SMC Networks EliteConnect SMC2891W-AG, EliteConnect SMC2890W-AG, 2890W-AG, 2891W-AG User Manual

Download

Page 1

USER GUIDE

SMC2890W-AG /

SMC2891W-AG

Elite Connect™

802.11a/g Outdoor Enterprise Access Point

Page 2

EliteConnect

™

SMC2890W-AG and SMC2891W-AG Universal 2.4GHz/ 5GHz Wireless Dual-Band Outdoor Access Point

The easy way to make all your network connections

20 Mason, Irvine, CA 92618 Phone: (949) 679-8000

February 2007 Revision Number: R01 F1.0.0.1

Page 3

Information furnished by SMC Networks, Inc. (SMC) is believed to be accurate and reliable. However, no responsibility is assumed by SMC for its use, nor for any infringements of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent or patent rights of SMC. SMC reserves the right to change specifications at any time without notice.

SMC Networks, Inc.

20 Mason

Irvine, CA 92618

Trademarks:

SMC is a registered trademark; and EliteConnect is a trademark of SMC Networks, Inc. Other product and company names are trademarks or registered trademarks of their respective holders.

Page 4

Compliances

Federal Communication Commission Interference Statement

This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one of the following measures:

• Reorient or relocate the receiving antenna

• Increase the separation between the equipment and receiver

• Connect the equipment into an outlet on a circuit different from that to which the receiver is connected

• Consult the dealer or an experienced radio/TV technician for help

FCC Caution: Any changes or modifications not expressly approved by the party responsible for compliance could void the user’s authority to operate this equipment. This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation.

IMPORTANT NOTE: FCC Radiation Exposure Statement

This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with a minimum distance of 20 centimeters (8 inches) between the radiator and your body. This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter.

Wireless 5 GHz Band Statement:

As the access point can operate in the 5150-5250 MHz frequency band it is limited by the FCC, Industry Canada and some other countries to indoor use only so as to reduce the potential for harmful interference to co-channel Mobile Satellite systems.

High power radars are allocated as primary users (meaning they have priority) of the 5250-5350 MHz and 5650-5850 MHz bands. These radars could cause interference and/ or damage to the access point.

Page 5

VCCI Notice

This is a class A product based on the standard of the Voluntary Control Council for Interference by Information Technology Equipment (VCCI). If this equipment is used in a domestic environment, radio disturbance may arise. When such trouble occurs, the user may be required to take corrective actions.

EC Conformance Declaration

Marking by the above symbol indicates compliance with the Essential Requirements of the R&TTE Directive of the European Union (1999/5/EC). This equipment meets the following conformance standards:

• EN 60950 (IEC 60950) - Product Safety

• EN 301 893 - Technical requirements for 5 GHz radio equipment

• EN 300 328 - Technical requirements for 2.4 GHz radio equipment

• EN 301 489-1 / EN 301 489-17 - EMC requirements for radio equipment

Countries of Operation & Conditions of Use in the European Community

This device is intended to be operated in all countries of the European Community. Requirements for indoor vs. outdoor operation, license requirements and allowed channels of operation apply in some countries as described below:

Note:

• This device requires that the user or installer properly enter the current country of

• This device will automatically limit the allowable channels determined by the current

The user must use the configuration utility provided with this product to ensure the channels of operation are in conformance with the spectrum usage rules for European Community countries as described below.

operation in the command line interface as described in the user guide, before operating this device.

country of operation. Incorrectly entering the country of operation may result in illegal operation and may cause harmful interference to other system. The user is obligated to ensure the device is operating according to the channel limitations, indoor/outdoor restrictions and license requirements for each European Community country as described in this document.

Page 6

• This device employs a radar detection feature required for European Community operation in the 5 GHz band. This feature is automatically enabled when the country of operation is correctly configured for any European Community country. The presence of nearby radar operation may result in temporary interruption of operation of this device. The radar detection feature will automatically restart operation on a channel free of radar.

• The 5 GHz Turbo Mode feature is not allowed for operation in any European Community country. The current setting for this feature is found in the 5 GHz 802.11a Radio Settings Window as described in the user guide.

• The 5 GHz radio's Auto Channel Select setting described in the user guide must always remain enabled to ensure that automatic 5 GHz channel selection complies with European requirements. The current setting for this feature is found in the 5 GHz

802.11a Radio Settings Window as described in the user guide.

• This device may be operated indoors or outdoors in all countries of the European Community using the 2.4 GHz band: Channels 1 - 13, except where noted below.

- In Italy the end-user must apply for a license from the national spectrum authority to

operate this device outdoors.

- In Belgium outdoor operation is only permitted using the 2.46 - 2.4835 GHz band:

Channel 13.

- In France outdoor operation is only permitted using the 2.4 - 2.454 GHz band:

Channels 1 - 7

Operation Using 5 GHz Channels in the European Community

The user/installer must use the provided configuration utility to check the current channel of operation and make necessary configuration changes to ensure operation occurs in conformance with European National spectrum usage laws as described below and elsewhere in this document.

Allowed 5GHz Channels in Each European Community Country Allowed Frequency Bands Allowed Channel Numbers Countries

5.15 - 5.25 GHz* 36, 40, 44, 48 Austria, Belgium

5.15 - 5.35 GHz* 36, 40, 44, 48, 52, 56, 60, 64 France, Switzerland, Liechtenstein

5.15 - 5.35* & 5.470 - 5.725

GHz

36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140

Denmark, Finland, Germany, Iceland, Ireland, Italy, Luxembourg, Netherlands, Norway, Portugal, Spain, Sweden, U.K.

iii

Page 7

Allowed 5GHz Channels in Each European Community Country Allowed Frequency Bands Allowed Channel Numbers Countries

5 GHz Operation Not Allowed None Greece * Outdoor operation is not allowed using 5.15-5.35 GHz bands (Channels 36 - 64).

Channels 36 - 64 are currently not available for use.

Safety Compliance

Power Cord Safety

Please read the following safety information carefully before installing the device:

Warning:

• The unit must be connected to an earthed (grounded) outlet to comply with international safety standards.

• Do not connect the unit to an A.C. outlet (power supply) without an earth (ground) connection.

• The appliance coupler (the connector to the unit and not the wall plug) must have a configuration for mating with an EN 60320/IEC 320 appliance inlet.

• The socket outlet must be near to the unit and easily accessible. You can only remove power from the unit by disconnecting the power cord from the outlet.

• This unit operates under SELV (Safety Extra Low Voltage) conditions according to IEC

60950. The conditions are only maintained if the equipment to which it is connected also operates under SELV conditions.

France and Peru only

This unit cannot be powered from IT must be powered by 230 V (2P+T) via an isolation transformer ratio 1:1, with the secondary connection point labelled Neutral, connected directly to earth (ground).

†

Impédance à la terre

Important! Before making connections, make sure you have the correct cord set. Check it (read the label on the cable) against the following:

Installation and removal of the unit must be carried out by qualified personnel only.

†

supplies. If your supplies are of IT type, this unit

Page 8

Power Cord Set

U.S.A. and Canada

Denmark The supply plug must comply with Section 107-2-D1, Standard

Switzerland The supply plug must comply with SEV/ASE 1011. U.K. The supply plug must comply with BS1363 (3-pin 13 A) and be

Europe The supply plug must comply with CEE7/7 (“SCHUKO”).

The cord set must be UL-approved and CSA certified. The minimum specifications for the flexible cord are:

- No. 18 AWG - not longer than 2 meters, or 16 AWG.

- Type SV or SJ

- 3-conductor The cord set must have a rated current capacity of at least 10 A The attachment plug must be an earth-grounding type with

NEMA 5-15P (15 A, 125 V) or NEMA 6-15P (15 A, 250 V) configuration.

DK2-1a or DK2-5a.

fitted with a 5 A fuse which complies with BS1362. The mains cord must be <HAR> or <BASEC> marked and be of

type HO3VVF3GO.75 (minimum).

The mains cord must be <HAR> or <BASEC> marked and be of type HO3VVF3GO.75 (minimum).

IEC-320 receptacle.

Veuillez lire à fond l'information de la sécurité suivante avant d'installer l’appareil: AVERTISSEMENT: L’installation et la dépose de ce groupe doivent être confiés à un

personnel qualifié.

• Ne branchez pas votre appareil sur une prise secteur (alimentation électrique) lorsqu'il

n'y a pas de connexion de mise à la terre (mise à la masse).

• Vous devez raccorder ce groupe à une sortie mise à la terre (mise à la masse) afin de

respecter les normes internationales de sécurité.

• Le coupleur d’appareil (le connecteur du groupe et non pas la prise murale) doit

respecter une configuration qui permet un branchement sur une entrée d’appareil EN 60320/IEC 320.

• La prise secteur doit se trouver à proximité de l’appareil et son accès doit être facile.

Vous ne pouvez mettre l’appareil hors circuit qu’en débranchant son cordon électrique au niveau de cette prise.

Page 9

• L’appareil fonctionne à une tension extrêmement basse de sécurité qui est conforme à la norme IEC 60950. Ces conditions ne sont maintenues que si l’équipement auquel il est raccordé fonctionne dans les mêmes conditions.

France et Pérou uniquement:

Ce groupe ne peut pas être alimenté par un dispositif à impédance à la terre. Si vos alimentations sont du type impédance à la terre, ce groupe doit être alimenté par une tension de 230 V (2 P+T) par le biais d’un transformateur d’isolement à rapport 1:1, avec un point secondaire de connexion portant l’appellation Neutre et avec raccordement direct à la terre (masse).

Cordon électrique - Il doit être agréé dans le pays d’utilisation

Etats-Unis et Canada:

Danemark: La prise mâle d’alimentation doit respecter la section 107-2 D1

Suisse: La prise mâle d’alimentation doit respecter la norme SEV/ASE

Europe La prise secteur doit être conforme aux normes CEE 7/7

Le cordon doit avoir reçu l’homologation des UL et un certificat de la CSA.

Les spécifications minimales pour un cable flexible sont AWG No. 18, ouAWG No. 16 pour un cable de longueur inférieure à 2 mètres.

- type SV ou SJ

- 3 conducteurs Le cordon doit être en mesure d’acheminer un courant nominal

d’au moins 10 A. La prise femelle de branchement doit être du type à mise à la

terre (mise à la masse) et respecter la configuration NEMA 5-15P (15 A, 125 V) ou NEMA 6-15P (15 A, 250 V).

de la norme DK2 1a ou DK2 5a.

1011.

(“SCHUKO”) LE cordon secteur doit porter la mention <HAR> ou <BASEC> et

doit être de type HO3VVF3GO.75 (minimum).

Page 10

Bitte unbedingt vor dem Einbauen des Geräts die folgenden Sicherheitsanweisungen durchlesen

WARNUNG: Die Installation und der Ausbau des Geräts darf nur durch Fachpersonal

erfolgen.

• Das Gerät sollte nicht an eine ungeerdete Wechselstromsteckdose angeschlossen

werden.

• Das Gerät muß an eine geerdete Steckdose angeschlossen werden, welche die

internationalen Sicherheitsnormen erfüllt.

• Der Gerätestecker (der Anschluß an das Gerät, nicht der Wandsteckdosenstecker) muß

einen gemäß EN 60320/IEC 320 konfigurierten Geräteeingang haben.

• Die Netzsteckdose muß in der Nähe des Geräts und leicht zugänglich sein. Die

Stromversorgung des Geräts kann nur durch Herausziehen des Gerätenetzkabels aus der Netzsteckdose unterbrochen werden.

• Der Betrieb dieses Geräts erfolgt unter den SELV-Bedingungen

(Sicherheitskleinstspannung) gemäß IEC 60950. Diese Bedingungen sind nur gegeben, wenn auch die an das Gerät angeschlossenen Geräte unter SELV-Bedingungen betrieben werden.

(Germany):

vii

Page 11

Stromkabel. Dies muss von dem Land, in dem es benutzt wird geprüft werden:

U.S.A und Canada Der Cord muß das UL gepruft und war das CSA beglaubigt.

Das Minimum spezifikation fur der Cord sind:

- Nu. 18 AWG - nicht mehr als 2 meter, oder 16 AWG.

- Der typ SV oder SJ

- 3-Leiter Der Cord muß haben eine strombelastbarkeit aus wenigstens

10 A Dieser Stromstecker muß hat einer erdschluss mit der typ

NEMA 5-15P (15A, 125V) oder NEMA 6-15P (15A, 250V) konfiguration.

Danemark Dieser Stromstecker muß die ebene 107-2-D1, der standard

DK2-1a oder DK2-5a Bestimmungen einhalten.

Schweiz Dieser Stromstecker muß die SEV/ASE 1011Bestimmungen

einhalten.

Europe Das Netzkabel muß vom Typ HO3VVF3GO.75

(Mindestanforderung) sein und die Aufschrift <HAR> oder <BASEC> tragen.

Der Netzstecker muß die Norm CEE 7/7 erfüllen (”SCHUKO”).

viii

Page 12

Table of Contents

Chapter 1: Introduction 1-1

Radio Characteristics 1-1 Package Checklist 1-2 Hardware Description 1-2 LED Indicators 1-3 Integrated High-Gain Antenna 1-5 External Antenna Options 1-5 Ethernet Port 1-6 Power Injector Module 1-6 Grounding Point 1-7 Water Tight Test Point 1-7 Wall- and Pole-Mounting Bracket Kit 1-7 System Configuration 1-8 Features and Benefits 1-8

Chapter 2: Network Configuration 2-1

Access Point Topologies 2-1

Infrastructure Wireless LAN 2-2 Infrastructure Wireless LAN for Roaming Wireless PCs 2-3

Bridge Link Topologies 2-4

Point-to-Point Configuration 2-4 Point-to-Multipoint Configuration 2-5

Chapter 3: Bridge Link Planning 3-1

Data Rates 3-1 Radio Path Planning 3-1

Antenna Height 3-2 Antenna Position and Orientation 3-4 Radio Interference 3-5

Weather Conditions 3-5 Ethernet Cabling 3-5 Grounding 3-6

Chapte r 4: Hardware Installation 4-1

Testing Basic Link Operation 4-1 Mount the Unit 4- 1

Page 13

Contents

Mounting to a Wall 4-4 Connect External Antennas 4-5 Connect Cables to the Unit 4-6 Connect the Power Injector 4-7 Align Antennas 4-8

Chapter 5: Initial Configuration 5-1

Initial Setup through the CLI 5-1

Required Connections 5-1 Initial Configuration Steps 5-2

Logging In 5-3

Chapter 6: System Configuration 6-1

Advanced Confi gur atio n 6-2

System Identification 6-3 TCP / IP Settings 6-5 RADIUS 6-7 SSH Settings 6-11 Authentication 6-12 Filter Control 6-17 VLAN 6-19 WDS Settings 6-21 AP Management 6-27 Administration 6-28 System Log 6-33 RSSI 6-37

SNMP 6-40

Configuring SNMP and Trap Message Parameters 6-41 Configuring SNMPv3 Users 6-46 Configuring SNMPv3 Trap Filters 6-48 Configuring SNMPv3 Targets 6-50

Radio Interface 6- 51

Radio Settings A (802.11a) 6-53 Radio Settings G (802.11g) 6-68 Security 6-70

Status Information 6-88

Access Po int Status 6-88 Station Status 6-91 Event Logs 6-93 STP Status 6-95

Page 14

Contents

Chapter 7: Command Line I nterfac e 7-1

Using the Command Line Interface 7-1

Accessing the CLI 7-1

Console Connection 7-1

Telnet Connection 7-1 Entering Commands 7-2

Keywords and Arguments 7-2

Minimum Abbreviation 7-2

Command Completion 7-3

Getting Help on Commands 7-3

Partial Keyword Lookup 7-4

Negating the Effect of Commands 7-4

Using Command History 7-4

Understanding Command Modes 7-4

Exec Commands 7-5

Configuration Commands 7-5

Command Line Processing 7-6 Command Groups 7-6 General Commands 7-7

configure 7-8

end 7-8

exit 7-8

ping 7-9

reset 7-10

show history 7-10

show line 7-11 System Management Commands 7-11

country 7-12

prompt 7-14

system name 7-14

username 7-15

password 7-15

ip ssh-server enable 7-16

ip ssh-server port 7-16

ip telnet-server enable 7-17

ip http port 7-17

ip http server 7-18

ip http session-time out 7-18

ip https port 7-19

ip https server 7-1 9

web-redirect 7-20

APmgmtIP 7-21

APmgmtUI 7-22

show apmanagement 7-22

Page 15

Contents

show system 7-24 show version 7-25 show config 7-25 show hardware 7-29

System Logging Commands 7-29

logging on 7-30 logging host 7-30 logging console 7-31 logging level 7-31 loggin g facility-type 7-32 logging clear 7-33 show logging 7-33 show event-log 7-34

System Clock Commands 7-34

sntp-server ip 7-35 sntp-server enable 7-35 sntp-server date-time 7-36 sntp-server daylight-saving 7-37 sntp-server timezone 7-37 show sntp 7-38

DHCP Relay Commands 7-39

dhcp-relay enable 7-39 dhcp-relay 7-40 show dhcp-relay 7-40

SNMP Commands 7-41

snmp-server community 7-42 snmp-server contact 7-42 snmp-server location 7-43 snmp-server enable server 7-43 snmp-server host 7-44 snmp-server trap 7-45 snmp-server engine-id 7-46 snmp-server user 7-47 snmp-server targets 7-49 snmp-server filter 7-50 snmp-server filter-assignments 7-51 show snmp groups 7-51 show snmp users 7-52 show snmp group-assignments 7-52 show snmp target 7-53 show snmp filter 7-53 show snmp filter-assignments 7-54 show snmp 7-55

Flash/File Commands 7-56

bootfile 7-56

xii

Page 16

Contents

copy 7-57

delete 7-58

dir 7-59

show bootfile 7-59 RADIUS Client 7-60

radius-server address 7-60

radius-server port 7-61

radius-server key 7-61

radius-server retransmit 7-62

radius-server timeout 7-62

radius-server port-accounting 7-63

radius-server timeout-interim 7-63

radius-server radius-mac-format 7-64

radius-server vlan-format 7-64

show radius 7-65

802.1X A uthentication 7-66

802.1x 7-66

802.1x broadcast-key-refresh-rate 7-67

802.1x se ssion-key- refresh-rate 7-68

802.1x session-timeout 7-68

802.1x-supplicant enable 7-69

802.1x-supplicant user 7-69

show authentication 7-70 MAC Address Authentication 7-71

address filter default 7-71

address filter entry 7-72

address filter delete 7-72

mac-authentication server 7-73

mac-authentication session-timeout 7-73 Filtering Commands 7-74

filter local-bridge 7-75

filter ap-manage 7-75

filter uplink enable 7-76

filter uplink 7-76

filter ethernet-type enable 7-76

filter ethernet-type protocol 7-77

show filters 7-78 WDS Bridge Commands 7-78

bridge mode 7-79

bridge role (WDS) 7-79

bridge channel-auto-sync 7-80

bridge-link parent 7-80

bridge-link child 7-81

bridge dynamic-entry age-time 7-82

show bridge aging-time 7-82

xiii

Page 17

Contents

show bridge filter-entry 7-83 show bridge link 7-83

Spanning Tree Commands 7-85

bridge stp enable 7-85 bridge stp forwarding-delay 7-86 bridge stp hello-time 7-86 bridge stp max-age 7-87 bridge stp priority 7-87 bridge-link path-cost 7-88 bridge-link port-priority 7-88 show bridge stp 7-89

Ethernet Interface Commands 7-90

interface ethernet 7-90 dns server 7-91 ip address 7-91 ip dhcp 7-92 speed-duplex 7-93 shutdown 7-94 show interface ethernet 7-94

Wireless Interfac e Comm and s 7-95

interface wireless 7-97 vap 7-97 speed 7-98 turbo 7-98 multicast-data-rate 7-99 channel 7-100 transmit-power 7-100 radio-mode 7-101 preamble 7-102 antenna control 7-103 antenna id 7-103 antenna location 7-104 beacon-interval 7-105 dtim-period 7-105 fragmentation-length 7-106 rts-threshold 7-107 super-a 7-108 super-g 7-108 description 7-109 ssid 7-109 closed-system 7-110 max-association 7-110 assoc-timeout-interval 7-111 auth-timeout-value 7-111 shutdown 7-111

xiv

Page 18

Contents

show interface wireless 7-113

show station 7-115 Rogue AP Detection Commands 7-116

rogue-ap enable 7-116

rogue-ap authenticate 7-117

rogue-ap duration 7-118

rogue-ap interval 7-118

rogue-ap scan 7-119

show rogue-ap 7-120 Wireless Security Comm and s 7-120

auth 7-121

encryption 7-123

key 7-124

transmit-key 7-125

cipher-suite 7-126

mic_mode 7-127

wpa-pre-shared-key 7-128

pmksa-lifetime 7-128

pre-authentication 7-129 Link Integrity Commands 7-130

link-integrity ping-detect 7-131

link-integrity ping-host 7-131

link-integrity ping-interval 7-132

link-integrity ping-fail-retry 7-132

link-integrity ethernet-detect 7-132

show link-integrity 7-133 IAPP Commands 7-134

iapp 7-134 VLAN Commands 7-135

vlan 7-135

management-vlanid 7-136

vlan-id 7-136 WMM Commands 7-137

wmm 7-138

wmm-acknowledge-policy 7-138

wmmparam 7-139

Appendix A: Troubleshooting A-1

Appendix B: Cables and Pinouts B-1

Twisted-Pair Cable Assignments B-1

10/100BASE-TX Pin Assignments B-1

Straight-Through Wiring B-2

Page 19

Contents

Crossover Wiring B-3 8-Pin DIN Connector Pinout B-3 8-Pin DIN to RJ-45 Cable Wiring B-4

Appendix C: Specifications C-1

General Specifications C-1 Sensitivity C-4 Transmit Power C-5

Appendix D: Montieren der Bridge D-1

Verwenden der Halterung für Mastmontage D-1 Verwenden der Halterung für Wandmontage D-3 Anschließen der externen Antennen D-5 Anschließen der Kabel an das Gerät D-6 Anschließen des PoE Inject ors D-7

Glossary

Index

xvi

Page 20

Chapter 1: Introduction

The Dual-band Outdo or Acc ess Point / Bridge system con si sts of tw o m odels that provide point-to- poi nt or poi nt - to -multipoint bridge links between remote E thernet LANs, and wireles s access point services for clients in the local LAN ar ea:

• SMC2891W-AG – Includes an integrated high-gain antenna for the 802.11a radio and is designed to operate as a “bridge node” in point-to-multipoint configurations, or provide a high-speed point-to-point wireless link between two sites that can be up to 15.4 km (9.6 miles) apart. The 802.11b/g radio requires an external antenna option.

• SMC2890W-AG – Provides only ex ternal antenna options and i s de si gned to operate as the “root br id ge” in poi nt-to-multipoint conf i gur at ions, supporting wireless bridge connections to as many as six units.

Note: Both models can be set to operate in either “root bridge” or “bridge node” mode.

Each model is hous ed in a weatherproof encl os ur e f or mounting outdoors and includes its own brackets for attaching to a wall, pole, radio mast, or tower structure. The unit is powered th ro ugh its Ethernet cable connec tion from a power injector module that is installe d indoors.

The wireless bridge system offers a fast, reliable, and cost-effective solution for connectivity bet ween remote Ethernet w ired LANs or to provide Inte rn et access to an isolated site. The system is also easy to in stall and operate, ideal for situ at i ons where a wired link may be difficult or expensive to deploy. The wireless bridge connection prov id es data rates of up to 108 Mbps.

In addition, both wireless bridge mode ls offer full network ma na gem e nt capabilities through an easy -to- use web interface, a com m and-line interface , an d support for Simple Network Managemen t Protocol (SNMP) t ools.

Radio Characteristics

The IEEE 802.11a and 802.11g standards use a radi o m odulation techniq ue kn ow n as Orthogonal F re quency Division Multi plexing (OFDM), and a shared collision domain (CSMA/ CA ) . Th e 802 . 11a standard operates in the 5 GH z U n licensed National Informat i on Infrastructure (UN I I) band, and the 802.11g standard in the

2.4 GHz band.

IEEE 802.11g includes backward compatibi lity w i th th e IE EE 802.11b standard. IEEE 802.11b also operates at 2.4 GHz, but uses D irec t Se qu ence Spread Spectrum (DSSS) and Complem enta ry Code Keying (CCK) modul at ion t echnology to achieve a communication rate of up to 11 Mbps.

The wireless bridge pro vi des a 54 Mbps half-duplex con nection for each active channel (up to 108 M bps in turbo mode on the 802.11a interface).

1-1

Page 21

Introduction

Package Checklist

The Dual-band Outdo or Access Point / Bridge packag e incl udes:

• One Wireless Dual-band Access Point (SMC 2890W-AG or SMC2891W-AG)

• One Category 5e network PoE cable, length 98 ft (30 m )

• One power injector module and power cord 5.9 ft (1.8 m)

• One RS232 console cable 5.9ft (1.8 m)

• Outdoor pole- and wall- m ounting bracket kit

• User Guide CD Inform your deal er if the re are any incorrect, missing or damaged parts. If possible,

retain the carton, including the original packing materials. Use them again to repack the product in case t her e i s a need to return it.

Hardware Description

Bottom View (both models)

Console Port CoverAttachment

Top View (SMC2891W-AG)

Console Port

Ethernet/PoE Connector

Water-Tight Test Point (DO NOT REMOVE)

Integrated Anten na

N-Type External Antenna Connector (2.4 GHz)

1-2

N-Type External Antenna Conne ctor (5 GHz)

N-Type Exter nal Antenna Connect or (2.4 GHz)

Page 22

Top View (SMC2890W-AG)

LED Indicators

N-Type External Antenna Connector (2.4 GHz) Right Antenna

N-Type Exter nal Antenna Connecto r (5 GHz) Right Antenna

N-Type Exter nal Antenna Connect or (5 GHz) Left Antenna

N-Type External Antenna Connector (2.4 GHz) Left Antenna

LED Indicators

The access point i ncludes eight status LED in dicators, as indicated i n th e fo l low i ng figure.

802.11b/g Wireless Link/Activity

11b/g

11a

802.11a Wireless Link/Activity

Power

Link

Power

Ethernet Link/Activity

The following table describes the system status LED s.

LED Status Description

Power On Gree n Indicates that the system is working normally.

On Amber Indicates a system reset.

Link On Green Indicates a valid 10/100 Mbps Ethernet cable link.

Flashing Green Indicates that the access point is transmitting or receiving data

on a 10/100 Mbps Ethernet LAN. Flashing rate is proportional to network activity.

1-3

Page 23

Introduction

The 11a and 11b/g LEDs operate in two display mo des, which are configur able through the management interface. The RSSI m ode is for aligning antennas in a bridge link. The AP mod e is for indi cating data traffic rates.

The following table desc ribes the wireless status LED s i n AP m od e.

LED Status Description

11a (three LEDs)

11b/g (three LEDs)

Off No signal detected or the 802.11a radio is disabled. Slow Flashing Green The 802.11a radio is enabled with a low level of network

activity. Fast Flashing Green Indicates a medium level of network activity. On Green Indicates a high level of network activity. Off No signal detected or the 802.11b/g radio is disabled. Slow Flashing Green The 802.11b/g radio is enabled with a low level of network

activity. Fast Flashing Green Indicates a medium level of network activity. On Green Indicates a high level of network activity.

The following table desc ribes the wireless status LED s i n RSSI m ode.

LED Status Description

11a (three LEDs)

Off No signal detected or the 802.11a radio is disabled. Slow Flashing Green The 802.11a radio is enabled with a low level signal. Fast Flashing Green Indicates a medium level signal. On Green Indicates a high level signal.

11b/g (three LEDs)

Off No signal detected or the 802.11b/g radio is disabled. Slow Flashing Green The 802.11b/g radio is enabled with a low level signal. Fast Flashing Green Indicates a medium level signal. On Green Indicates a high level signal.

1-4

Page 24

Introduction

Ethernet Port

The wireless bridge has one 10BAS E-T /1 00 BASE-TX 8-pin DIN port that connects to the power injector mo dul e u si ng t he inc luded Ethernet cable. The Ether net port connection prov id es power to the wireless bridge as well as a data link to th e l ocal network.

The wireless bridge appears as an Ethernet nod e and performs a bridging fun ct i on by moving packets from the wired LAN to the remote end of the wireless bridge link.

Note: The power injector module does not support Power over Ethernet (PoE) based on

the IEEE 802.3af standard. The wireless bridge unit must always be powered on by being connected to the power injector module.

Power Injector Module

The wire l ess bridge receiv es power th rough its network cable conn ection using power-over-Ethernet technology. A power injector module is included in the wireless bridge package and pr ovides two RJ-45 Ether net ports, one for connecting t o t he wireless bridge (Output), and the other for connecting to a local LAN s w itc h (Input).

The Input port uses an MDI (i.e., internal straight-through) pin configuration. You can therefore use straight-through twisted-pair cable to connect this port to most network interconnectio n devices such as a switc h or router that provide MDI -X ports. However, when connecting t he ac cess point to a workstati on or ot her device that does not have MDI-X ports, you must use cr ossover twisted-pair cabl e.

Ethernet from Local Network

LED Indicator

Input Output

Ethernet and Power to Wireless Bridge

AC Power Socket (Hidden)

The wireless bridge does not have a power sw it ch. It is powered on when its Ethernet port is connected to the power inj ect or m odule, and the power inj ect o r module is connec ted t o an AC power source. The pow er injector includes one LED indicator that turns on when AC power is appl i ed.

1-6

Page 25

Grounding Point

The power injecto r module automaticall y ad ju sts to any AC voltage between 100-240 volts at 50 or 60 Hz. No voltage range settings are required.

Warning: The power injector module is designed for indoor use only. Never mount

the power injector outside with the wireless br id ge uni t.

Grounding Point

Even though the wir el ess bridge includes its ow n built-in lightning protect i on, it is important that the unit is pro per l y co nnected to ground. A grounding screw is provided for attaching a gr ound wire to the unit.

Water Tight Test Point

Caution: Do no remove or loosen this sc re w. Doing so could lea d t o dam age of the

unit.

Wall- and Pole-Mounting Bracket Kit

The wireless bridge includes a bracket ki t tha t ca n be used to mount the brid ge t o a wall, pole, radio m ast , or part of a to w er st ru ct ur e.

1-7

Page 26

Introduction

System Configuration

At each location w her e a un i t is install ed, it must be connected t o t he local network using the power in je ctor module. The followi ng f ig ur e i llus trat es the system component co nnections.

External Antenna

RF Coaxial Cable

Wireless Bridge Unit

Ground Wire

LAN Switch

Ethernet Cable

AC Power

Power Injector

Indoor Outdoor

Ethernet

Cable

Lightning

Arrestor

Features and Benefits

• SMC2891W-AG units support a 5 GHz point-to-point wireless link up 15.4 km (at 6 Mbps data rate) using integrated high-gai n 17 dBi antennas

• SMC2890W-AG units su pport 5 GHz point-to- m ul ti poi nt lin ks using various external antenna options

• Both SMC2890W-AG and SMC2 891W-AG units also support acc ess point services for the 5 GHz and 2.4 GHz radios using various external antenna options

• Maximum data rate up to 108 Mbps on the 802.11a (5 GH z) radio

• Outdoor weatherproo f de si gn

• IEEE 802.11a and 802.11b/g compliant

• Local network connecti on via 10/100 Mbps Ether net port

• Powered through its Ethe rn et cab le con nection to the power injec to r module

• Includes wall- and pole -mount bracket

• Security through 64/128/ 152-bit Wired Equivalent Protection (WE P ) o r 12 8- bi t Advanced Encryp t ion St and ar d (AES) encryption

• Scans all available channels and selects the best channel and data rate based on the signal-to-n oise r at i o

• Manageable through an easy-to-use web -b ro w ser interface, comm and line (via Telnet), or SNMP network management tools

1-8

Page 27

Chapter 2: Network Configuration

The Dual-band Outdo or Acc ess Point / Bridge system pro vides access point and bridging service s t hro ugh either the 5 GHz or 2.4 G H z radio interfaces.

The wireless bridge units can be used just as nor m al 802.11a/b/g access poi nts connected to a local wired LAN, providing connectivity and roaming services for wireless clients in an ou tdoor ar ea. Units can also be used pu re l y as bridges connecting rem ote LANs. Alternatively, you can employ both access point and bridging functions to get her, offering a flexible and convenient wireless sol ut ion f or many applications.

This chapter desc ribe s t he r ol e of Dual - band Outdoor Access Point / Bri dge in various wirele ss net w or k configurations.

Access Point Topologies

Operat ing as an outdoor ac cess poin t , the unit is deplo yed in an int egrated configuration wi t h w ired Ethernet LANs, providing network a ccess to wireless stations in the wireles s coverage area.

The access point’s radios can support these m od es:

• Infrastructure wireless LAN

• Infrastructure wireless LAN with roaming

• Point-to-point bridge link

• Point-to-multi point bridge links The 802.11b and 802.11g frequency band, w hi ch operates at 2.4 GHz, can easily

encounter inte rfer ence from other 2.4 G Hz devices, such as oth er 802.11b or g wireless devices, cordless phones and microwave ovens. If you experience poor wireless LAN perf ormance, try the follow i ng measures:

• Limit any possible sources of radio interference within the service area

• Increase the distance between neighboring ac cess points

• Increase the channe l se parati on of n ei ghboring access poin ts (e.g ., up to 3 channels of separat ion f or 802.11b or up to 5 channels for 802.11g)

2-1

Page 28

Network Configuration

Infrastructure Wireless LAN

The access point fu nction of the wireless brid ge provides access to a wir ed L A N for

802.11a/b/g wireless workstations. An integrated wired/wireless LAN is called an Infrastructure conf ig ur at ion. A Bas ic Ser vice Set (BSS) consists of a group of wireless PC users a nd an access point that is di re ct ly connected to the wired LAN. Each wireless PC in a B SS can connect to any comput e r in its wir eless group or access other computers or networ k re sources in the wired LAN in frastructure through the acces s point.

The infrastructure configuration not only extends the accessibility of wireless PCs to the wired LAN, but als o in cr eases the effective wireless transmission range for wireless PCs by passi ng t hei r signals through one or mor e access points.

A wireless infrastr uct ur e can be used for acce ss t o a central database, or for connection between mobile worke rs , as shown in the following fig ur e.

Wired LAN Extension to Wireless Clients

Desktop PC

Server

Switch

Access Point

Notebook PC

Desktop PC

2-2

Page 29

Access Point To pologies

Infrastructure Wireless LAN for Roaming Wireless PCs

The Basic Service Set (BSS) defines the communications domain for each access point and its associate d wirel ess clients. The BSS ID is a 48-bit binary number based on the acce ss point’s wireless MAC address, and is set auto m at i cal ly and transparently as clients as sociate with the access point . The BSS ID is used in frames sent between the access point and its clients to identify traffic in the service area.

The BSS ID is only set by the access point, never by i ts clients. The clients only need to set the Service Set Identifier (SSID) that ide nti fies the ser vi ce set pr ovided by one or more access po in ts. The SSI D can be manually configured by the clients, can be detected in an access point’s beacon, or can be obtained by querying for the identity of the nearest access point. For clients that do not need to roam, set the SSID for the wireless card to that used by the acc ess point to which you want to connect.

A wireless infrastructure can also support roaming for mobile workers. More than one access point ca n be configured to create an Ext ended Service Set (ESS). B y placing the acce ss points so that a continuous coverage area is created, wireless users within this ESS can roam freely. All wireless network card adapter s and wireless access points within a specific ESS must be con f igur ed with the same SSID.

Desktop PC

Switch

Access Point

Desktop PC

Server

Notebook PC

<BSS 1>

Seamless Roaming

Between Access Points

Switch

Access Point

Notebook PC

<BSS 2>

<ESS>

2-3

Page 30

Network Configuration

Bridge Link Topologies

The IEEE 802.11 standard defines a WIreless Distribution System (WDS) for bridge connections bet w ee n BSS areas (access po in ts). The outdo or wir eless bridge uses WDS to forward traffic on links between units. Up to 5 WDS links can be specified for a SMC2890W-AG unit, w hich acts as the “Master” in the wire less bridge network. Other SMC2891 W-AG units su pport only one WDS link , whi c h m ust be to the networ k’s master unit.

The unit supports WDS br id ge li nks on either the 5 GHz (802. 11a) or 2.4 GHz (802.11b/g) bands and can be used with various external antennas to offer flexible deployment opti ons.

Note: The external antennas offer longer range options using the 5 GHz radio, which

makes this interface more suitable for bridge links. The 2.4GHz radio has various types of antenna options, but the 8dBi omnidirectional antenna is better suited for local access point services.

When using WDS on a radio band, only w irel ess bridge units can assoc ia te to each other. Wireless clients can only associate with the wireless bridge using a radio band set to access point mode.

Point-to-Point Configuration

Two SMC28 91W-AG bridges can form a wir eless poi nt-to- point li nk using th eir integrated 5 GHz (802. 11a) antennas. A point-t o- point configuration can pr ovide a limited data rate (6 Mbps) link ov er a lon g ra nge (up to 15.4 km), or a high da ta rate (108 Mbps) over a shor t ran ge ( 1. 3 km ) .

SMC2891W-AG SMC2891W-AG

LANLAN

2-4

Page 31

Bridge Link Topologies

Point-to-Multipoint Configuration

A SMC2890W-AG wireless bridge can use an omnidirectional or sector antenna to connect to as many as 6 bridges in a point -to- m ul t ip oint configuration. There can only be one “Mast er ” un it in th e w i re less bridge network, all ot her br id ges must be “Slave ” units.

Using the 5 GHz 8 d Bi o m nidi re ct i onal external antenna , the SMC2890W-AG can connect to SMC 2891W-AG units up to 3.3 km (2 m i le s) aw ay. Using the 13.5 dBi 120-degree sec t or antenna, the SMC2890 W-AG can connect to SMC2891W-AG units up to 10.3 km (6.4 miles) away.

SMC2891W-AG

SMC2890W-AG with

Omnidirectional

Antenna

SMC2891W-AG

SMC2890W-AG with

Sector Antenna

SMC2891W-AG

2-5

Page 32

Network Configuration

2-6

Page 33

Chapter 3: Bridge Link Planning

The Dual-band Outdo or Acc ess Point / Bridge supports fixed point-to-point or point-to-multipo i nt wirel ess links. A single link bet ween two points can be used t o connect a remote site to larger core network. Multiple bridge links can provide a way to connect widesp re ad Et hernet LANs.

For each link in a wireless bridge network to be reliable and provide optimum performance, some careful site planning is required. This chapter provides guidance and informatio n fo r plan ni ng your wireless bridg e l in ks.

Note: The planning and installation of the wireless bridge requires professional

personnel that are trained in the installation of radio transmitting equipment. The user is responsible for compliance with local regulations concerning items such as antenna power, use of lightning arrestors, grounding, and radio mast or tower construction. Therefore, it is recommended to consult a professional contractor knowledgeable in local radio regulations prior to equipment installation.

Data Rates

Using its 5 GHz integrat ed antenna, the SMC28 91W-AG bridge can operate over a range of up to 15.4 km ( 9. 6 m i le s) or provide a high-speed c onnection of 54 Mbps (108 Mbps in turbo mode). However, the maximum data rate for a link decreases as the operating range increases.

When you are planning each wireless bridge link, take into account the maximum distance and data rates fo r the various antenna op tions. See “Transmit Power” on page C-5.

Radio Path Planning

Although the wirel es s br id ge uses IEEE 802.11a radio technology, which is capable of reducing the effect of mu ltipath si gnals due to obstructions, the wireless bridge link requires a “radio l in e- of -s ight ” b etw een the two antennas f or opt imum performance.

The concept of radio l ine-of-sight involves the ar ea al ong a radio link path through which the bulk of the r adio signal power travel s. This ar ea is known as the first Fresnel Zone of the ra di o lin k. For a radio link not to be affected by obstacles along its path, no object, including the ground, must intrude within 60% of the first Fresnel Zone.

The following figure illustra t es the conc ept of a good radio lin e-of-sight.

3-1

Page 34

Bridge Link Planning

Visual Line of Sight

If there are obstacles in th e radio path, there may still be a radio link but the qualit y and strength of the signal will be affected. Calcul ating the maximum clearance from objects on a path is important as it directly affects the decision on antenna placement and height. It is especially critical for long-distance links, where the radio signal could easily be lost .

Radio Line of Sight

When planning t he r adi o path fo r a wi r el ess bridge link, conside r t he se f actors:

• Avoid any partial line-of -s ight between the anten nas .

• Be cautious of trees or oth er foliage that may be near th e path, or may grow and obstruct the path.

• Be sure there is enough clearance from buildings and that no building construction may eventually bl oc k t he path.

• Check the topology of th e la nd between the antennas using topograph i cal m aps, aerial photos, or even satellite image data (software packages are available that may include this information for your area)

• Avoid a path that may in cur te m porary blockage due t o t he m ovement of cars, trains, or aircraft .

Antenna Height

A reliable wireless li nk i s us ual l y best achieved by mo unt ing the antennas at each end high enough for a cl ear ra di o l ine of si ght between them. The mi ni m um height required depends on the distance of the link , obstac l es t hat may be in the path, topology of the terrain, and the curvature of t he earth (for links over 3 mile s) .

For long-distance link s, a m as t or pole m ay need to be contsructe d t o at tain the minimum requir ed height. Use the following table to estimate the requ ired minimum clear ance above the groun d or path obstruction.

3-2

Page 35

Radio Path Planning

Total Link Distance Max Clearance for

60% of First Fresnel Zone at 5.8 GHz

0.25 mile (402 m) 4.5 ft (1.4 m) 0 4.5 ft (1.4 m)

0.5 mile (805 m) 6.4 ft (1.95 m) 0 6.4 ft (1.95 m) 1 mile (1.6 km) 9 ft (2.7 m) 0 9 ft (2.7 m) 2 miles (3.2 km) 12.7 ft (3.9 m) 0 12.7 ft (3.9 m) 3 miles (4.8 km) 15.6 ft (4.8 m) 1.8 ft (0.5 m) 17.4 ft (5.3 m) 4 miles (6.4 km) 18 ft (5.5 m) 3.2 ft (1.0 m) 21.2 ft (6.5 m) 5 miles (8 km) 20 ft (6.1 m) 5 ft (1.5 m) 25 ft (7.6 m) 7 miles (11.3 km) 24 ft (7.3 m) 9.8 ft (3.0 m) 33.8 ft (10.3 m) 9 miles (14.5 km) 27 ft (8.2 m) 16 ft (4.9 m) 43 ft (13.1 m) 12 miles (19.3 km) 31 ft (9.5 m) 29 ft (8.8 m) 60 ft (18.3 m) 15 miles (24.1 km) 35 ft (10.7 m) 45 ft (13.7 m) 80 ft (24.4 m) 17 miles (27.4 km) 37 ft (11.3 m) 58 ft (17.7 m) 95 ft (29 m)

Approximate Clearance for Earth Curvature

Total Clearance Required at Mid-point of Link

Note that to avoid any obstruction along th e path , the he i ght of th e object must be added to the minimum clearance required for a clear radio line-of-sight. Consider the following simple example, illustrated in the figure below.

Radio Line of Sight

1.4 m

12 m

2.4 m

20 m

Visual Line of Sight

3miles(4.8km)

5.4 m

17 m

A wireless bridge link is deployed to connect building A to a building B, which is located three mi le s (4 . 8 km ) aw ay. Mid-way between th e two bui di ngs is a small tree-covered hill. From the above table it can be seen that for a three-mile link, the object clearance required at the mid-point is 5.3 m (17.4 ft). The tree-tops on the hill are at an elevation of 17 m (56 ft), so the antennas at each end of the link need to be at least 22.3 m (73 ft) high. Bu ilding A is six stories high, or 20 m (66 ft), so a 2.3 m

3-3

Page 36

Bridge Link Planning

(7.5 ft) mast or pole must be contructed on its roof to achi eve the required anten na height. Building B is only thr ee stories high, or 9 m (30 ft), but is locat ed at an elevation that is 12 m (3 9 ft) higher than bulding A. To mount an anntena at the required height on bui ldi ng B, a m as t or pole of only 1.3 m (4.3 ft) is needed.

Warning:Never cons truct a radio mast, pole, or tower near overhead power lines. Note: Local regulations may limit or prevent construction of a high radio mast or tower. If

your wireless bridge link requires a high radio mast or tower, consult a professional contractor for advice.

Antenna Position and Orientation

Once the required antenna height has been determined, oth er fa ct or s affect in g the precise position of the w irel es s br i dge must be consider ed:

• Be sure there are no other radio antennas within 2 m (6 ft) of the wireless bridge

• Place the wireless bridg e aw ay from power and tele phone lines

• Avoid placing the wireless bridge too close to any metallic, refective surfaces, such as roof-installed air-conditioning equipment, tinted windows, wire fences, or water pipes

• The wireless bridge antennas at both ends of the link must be positioned with the same polariza tion di re ct io n, ei th er hor iz on ta l or vertical

Antenna Polarization — The wireless bridge’s integrated ante nna sends a radio signal that is polariz ed i n a parti cu la r dir ect i on . Th e antenna’s receive sensitivi t y is also higher for radio signals that have the same polarization. To maximize the performance of the wireless link, both antennas must be set to the same polarization direction. The unit should be mounted w ith the antenna sockets faci ng upwards.

Antenna sockets should point upwards in a vertic al manner

3-4

Page 37

Ethernet Cabling

Radio Interference

The avoidance of ra di o int er fe re nce is an important part of wireles s lin k pl anning. Interference is caused by other radio tra nsm i s si ons using the same or an adj acent channel frequency. You should first scan your proposed site using a spe ct r um analyzer to dete rmi ne if there are any strong r adi o sig nals using the 802.11a channel frequen ci es. Always use a chann el frequency that is furth es t away from another signal.

If radio interference is still a problem with your wireless bridge li nk, changing the antenn a pol a ri za tio n dire ct i on may i mpr ov e th e si tu at io n. T hi s is on ly rec o mmen de d when the integrated internal antenna is used.

Weather Conditions

When planning w ireless bridge links, yo u m ust take into account any ex trem e weather condi tion s t hat ar e known to affect your locat ion. C onsider these factor s:

• Temperature — The wirel ess bridge is teste d for nor mal opera tion in t emperat ures

from -40°C to 60°C. Operating in temperatures outside of this range may cause the unit to fail.

• Wind Velocity — The wireless bridge can op er at e i n w inds up to 44 m/s and

survive higher wind speeds up to 66 m/s. You must consider the known maximum wind velocity an d direction at the site and be sure that any suppor t ing st ructure, such as a pole, mast, or tower, is built to withstand this force.

• Lightning — The wireless br id ge includes its own built -in lightning protection .

However, you should make sure that the unit, any supporting structure, and cables are all properly grou nded. Additional pro te ctio n using lightning rods, lightning arrestors, or sur ge suppressors may al so be employed.

• Rain — The wireless bridge is weatherproofed against rain. Also, prolonged heavy

rain has no significant effect on the radio s ig nal . H ow ever, it is recommen ded to apply weatherproof sealing tape around the Ethernet port and antenna connectors for extra protection. If moisture enters a connector, it may cause a degradation in performance or even a complete fail ur e of the link .

• Snow and Ice — Fal lin g snow, like rain, has no sign if ic ant effect on the radio

signal. However, a build up of snow or ice on antennas may cause the link to fail. In this case, the sno w or ice h as to be cl ear ed from the antennas t o re st or e operation of the link .

Ethernet Cabling

When a suitable antenna location has been determined, you must plan a cable route form the wireles s br idge outdoors to the power inj ector module indoor s. C onsider these points:

• The Ethernet cable length should never be longer than 100 m (328 ft )

• Determine a building entry point for the cable

3-5

Page 38

Bridge Link Planning

• Determine if conduits, bra ci ng, or other structures are req ui re d f or saf et y or protection of the cable

• For lightning protectio n at th e po w er injector end of the cable, consider using a lightning arresto r im m edi ately before the cable enters the building

Grounding

It is important that the wirel ess bridge, cables, and any supporting struc t ur es are properly ground ed. The wireless bridg e unit in cl udes a grounding scre w for attaching a ground wir e. B e sur e t hat grounding is availab l e and that it meets local and national electrical codes.

3-6

Page 39

Chapter 4: Hardware Installation

Before mounting antennas to set up you r wi r el ess bridge links, be sure you have selected approp riat e l ocations for each ante nna. Follow the guidance and information in Chapter 2, “Wireless Link Planning.”

Also, before mounting units in their intended locations, you should first perform initial configuration and test the basic operation of the wireless bridge links in a controlled environment o ver a ver y s hort range. (See the sect i on “Testing Basic Link Operation” in this chapter.)

The wireless bridge includes its own bracket kit for mounting the un i t to a 1. 5 t o 2 inc h dia meter st eel p ole o r t ube, or to a wal l. The po le- moun ting brac ket a ll ows t he unit to be mounted to part of a rad i o m ast or to wer structure. The wall-mounting option enables it to be fixed to a building wall or roof when using external antennas.

Hardware installation of the wireless bridge involves these steps:

1. Mount the unit on a wall, pole, mast, or tower using the mounting bracket.

2. Mount exter nal antennas directly on th e br id ge or on the same suppor ting

structure as the br id ge and connect them t o the bridge unit.

3. Connect the Eth er net cable and a grounding wir e t o th e unit.

4. Connect the power injector to the Etherne t cabl e, a local LAN switch, an d an

AC power source.

5. Align antennas at both ends of the link.

Testing Basic Link Operation

Set up the units over a ver y sho rt ra nge (15 to 25 feet), either ou tdoors or in do ors. Connect the units as indicated in this chap te r an d be sure to perform all the basic configuration tasks outlined in Chap te r 5 : "Initial Configuration." When you are satisfied that the links are operating correctly, proceed to mount the units in their intended locatio ns .

Mount the Unit

The bridge can be mounted in the followin g ways using the included mounting bracket:

• To a 1.5 to 2 inch diamet er Pole

• To a wall

4-1

Page 40

Hardware Installation

The bridge’s mounting br acket has four parts. One rectangul ar pl at e th at is used for pole and wall mou nt ing, one square plate that at tach es dir ectly to the bridge, and two plates that form an adjustable V-shaped clamp for pole mou nt in g.

Mounting on a Pole

Perform the following steps to mount the unit to a 1.5 to 2 inch diameter steel pole or tube usi ng the mounting bracket:

1. Fit the edges of th e V-shaped clamp parts into the slots on the flat side of the

rectangular plate. The inner slots are for a 1.5 inch diameter pole and the outer slots for a 2 inch diamet er pol e.

2. Place the V-shaped clamp parts of the bracket around the pole and tighten the

securing nuts just eno ugh to hold the bracke t to th e pole. (The bracket ma y need to be rotated around the pole during the an te nna alignment proces s. )

Fit the edges of the V-shaped part into the slots

Tighten the securing bolts

3. Attach the square m ounting plate to the bridge with the supplied scr ews.

4-2

Page 41

Attach the adjustable rectangular plate to the bridge with supplied screws

Mount the Unit

4. Attach the bridge with its mounting plate to the bracket already fixed to the pole.

Attach t he brid ge to the plate on the pole

5. Use the included nuts to secure the wire le ss bridge to the pole bra cket. Note

that the wireless bridge tilt angle may need t o be ad j ust ed during the antenna alignment process.

4-3

Page 42

Hardware Installation

Be sure to take account of the ant enna polarization dir ect i on ; all ant ennas in a link must be mounted with the same polarization.

Mounting to a Wall

Perform the follow in g st eps to mo unt the unit to a wall using the wal l -mounting bracket:

Note: The wall-mounting bracket does not allow the wireless bridge’s intrgrated antenna

to be aligned. It is intended for use with the unit using external antennas.

1. Attach the bracket to a wall with flat side flush aga in st th e wal l (se e f ollo w ing

figure). Position th e br acket in the intended loca t io n and m ark th e position of the four mountin g scr ew holes.

2. Drill four holes in the wall that match the screws and wall plugs included in the

bracket kit, then secure the bracket to th e w all .

3. Attach the square m ounting plate to the bridge with the supplied scr ews.

4. Use the included nuts to tightly secure the w irel es s bridge to the bracket .

4-4

Page 43

Connect External Antennas

When deploying a SMC2891W-AG unit for a bridge link or access point operation, you need to moun t e xt er nal antennas and connect them to the bridge. Typically, a bridge link require s a 5 G H z ant enna, and access point operation a 2.4 GHz antenna. SMC2890W-AG units also require an ext ernal antenna for 2.4 G H z operation.

Perform t hese steps:

1. Mount the ext er nal antenna to the same supporting structure as the bridge,

within 3 m (10 ft) distance, u sing t he bracket supplie d in th e ant en na package.

2. Connect the ant enna to the br idge’s N-type c onnector using the RF coaxial

cable provided in t he antenna package. Some om ni directional externa l antennas attach di re ct ly to an N -type connector wi thout using a coaxial cable.

3. Apply weath er pr oof i ng tape to th e ant enna connectors to h el p pr event water

entering the connectors.

4. Set the antenn a opt i on for the corresponding antenna through th e user

interface. See “An tenna ID” on page 6-59 and “Ant enna Control Method” on page 6-59.

4-5

Page 44

Hardware Installation

2.4 GHz N-type Connector

5 GHz N-type Connector

RF Coaxial Cable

5 GHz External High-gain Panel Antenna

2.4 GHz External Omnidirectional Antenna

Connect Cables to the Unit

Warning: Do not connect or disconnect cables or otherwise work with the br id ge

during periods of lightning acti vity.

1. Attach the Ethernet cable to the Ethernet port on the wireless bridge.

2. For extra protection against rain or moi sture, apply weather pr oofing tape (not

included) around t he Et hernet connector.

3. Be sure to ground the unit with an appropriate grounding wire (not included) by

attaching it to the groundi ng point on the base of the uni t u sing the screw provided in the package.

Caution: Be sure that grounding is avail abl e and t hat it meets local and national

electrical codes . For a ddi t ional lightning protecti on, us e lightning rods, lightning arrestors, or surge suppressors.

Note: The Eth er net cable included with t he package is 30 m (100 ft) lo ng.

4-6

Page 45

Grounding Screw

Ethernet Cable

Connect the Power Injector

PoE (Ethernet) PortConsole Port

Ground Wire

Connect the Power Injector

To connect the wireless bridge to a po w er source:

Caution: Do not install the power injector outdoors. The unit is for indoor installation

only.

Caution: Install lightning protection at the power injector end of the Et hernet cable,

use a lightning arrestor immediately bef or e t he cable enters the buildi ng.

Note: The wireless bridge’s Ethernet port does not support Power over Ethernet (PoE)

based on the IEEE 802.3af standard. Do not try to power the unit by connecting it directly to a network switch that provides IEEE 802.3af PoE. Always connect the unit to the included power injector module.

1. Connect the Eth er net cable from the wireles s br id ge to the RJ-45 port labeled

“Output” on the po w er in ject or.

2. Connect a strai ght-through unshie ld ed twisted-pair (UTP) cable from a l oca l

LAN switch to the RJ- 45 port labeled “Input” on th e power injector. Use Category 5e or better U TP cable for 10/100BASE-TX connections.

Note: The RJ-45 port on the power injector is an MDI port. If connecting directly to a

computer for testing the link, use a crossover cable.

4-7

Page 46

Hardware Installation

Ethernet cable from LAN switch

Input

Output

Ethernet cable to wireless bridge

AC power

Power LED indicator

1. Insert the pow er cabl e plug directly into the standar d AC receptacle on the

power injector.

2. Plug the other end of the power cable into a grounded, 3-pin socket, AC power

source.

Note: For International use, you may need to change the AC line cord. You must use a

line cord set that has been approved for the receptacle type in your country.

3. Check the LED on top of the power injector to be sure that power is being

supplied to the wirel ess bridge through the Ethernet connection.

Align Antennas

After wireless bridge un i ts have bee n mounted, connect ed, and their radios are operating, the antennas must be accurately aligned to ensure optimum performance on the bridge links. Th is alig nm ent process is particularly important for long-range point-to-point lin ks. I n a point-to-multipoint conf iguration the root bridg e uses an omnidirectional or sec to r an te nna, which does not req ui re alig nm ent, but bridge nodes still need to be correctly aligned with the root bridge antennna.

• Point-to-Point Configurations – In a point-to- poi n t co nf i gur at i on, the al i gnment process requires two people, one at each end of the link. The use of cell phones or two-way radio com m unication may he lp wit h coordination. To start, you can just point the antennas at each other, using binoculars or a compass to set the general direction. For accur at e al i gnment, you must m onit or the si gnal strength LEDs as the antenna moves horizontally and vert ic al ly.

• Point-to-Multipoint Configurations – In a point-to-multipoint config ur at io n all bridge nodes must be aligned with the root bridge antenna. The alignment process is the same as in poin t-t o- poi nt links, but only the bridge node end of the link requires the alignment.

4-8

Page 47

Align Antennas

The signal strengt h LEDs indicate the received radio signal strength for a particular bridge link. The mor e LEDs that turn on, the stronger the signal. Alternatively, you can monitor the Rec ei ve Si gn al Strength Indica tor ( RSSI ) v al ue d irectly from the management i nter fa ce. The higher the RSSI value, the stronger the sign al .

When you move the antenna during alignment, the radio signal from the remote antenna can be seen to have a strong central main lobe and smaller side lobes. The object of the alignm ent process is to set the ant enna so that it is receiving the strongest sign al fr om t he central main lobe.

Vertical Scan

Remote Antenna

Horizontal Scan

RSSI Value

Main Lobe Maximum

Maximum Signal Strength Position

for Horizontal Alignment

RSSI Value

Side Lobe Maximum

Maximum Signal

Strength Position for

Vertical Alignment

To align the an te nna s i n t he li nk , m oni t or th e signal st r eng th L EDs or th e RS SI va lue in the managem ent int er fa ce. Start with one antenn a fix ed and then perform the following proced ure on the other antenna:

Note: The RSSI value can be configured through management interfaces to display a

value for specific WDS bridge links. See page 6-40 for more information.

High 11a Signal

Medium 11a Signal

Low 11a Signal

11b/g

11a

11b/g

11a

11b/g

11a

Power

Link

Power

Link

Power

Link

4-9

Page 48

Hardware Installation

1. Pan the antenna horizontally back and fort h w hi le checking the LEDs. If usi ng

the pole-moun ting bracket with the uni t, you must rotate the mounting br ack et around the pole. Other external antenna brackets may require a di fferent horizontal adjustme nt .

2. Find the point w he re t he sig nal is strongest (all LED s on ) and secure the

horizontal adjustme nt in tha t posit i on.

Note: Sometimes there may not be a central lobe peak because vertical alignment is too

far off; only two similar peaks for the side lobes are detected. In this case, fix the antenna so that it is halfway between the two peaks.

3. Loosen the ve rt ical adjustment on th e m ounting bracket and til t the an t enna

slowly up and down w hi le che cking the LEDs.

4. Find the point w here the signal is strong est and secure the vertical adjustment

in that position.

4-10

Page 49

Chapter 5: Initial Configuration

The Dual-band Outdo or Acc ess Point / Bridge offers a variety of man agement options, includ in g a web-based interfa ce, a di r ect connection to the co ns ol e por t , Telnet, Secure Shell (SSH), or using SNMP software.

The initial configuration steps can be made through the web browser interface or CLI. The access point requests an IP address via DHCP by default. If no response is received from the DHCP server, then the access point uses the default address

192.168.2.2. If this address is not compatible with your network, you can first use the command line inter f ac e (CLI) as described be lo w to configure a valid addre ss .

Note: Units sold in countries outside the United States are not configured with a specific

country code. You must use the CLI to set the country code and enable wireless operation (page 5-3).

Initial Setup through the CLI

Required Connections

The access point pr ov id es an RS-232 serial port that enables a connect io n t o a PC or terminal for monitoring and configuration. Attach a VT100-compatible terminal, or a PC running a term inal em ul ati on program to the access poi nt . You can use the console cable pro vi ded with this package, or u se a cable that complies w i t h th e wiring assignmen ts sho w n on page B-3.

To connect to the console port, com pl et e t he following steps:

1. Connect the con sol e cable to the serial port on a t er m inal , or a PC running

terminal emulation software, and tighten the captive retaining screws on the DB-9 connector.

2. Connect the oth er end of the cable to the RS-232 serial port on the a cce ss

point.

3. Make sure the terminal emulation software is set as follows:

• Select the ap propri ate serial port (COM port 1 or 2).

• Set the data rate to 9600 b aud .

• Set the data format to 8 data bits, 1 stop bit, and no pa rit y.

• Set flow control to none.

• Set the emulation mode to VT 10 0.

• When using HyperT er m in al , sel ect Terminal keys, not Wi ndows keys.

4. Once you have set up the terminal correctly , press the [Enter] key to initiate the

console connection. The console login screen will be displayed.

5-1

Page 50

Initial Configuration

For a description of how to use the CLI, see “Using the Command Line Interface” on page 7-1. For a list of all the CLI com m ands and detailed inform at ion on using the CLI, refer to “Command Groups” on page 7-6.

Initial Configuration Steps

Logging In – Enter “admin” for the user name. The default password is null, so just

press [Enter] at the password prompt. The CLI prompt appear s di sp la yi ng the access point’s name.

Username: admin Password: SMC Enterprise AP/Bridge#

Setti ng the IP Address – By default, the access poin t is co nf ig ur ed to ob tain IP address settings from a DHCP server. If a DHCP server is not available, the IP address defau lts to 192. 168.2.2, which may not be compatible with your net w or k. You will therefore have to use the command line interface (CLI) to assign an IP address that is compatible with your network.

Type “configure” to enter configurat i on mode, then type “inte rf ac e et hernet” to access the Ethern et inte rface-configuration m ode.

SMC AP#configure SMC AP(config)#interface ethernet SMC AP(config-if)#

First type “no ip dhcp” to d is able DHCP client mode. Th en type “ip address ip-address net m ask gateway,” where “ip-address” is the ac ce ss point’s IP address, “netmask” is the network mask for the network, and “gateway” is the default gateway router. Check with your system administrator to obtain an IP address that is compatible with your network.

SMC AP(if-ethernet)#no ip dhcp SMC AP(if-ethernet)#ip address 192.168.2.2

255.255.255.0 192.168.2.254

SMC AP(if-ethernet)#

After configuring the access point’s IP parameters, you can access the management interface from any w here within the attached net wor k. The command line interface can also be acces sed using Telnet from any computer attached to the network.

5-2

Page 51

Logging In

Setting the Country Code – Units sold in the United States are configure d by default to use only rad io channels 1-11 in 802.11b or 802.11g mode as defined by FCC regulations. Units sold in other count ries are configured by defa ult witho ut a country code (i.e., 99). You must use the CLI to set the country code. Setting the country code rest r ic ts ope ra tion of the access point to th e ra di o ch annels and transmit power levels permitted for wireless networks in the specified country.

Type “exit” to leave configuration mode. Then type “count r y ?” to d ispl ay the list of countries. Select the code for your coun tr y, and enter the country com m and again, following by you r co unt r y code (e.g., tw for Taiwan).

SMC AP#country tw SMC AP#

Note: Command examples shown later in this manual abbreviate the console prompt to

“AP” for simplicity.

Logging In

There are only a few basic steps you need to co m pl et e t o connect the access poi nt to your corporate network, and provi de ne twork access to wireless clients.

The access point can be managed by any com puter using a web browser (Internet Explorer 5.0 or above, or Netscape 6.2 or above). Enter the default IP address: http://192.168.2.2

Logging In – Enter the username “admin,” the password is null, so just press just leave it blank and cli ck LOGIN. For inform at ion on configuring a user na me and password, see page 6-28.

5-3

Page 52

Initial Configuration

The home page displays the Main Menu.

5-4

Page 53

Chapter 6: System Configuration

Before continuing with advanced configuration, first complete the initial configuration steps described in Chapter 4 to set up an IP add re ss f or the access point.

The access point can be managed by any com puter using a web browser (Internet Explorer 5.0 or above, or Netscape 6.2 or above). Enter the configured IP address of the access point , or use the default address : http: / /1 92.168.2.2

To log into the access point, enter the default user name “ad m in ” an d t hen press “LOGIN”. When the home page displays, click on Advanced Setup. The following page will display.

The information in this chapter is organized to reflect the structure of the web screens for easy r ef er ence. However, it is recommended t hat you configure a user name and password as th e f irst step under Administra tion to c ont r ol ma na gement access to this dev ice ( page 6- 28).

6-1

Page 54

System Configuration

Advanced Configuration

The Advanced Co nf ig ur at i on pages include the followi ng options.

Table6-1. Menu

Menu Description Page

System Configures basic administrative and client access 6-3

Identification Specifies the host name 6-3 TCP / IP Settings Configures the IP address, subnet mask, gateway, and domain

name servers

RADIUS Configures the RADIUS server for wireless client authentication

and accounting SSH Settings Configures Secure Shell management access 6-11 Authentication Configures 802.1X client authentication, with an option for MAC

address authentica tion Filter Control Filters communications between wireless clients, access to the

management interface from wireless clients, and traffic matching

specific Ethernet protocol types VLAN Enables VLAN support and sets the management VLAN ID 6-19 WDS Settings Configures bridge or repeater modes for each radio interface and

sets spanning tree parameters AP Management Configures access to management interfaces 6-27 Administration Configures user name and password for management

upgrades software from local file, FTP or TFTP server;

configuration settin gs to facto ry def ault s; and res ets the acces s

point System Log Controls logging of error messages; sets the system clock via

SNTP server or manual configuration

access;

resets

6-4

6-7

6-12

6-17

6-21

6-28

6-33

RSSI Configures RSSI value display, bridge link distance, and LED

SNMP Configures SNMP settings 6-40

SNMP Controls access to this access point from management stations

SNMP Trap Filters Defines trap filters for SNMPv3 users 6-48 SNMP Targets Specifies SNMPv3 users that will receive trap messages 6-50

Radio Interface A Configures the IEE E 802 .11a interface 6-51

Radio Settings Configures common radio signal parameters and other settings for

Security Enables each virtual access point (VAP) interface, sets the Service

6-2

6-37

display mode

6-40

using SNMP, as well as the hosts that will receive trap messages

6-53

each VAP interface

6-70

Set Identifier (SSID), and configures wireless security

Page 55

Advanced Configuration

Table6-1. Menu

Menu Description Page

Radio Interface G Configur es the IEE E 802 .11g interface 6-51

Radio Settings Configures common radio signal parameters and other settings for

each VAP interface

Security Enables each VAP interface, sets the SSID, and configures

wireless security

Status Displays information about the access point and wireless clients 6-88

AP Status Displays configuration settings for the bas ic system and the

wireless interface

Station Station Shows the wireless clients currently associated with the access

point

Event Logs Shows log mes sag es stor ed in mem ory 6-93

6-68

6-70

6-88

6-91

System Identification

The system name for the access point can be le ft at its default set tin g. Ho wever, modify in g thi s p a ra me te r can he l p you to mor e ea si l y di st in gui s h di f f er ent devi ce s in your network.

System Name – An alias for th e access poi nt, enabling the device to be unique l y identified on the network. (Default: SMC Enterprise AP/ Br idge; Range: 1-32 characters)

6-3

Page 56

System Configuration

CLI Comma nds f or Sy st em I den ti f ic at io n – Ent er th e gl oba l co nf i gur at i on m ode , an d use the system nam e command to specify a new system name. Then return to the Exec mode , and use the show system command to display the changes to the system identific at i on settings.

SMC AP#config 7-8 Enter configuration commands, one per line. SMC AP(config)#system name R&D 7-14 SMC AP(config)#end 7-90 SMC AP#show system 7-24

System Information ============================================================== Serial Number : System Up time : 0 days, 0 hours, 32 minutes, 22 seconds System Name : Enterprise Wireless AP System Location : System Contact : Contact System Country Code : US - UNITED STATES MAC Address : 00-12-CF-12-34-60 Radio A MAC Address : 00-12-CF-12-34-61 Radio G MAC Address : 00-12-CF-12-34-65 IP Address : 192.168.2.2 Subnet Mask : 255.255.255.0 Default Gateway : 0.0.0.0 VLAN State : DISABLED Management VLAN ID(AP): 1 IAPP State : ENABLED DHCP Client : ENABLED HTTP Server : ENABLED HTTP Server Port : 80 HTTP Session Timeout : 300 sec(s) HTTPS Server : ENABLED HTTPS Server Port : 443 Slot Status : Dual band(a/g) Boot Rom Version : v1.1.6 Software Version : v4.3.3.1b05 SSH Server : ENABLED SSH Server Port : 22 Telnet Server : ENABLED DHCP Relay : DISABLED ==============================================================

SMC AP#

6-4

Page 57

Advanced Configuration

TCP / IP Settings

Configuring the access point with an IP address expands your ability to manage the access point. A nu m ber of acc ess point features depe nd on IP addressing to operate.

Note: You can use the web browser interface to access IP addressing only if the access

point already has an IP address that is reachable through your network.

By default, the access point will be automatically configured with IP settings from a Dynamic Host Configuration Protocol (DHCP) server. However, if you are not using a DHCP server to configure IP addressing, use the CLI to manually configure the initial IP values (see page 5-2). After you have netw or k ac cess to the access poin t , you can use the web br owser interface to m odify the initial IP config ur at ion, if needed.

Note: If there is no DHCP server on your network, or DHCP fails, the access point will

automatically start up with a default IP address of 192.168.2.2.

DHCP Client (Enable) – Select this option to obtain the IP settings for the access point from a DHCP (Dynamic Host Configuration Protocol) server. The IP address, subnet mask, default gateway, and Domain Name Server (DNS ) address are dynamically assigned to the access point by the network DHCP server. (Default: Enabled)

DHCP Client (Disable) – Select this option to manually configure a static address for the access point .

• IP Address: The IP address of the access point. Valid IP addresses consist of four

decimal numbers, 0 to 255, separated by periods.

• Subnet Mask: The ma sk t hat identifies the host address bits used for rout i ng to

specific subne ts .

6-5

Page 58

System Configuration

• Default Gateway: The default gateway is the IP address of the router for the access point, which is used if the requested destination address is not on the local subnet.

If you have management stations, DNS, RADIUS, or othe r ne two rk ser vers

located on another subnet, type the IP address of the default gateway router in the text field provided. Otherwise, leave the address as all zeros (0.0.0.0).

• Primary and Secondary D N S Add re ss: The IP address of Doma in Na m e Se rv ers on the network. A DNS maps numerical IP addresses to domain names and can be used to identify network hosts by familiar names instead of the IP addresses.

If you have one or more DNS servers located on the local network, type the IP

addresses in the text fields provided. Otherwise, leave the addresses as all zeros (0.0.0.0).

CLI Commands for TCP/IP Settings – From the global configuration mode, enter the interface configur at i on mode with the interf ace ethernet com m and. Use the ip dhcp command to enable the DHCP client, or no ip dhcp to disable i t . To manually configure an addr ess, specify the new IP ad dr ess, subnet mask, and default gateway using the ip address command. To specify DNS server addresses use the dns server command. Then use the s how in te rf ace ethernet comm and from the Exec mode to display the current IP settings.

SMC AP(config)#interface ethernet 7-90 Enter Ethernet configuration commands, one per line. SMC AP(if-ethernet)#no ip dhcp 7-92 SMC AP(if-ethernet)#ip address 192.168.1.2

255.255.255.0 192.168.1.253 7-91

SMC AP(if-ethernet)#dns primary-server 192.168.1.55 7-91 SMC AP(if-ethernet)#dns secondary-server 10.1.0.55 7-91 SMC AP(config)#end 7-8 SMC AP#show interface ethernet 7-94 Ethernet Interface Information ======================================== IP Address : 192.168.1.2 Subnet Mask : 255.255.255.0 Default Gateway : 192.168.1.253 Primary DNS : 192.168.1.55 Secondary DNS : 10.1.0.55 Admin status : Up Operational status : Up ======================================== SMC AP#

6-6

Page 59

Advanced Configuration

RADIUS

Remote Authent icat i on D ial - in Us er Ser vice (RADIUS) is an authentication protocol that uses software run ni ng on a central server to c ont r ol access to RADIUS-a w ar e devices on the net w or k. An authentication server contains a database of use r credentials for each user that requires access to the network.

A primary RADIUS server must be specified for the access point to implement IEEE

802.1X network access control and Wi-Fi Protected Access (WPA) wireless security. A secondary RA DIUS server may also be specified as a backup should the primary server fail or become inaccessible.

In addition, the conf igur ed RADIUS server can al s o act as a RADIUS Accou ntin g server and recei ve user-session acco unting information from th e access point. RADIUS Account i ng can be used to provide valuable information on user ac tivi t y in the network.

Note: This guide assumes that you have already configured RADIUS server(s) to

support the access point. Configuration of RADIUS server software is beyond the scope of this guide, refer to the documentation provided with the RADIUS server software.

6-7

Page 60

System Configuration

6-8

Page 61

Advanced Configuration

MAC Address Format – MAC addresses can be specified in one of four formats, using no delimete r, with a single dash del i m et er, with multiple das h delimeters, and with multiple colon delimeters.

VLAN ID Format – A VLAN ID (a number between 1 and 40 94 ) ca n be assigned to each client after successful authentication using IEEE 802.1X and a central RADIUS server. The user VLAN IDs must be configured on the RADIUS server for each user authorized to access the network. VLAN IDs can be entered as hexadecimal numbers or as AS CII st r in gs.

Primary Radius Server Setup – Configure the following settings to use RADIUS authentication on t he access point.

• Radius Status: Enabling Radius Status allows the settings of RADIUS

authentication . (D efault: Enable)

• IP Address: Specifies th e IP address or host nam e of t he RA DI U S server.

• Port: The UDP port number used by the RADIUS server for authentication

messages. (Range: 1024-65535 ; Default: 1812)

• Key: A shared text string used to encrypt messages between the access point and

the RADIUS server. Be sure that the same text string is specified on the RADIUS server. Do not use blank spaces in the str ing. (M aximum length: 255 characters)

• Timeout: Number of sec onds the access point wa i ts for a re pl y f ro m the RA D I US

server before resending a request. (Range: 1-60 seconds; Default: 5)

• Retransmit attempts: The number of times the access point tries to resend a

request to the RADIUS server before authentication fails. (Range: 1-30; Default: 3)

• Accounting Port: The RAD I US Ac counting server UDP port used for accoun ting

messages. (Range: 0 or 1024-65535; D ef au lt: 0, disabl ed)

• Int erim Update Timeout: Th e i nterval betwe en transmitting account ing upda t es to

the RADIUS ser ver . (Range: 60-86400; Def ault: 3600 seconds)

Note: For the Timeout and Retransmit attempts fields, accept the default values unless

you experience problems connecting to the RADIUS server over the network.

Secondary Radius Server Setup – Configure a secondary RADIUS server to provide a backup in case the pr i m ary server fails. The access point uses the s econdary server if the primary server fails or becomes inaccessible. Once the access point switches over to the secondary server, it periodically attem pts to establish communicat io n aga i n w i th prim ar y server. If communication with the pri m ar y server is re-established, th e se condary server reverts to a backup role.

6-9

Page 62

System Configuration

CLI Commands for RADIUS – From the global configur at ion m ode, use the radius-server address command to specify the address of th e pr imary or

secondary RADIUS servers. (The following example configures the settings for the primary RADIUS server.) Configure the other parameters for the RADIUS server. Then use the show show radius command from the Exec mode to display the current setting s fo r the primary and secon dary RADIUS servers.

SMC AP(config)#radius-server address 192.168.1.25 7-60 SMC AP(config)#radius-server port 181 7-61 SMC AP(config)#radius-server key green 7-61 SMC AP(config)#radius-server timeout 10 7-62 SMC AP(config)#radius-server retransmit 5 7-62 Enterprise AP(config)#radius-server port-accounting 1813 7-63 Enterprise AP(config)#radius-server timeout-interim 500 7-63 SMC AP(config)#exit SMC AP#show radius 7-65

Radius Server Information ======================================== IP : 192.168.1.25 Port : 181 Key : ***** Retransmit : 5 Timeout : 10 Radius MAC format : no-delimiter Radius VLAN format : HEX ========================================

Radius Secondary Server Information ======================================== IP : 0.0.0.0 Port : 1812 Key : ***** Retransmit : 3 Timeout : 5 Radius MAC format : no-delimiter Radius VLAN format : HEX ======================================== SMC AP#

6-10

Page 63

Advanced Configuration

SSH Settings

Telnet is a remote management to ol tha t c an be used to configure th e access point from anywhere i n th e network. However, Telnet is not secure from hostile at tack s. The Secure Shell (SSH ) can ac t as a se cur e r epl a cem ent for Telnet. The SSH protocol uses gen er at ed public keys to encrypt all data transfers passing be t w een the access point and SSH-enabled management station clients and ens ur es that data traveling over the network arrives un al tered. Clients can then sec urely use the local user name and password for access authentication.

Note that SSH client software needs to be installed on the management station to access the acce ss point for managem ent vi a t he SSH protocol.

Notes: 1. The access point supports only SSH version 2.0.

2. After boot up, the SSH server needs about two minutes to generate host

encryption keys. The SSH server is disabled while the keys are being generated.

SSH Settings

Telnet Server Status – Enables or disables the Telnet server. (Default: Enabled) SSH Server Status – Enables or disables the SSH server. (Default: Enabled) SSH Server Port – Sets the UDP port for the SSH server. (Range: 1-65535;

Default: 22)

6-11

Page 64

System Configuration

CLI Commands for SSH – To enable the SSH server, use the ip ssh-server enable command from th e C LI Et her net interface config ura t io n m ode . To set the SSH server UDP port, use the ip ssh-server port command. To view the current settings, use the show syste m command from the CLI Exec mode (n ot shown in the following examp le ).

Enterprise AP(if-ethernet)#no ip telnet-server 7-17 Enterprise AP(if-ethernet)#ip ssh-server enable 7-16 Enterprise AP(if-ethernet)#ip ssh-server port 1124 7-16 Enterprise AP(if-ethernet)#exit Enterprise AP(if-ethernet)#configure

Authentication

Wireless clients can be aut henticated for netw or k access by checking the i r MA C address against th e lo cal da tabas e configured on the ac ce ss point, or by using a database configured on a central RADIUS ser ver. Alternatively, authentication can be implemented using the IEEE 802.1X network access control protocol.

A client’s MAC address pro vi des relatively weak us er aut hen tication, since MAC addresses can be easily captured and used by another station to break into the network. Using 802.1X provides more rob ust user authenticati on us i ng user names and passwords or digital certificates. You can configure the access point to use both MAC address and 802.1X authentication, with client station MAC authentication occurring prior to IEEE 802.1X authentication. However, it is better to choose one or the other, as appropriate.

Take note of the following points before configuring MAC ad dr ess or 802.1X authentication:

• Use MAC address au t hentication for a small ne t w or k wi th a lim i te d number of users. MAC addresses can be ma nually configured on the access point itse lf without the need to set up a RADIUS server, but managing a large number of MAC addresses across many access points is very cumbersome. A RADIUS server can be used to centrally manage a larger database of user MAC addresses.

• Use IEEE 802.1X authentication for netwo rk s w i th a larger number of users and where security is t he m os t im portant issue. When using 802.1X authenti cat ion, a RADIUS server is required in the wired network to centrally manage the credentials of the w ireles s clien ts. It also pr ovides a mechani sm for enhanced network securi ty using dynamic e ncr yp tion key rotation or W-Fi Prot ected Access (WPA ).

Note: If you configure RADIUS MAC authentication together with 802.1X, RADIUS MAC

address authentication is performed prior to 802.1X authentication. If RADIUS MAC authentication succeeds, then 802.1X authentication is performed. If RADIUS MAC authentication fails, 802.1X authentication is not performed.

• The access point can also operate in a 802.1X supplicant mode. This enables the access point itself to be aut henticated with a RA D IU S ser ve r us i ng a configured MD5 user name and password. This prev ents rogue access point s f ro m ga ini ng access to the network.

6-12

Page 65

Advanced Configuration

MAC Authentication – You can configure a list of the MAC addresses for wireless clients that are author ized to access the netw or k. This provides a basic level of authen t ication for wireless cli ents attemptin g to gain access to the network. A database of authorized MAC addresses can be stored locally on the access point or remotely on a central RADIUS server. (Default: Disabled)

• Disabled: No checks ar e performed on an ass o ciating station’s MAC address.

• Local MAC: The MAC addr ess of the associatin g stat i on i s co mpared against the

local database s to re d on t he access point. Use t he Local MAC Authen tica t io n section of this web page to set up the local d at abase, and configur e al l access points in the wireless network service area with the same MAC address database.

• Radius MAC: The MA C address of the associat i ng st at i on is s ent to a configured

RADIUS server for authentication. When using a RADIUS authentication server for MAC address aut hentication, the serv er mu st fir st be configured in the Radi us window (see “RADI U S” on page 6-7). The database of MAC addresses and filtering policy mu st be defined in the RADIUS server.

Note: MAC addresses on the RADIUS server can be entered in four different formats

(see “RADIUS” on page 6-7).

802.1X Supplicant – The access point can also operate in a 802.1X suppl i cant mode. Th is enabl es t he ac ces s poi nt i ts elf to b e aut hent ica ted w ith a RAD IUS se rve r using a configured MD5 user name and passw ord. This prevents rogue access points from gaining ac cess to the network.

6-13

Page 66

System Configuration

Local MAC Authentication – Configures the local MAC authentication database. The MAC database prov id es a mechanism to take cer tain act ions based on a wirele ss client’s MAC address . Th e M A C l is t ca n be configured to allow or deny network access to specif ic clie nts.

• System Default: Specifies a default action for all unknown MAC addresses (that is, those not listed in th e local MAC database ).

• Deny: Blocks access for all M AC addresses except th ose listed in the local database as “Allow . ”

• All ow : Per mits access for all MAC addresses except those listed in the local database as “Den y. ”

• MAC Authentication S ettings: Enters specified MAC addresses and per m i ssi ons into the loca l MAC da tabase.

• MAC Address: Physical address of a client. Enter six pairs of hexadecimal digits separated by hyphens; for example, 00-90-D1-12-AB-89.

• Permission: Select Allow to permit access or Deny to block access. If Delete is selected, the specified MAC addres s entry is removed from the database.

• Update: Enters the specified MAC address and permission setting into the local database.

• MAC Authentication Table: Displays current entries in the local MAC database.

6-14

Page 67

Advanced Configuration

CLI Commands for Local MAC Authentication – Use the mac-authentication server com mand from the global configuration mod e t o enable local MAC

authentication . Us e th e m ac-authentication sessi on-timeout command to set the authentication inte rv al , an d web-redirect comm an d t o enable web-based authentication for service billing. Set the default action for MAC addresses not in the local table using the address filter default command, then enter MAC addresses in the loc al table using the address filter entry command. To remove an entry from the table, use the addre ss f ilter delete comm and. To display the curr ent settings, use the show authentication command from the Exec mode.

SMC AP(config)#mac-authentication server local 7-73 SMC AP(config)#mac-authentication session-timeout 5 7-73 SMC AP(config)#web-redirect 7-20 SMC AP(config)#address filter default denied 7-71 SMC AP(config)#address filter entry 00-70-50-cc-99-1a denied 7-72 SMC AP(config)#address filter entry 00-70-50-cc-99-1b allowed SMC AP(config)#address filter entry 00-70-50-cc-99-1c allowed SMC AP(config)#address filter delete 00-70-50-cc-99-1c 7-72 SMC AP(config)#exit SMC AP#show authentication 7-69

Authentication Information =========================================================== MAC Authentication Server : LOCAL MAC Auth Session Timeout Value : 0 min

802.1x supplicant : DISABLED

802.1x supplicant user : EMPTY

802.1x supplicant password : EMPTY Address Filtering : DENIED

System Default : ALLOW addresses not found in filter table. Filter Table

MAC Address Status

----------------- ---------00-70-50-cc-99-1a DENIED 00-70-50-cc-99-1b ALLOWED ========================================================= SMC AP#

6-15

Page 68

System Configuration

CLI Commands for RADIUS MAC Authentication – Use the mac-authentication server com mand from the global configuration mod e t o enable remote MAC authentication. Se t the timeout value for re-au t hen tication using the macauthent icati on session- timeout command. Be su re to a ls o co nf ig ur e connection

settings for the RAD IU S s er ver (not shown in the follow in g example). To display the current settings, use the show authenti cat i on com m and from the Exec mode.

SMC AP(config)#mac-authentication server remote 7-73 SMC AP(config)#mac-authentication session-timeout 300 7-73 SMC AP(config)#exit SMC AP#show authentication 7-69

Authentication Information =========================================================== MAC Authentication Server : REMOTE MAC Auth Session Timeout Value : 300 min

802.1x supplicant : DISABLED

802.1x supplicant user : EMPTY

802.1x supplicant password : EMPTY Address Filtering : DENIED

System Default : DENY addresses not found in filter table. Filter Table

MAC Address Status

----------------- ---------00-70-50-cc-99-1a DENIED 00-70-50-cc-99-1b ALLOWED ========================================================= SMC AP#

CLI Command for 802.1x S up pl ic an t – To configure the access point to operate as a

802.1X supplica nt , firs t us e t he 802.1X supplicant user command to set a user name and password for the access point, then use the 802.1X supplicant command to enable the featu re. To display the current settings, use t he show authentication command from th e Exec mode (not shown i n th e f ollo w ing example)

SMC AP(config)#802.1X supplicant user secureAP dot1xpass 7-69 SMC AP(config)#802.1X supplicant 7-69 SMC AP(config)#

6-16

Page 69

Advanced Configuration

Filter Control

The access point can employ network traffic fra m e fil t erin g to control access to network resources and increase security. You can prevent communications between wireless clients and prevent access poi nt m anagement from wir el ess cl ie nt s. Also, you can block spe ci f ic Eth er net traf f i c from being forwarded by t he access point.

Inter Client STAs Communication Filter – Sets the global mode for wirel ess- to-w irel ess c ommun ic atio ns be tween cli ent s a ssoci at ed to Vi rtua l AP (VA P) interfaces on the access point. (Default: Prevent Inter and Intra VAP client Communication)

• Disabled: All clients can com m unicate with each oth er thr ough the access point .

• Prevent Intra VAP client communication: When enabled, clients associated with a specific VAP interface cannot establish wireless communications with each other. Clients can communicate with clients associated to other VAP interfaces.

• Prevent Inter and Intra VAP cl ie nt com munication: Wh en enabled, clients cannot establish wireless communications with any other client, either those associated to the same VAP interface or a ny ot her VAP interface.

AP Management Filter – Controls management acc ess to the access point fro m wireless clients. Management interfaces include the web, Telnet, or SNMP. (Default: Disabled)

• Disabled: Allows management access from wireless clients.

• Enabled: Blocks management access from wireless clients.

6-17

Page 70

System Configuration

Uplink Port MAC Address Filtering Status – Prevents traffic with specif ied source MAC addresses from being forward ed t o w ire le ss clients through the acces s point. You can add a maximum of four MAC addresses to the filter table. (Default: Disabled)

• MAC Address: Specvifies a MAC address to filter, in the form xx-xx-xx-xx-xx-xx.

• Permission: Adds or deletes a MAC address from the filtering table. Ethernet Type Filter – Controls checks on t he Ethernet type of all incom i ng and

outgoing Ethernet packe ts aga in st the pr ot ocol filtering table. (Default: Dis abled)

• Disabled: Access poin t do es not filter Ethernet proto col t ypes.

• Enabled: Access point filters Ethernet protocol types based on the configuration of protoco l types in the filter t able. If th e status of a pr otocol is set to “ON,” t he protocol is filtered from t he access point.

Note: Ethernet protocol types not listed in the filtering table are always forwarded by the

access point.

Ethernet Type Filter – Enables or disables Ethernet filtering on the port. (Default: Disabled)

CLI Commands for Bridge Filte ring – Use the filter local-bridge command from the global configura tion mode to prevent wir el ess-to-wireless com m unications throug h the access point . Us e th e fil te r ap -m anage command to restrict management access from wirel ess clients. To configure Ethernet protocol filtering, use the filter

ethernet-type en abl e command to enable filtering and the filter ethernet-type protocol command to define the protocols that you want to filter. To remove an entry

from the table, use the address filter delete command. To display the current settings, use the show filters command from the Exec mode.

SMC AP(config)#filter local-bridge 7-75 SMC AP(config)#filter ap-manage 7-75

SMC AP(config)#filter uplink enable 7-76 SMC AP(config)#filter uplink add 00-12-34-56-78-9a 7-76

SMC AP(config)#filter ethernet-type enable 7-76 SMC AP(config)#filter ethernet-type protocol ARP 7-77 SMC AP(config)#exit SMC AP#show filters 7-78

Protocol Filter Information ========================================================= Local Bridge :ENABLED AP Management :ENABLED Ethernet Type Filter :ENABLED

Enabled Protocol Filters

--------------------------------------------------------Protocol: ARP ISO: 0x0806 ========================================================= SMC AP#

6-18

Page 71

Advanced Configuration

VLAN

The access point can employ VLAN tagging support to control access to network resources and increase security. VLANs separate traffic passing between the access point, associated clients, and the wir ed network. There can be a VLAN assigned to each as sociated client, a defaul t VLAN f or each VAP (Virtual Access Point) interface, and a management VLAN for the access point.

Note the following poi nts about the access point’s VLAN support:

• The management VLAN is for managing the access point through remote

management tools, such as the web interface, SSH, SNMP, or Telnet. The access point only accep ts ma nagement traffic that is t agged with the specified management VLAN ID.

• All wireless clients associated to the access point are assigned to a VLAN. If IEEE

802.1X is being use d t o aut h ent i cat e wireless clients, sp eci f ic VLAN IDs can be configured on th e RA D IU S se rver to be assigned to each client. If a client is not assigned to a speci f ic VLAN or if 802.1X is not used , the client is assigned to the default VLAN for the V AP inte rface with which it is associated. The access point only allows traffic ta gged with assigned VLA N IDs or default VLAN IDs to ac cess clients associated on each VAP interfac e.

• When VLAN support is enabled on the access point, traffic passed t o t he wi r ed

network is tagged with the appropriate VLAN ID, either an assigned client VLAN ID, default VLAN ID, or the management VLAN ID. Traffic received from the wired network must also be tagged with one of these known VLAN IDs. Received traffic that has an unknown VLAN ID or no VLAN tag is drop pe d.

• When VLAN support is disabled, the access point does not tag traffic passed to the

wired network and ignores the VLAN tags on any received frames .

Note: Before enabling VLAN tagging on the access point, be sure to configure the

attached network switch port to support tagged VLAN frames from the access point’s management VLAN ID, default VLAN IDs, and other client VLAN IDs. Otherwise, connectivity to the access point will be lost when you enable the VLAN feature.

Using IEEE 802.1X and a central RADIUS s er ver, up to 64 VLAN IDs can be mapped to specifi c wi re l ess cl ie nts, allo wi ng users to remain within th e sam e VLAN as they move around a campus site. This feature can also be used to control access to network resour ces from clients, thereby improving security.

A VLAN ID (1-4094) can be assigned to a client after su ccessful IEEE 802.1 X authentication. Th e cl i ent VLAN IDs must be confi gur ed on the RADIUS server for each user autho rize d t o access the network. If a cl ient does not have a configured VLAN ID on the RADIUS server, the access point assigns the client to the configured defaul t VLAN I D fo r the VAP interface.

Note: When using IEEE 802.1X to dynamically assign VLAN IDs, the access point must

have 802.1X authentication enabled and a RADIUS server configured. Wireless clients must also support 802.1X client software.

6-19

Page 72

System Configuration

When setting up VLAN IDs for each user on the RADIUS server, be sure to use the RADIUS attribu t es and values as indicate d i n th e f ol low i ng tab le.

Number RADIUS Attribute Value

64 Tunnel-Type VLAN (13) 65 Tunnel-Medium-Type 802 81 Tunnel-Private-Group-ID VLANID

(1 to 4094 as hexadecimal or string)

VLAN IDs on the RADIUS server can be en te re d as hexadecimal digit s or a stri ng (see “radius-ser ver vl an-format” on page 7-64).

Note: The spe cific configuration of RADIUS server software is beyond the scope of this

guide. Refer to the documentation provided with the RADIUS server software.

VLAN Classification – Enables or disables VLAN tagging support on the access point.

Native VLAN ID – The VLAN ID that traffic must have to be able to manage the access point. (R ange 1-4094; Default: 1)

6-20

Page 73

Advanced Configuration

WDS Settings

Each access poin t rad io interface can be configur ed to operate in a bridge or repeater mode, w hi ch allows it to forward traffic directly to other access poi nt uni ts. To set up bridge links between access point units, you mu st con figure the wireless Distribution System (WDS) forwarding table by specifying the wireless MAC address of all units to which you wan t to fo rward traffic. Up to six WDS bri dge or r epeater links can be speci fie d fo r each unit in the wireless bridge network.

The Spanning Tree Protocol (STP) can be used to detect and disable network loops, and to provide backup links between bridges. This allows a wireless bridge to interact with other bridging devices (that is, an STP-compliant sw i tch, bridge or router) in your network to ensure that only one route exists between any two stations on the network, and provide backup link s w hi ch automatically take over w hen a primary link goes down.

WDS Bridge – Up to six WDS bridge or repeater links (MAC addresses) pe r r adio interface can be specified for each unit in the wireless bridge network. One unit only must be configure d as the “root bridge” in the w ire le ss network. The root bridge is the unit connected to the main core of the wired LAN. Other bridges need to specify one “Parent” link to t he r oot br id ge or to a bridge connecte d to th e ro ot bridge. The other five WDS links ar e available as “Child” lin ks to other bridges.

• Bridge Role – Each radio interface can be set to operate in one of the following four

modes: (Default: AP)

• AP (Access Point): Operates as an access point for wireless clients, providing connectivity to a wired LAN.

6-21

Page 74

System Configuration

• Bridge: Operates as a bridge to other access points. The “Parent” link to the root bridge must be co nf igured. Up to five other ”C hi ld” links are available to ot her bridges.

• Repeater: Operate s as a wi r el es s re peater, extending th e ra nge for remote wireless clients and connecting them to the root bridge. The “Parent” link to the root bridge must be configured. In this mode, traffic is not forwarded to the Ethernet port from the radio interface.

• Root Bridge: Operates as the root bridge in the wireless bridge network. Up to six ”Child” links ar e available to other bridges in the network.

• Master/Slave Mode – Selects between Master and Sl av e m ode. A single master enables up to five slave links, whereas a slave will have only one link to the master.

• Bridge Parent – The physical layer address of the root bridge unit or the bridge unit connected to the root bridge. (12 hexadecimal digits in the form “xx-xx-xx-xx-xx-xx”)

• Channel Auto Sync – Allows a Bridge Child to automatically find the operating channel used by its Br id ge Pa re nt .

Caution:Do not enable Channel Auto Sync on a master bridge if there is no root bridge

acting as the master bridge's parent.

• Bridge Child – The physical layer addre ss of other bridge units f or wh ich t hi s unit serves as the bridge parent or the root bridge. Note that the first entry under the list of child nodes is reserved for the root bridge, and can only be configured if the role is set to “Root B rid ge.” (12 hexadec i mal digits in the for m “xx-xx-xx-x x-xx-xx”)

6-22

Page 75

Advanced Configuration

Spanning Tree Protocol – STP uses a distri buted algorithm to selec t a bridging device (STP-c om pli ant sw it ch, bridge or router) th at ser ves as t he root of the spanning tree network. It selects a root port on e ach bridging device (ex cept for the root device) which incurs the lowest path cost when forwarding a packet from that device to the root de vi ce. Then it selects a designated bridging device from each LAN which incurs th e lo w es t path cost when forwarding a packet from that LAN to the root device. All po rts conn ected to designated br id gi ng devi ces are assigned as designated ports. After determining the lowest cost spanning tree, it enables all root ports and designate d ports, and disables all other por ts. N et work packets are theref ore only f orwarded between root ports and designated ports, eliminating any possible network loops.

6-23

Page 76

System Configuration

Once a stable network t opology has been establ is hed, all bridges listen for Hello BPDUs (Bridge Protocol Data Units) transmitted from the root bridge. If a bridge does not get a Hello B PD U after a pre def ined interval (Maximum Age), the bridge assumes that th e lin k to th e ro ot bridge is down. This bridge w ill the n i ni tia te negotiations w ith other bridges to reco nf igur e th e network to reestablish a val i d networ k topology.

• Bridge – Enables/disables STP on the wireless bridge or repeater. (Default: Disabled)

• Bridge Priority – Used in selecting the root device, root port, and designated port. The device with the highest priority become s t he STP root device. Howev er , if all devices have the same priority, the device with the lowest MAC address will then become the root devi ce. (Note that lower nu m er ic val ues indicate higher pri or ity .)

• Range: 0-65535

• Def au l t: 32768

• Bridge Max Age – The maxi m um time (in seconds) a device can wait without receiving a confi gur at i on m essage before attempting to reconfigur e. A ll de vi ce ports (except for desi gnated ports) shou ld rec ei ve configuration mess ages at regular intervals. An y por t tha t ages out STP i nfor m at i on ( pr ovided in the last configuration message) becomes the designated port for the attached LAN. If it is a root port, a new root port is selected from among the device ports attached to the network. (Range: 6-40 seconds)

• Def au l t: 20

• Mi nimum: The higher of 6 or [2 x ( Hel lo Ti m e + 1) ] .

• Maximum: The lower of 40 or [2 x (Fo rw ard Delay - 1)]

• Bridge Hello Ti me – Interval (in seconds) at which t he root device transmits a configuration message. (Range: 1-10 seconds)

• Def au l t: 2

• Minimum: 1

• Maximum: The lower of 10 or [(M ax . Message Age / 2) -1]

• Bridge Forwarding Delay – The maximum time (in seconds) this device waits before changing sta t es ( i.e. , discarding to learning to for war di ng). This delay is required because every device mus t receive information ab out topology change s before it starts to forward frames. In addition, each port needs time to listen for conflicting info rm a tion that would make it re t urn to a di scarding state; othe rwi se , temporary data loops might result. (Range: 4-30 seconds)

• Def au l t: 15

• Mi ni m um : The higher of 4 or [(Max. Message Age / 2) + 1]

• Maximum: 30

• Link Path Cost – This parameter is us ed by the STP to determine th e best path between devices. Therefore, lower values should be assigned to ports attached to faster media, an d higher values assigne d to por t s w ith slo wer media. (Path cost takes precede nce over port priority. )

6-24

Page 77

Advanced Configuration

• Range: 1-65535

• Def au l t: Et her net interface: 19; Wirel ess interface: 40

• Link Port Priority – De fines the priority used fo r thi s por t in the S panning Tree

Protocol. If the path cost for all ports on a switch are the same, the port with the highest priority ( i.e., lo w est value) will be configur ed as an active link in the spanning tree. This makes a port with higher priority less likely to be blocked if the Spanning Tree Protocol is detecting network l oops. Where more tha n one port is assigned the highest priori ty, the port with lowest numer ic identifier will be ena bled.

• Def au l t: 128

• Range: 0-240, in steps of 16

CLI Commands for WDS Settings – To set the r ol e of th e access point radio interface, use the br idge ro le command from the CLI wireless interface configuration mode. If the role of the radio in te rfac e i s set t o “Br idge” or “Repeater,” the MAC addres s of the paren t no de must also be configu red using the bridge-link parent command. If the role is set to anything other than “Access Point,” then you should also conf ig ur e th e M AC addresses of the chil d nodes using the bridge-link child command. To view the current bridg e lin k set t i ngs , us e t he show bridge link command.

Enterprise AP(if-wireless a)#bridge role bridge 7-79 Enterprise AP(if-wireless a)#bridge channel-auto-sync enable 7-80 Enterprise AP(if-wireless a)#bridge-link child 2 00-08-3e-84-bc-6d 7-81 Enterprise AP(if-wireless a)#bridge-link child 3 00-08-3e-85-13-f2 Enterprise AP(if-wireless a)#bridge-link child 4 00-08-3e-84-79-31 Enterprise AP(if-wireless a)#bridge-link parent 00-08-2d-69-3a-51 7-80 Enterprise AP(if-wireless a)#exit Enterprise AP#show bridge link wireless a 7-83

Interface Wireless A WDS Information ==================================== AP Role: Bridge Channel Auto Sync: Enable Parent: 00-08-2d-69-3a-51 Child: Child 2: 00-08-3e-84-bc-6d Child 3: 00-08-3e-85-13-f2 Child 4: 00-08-3e-84-79-31 Child 5: 00-00-00-00-00-00 Child 6: 00-00-00-00-00-00 STAs: No WDS Stations. Enterprise AP#

6-25

Page 78

System Configuration

CLI Commands for STP Settings – If the role of a radio inter fa ce i s se t to R epeater, Bridge or Root Bridge , ST P can be enabled on the access poi nt to ma in tain a va lid network topology. To gl obally enable STP, use the bridge stp enable comm and from the CLI configuration mode. Then co nf igure the other global STP paramet ers for the bridge. The path cost and priority for each bridge link can be set using the bridge-link path-cost and bridge-link port-priority command f ro m th e Wireless Interface configuration mode. The path co st and priority can also be set fo r t he Ethernet port from the Eth er net I nt er face configuration mode. To view the curren t STP settings, use the sh ow bridge stp command.

Enterprise AP(config)#bridge stp enable 6-104 Enterprise AP(config)#bridge stp forwarding-delay 2500 6-105 Enterprise AP(config)#bridge stp hello-time 500 6-106 Enterprise AP(config)#bridge stp max-age 4000 6-107 Enterprise AP(config)#bridge stp priority 40000 6-108 Enterprise AP(config)#interface wireless a Enterprise AP(if-wireless a)#bridge-link path-cost 2 40 6-109 Enterprise AP(if-wireless a)#bridge-link port-priority 2 64 6-110 Enterprise AP(if-wireless a)#exit Enterprise AP#show bridge stp 6-111

Bridge MAC : 00:30:F1:F0:9A:9C Status : Disabled priority : 32768 desiginated-root : priority = 0, MAC = 00:00:00:00:00:00 root-path-cost : 0 root-Port-no : 0 Hold Time : 0 Seconds Hello Time : 0 Seconds Maximum Age : 0 Seconds Forward Delay : 0 Seconds bridge Hello Time : 2 Seconds bridge Maximum Age : 20 Seconds bridge Forward Delay : 5 Seconds time-since-top-change: 3168 Seconds topology-change-count: 0 Enterprise AP#

6-26

Page 79

Advanced Configuration

AP Management

The Web, T elnet, and SNMP management interfaces are enabled and open to all IP addresses by def a ul t. To provide more security for management access to the access point, sp eci f ic in te rfaces can be disabled and managemen t rest r ic t ed to a single IP addres s or a lim ite d ra nge of IP addresses.

Once you specif y an I P address or range of add resses, access to m anagement interfaces is restr ict ed to the specified addr es ses. If anyone tries to access a management interface from an unauthorized address, the access point will reject the connection.

UI Manage ment – Enables or disables management access through T elnet, the Web (HTTP), or SNMP interfaces. (Default: Enabled)

Note: Secure Web (HTTPS) connections are not affected by the UI Management or IP

Management settings.

IP Management – Restricts manage ment access to Telnet, Web, and SNMP interfaces to specified IP addresses. (Default: Any IP)

• Any IP: Indicates that any IP address is allowed management access.

• Single IP: Specifies a single IP address that is a llo w ed m anagement access.

• Multiple IP: Specifies an address range as defined by the entered IP address and

subnet mask. For example, IP address 192.168.1.6 and sub net m ask

255.255.255.0 , de fines all IP addresse s from 192.168.2.2 to 192.1 68.1.254.

6-27

Page 80

System Configuration

CLI Commands fo r AP Management features .

SMC AP(config)#apmgmtip multiple 192.168.1.50 255.255.255.0 7-21 SMC AP(config)#apmgmtui SNMP enable 7-22

Administration

Changing the Password

Management access to the web and CL I inte r f ace on t he access point is contr ol l ed through a single user name and password . You can also gain additional access security by using control filters (see “Fil t er Co nt rol” on page 6-17).

To protect acces s t o t he managem ent interface, you need to configur e an Admini strator’s user na m e and pa ssword as soon as possible. If the user name and password are not co nf igured, then anyone having access to the ac cess point may be able to compromise access point and network security . Once a new Administrator has been configured, you can delete the default “admin” user name from the system.

Username – The name of the use r. The default name is “a dmin.” (Length: 3-16 characters, ca se sensitive)

New Password – The password for management access. (Le ng th : 3-16 characters, case sensitive )

Confirm New Password – Enter the p assword again for verification. CLI Commands fo r the Administrator’s User Name and Passw ord – Use the

username and passwo rd commands from th e CLI configuration mod e.

SMC AP(config)#username bob 7-15 SMC AP(config)#password admin 7-15 SMC AP#

Setting the Timeout Interval

You can set the timeout interval for web access to the unit, after which the user will have to re-enter th e username and passwor d.

6-28

Page 81

Advanced Configuration

Session Timeout for WEB – Sets the time limit for an idle web interface session. (Range: 0-1800 se conds; Def ault: 30 0 seconds; 0 is disabled)

CLI Command for the Web Ses si on Timeout – Use th e ip http session-timeout command from the C LI configuration mod e.

SMC AP(config)#ip http session-timeout 0 7-18 SMC AP(config)#

Upgrading Firmware

You can upgrade new acce ss point software from a loc al file on t he management workstation, or from an FTP or TFTP server. New software may be provided periodically from your distributor.

After upgrading new softwar e, you must reboot the access point to impleme nt th e new code. Until a rebo ot occu rs , the access point will continu e to run the software it was using before the upgrade started. Also note that new software that is incompatible with the current configuration automatically restores the access point to the factory defaul t set t in gs when first activated a fter a re boot.

6-29

Page 82

System Configuration

Before upgrading new software, verify that the access point is connected to the networ k and has been configured with a compatible IP add r ess and subnet mask.

If you need to downl oad from an FTP or TFTP server, take the following additional steps:

• Obtain the IP address of the FTP or TFTP server where the access point software is stored.

• If upgrading from an FTP server, be sure that you have an account configured on the server with a user name and passwor d.

• If VLANs are configured on t he access point, determ ine the VLAN ID with whi ch the FTP or TFTP server is associated, and then configure the management station, or the network port to which it is attached, with the same VLAN ID. If you are managing the access point from a wireless client, the VLAN ID for the wireless client must be configured on a RADIUS server.

Current version – Version number of runtime co de.

6-30

Page 83

Advanced Configuration

Firmware Upgrad e Local – Downloads an operation code ima ge f i le from the web management station to th e access po i nt usin g HT TP. Use the Browse button t o locate the image fi le loc all y on the management station and click Start Upgrade to proceed.

• New firmware file: Specifies the name of the code file on the server. The new

firmware file nam e should not contain slashes (\ or /), the leading l et te r of th e f ile name should no t be a period (.), and the maxim u m length for file names is 32 characters for files on the access point. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

Firmware Upgrad e R em o te – D ow n lo ads an operation code image file from a specified remote FTP or TFTP server. After filling in the following fields, click Start Upgrade to proc eed .

• New firmware file: Specifies the name of the code file on the server.

firmware file name should not contain slashes (\ or /), name should no t be a period (.), and the maximum length for file nam es on the FTP/TFTP server is 255 characters or 32 characters for files on the access point. (Valid ch aracter s : A -Z, a-z, 0- 9, “.”, “-”, “_”)

• IP Address: IP address or hos t na m e of FTP o r TFTP server.

• Username: The user ID used for login on an FTP server.

• Password: The password used for login on an FT P se rv er . Configuration File Backup/Restore – Upl oads th e curren t access point configuration

file to a specified remot e FTP or TFTP server. A configuration file can also be downlo aded to the access poi nt to rest ore a specif ic confi gurati on.

• Export/Import: Select Export to upload a file to an FTP/TFTP server. Select Import

to download a file from an FTP/ TFTP server.

• Config file: Specifies the nam e of t he configuration file, wh ic h m ust always be

"syscfg." A path on the server can be specified using “/” in the name, providing the path already exist s; fo r ex am pl e, “myfolder/syscfg.” Other than to indicate a pat h, the file name must not contain any slashes (\ or /), the leading letter cannot be a period (.), and the maximum le ngt h f or file nam es on the FTP/TFTP server is 255 characters. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

the leading letter of t he f ile

The new

• IP Address: IP address or hos t na m e of FTP o r TFTP server.

• Username: The user ID used for login on an FTP server.

• Password: The password used for login on an FT P se rv er . Restore Factor y Settin gs – Click the Restore bu tton to reset the configuration

settings for the access point to the factory defaults and reboot the system. Note that all user configured information will be lost. You will have to re-enter the default user name (admin) to re-gain management access to this device.

Reboot Access Point – Click the Reset button to reb oot th e system.

Note: If you have upgraded system software, then you must reboot the access point to

implement the new operation code. New software that is incompatible with the current configuration automatically restores the access point to default values when first activated after a reboot.

6-31

Page 84

System Configuration

Upon uploading a new configuration file you will be prompted to eith er res to re factory setting s, or reboot the unit.

CLI Commands for Downloading Software from a TFTP Server – Use the copy tftp file command from the Exec m ode and then specify the file ty pe, name, and IP address of the TFTP server. When the download is complete, the dir command can be used to check that th e new file is present in the access point file system . To run the new software, use the res et boar d co mmand to reboot the access point.

SMC AP#copy tftp file 7-57

1. Application image

2. Config file

3. Boot block image Select the type of download<1,2,3>: [1]:1 TFTP Source file name:img.bin TFTP Server IP:192.168.2.29

SMC AP#dir 7-59 File Name Type File Size

-------------------------- ---- ----------dflt-img.bin 2 1319939 img.bin 2 1629577 syscfg 5 17776 syscfg_bak 5 17776

262144 byte(s) available

SMC AP#reset board 7-10 Reboot system now? <y/n>: y

6-32

Page 85

Advanced Configuration

System Log

The access point can be configured to send event and error messages to a System Log Server. The system clock can also be synchronized with a time server, so that all the messages sent to the Syslog server are stamped with the correct time and date.

Enabling System Logging

The access point supports a logging process that can control error messages saved to memory or sent to a Syslog server. The logged messages serve as a valuable tool for isolating access point and network pro blems.

System Log Setup – Enables the logging of er ro r m es sages. (Default: Dis ab le ) Server (1-4) – Enables the sending of log messages to a Syslog server host . Up to

four Syslog serv er s ar e supported on the access point. (Defau lt: Dis abl e)

Server Name/IP – The IP address or name of a Sys log server. (Default: 0.0.0.0) UDP Port – The UDP port used by a Sy sl og server. (Range: 514 or 11024-65535;

Default: 514) Logging Console – Enables the logg in g of er ro r messages to the console.

(Default: Disable)

6-33

Page 86

System Configuration

Logging Level – Sets the minimum severity level for event logging. (Default: Informational)

The system allow s yo u t o lim i t the messages that are logged by specifying a minimum severit y l evel. The following table lists the error message levels f rom the most severe (Emergency) to least severe (Debug). The message levels that are logged include the specified minimum level up t o t he Em ergency level.

Error Level Description

Emergency System unusable Alerts Immediate action needed Critical Critical conditions (e.g., memory allocation, or free memory error - resource

exhausted) Error Error conditions (e.g., invalid input, default used) Warning Warning conditions (e.g., return false, unexpected return) Notice Normal but significant condition, such as cold start Informational Informational messa ges only Debug Debugging messages

Note: The access point error log can be viewed using the Event Logs window in the

Status section (page 6-93). The Event Logs window displays the last 128 messages logged in chronological order, from the newest to the oldest. Log messages saved in the access point’s memory are erased when the device is rebooted.

Logging Facility T ype – Sets the facility type for remote logging of syslog messages. The command specifies the facility type tag sent in syslog messages. (See RFC

3164.) This type has no effect on the kind of messages reported by th e swi t ch. However, it may be used by the sysl og server to sort messa ges or to store messages in the c or re sponding database. (Ra nge: 16-23; Default: 16)

6-34

Page 87

Advanced Configuration

CLI Commands for System Logging – To enable logging on the ac cess point, use the logging on command from th e gl ob al configuration mode. Th e logging level command sets the mi nimum level of messa ge t o log. U se the logging console command to enable logging to the console. Use the logging host command to specify up to four Syslog servers. The CLI also allows the logging facility-type command to set the facility-type number to use on the Syslog server. To view the current logging settings, use the s how logg ing command.

SMC AP(config)#logging on 7-30 SMC AP(config)#logging level alert 7-31 SMC AP(config)#logging console 7-31 SMC AP(config)#logging host 1 IP 10.1.0.3 514 7-30 SMC AP(config)#logging host 1 Port 514 7-30 SMC AP(config)#logging facility-type 19 7-32 SMC AP(config)#exit SMC AP#show logging 7-33

Logging Information ============================================ Syslog State : Enabled Logging Console State : Enabled Logging Level : Alert Logging Facility Type : 19 Servers 1: 10.1.0.3, UDP Port: 514, State: Enabled 2: 0.0.0.0, UDP Port: 514, State: Disabled 3: 0.0.0.0, UDP Port: 514, State: Disabled 4: 0.0.0.0, UDP Port: 514, State: Disabled =============================================

SMC AP#

Configuring SNTP

Simple Network Time Protocol (SNTP) allows the access point to set its internal clock based on pe riodic updates from a time s er ver (SNTP or NTP). Maintaining an accurate time on t he access point enabl es the system log to record meaningful dates and times for event entries. If the clock is not set, the access point will only record the time from t he fac to ry def ault set at the last bootup.

The access point acts as an SNTP client, periodically sending time synchronization requests to specifi c tim e s ervers. You can configure up to two t im e server IP addresses. The access point will attempt to poll each server in the configured sequence.

SNTP Server – Con figu res the access point to o per at e as an SNTP client. Whe n enabled, at least one t ime server IP address must be specified.

• Primary Server: The IP address of an SNTP or NTP time server that the access point attempts to poll for a time update.

• Se cond a ry Se rv er : T he I P ad dr ess of a s e cond a ry SNT P or N TP t i me ser ver . The access point first a ttempts to upda te the time fr om the pr imary s erver; if this fails it attempts an upd at e from t he secondary serv er .

6-35

Page 88

System Configuration

Note: The access point also allows you to disable SNTP and set the system clock

manually.

Set Time Zone – SNTP uses Coordinated Universal Time (or UTC, formerly Greenwich Mea n Time, or GMT) based on the time at the Earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the numb er of hours your time zo ne is located before (e ast) or after (west) UTC.

Enable Daylight Saving – The access point prov ides a way to automatical l y adjust the system clock f or Da yl i ght Sav i ngs Time changes. To use this feature you must define the month an d date to begin and to end the change from standard tim e. During this period th e system clock is set bac k by one hour.

CLI Commands for SNTP – To enable SNTP support on the access point, from the global configuration mode specify SNTP server IP addresses using the sntp-server ip command, then use the sntp-server enable command to enable the service. Use the sntp-server timezone command to set the time zone for your location, and the sntp-server daylight-saving com m and to set daylight sav in gs . To view the curren t SNTP settings, use th e sho w snt p command.

SMC AP(config)#sntp-server ip 1 10.1.0.19 7-35 SMC AP(config)#sntp-server enable 7-35 SMC AP(config)#sntp-server timezone +8 7-37 SMC AP(config)#sntp-server daylight-saving 7-37 Enter Daylight saving from which month<1-12>: 3 and which day<1-31>: 31 Enter Daylight saving end to which month<1-12>: 10 and which day<1-31>: 31 SMC AP(config)#exit SMC AP#show sntp 7-38

SNTP Information ========================================================= Service State : Enabled SNTP (server 1) IP : 10.1.10.19 SNTP (server 2) IP : 192.43.244.18 Current Time : 19 : 35, Oct 10th, 2003 Time Zone : +8 (TAIPEI, BEIJING) Daylight Saving : Enabled, from Mar, 31st to Oct, 31st =========================================================

SMC AP#

6-36

Page 89

Advanced Configuration

CLI Commands fo r the System Clock – The follow i ng example shows how t o manually set the system time when SNTP server support is disabled on the access point.

SMC AP(config)#no sntp-server enable 7-35 SMC AP(config)#sntp-server date-time 7-36 Enter Year<1970-2100>: 2003 Enter Month<1-12>: 10 Enter Day<1-31>: 10 Enter Hour<0-23>: 18 Enter Min<0-59>: 35 SMC AP(config)#

RSSI

The RSSI value display ed on the RSSI page represen ts a signa l to no ise ratio. A value of 30 would indicate that the power of the received signal is 30 dBm above the ambient noise floor. This value can be used to align antennas (s ee page 4-6) and monitor the quality of the received signal for bridge links. An RSSI value of about 30 or more indicate s a st ro ng enough signal to sup port the maximum data rat e of 54 Mbps. Below a value of 30, the supported data rate would drop to lower rates. A value of 15 or less ind ic at es tha t the si gnal is weak and the antennas may require realignment.

6-37

Page 90

System Configuration

The RSSI controls allow the external connector to be disabled and the receive signal for each WDS port displayed.

RSSI:

• Auto Refresh – Enables or d is ables the refreshing of RS SI infor m at i on.

• RSSI Value – The displayed RSSI value for a selected port.

6-38

Page 91

Advanced Configuration

•Port Number: Selects a specific WDS port for which to display the RSSI output value. Ports 1-6 are available for a Master unit, only port 1 for a Slave unit. (Default: 1)

Distance:

• Mode: Indicates if the 802.11a radio is operating in normal or Turbo mode. (See "Radio Settings A" on pag e 6- 53.)

• Distance: The appro xim at e di st ance between ante nnas in a bridge link.

LED Status

• Mode – Selects AP mode or B ridg e m ode.

• Bridge Port – Allows the user to sel ec t the bridge port on which to m oni tor traf fic . (Default:1; Range: 1~6)

There are currentl y no equivalent CLI comm a nds for the RSSI control s.

6-39

Page 92

System Configuration

SNMP

Simple Network Man agement Protoco l (SNMP) is a com m unication prot ocol designed specif i call y f or ma naging devices on a net wor k. Equipment comm only managed with S NM P in cludes switches, routers and host computers. SNMP is typically used to configure these devices for proper operation in a network environment, as well as to monitor them to evaluate performance or detect potential problems.

Managed devices supporting SNMP contain software, which runs local l y on th e device and is referred to as an agent. A defined set of variables, known as managed objects, is maintained by the SNMP agent and used to m a nage the device. These objects are defined in a M anagement Inform at io n Bas e (M IB ) th at pro vides a standard presentation of the information controlled by the agent. SNMP defines both the format of the MIB specifications and the protocol used to access this information over the network.

The access point i ncludes an onboard agent that supports SNMP versions 1, 2c, and 3 clients. This agen t cont i nuously monitors the status of the access point, as well as the traffic passing to and fro m w irel es s cl ients . A ne two rk m anagement station can access thi s inf or m at i on us i ng SN M P management softw ar e th at is compliant with MIB II. To implement SNMP management, the access point must first have an IP addres s and subnet mask, con figured either manual ly or dynamically. Access to the onboard agent using SNMP v1 and v2c is controlled by com munity strings. To communicate with the access point, the management station must first submit a valid comm unity string for auth ent ication.

Access t o the ac cess poin t usin g SNM P v3 prov ides addi tio nal se cur ity featu res t hat cover messag e in te gr i ty, authentication, and en cr yption; as well as cont ro lling notifications that are sent to specified user targets.

6-40

Page 93

SNMP

Configuring SNMP and Trap Message Parameters

The access point SN M P age nt mu st be enabled to function (fo r ve rsions 1, 2c, and 3 clients). Manageme nt access using SNMP v1 and v2c also requires com m unity strings to be configured for authentica tion. Trap notifications can be en abled and sent to up to four management stations.

SNMP – Enables or disables SNMP manag em ent access and also en abl es th e access point to send SNMP traps (notification s) . (D ef au lt: D isable)

Location – A tex t str in g t hat describes the system lo cation. (Maximum len gt h: 255 characters)

Contact – A text string that describes t he system contact. (Maxi m um l eng t h: 255 characters)

Community Nam e ( R ead Only) – Defines th e SNMP community ac ce ss string that has read-only access. Authorized m anagement stations are onl y able to retrieve MIB objects. (Maximum length: 23 charac te rs , c ase sensitive; Default : pu bl ic)

6-41

Page 94

System Configuration

Community Nam e ( R ead/Write) – Defines the SNMP community access string that has read/write access. Authorized management stations a re a bl e to bot h r et rieve and modify MIB objects. (Maximum length: 23 characters, case sensitive; Default: private)

Trap Destination (1 to 4) – Enables recipients (up to fou r) of SN M P not ifications.

• Trap Destination IP Address – Specifies the recipient of SNMP notifications. Enter the IP address or t he host name. (Host Name: 1 to 63 character s, case sensitive)

• Trap Destination Com m uni t y Nam e – The community string sent with the notification oper at ion. (M aximum length: 23 characters, case se ns iti ve; Default: public)

Engine ID – Sets the engine identifier for the SN M P v3 agent that resides on th e access point. This engine protects against message replay , delay, and redirection. The engine ID is also used in combination wit h us er passw ords to generate the security keys for a ut hen ticating and encrypting SN M Pv3 packets. A default engine ID is automatica lly ge nerated that is uniqu e to th e acc ess point. (Range: 10 to 64 hexadecima l ch ar acters)

Note: If the local engine ID is deleted or changed, all SNMP users will be cleared. All

existing users will need to be re-configured. If you want to change the default engine ID, change it first before configuring other SNMP v3 parameters.

6-42

Page 95

SNMP

Trap Configuration – Allows selection of specific SNMP notifications to send. The following items ar e av ai l abl e:

• sysSystemUp - The acc ess point is up and running.

• sysSystemDown - The access point is about to shutdown and reboo t.

• sysRadiusServerC hanged - The access point has changed from t he primary

RADIUS server to the secondary, or from th e sec o n dary to the primary.

• sysConfigFileVersio nC hanged - The access point’s configuratio n fil e ha s been

changed.

• dot11StationAssoci at i on - A cl ient st at io n has successfully associated with the

access point.

• dot11StationReAssociation - A client station has successfully re-a sso ci at ed with

the access poin t.

• dot11StationAuthentication - A client station has been successfully authenticated.

• dot11StationRequestFail - A client station has failed association, re-association, or

authentication.

• dot11InterfaceBFail - Th e 802.11b interface has fa iled .

• dot11InterfaceAFail - The 802.11a or 802.11 g in terface has failed.

• dot1xMacAddrAut hSuccess - A client stati on ha s successfully authenticated its

MAC address w ith t he RADIUS server.

• dot1xMacAddrAuthFail - A client station has failed MAC address authentication

with the RADIUS server.

• dot1xAuthNotInitiated - A cli ent stat i on did not in itiat e 802.1X authentication.

• dot1xAuthSuccess - A 802.1X client station has been successfully authenticated

by the RADIUS server.

• dot1xAuthFail - A 802.1X client st at ion has failed RADIUS aut he nt icat i on.

• dot1xSuppAuthenticated - A supplicant station has been successfully

authenticated by the RADIUS server

• localMacAddrAuthSuccess - A client station has successfully authenticated its

MAC address w ith t he local database on the access point.

• localMacAddrAuthFail - A client station has failed authentication with the local MAC

address database on the access point.

• iappStationRoamedFrom - A client station has roamed from another access point

(identified by its IP a ddr ess).

• iappStationRoamedTo - A client station has ro am ed to another access point

(identified by its IP a ddr ess).

• iappContextDataSent - A client station’s C ont ex t Data has been sent to an ot her

access point wit h whi ch the station has associated.

• sntpServerFail - The access point has failed to set the time from the configured

SNTP server.

• wirelessExternalA nt enna - An external antenn a has been enabled.

• dot11WirelessSt ationDe authenticate - A client station has de-authenticated from

the network.

6-43

Page 96

System Configuration

• dot11StationDisas soc ia t e - A cli ent st at i on no longer associates w ith t he net w or k.

• dot11StationAuthe ntic at eFail - A client station has tried and f ai led to aut he nt ic at e to the network.

• Enable All Traps - Click the button to enable all the available traps.

• Disable All Traps - Click the button to disable all the available traps.

CLI Commands for SNMP and Trap Configuration – Use the snmp-server enable server com m and from the global co nfig ur at i on m ode to enable the SNMP agent. Use the snmp-server l ocation and snmp -server con tact commands to indi cate the physical locat i on of the access point and define a system co ntac t. To set the read-only and rea d/ wr ite community names , u se t he snmp-server community command. Us e th e snmp-server hos t co m m and to define a trap receiver host and the sn m p-s erver trap comman d t o enable or disable speci fic traps.

SMC AP(config)#snmp-server enable server 7-43 SMC AP(config)#snmp-server community alpha rw 7-42 SMC AP(config)#snmp-server community beta ro SMC AP(config)#snmp-server location WC-19 7-43 SMC AP(config)#snmp-server contact Paul 7-42 SMC AP(config)#snmp-server host 192.168.1.9 alpha 7-44 Enterprise AP(config)#snmp-server trap dot11StationAssociation 7-45 Enterprise AP(config)#

6-44

Page 97

SNMP

To view the current SNMP settings, use the show snmp command.

SMC AP#show snmp 7-55

SNMP Information ============================================== Service State : Enable Community (ro) : ***** Community (rw) : ***** Location : WC-19 Contact : Paul

EngineId :80:00:07:e5:80:00:00:2e:62:00:00:00:18 EngineBoots:1

Trap Destinations: 1: 192.168.1.9, Community: *****, State: Enabled 2: 0.0.0.0, Community: *****, State: Disabled 3: 0.0.0.0, Community: *****, State: Disabled 4: 0.0.0.0, Community: *****, State: Disabled

dot11InterfaceAGFail Enabled dot11InterfaceBFail Enabled dot11StationAssociation Enabled dot11StationAuthentication Enabled dot11StationReAssociation Enabled dot11StationRequestFail Enabled dot1xAuthFail Enabled dot1xAuthNotInitiated Enabled dot1xAuthSuccess Enabled dot1xMacAddrAuthFail Enabled dot1xMacAddrAuthSuccess Enabled iappContextDataSent Enabled iappStationRoamedFrom Enabled iappStationRoamedTo Enabled localMacAddrAuthFail Enabled localMacAddrAuthSuccess Enabled iappContextDataSent Enabled dot1XSuppAuthenticated Enabled wirelessExternalAntenna Enabled dot11InterfaceAFail Enabled dot11InterfaceGFail Enabled pppLogonFail Enabled sntpServerFail Enabled configFileVersionChanged Enabled radiusServerChanged Enabled systemDown Enabled systemUp Enabled

============================================= Enterprise AP#

6-45

Page 98

System Configuration

Configuring SNMPv3 Users

The access point all ow s up to 10 SN M P v3 users to be configur ed. Each user must be defined by a unique name, assigned to one of three pre -de f ined security groups, and configured wi t h specific authenticat ion and encryption set t ings.

User – The SNMPv3 user nam e. (3 2 characters maxim um ) Group – The SNMPv3 group name. (Options: RO, RWAuth, or RWPriv; Default: RO)

• RO – Read-only acce ss.

• RWAuth – Read/wri te access with user authe nt i cati on.

• RWPriv – Read/write access with both user aut hentication and data enc ry p tio n.

Auth Type – The authentication type us ed for the SNMP user; eithe r MD 5 or no ne. When MD5 is selec t ed, ent er a password in the corresponding Passphras e field.

Priv T ype – The data encryption type used for the SN M P user; either DES or none. When DES is select ed, enter a key in the corresponding Passphrase f ie ld .

Passphrase – The passw or d or key associated with th e aut hentication and privacy settings. A minimum of eight plain text characters is req ui re d.

Action – Click the Add button to add a new user to the list. Click the edit button to change details of an existing user. Click the Del button to remove a user from the list.

Note: Users must be assigned to groups that have the same security levels. For

example, a user who has “Auth Type” and “Priv Type” configured to MD5 and DES respectively (that it, uses both authentication and data encryption) must be assigned to the RWPriv group. If this same user were instead assigned to the read-only (RO) group, the user would not be able to access the database.

6-46

Page 99

SNMP

CLI Commands for Configuring SNMPv3 Users – Use the snmp- ser ver engine-id command to def ine th e SN M P v3 engine before ass ig ni ng users to groups. Use the snmp-server user command to assign users to one of the three groups and set the appropriate authentication and encr yption types to be used. To view the current SNMP v3 engine ID , us e the show snmp comma nd. To view SNMP user s and group settings, us e t he show snmp users or show snmp group-assignments commands.

Enterprise AP(config)#snmp-server engine-id 1a:2b:3c:4d:00:ff 7-46 Enterprise AP(config)#snmp-server user 7-47 User Name<1-32> :chris Group Name<1-32> :RWPriv Authtype(md5,<cr>none):md5 Passphrase<8-32>:a good secret Privacy(des,<cr>none) :des Passphrase<8-32>:a very good secret Enterprise AP(config)#exit Enterprise AP#show snmp users 7-52

============================================= UserName :chris GroupName :RWPriv AuthType :MD5 Passphrase:**************** PrivType :DES Passphrase:**************** ============================================= Enterprise AP#show snmp group-assignments 7-52

GroupName :RWPriv UserName :chris Enterprise AP#

6-47

Page 100

System Configuration

Configuring SNMPv3 Trap Filters

SNMP v3 users can be configured to receive notification messages from the access point. An SNMP Tar get I D is cre at ed t hat specifies the SNM P v3 user, IP address, and UDP port. A user - def ined notification filter can be created so that sp ecif i c notifications can be pr evented from being sent to particular targets.

The access point allows up to 10 notification filters to be created. Each filter can be defined by up to 20 MIB subtree ID entries.

To configure a new notification filter, click the New button. A new page opens to configure the filter (see below). To edit a n exi s ting filter, select the radio button next to the entry in the table and then click the Edit button. To delete a filter, select the radio button next to t he entry in the table and then cl ick t he D elete button.

When you click on the New button in the SNM P Trap Filters page, a new page opens where the fi lter parameters are configure d. Def i ne a f ilter nam e and subtree ID to be filtered. Select the filter type, includ e or exc l ude, from the drop-do wn l is t. Click Apply to create the filter.

To add more subtree IDs to the fil te r, return to the SNMP Tra p Filt er s page and click the Edit button. In the Edit page, click the New button to access the Add SNMP Notification Subtree page and configure a new subtree ID to be filtered.

Note: Only the New Filter page allows the Filter ID to be configured.

6-48

SMC Networks EliteConnect SMC2891W-AG, EliteConnect SMC2890W-AG, 2890W-AG, 2891W-AG User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual