Alcatel-Lucent AOS-W 6.5.3.x

To Next Page

To Previous Page

14| Contents AOS-W 6.5.3.x| User Guide

AirGroup 819

Security 820

UCC 820

Controller 822

WLANs 824

Access Points 825

Clients 826

Firewall 827

Management Access 833

Configuring Certificate Authentication for WebUI Access 833

Secure Shell (SSH) 834

WebUI Session Timer 835

Enabling RADIUS Server Authentication 836

Connecting to an OmniVista Server 842

Custom Certificate Support for RAP 846

Implementing a Specific Management Password Policy 848

Configuring AP Image Preload 850

Configuring Centralized Image Upgrades 852

Managing Certificates 854

Configuring SNMP 860

Enabling Capacity Alerts 862

Configuring Logging 864

Enabling Guest Provisioning 868

Managing Files on the Switch 882

Setting the System Clock 885

ClearPass Profiling with IF-MAP 887

Whitelist Synchronization 888

Downloadable Regulatory Table 889

Main Page

Contents3
- Table of Contents3
- Revision History18
About this Guide19
- What's New in AOS-W 6.5.X19
- Fundamentals31
- Related Documents32
- Conventions32
- Contacting Support34
The Basic User-Centric Networks35
- Understanding Basic Deployment and Configuration Tasks35
- Switch Configuration Workflow38
- Connect the Switch to the Network39
- OAW-40Xx Series and OAW-4X50 Series Switches40
- Using the LCD Screen42
- Configuring a VLAN to Connect to the Network45
- Enabling Wireless Connectivity49
- Configuring Your User-Centric Network49
- Replacing a Switch49
Control Plane Security56
- Control Plane Security Overview57
- Configuring Control Plane Security57
- Managing AP Whitelists59
- Managing Whitelists on Master and Local Switches66
- Working in Environments with Multiple Master Switches70
- Replacing a Switch on a Multi-Switch Network73
- Configuring Control Plane Security after Upgrading76
- Troubleshooting Control Plane Security77
Software Licenses79
- Getting Started with AOS-W Licenses79
- License Types and Usage79
- Licensing Best Practices and Limitations82
- Centralized Licensing Overview83
- Configuring Centralized Licensing89
- Installing a License91
- Deleting a License93
- Monitoring and Managing Centralized Licenses94
Network Configuration Parameters97
- Campus WLAN Workflow97
- Understanding VLAN Assignments98
- Configuring Vlans105
- Configuring Ports110
- Configuring Static Routes113
- Configuring the Loopback IP Address113
- Configuring the Switch IP Address114
- Configuring GRE Tunnels115
- Configuring GRE Tunnel Groups124
- Jumbo Frame Support127
Ipv6 Support130
- Understanding Ipv6 Notation130
- Understanding Ipv6 Topology130
- Enabling Ipv6131
- Enabling Ipv6 Support for Switch and Aps131
- Filtering an Ipv6 Extension Header (EH)139
- Configuring a Captive Portal over Ipv6139
- Working with Ipv6 Router Advertisements (Ras)140
- RADIUS over Ipv6144
- TACACS over Ipv6145
- Dhcpv6 Server146
- Understanding AOS-W Supported Network Configuration for Ipv6 Clients148
- Understanding AOS-W Authentication and Firewall Features that Support Ipv6149
- Managing Ipv6 User Addresses154
- Understanding Ipv6 Exceptions and Best Practices155
Link Aggregation Control Protocol157
- Understanding LACP Best Practices and Exceptions157
- Configuring LACP158
- LACP Sample Configuration160
Ospfv2161
- Understanding OSPF Deployment Best Practices and Exceptions161
- Understanding Ospfv2 by Example Using a WLAN Scenario162
- Understanding Ospfv2 by Example Using a Branch Scenario163
- Configuring OSPF165
- Sample Topology and Configuration166
Authentication Servers178
- Understanding Authentication Server Best Practices and Exceptions178
- Understanding Servers and Server Groups178
- Configuring Authentication Servers179
- Managing the Internal Database196
- Configuring Server Groups199
- Assigning Server Groups205
- Configuring Authentication Timers210
- Authentication Server Load Balancing211
MAC-Based Authentication212
- Configuring MAC-Based Authentication212
- Configuring Clients213
Branch Switch Config for Cloud Services Switches215
- Branch Deployment Features216
- Scalable Site-To-Site VPN Tunnels217
- Layer-3 Redundancy for Branch Switch Masters217
- WAN Failure (Authentication) Survivability218
- WAN Health Check224
- WAN Optimization through IP Payload Compression224
- Interface Bandwidth Contracts225
- Branch Integration with a Palo Alto Networks (PAN) Portal226
- Branch Switch Routing Features229
- Cloud Management230
- Zero-Touch Provisioning230
- Using Smart Config to Create a Branch Config Group233
- Portfast and BPDU Guard254
- Preventing WAN Link Failure on Virtual Aps257
- Branch WAN Dashboard257
- 802.1X Authentication259
Understanding 802.1X Authentication259
- Configuring 802.1X Authentication262
- Enabling 802.1X Supplicant Support on an AP270
- Sample Configurations271
- Performing Advanced Configuration Options for 802.1X287
- Application Single Sign-On Using L2 Authentication287
- Device Name as User Name for Non-802.1X Authentication290
Stateful and Wispr Authentication291
- Working with Stateful Authentication291
- Working with Wispr Authentication292
- Understanding Stateful Authentication Best Practices292
- Configuring Stateful 802.1X Authentication292
- Configuring Stateful NTLM Authentication293
- Configuring Stateful Kerberos Authentication294
- Configuring Wispr Authentication295
Certificate Revocation298
- Understanding OCSP and CRL298
- Configuring the Switch as an OCSP Client299
- Configuring the Switch as a CRL Client301
- Configuring the Switch as an OCSP Responder302
- Certificate Revocation Checking for SSH Pubkey Authentication303
- OCSP Configuration for AOS-W VIA304
Captive Portal Authentication306
- Understanding Captive Portal306
- Configuring Captive Portal in the Base Operating System307
- Using Captive Portal with a PEFNG License309
- Sample Authentication with Captive Portal312
- Configuring Guest Vlans318
- Configuring Captive Portal Authentication Profiles319
- Enabling Optional Captive Portal Configurations324
- Personalizing the Captive Portal Page328
- Creating and Installing an Internal Captive Portal330
- Creating Walled Garden Access339
- Enabling Captive Portal Enhancements341
- Netdestination for AAAA Records345
Virtual Private Networks346
- Planning a VPN Configuration346
- Working with VPN Authentication Profiles350
- Configuring a Basic VPN for L2Tp/Ipsec352
- Configuring a VPN for L2Tp/Ipsec with Ikev2356
- Configuring a VPN for Smart Card Clients361
- Configuring a VPN for Clients with User Passwords362
- Configuring Remote Access Vpns for Xauth363
- Working with Remote Access Vpns for PPTP364
- Working with Site-To-Site Vpns365
- Working with VPN Dialer373
Roles and Policies375
- Configuring Firewall Policies375
- User Roles385
- Assigning User Roles387
- Understanding Global Firewall Parameters393
- Using Apprf 2.0397
Clearpass Policy Manager Integration402
- Introduction402
- Important Points to Remember402
- Enabling Downloadable Role on a Switch403
- Sample Configuration403
Virtual Aps411
- Virtual AP Configuration Workflow411
- Virtual AP Profiles412
- Changing a Virtual AP Forwarding Mode420
- Radio Resource Management (802.11K)420
- BSS Transition Management (802.11V)428
- Fast BSS Transition ( 802.11R)428
- SSID Profiles430
- WLAN Authentication438
- High-Throughput Virtual Aps441
- Guest Wlans446
- Changing a Virtual AP Forwarding Mode449
Adaptive Radio Management450
- Understanding ARM450
- Client Match452
- ARM Coverage and Interference Metrics454
- Configuring ARM Profiles455
- Assigning an ARM Profile to an AP Group465
- Using Multi-Band ARM for 802.11A/802.11G Traffic465
- Band Steering466
- Dynamic Bandwidth Switch467
- Enabling Traffic Shaping468
- Traffic Steering470
- Spectrum Load Balancing471
- Reusing Channels to Control RX Sensitivity Tuning471
- Configuring Non-802.11 Noise Interference Immunity472
- Troubleshooting ARM472
Wireless Intrusion Prevention474
- Working with the Reusable Wizard474
- Monitoring the Dashboard477
- Detecting Rogue Aps478
- Working with Intrusion Detection481
- Configuring Intrusion Protection493
- Configuring the WLAN Management System497
- Understanding Client Blacklisting501
- Working with WIP Advanced Features503
- Configuring Totalwatch504
- Administering Totalwatch506
- Tarpit Shielding Overview507
- Configuring Tarpit Shielding507
Access Points509
- Important Points to Remember509
- AP Discovery Logic510
- Basic Functions and Features523
- Naming and Grouping Aps524
- Understanding AP Configuration Profiles526
- Before You Deploy an AP533
- Enable Switch Discovery533
- Enable DHCP to Provide Aps with IP Addresses534
- AP Provisioning Profiles535
- Configuring Installed Aps538
- Optional AP Configuration Settings543
- RF Management558
- Optimizing Aps over Low-Speed Links572
- AP Scanning Optimization580
- Channel Group Scanning582
- Configuring AP Channel Assignments583
- Managing AP Console Settings585
- Link Aggregation Support on OAW-AP220 Series, OAW-AP270 Series, and OAW-AP320 Series588
- Recording Consolidated AP-Provisioned Information592
- Intelligent Power Monitoring593
Secure Enterprise Mesh595
- Mesh Overview Information595
- Mesh Configuration Procedures595
- Understanding Mesh Access Points595
- Understanding Mesh Links597
- Understanding Mesh Profiles599
- Understanding Remote Mesh Portals (Rmps)603
- Understanding the AP Boot Sequence604
- Mesh Deployment Solutions605
- Mesh Deployment Planning607
- Configuring Mesh Cluster Profiles609
- Creating and Editing Mesh Radio Profiles613
- Creating and Editing Mesh High-Throughput SSID Profiles618
- Configuring Ethernet Ports for Mesh624
- Provisioning Mesh Nodes626
- Verifying Your Mesh Network628
- Configuring Remote Mesh Portals (Rmps)630
Increasing Network Uptime through Redundancy and VRRP633
- High Availability633
- VRRP-Based Redundancy633
- High Availability Deployment Models634
- Client State Synchronization636
- High Availability Inter-Switch Heartbeats637
- High Availability Extended Switch Capacity637
- Configuring High Availability638
- High Availability Alerting640
- Migrating from VRRP or Backup-LMS Redundancy641
- Configuring VRRP Redundancy643
Rstp651
- Understanding RSTP Migration and Interoperability651
- Working with Rapid Convergence651
- Configuring RSTP652
- Troubleshooting RSTP654
Pvst655
- Understanding PVST+ Interoperability and Best Practices655
- Enabling PVST+ in the CLI655
- Enabling PVST+ in the Webui656
Link Layer Discovery Protocol657
- Important Points to Remember657
- LLDP Overview657
- Configuring LLDP658
- Monitoring LLDP Configuration659
IP Mobility663
- Understanding Alcatel-Lucent Mobility Architecture663
- Configuring Mobility Domains664
- Tracking Mobile Users668
- Configuring Advanced Mobility Functions670
- Understanding Bridge Mode Mobility Deployments679
- Enabling Mobility Multicast680
External Firewall Configuration684
- Understanding Firewall Port Configuration Among Alcatel-Lucent Devices684
- Enabling Network Access685
- Ports Used for Virtual Intranet Access (VIA)685
- Configuring Ports to Allow Other Traffic Types685
PAPI Enhanced Security687
- Interoperability687
- Configuring PAPI Enhanced Security687
- Verifying PAPI Enhanced Security688
Palo Alto Networks Firewall Integration689
- Limitation689
- Preconfiguration on the PAN Firewall689
- Configuring PAN Firewall Integration692
Remote Access Points695
- About Remote Access Points695
- Configuring the Secure Remote Access Point Service697
- Deploying a Branch/Home Office Solution703
- Enabling Remote AP Advanced Configuration Options709
- Understanding Split Tunneling723
- Understanding Bridge729
- Provisioning Wi-Fi Multimedia734
- Reserving Uplink Bandwidth734
- Provisioning 4G USB Modems on Remote Access Points735
- Provisioning Raps at Home737
- Configuring OAW-RAP3WN and OAW-RAP3WNP Access Points740
- Converting an IAP to RAP or CAP741
- Enabling Bandwidth Contract Support for Raps742
- RAP TFTP Image Upgrade745
Virtual Intranet Access748
Spectrum Analysis749
- Understanding Spectrum Analysis749
- Creating Spectrum Monitors and Hybrid Aps754
- Connecting Spectrum Devices to the Spectrum Analysis Client756
- Configuring the Spectrum Analysis Dashboards759
- Customizing Spectrum Analysis Graphs762
- Working with Non-Wi-Fi Interferers787
- Understanding the Spectrum Analysis Session Log788
- Viewing Spectrum Analysis Data788
- Recording Spectrum Analysis Data789
- Troubleshooting Spectrum Analysis792
Dashboard Monitoring794
- Wan794
- Performance795
- Usage796
- Potential Issues797
- Traffic Analysis797
- Airgroup819
- Security820
- Ucc820
- Controller822
- Wlans824
- Access Points825
- Clients826
- Firewall827
Management Access833
- Configuring Certificate Authentication for Webui Access833
- Secure Shell (SSH)834
- Webui Session Timer835
- Enabling RADIUS Server Authentication836
- Connecting to an Omnivista Server842
- Custom Certificate Support for RAP846
- Implementing a Specific Management Password Policy848
- Configuring AP Image Preload850
- Configuring Centralized Image Upgrades852
- Managing Certificates854
- Configuring SNMP860
- Enabling Capacity Alerts862
- Configuring Logging864
- Enabling Guest Provisioning868
- Managing Files on the Switch882
- Setting the System Clock885
- Clearpass Profiling with IF-MAP887
- Whitelist Synchronization888
- Downloadable Regulatory Table889
802.11U Hotspots892
- Hotspot Profile Configuration Tasks892
- Hotspot 2.0 Overview892
- Configuring Hotspot 2.0 Profiles895
- Configuring Hotspot Advertisement Profiles899
- Configuring ANQP Venue Name Profiles901
- Configuring ANQP Network Authentication Profiles903
- Configuring ANQP Domain Name Profiles904
- Configuring ANQP IP Address Availability Profiles905
- Configuring ANQP NAI Realm Profiles906
- Configuring ANQP Roaming Consortium Profiles909
- Configuring ANQP 3GPP Cellular Network Profiles909
- Configuring H2QP Connection Capability Profiles910
- Configuring H2QP Operator Friendly Name Profiles912
- Configuring H2QP Operating Class Indication Profiles913
- Configuring H2QP WAN Metrics Profiles914
- Configuring H2QP OSU Provider List Profiles915
Adding Local Switches920
- Moving to a Multi-Switch Environment920
- Configuring Local Switches923
- Uplink Monitoring and Management925
Voice and Video927
- Voice and Video License Requirements927
- Configuring Voice and Video927
- Working with Qos for Voice and Video936
- Unified Communication and Collaboration945
- Understanding Extended Voice and Video Features964
- Advanced Voice Troubleshooting988
Airgroup994
- Zero Configuration Networking994
- Airgroup Solution994
- Airgroup Integrated Deployment Model998
- Features Supported in Airgroup999
- Clearpass Policy Manager and Clearpass Guest Features1004
- Auto-Association and Switch-Based Policy1004
- Best Practices and Limitations1006
- Integrated Deployment Model1010
- Switch Dashboard Monitoring1018
- Configuring the Airgroup-CPPM Interface1021
- Bluetooth-Based Discovery and Airgroup1028
- Airgroup Mdns Static Records1029
- Mdns AP VLAN Aggregation1031
- Mdns Multicast Response Propagation1033
- Troubleshooting and Log Messages1035
Instant AP VPN Support1038
- Overview1038
- VPN Configuration1043
- Viewing Branch Status1044
External Services Interface1046
- Sample ESI Topology1046
- Understanding the ESI Syslog Parser1048
- Configuring ESI1051
- Sample Route-Mode ESI Topology1058
- Sample NAT-Mode ESI Topology1063
- Understanding Basic Regular Expression (BRE) Syntax1066
External User Management1069
- Overview1069
- How the AOS-W XML API Works1069
- Creating an XML Request1069
- XML Response1072
- Using the XML API Server1076
- Sample Scripts1080
Behavior and Defaults1086
- Understanding Mode Support1086
- Understanding Basic System Defaults1088
- Understanding Default Management User Roles1096
- Understanding Default Open Ports1099
DHCP with Vendor-Specific Options1102
- Configuring a Windows-Based DHCP Server1102
- Enabling DHCP Relay Agent Information Option (Option-82)1105
- Enabling Linux DHCP Servers1107
802.1X Configuration for IAS and Windows Clients1109
- Configuring Microsoft IAS1109
- Configuring Management Authentication Using IAS1111
- Window XP Wireless Client Sample Configuration1113
Glossary of Terms1116

Alcatel-Lucent AOS-W 6.5.3.x - Page 14

Table of Contents