerhetsadvarsler].)

Aviso

Este símbolo de aviso indica perigo. Encontra-se numa situação que lhe poderá causar danos
fisicos. Antes de começar a trabalhar com qualquer equipamento, familiarize-se com os perigos
relacionados com circuitos eléctricos, e com quaisquer práticas comuns que possam prevenir
possíveis acidentes. (Para ver as traduções dos avisos que constam desta publicação, consulte o
apêndice “Translated Safety Warnings” - “Traduções dos Avisos de Segurança”).

Cisco Wireless LAN Controller Configuration Guide

OL-9141-03

Preface

Related Publications

¡Advertencia!

Este símbolo de aviso significa peligro. Existe riesgo para su integridad física. Antes de manipular
cualquier equipo, considerar los riesgos que entraña la corriente eléctrica y familiarizarse con los
procedimientos estándar de prevención de accidentes. (Para ver traducciones de las advertencias
que aparecen en esta publicación, consultar el apéndice titulado “Translated Safety Warnings.”)

Varning!

Denna varningssymbol signalerar fara. Du befinner dig i en situation som kan leda till personskada.
Innan du utför arbete på någon utrustning måste du vara medveten om farorna med elkretsar och
känna till vanligt förfarande för att förebygga skador. (Se förklaringar av de varningar som
förekommer i denna publikation i appendix "Translated Safety Warnings" [Översatta
säkerhetsvarningar].)

Related Publications

These documents provide complete information about the Cisco Unified Wireless Network Solution:

• Quick Start Guide: Cisco 2000 Series Wireless LAN Controllers

• Quick Start Guide: Cisco 4400 Series Wireless LAN Controllers

• Cisco Wireless LAN Controller Command Reference

• Cisco Wireless Control System Configuration Guide

• Quick Start Guide: Cisco Wireless Control System for Microsoft Windows

• Quick Start Guide: Cisco Wireless Control System for Linux

• Quick start guide and hardware installation guide for your specific lightweight access point

Click this link to browse to the Cisco Support and Documentation page:

http://www.cisco.com/cisco/web/support/index.html

• Cisco 1800 Series Routers Hardware Installation Guide

• Cisco AP HWIC Wireless Configuration Guide

• Cisco Router and Security Device Manager (SDM) Quick Start Guide

• Cisco Aironet 2.4-GHz Articulated Dipole Antenna (AIR-ANT4941)

• Cisco Aironet High Gain Omnidirectional Ceiling Mount Antenna (AIR-ANT1728)

• Mounting Instructions for the Cisco Aironet 6.5 dBi Diversity Patch Wall Mount Antenna

• Cisco Aironet 2 dBi Diversity Omnidirectional Ceiling Mount Antenna (AIR-ANT5959)

• Cisco Multiband 2.4/5GHz Articulated Dipole Antenna (AIR-ANT1841)

• Cisco Multiband 2.4/5G Diversity Omnidirectional Ceiling Mount Antenna (AIR-ANT1828)

• Cisco Multiband 2.4/5G Patch Wall Mount Antenna (AIR-ANT1859)

• Mounting Instructions for the Cisco Diversity Omnidirectional Ceiling Mount Antenna

• Mounting Instructions for the Cisco Patch Wall Mount Antenna

Related documents from the Cisco TAC Web pages include:

• Antenna Cabling

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

21

Obtaining Documentation and Submitting a Service Request

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional
information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and
revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed
and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free
service and Cisco currently supports RSS Version 2.0.

Preface

Cisco Wireless LAN Controller Configuration Guide

22

OL-9141-03

CHA P TER

Overview

This chapter describes the controller components and features. Its contains these sections:

• Cisco Unified Wireless Network Solution Overview, page 1-2

• Operating System Software, page 1-5

• Operating System Security, page 1-6

• Layer 2 and Layer 3 LWAPP Operation, page 1-7

• Cisco Wireless LAN Controllers, page 1-7

• Controller Platforms, page 1-9

• Cisco UWN Solution Wired Connections, page 1-11

• Cisco UWN Solution WLANs, page 1-12

• Identity Networking, page 1-12

• File Transfers, page 1-14

• Power over Ethernet, page 1-14

1

• Pico Cell Functionality, page 1-14

• Rogue Access Points, page 1-19

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

1-1

Cisco Unified Wireless Network Solution Overview

Cisco Unified Wireless Network Solution Overview

The Cisco Unified Wireless Network (Cisco UWN) Solution is designed to provide 802.11 wireless
networking solutions for enterprises and service providers. The Cisco UWN Solution simplifies
deploying and managing large-scale wireless LANs and enables a unique best-in-class security
infrastructure. The operating system manages all data client, communications, and system
administration functions, performs radio resource management (RRM) functions, manages system-wide
mobility policies using the operating system security solution, and coordinates all security functions
using the operating system security framework.

The Cisco UWN Solution consists of Cisco Wireless LAN Controllers and their associated lightweight
access points controlled by the operating system, all concurrently managed by any or all of the operating
system user interfaces:

• An HTTP and/or HTTPS full-featured Web User Interface hosted by Cisco Wireless LAN

Controllers can be used to configure and monitor individual controllers. See Chapter 2.

• A full-featured command-line interface (CLI) can be used to configure and monitor individual Cisco

Wireless LAN Controllers. See Chapter 2.

• The Cisco Wireless Control System (WCS), which you use to configure and monitor one or more

Cisco Wireless LAN Controllers and associated access points. WCS has tools to facilitate
large-system monitoring and control. WCS runs on Windows 2000, Windows 2003, and Red Hat
Enterprise Linux ES servers.

Chapter 1 Overview

Note WCS software release 4.0 must be used with controllers running controller software release

4.0. Do not attempt to use older versions of WCS software with controllers running
controller software release 4.0.

• An industry-standard SNMP V1, V2c, and V3 interface can be used with any SNMP-compliant

third-party network management system.

The Cisco UWN Solution supports client data services, client monitoring and control, and all rogue
access point detection, monitoring, and containment functions. It uses lightweight access points, Cisco
Wireless LAN Controllers, and the optional Cisco WCS to provide wireless services to enterprises and
service providers.

Note Unless otherwise noted, all of the Cisco wireless LAN controllers are hereafter referred to as controllers,

and all of the Cisco lightweight access points are hereafter referred to as access points.

Cisco Wireless LAN Controller Configuration Guide

1-2

OL-9141-03

Chapter 1 Overview

Cisco Unified Wireless Network Solution Overview

Figure 1-1 shows the Cisco Wireless LAN Solution components, which can be simultaneously deployed

across multiple floors and buildings.

Figure 1-1 Cisco UWN Solution Components

Single-Controller Deployments

A standalone controller can support lightweight access points across multiple floors and buildings
simultaneously, and supports the following features:

• Autodetecting and autoconfiguring lightweight access points as they are added to the network.

• Full control of lightweight access points.

• Full control of up to 16 wireless LAN (SSID) policies for Cisco 1000 series access points.

Note LWAPP-enabled access points support up to 8 wireless LAN (SSID) policies.

• Lightweight access points connect to controllers through the network. The network equipment may

or may not provide Power over Ethernet to the access points.

Note that some controllers use redundant Gigabit Ethernet connections to bypass single network failures.

Note Some controllers can connect through multiple physical ports to multiple subnets in the network. This

feature can be helpful when operators want to confine multiple VLANs to separate subnets.

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

1-3

Cisco Unified Wireless Network Solution Overview

Figure 1-2 shows a typical single-controller deployment.

Figure 1-2 Single-Controller Deployment

Chapter 1 Overview

Multiple-Controller Deployments

Each controller can support lightweight access points across multiple floors and buildings
simultaneously. However, full functionality of the Cisco Wireless LAN Solution is realized when it
includes multiple controllers. A multiple-controller system has the following additional features:

• Autodetecting and autoconfiguring RF parameters as the controllers are added to the network.

• Same-Subnet (Layer 2) Roaming and Inter-Subnet (Layer 3) Roaming.

• Automatic access point failover to any redundant controller with a reduced access point load (refer

to the “Cisco Wireless LAN Controller Failover Protection” section on page 1-16).

Cisco Wireless LAN Controller Configuration Guide

1-4

OL-9141-03

Chapter 1 Overview

Operating System Software

Figure 1-3 shows a typical multiple-controller deployment. The figure also shows an optional dedicated

Management Network and the three physical connection types between the network and the controllers.

Figure 1-3 Typical Multi-Controller Deployment

Operating System Software

The operating system software controls Cisco Wireless LAN Controllers and Cisco 1000 Series
Lightweight Access Points. It includes full operating system security and Radio Resource Management
(RRM) features.

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

1-5

Operating System Security

Operating System Security

Operating system security bundles Layer 1, Layer 2, and Layer 3 security components into a simple,
Cisco WLAN Solution-wide policy manager that creates independent security policies for each of up to
16 wireless LANs. (Refer to the “Cisco UWN Solution WLANs” section on page 1-12.)

The 802.11 Static WEP weaknesses can be overcome using robust industry-standard security solutions,
such as:

• 802.1X dynamic keys with extensible authentication protocol (EAP).

• Wi-Fi protected access (WPA) dynamic keys. The Cisco WLAN Solution WPA implementation

includes:

–

Temporal key integrity protocol (TKIP) + message integrity code checksum (Michael) dynamic
keys, or

–

WEP keys, with or without Pre-Shared key Passphrase.

• RSN with or without Pre-Shared key.

• Cranite FIPS140-2 compliant passthrough.

• Fortress FIPS140-2 compliant passthrough.

Chapter 1 Overview

• Optional MAC Filtering.

The WEP problem can be further solved using industry-standard Layer 3 security solutions, such as:

• Passthrough VPNs

• The Cisco Wireless LAN Solution supports local and RADIUS MAC Address filtering.

• The Cisco Wireless LAN Solution supports local and RADIUS user/password authentication.

• The Cisco Wireless LAN Solution also uses manual and automated Disabling to block access to

network services. In manual Disabling, the operator blocks access using client MAC addresses. In
automated Disabling, which is always active, the operating system software automatically blocks
access to network services for an operator-defined period of time when a client fails to authenticate
for a fixed number of consecutive attempts. This can be used to deter brute-force login attacks.

These and other security features use industry-standard authorization and authentication methods to
ensure the highest possible security for your business-critical wireless LAN traffic.

Cisco WLAN Solution Wired Security

Many traditional access point vendors concentrate on security for the Wireless interface similar to that
described in the “Operating System Security” section on page 1-6. However, for secure Cisco Wireless
LAN Controller Service Interfaces, Cisco Wireless LAN Controller to access point, and inter-Cisco
Wireless LAN Controller communications during device servicing and client roaming, the operating
system includes built-in security.

Each Cisco Wireless LAN Controller and Cisco 1000 series lightweight access point is manufactured
with a unique, signed X.509 certificate. These signed certificates are used to verify downloaded code
before it is loaded, ensuring that hackers do not download malicious code into any Cisco Wireless LAN
Controller or Cisco 1000 series lightweight access point.

Cisco Wireless LAN Controller Configuration Guide

1-6

OL-9141-03

Chapter 1 Overview

Layer 2 and Layer 3 LWAPP Operation

The LWAPP communications between Cisco Wireless LAN Controller and Cisco 1000 series
lightweight access points can be conducted at ISO Data Link Layer 2 or Network Layer 3.

Note The IPv4 network layer protocol is supported for transport through an LWAPP controller system. IPv6

(for clients only) and AppleTalk are also supported but only on 4400 series controllers and the Cisco
WiSM. Other Layer 3 protocols (such as IPX, DECnet Phase IV, OSI CLNP, and so on) and Layer 2
(bridged) protocols (such as LAT and NetBeui) are not supported.

Operational Requirements

The requirement for Layer 2 LWAPP communications is that the Cisco Wireless LAN Controller and
Cisco 1000 series lightweight access points must be connected to each other through Layer 2 devices on
the same subnet. This is the default operational mode for the Cisco Wireless LAN Solution. Note that
when the Cisco Wireless LAN Controller and Cisco 1000 series lightweight access points are on
different subnets, these devices must be operated in Layer 3 mode.

The requirement for Layer 3 LWAPP communications is that the Cisco Wireless LAN Controllers and
Cisco 1000 series lightweight access points can be connected through Layer 2 devices on the same
subnet, or connected through Layer 3 devices across subnets. Another requirement is that the IP
addresses of access points should be either statically assigned or dynamically assigned through an
external DHCP server.

Note that all Cisco Wireless LAN Controllers in a mobility group must use the same LWAPP Layer 2 or
Layer 3 mode, or you will defeat the Mobility software algorithm.

Layer 2 and Layer 3 LWAPP Operation

Configuration Requirements

When you are operating the Cisco Wireless LAN Solution in Layer 2 mode, you must configure a
management interface to control your Layer 2 communications.

When you are operating the Cisco Wireless LAN Solution in Layer 3 mode, you must configure an
AP-manager interface to control Cisco 1000 series lightweight access points and a management interface
as configured for Layer 2 mode.

Cisco Wireless LAN Controllers

When you are adding Cisco 1000 series lightweight access points to a multiple Cisco Wireless LAN
Controller deployments network, it is convenient to have all Cisco 1000 series lightweight access points
associate with one master controller on the same subnet. That way, the operator does not have to log into
multiple controllers to find out which controller newly-added Cisco 1000 series lightweight access
points associated with.

One controller in each subnet can be assigned as the master controller while adding lightweight access
points. As long as a master controller is active on the same subnet, all new access points without a
primary, secondary, and tertiary controller assigned automatically attempt to associate with the master
Cisco Wireless LAN Controller. This process is described in the “Cisco Wireless LAN Controller

Failover Protection” section on page 1-16.

OL-9141-03

Cisco Wireless LAN Controller Configuration Guide

1-7

Cisco Wireless LAN Controllers

The operator can monitor the master controller using the WCS Web User Interface and watch as access
points associate with the master controller. The operator can then verify access point configuration and
assign a primary, secondary, and tertiary controller to the access point, and reboot the access point so it
reassociates with its primary, secondary, or tertiary controller.

Note Lightweight access points without a primary, secondary, and tertiary controller assigned always search

for a master controller first upon reboot. After adding lightweight access points through the master
controller, assign primary, secondary, and tertiary controllers to each access point. Cisco recommends
that you disable the master setting on all controllers after initial configuration.

Primary, Secondary, and Tertiary Controllers

In multiple-controller networks, lightweight access points can associate with any controller on the same
subnet. To ensure that each access point associates with a particular controller, the operator can assign
primary, secondary, and tertiary controllers to the access point.

When a primed access point is added to a network, it looks for its primary, secondary, and tertiary
controllers first, then a master controller, then the least-loaded controller with available access point
ports. Refer to the “Cisco Wireless LAN Controller Failover Protection” section on page 1-16 for more
information.

Chapter 1 Overview

Client Location

When you use Cisco WCS in your Cisco Wireless LAN Solution, controllers periodically determine
client, rogue access point, rogue access point client, radio frequency ID (RFID) tag location and store
the locations in the Cisco WCS database. For more information on location solutions, refer to the Cisco
Wireless Control System Configuration Guide and the Cisco Location Appliance Configuration Guide at
these URLs:

Cisco Wireless Control System Configuration Guide:

http://www.cisco.com/en/US/products/ps6305/products_installation_and_configuration_guides_list.ht
ml

Cisco Location Appliance Configuration Guide:

http://www.cisco.com/en/US/products/ps6386/products_installation_and_configuration_guides_list.ht
ml

Cisco Wireless LAN Controller Configuration Guide

1-8

OL-9141-03