Alcatel-Lucent AOS-W 6.5.3.x - Page 691

1160 pages

To Next Page

To Next Page

To Previous Page

To Previous Page

Loading...

Client Version IsValue

Nook

OS X

PlayStation

PS Vita

PS3

PSP

RIM Tablet

Roku

Symbian

webOS

Win 7

Win 8

Win 95

Win 98

Win 2000

Win CE

Win ME

Win NT

Win Server

Win Vista

Win XP

AOS-W 6.5.3.x | User Guide Palo Alto Networks Firewall Integration | 691

Table of Contents

Contents3
- Table of Contents3
- Revision History18
About this Guide19
- What's New in AOS-W 6.5.X19
- Fundamentals31
- Related Documents32
- Conventions32
- Contacting Support34
The Basic User-Centric Networks35
- Understanding Basic Deployment and Configuration Tasks35
- Switch Configuration Workflow38
- Connect the Switch to the Network39
- OAW-40Xx Series and OAW-4X50 Series Switches40
- Using the LCD Screen42
- Configuring a VLAN to Connect to the Network45
- Enabling Wireless Connectivity49
- Configuring Your User-Centric Network49
- Replacing a Switch49
Control Plane Security56
- Control Plane Security Overview57
- Configuring Control Plane Security57
- Managing AP Whitelists59
- Managing Whitelists on Master and Local Switches66
- Working in Environments with Multiple Master Switches70
- Replacing a Switch on a Multi-Switch Network73
- Configuring Control Plane Security after Upgrading76
- Troubleshooting Control Plane Security77
Software Licenses79
- Getting Started with AOS-W Licenses79
- License Types and Usage79
- Licensing Best Practices and Limitations82
- Centralized Licensing Overview83
- Configuring Centralized Licensing89
- Installing a License91
- Deleting a License93
- Monitoring and Managing Centralized Licenses94
Network Configuration Parameters97
- Campus WLAN Workflow97
- Understanding VLAN Assignments98
- Configuring Vlans105
- Configuring Ports110
- Configuring Static Routes113
- Configuring the Loopback IP Address113
- Configuring the Switch IP Address114
- Configuring GRE Tunnels115
- Configuring GRE Tunnel Groups124
- Jumbo Frame Support127
Ipv6 Support130
- Understanding Ipv6 Notation130
- Understanding Ipv6 Topology130
- Enabling Ipv6131
- Enabling Ipv6 Support for Switch and Aps131
- Filtering an Ipv6 Extension Header (EH)139
- Configuring a Captive Portal over Ipv6139
- Working with Ipv6 Router Advertisements (Ras)140
- RADIUS over Ipv6144
- TACACS over Ipv6145
- Dhcpv6 Server146
- Understanding AOS-W Supported Network Configuration for Ipv6 Clients148
- Understanding AOS-W Authentication and Firewall Features that Support Ipv6149
- Managing Ipv6 User Addresses154
- Understanding Ipv6 Exceptions and Best Practices155
Link Aggregation Control Protocol157
- Understanding LACP Best Practices and Exceptions157
- Configuring LACP158
- LACP Sample Configuration160
Ospfv2161
- Understanding OSPF Deployment Best Practices and Exceptions161
- Understanding Ospfv2 by Example Using a WLAN Scenario162
- Understanding Ospfv2 by Example Using a Branch Scenario163
- Configuring OSPF165
- Sample Topology and Configuration166
Authentication Servers178
- Understanding Authentication Server Best Practices and Exceptions178
- Understanding Servers and Server Groups178
- Configuring Authentication Servers179
- Managing the Internal Database196
- Configuring Server Groups199
- Assigning Server Groups205
- Configuring Authentication Timers210
- Authentication Server Load Balancing211
MAC-Based Authentication212
- Configuring MAC-Based Authentication212
- Configuring Clients213
Branch Switch Config for Cloud Services Switches215
- Branch Deployment Features216
- Scalable Site-To-Site VPN Tunnels217
- Layer-3 Redundancy for Branch Switch Masters217
- WAN Failure (Authentication) Survivability218
- WAN Health Check224
- WAN Optimization through IP Payload Compression224
- Interface Bandwidth Contracts225
- Branch Integration with a Palo Alto Networks (PAN) Portal226
- Branch Switch Routing Features229
- Cloud Management230
- Zero-Touch Provisioning230
- Using Smart Config to Create a Branch Config Group233
- Portfast and BPDU Guard254
- Preventing WAN Link Failure on Virtual Aps257
- Branch WAN Dashboard257
- 802.1X Authentication259
Understanding 802.1X Authentication259
- Configuring 802.1X Authentication262
- Enabling 802.1X Supplicant Support on an AP270
- Sample Configurations271
- Performing Advanced Configuration Options for 802.1X287
- Application Single Sign-On Using L2 Authentication287
- Device Name as User Name for Non-802.1X Authentication290
Stateful and Wispr Authentication291
- Working with Stateful Authentication291
- Working with Wispr Authentication292
- Understanding Stateful Authentication Best Practices292
- Configuring Stateful 802.1X Authentication292
- Configuring Stateful NTLM Authentication293
- Configuring Stateful Kerberos Authentication294
- Configuring Wispr Authentication295
Certificate Revocation298
- Understanding OCSP and CRL298
- Configuring the Switch as an OCSP Client299
- Configuring the Switch as a CRL Client301
- Configuring the Switch as an OCSP Responder302
- Certificate Revocation Checking for SSH Pubkey Authentication303
- OCSP Configuration for AOS-W VIA304
Captive Portal Authentication306
- Understanding Captive Portal306
- Configuring Captive Portal in the Base Operating System307
- Using Captive Portal with a PEFNG License309
- Sample Authentication with Captive Portal312
- Configuring Guest Vlans318
- Configuring Captive Portal Authentication Profiles319
- Enabling Optional Captive Portal Configurations324
- Personalizing the Captive Portal Page328
- Creating and Installing an Internal Captive Portal330
- Creating Walled Garden Access339
- Enabling Captive Portal Enhancements341
- Netdestination for AAAA Records345
Virtual Private Networks346
- Planning a VPN Configuration346
- Working with VPN Authentication Profiles350
- Configuring a Basic VPN for L2Tp/Ipsec352
- Configuring a VPN for L2Tp/Ipsec with Ikev2356
- Configuring a VPN for Smart Card Clients361
- Configuring a VPN for Clients with User Passwords362
- Configuring Remote Access Vpns for Xauth363
- Working with Remote Access Vpns for PPTP364
- Working with Site-To-Site Vpns365
- Working with VPN Dialer373
Roles and Policies375
- Configuring Firewall Policies375
- User Roles385
- Assigning User Roles387
- Understanding Global Firewall Parameters393
- Using Apprf 2.0397
Clearpass Policy Manager Integration402
- Introduction402
- Important Points to Remember402
- Enabling Downloadable Role on a Switch403
- Sample Configuration403
Virtual Aps411
- Virtual AP Configuration Workflow411
- Virtual AP Profiles412
- Changing a Virtual AP Forwarding Mode420
- Radio Resource Management (802.11K)420
- BSS Transition Management (802.11V)428
- Fast BSS Transition ( 802.11R)428
- SSID Profiles430
- WLAN Authentication438
- High-Throughput Virtual Aps441
- Guest Wlans446
- Changing a Virtual AP Forwarding Mode449
Adaptive Radio Management450
- Understanding ARM450
- Client Match452
- ARM Coverage and Interference Metrics454
- Configuring ARM Profiles455
- Assigning an ARM Profile to an AP Group465
- Using Multi-Band ARM for 802.11A/802.11G Traffic465
- Band Steering466
- Dynamic Bandwidth Switch467
- Enabling Traffic Shaping468
- Traffic Steering470
- Spectrum Load Balancing471
- Reusing Channels to Control RX Sensitivity Tuning471
- Configuring Non-802.11 Noise Interference Immunity472
- Troubleshooting ARM472
Wireless Intrusion Prevention474
- Working with the Reusable Wizard474
- Monitoring the Dashboard477
- Detecting Rogue Aps478
- Working with Intrusion Detection481
- Configuring Intrusion Protection493
- Configuring the WLAN Management System497
- Understanding Client Blacklisting501
- Working with WIP Advanced Features503
- Configuring Totalwatch504
- Administering Totalwatch506
- Tarpit Shielding Overview507
- Configuring Tarpit Shielding507
Access Points509
- Important Points to Remember509
- AP Discovery Logic510
- Basic Functions and Features523
- Naming and Grouping Aps524
- Understanding AP Configuration Profiles526
- Before You Deploy an AP533
- Enable Switch Discovery533
- Enable DHCP to Provide Aps with IP Addresses534
- AP Provisioning Profiles535
- Configuring Installed Aps538
- Optional AP Configuration Settings543
- RF Management558
- Optimizing Aps over Low-Speed Links572
- AP Scanning Optimization580
- Channel Group Scanning582
- Configuring AP Channel Assignments583
- Managing AP Console Settings585
- Link Aggregation Support on OAW-AP220 Series, OAW-AP270 Series, and OAW-AP320 Series588
- Recording Consolidated AP-Provisioned Information592
- Intelligent Power Monitoring593
Secure Enterprise Mesh595
- Mesh Overview Information595
- Mesh Configuration Procedures595
- Understanding Mesh Access Points595
- Understanding Mesh Links597
- Understanding Mesh Profiles599
- Understanding Remote Mesh Portals (Rmps)603
- Understanding the AP Boot Sequence604
- Mesh Deployment Solutions605
- Mesh Deployment Planning607
- Configuring Mesh Cluster Profiles609
- Creating and Editing Mesh Radio Profiles613
- Creating and Editing Mesh High-Throughput SSID Profiles618
- Configuring Ethernet Ports for Mesh624
- Provisioning Mesh Nodes626
- Verifying Your Mesh Network628
- Configuring Remote Mesh Portals (Rmps)630
Increasing Network Uptime through Redundancy and VRRP633
- High Availability633
- VRRP-Based Redundancy633
- High Availability Deployment Models634
- Client State Synchronization636
- High Availability Inter-Switch Heartbeats637
- High Availability Extended Switch Capacity637
- Configuring High Availability638
- High Availability Alerting640
- Migrating from VRRP or Backup-LMS Redundancy641
- Configuring VRRP Redundancy643
Rstp651
- Understanding RSTP Migration and Interoperability651
- Working with Rapid Convergence651
- Configuring RSTP652
- Troubleshooting RSTP654
Pvst655
- Understanding PVST+ Interoperability and Best Practices655
- Enabling PVST+ in the CLI655
- Enabling PVST+ in the Webui656
Link Layer Discovery Protocol657
- Important Points to Remember657
- LLDP Overview657
- Configuring LLDP658
- Monitoring LLDP Configuration659
IP Mobility663
- Understanding Alcatel-Lucent Mobility Architecture663
- Configuring Mobility Domains664
- Tracking Mobile Users668
- Configuring Advanced Mobility Functions670
- Understanding Bridge Mode Mobility Deployments679
- Enabling Mobility Multicast680
External Firewall Configuration684
- Understanding Firewall Port Configuration Among Alcatel-Lucent Devices684
- Enabling Network Access685
- Ports Used for Virtual Intranet Access (VIA)685
- Configuring Ports to Allow Other Traffic Types685
PAPI Enhanced Security687
- Interoperability687
- Configuring PAPI Enhanced Security687
- Verifying PAPI Enhanced Security688
Palo Alto Networks Firewall Integration689
- Limitation689
- Preconfiguration on the PAN Firewall689
- Configuring PAN Firewall Integration692
Remote Access Points695
- About Remote Access Points695
- Configuring the Secure Remote Access Point Service697
- Deploying a Branch/Home Office Solution703
- Enabling Remote AP Advanced Configuration Options709
- Understanding Split Tunneling723
- Understanding Bridge729
- Provisioning Wi-Fi Multimedia734
- Reserving Uplink Bandwidth734
- Provisioning 4G USB Modems on Remote Access Points735
- Provisioning Raps at Home737
- Configuring OAW-RAP3WN and OAW-RAP3WNP Access Points740
- Converting an IAP to RAP or CAP741
- Enabling Bandwidth Contract Support for Raps742
- RAP TFTP Image Upgrade745
Virtual Intranet Access748
Spectrum Analysis749
- Understanding Spectrum Analysis749
- Creating Spectrum Monitors and Hybrid Aps754
- Connecting Spectrum Devices to the Spectrum Analysis Client756
- Configuring the Spectrum Analysis Dashboards759
- Customizing Spectrum Analysis Graphs762
- Working with Non-Wi-Fi Interferers787
- Understanding the Spectrum Analysis Session Log788
- Viewing Spectrum Analysis Data788
- Recording Spectrum Analysis Data789
- Troubleshooting Spectrum Analysis792
Dashboard Monitoring794
- Wan794
- Performance795
- Usage796
- Potential Issues797
- Traffic Analysis797
- Airgroup819
- Security820
- Ucc820
- Controller822
- Wlans824
- Access Points825
- Clients826
- Firewall827
Management Access833
- Configuring Certificate Authentication for Webui Access833
- Secure Shell (SSH)834
- Webui Session Timer835
- Enabling RADIUS Server Authentication836
- Connecting to an Omnivista Server842
- Custom Certificate Support for RAP846
- Implementing a Specific Management Password Policy848
- Configuring AP Image Preload850
- Configuring Centralized Image Upgrades852
- Managing Certificates854
- Configuring SNMP860
- Enabling Capacity Alerts862
- Configuring Logging864
- Enabling Guest Provisioning868
- Managing Files on the Switch882
- Setting the System Clock885
- Clearpass Profiling with IF-MAP887
- Whitelist Synchronization888
- Downloadable Regulatory Table889
802.11U Hotspots892
- Hotspot Profile Configuration Tasks892
- Hotspot 2.0 Overview892
- Configuring Hotspot 2.0 Profiles895
- Configuring Hotspot Advertisement Profiles899
- Configuring ANQP Venue Name Profiles901
- Configuring ANQP Network Authentication Profiles903
- Configuring ANQP Domain Name Profiles904
- Configuring ANQP IP Address Availability Profiles905
- Configuring ANQP NAI Realm Profiles906
- Configuring ANQP Roaming Consortium Profiles909
- Configuring ANQP 3GPP Cellular Network Profiles909
- Configuring H2QP Connection Capability Profiles910
- Configuring H2QP Operator Friendly Name Profiles912
- Configuring H2QP Operating Class Indication Profiles913
- Configuring H2QP WAN Metrics Profiles914
- Configuring H2QP OSU Provider List Profiles915
Adding Local Switches920
- Moving to a Multi-Switch Environment920
- Configuring Local Switches923
- Uplink Monitoring and Management925
Voice and Video927
- Voice and Video License Requirements927
- Configuring Voice and Video927
- Working with Qos for Voice and Video936
- Unified Communication and Collaboration945
- Understanding Extended Voice and Video Features964
- Advanced Voice Troubleshooting988
Airgroup994
- Zero Configuration Networking994
- Airgroup Solution994
- Airgroup Integrated Deployment Model998
- Features Supported in Airgroup999
- Clearpass Policy Manager and Clearpass Guest Features1004
- Auto-Association and Switch-Based Policy1004
- Best Practices and Limitations1006
- Integrated Deployment Model1010
- Switch Dashboard Monitoring1018
- Configuring the Airgroup-CPPM Interface1021
- Bluetooth-Based Discovery and Airgroup1028
- Airgroup Mdns Static Records1029
- Mdns AP VLAN Aggregation1031
- Mdns Multicast Response Propagation1033
- Troubleshooting and Log Messages1035
Instant AP VPN Support1038
- Overview1038
- VPN Configuration1043
- Viewing Branch Status1044
External Services Interface1046
- Sample ESI Topology1046
- Understanding the ESI Syslog Parser1048
- Configuring ESI1051
- Sample Route-Mode ESI Topology1058
- Sample NAT-Mode ESI Topology1063
- Understanding Basic Regular Expression (BRE) Syntax1066
External User Management1069
- Overview1069
- How the AOS-W XML API Works1069
- Creating an XML Request1069
- XML Response1072
- Using the XML API Server1076
- Sample Scripts1080
Behavior and Defaults1086
- Understanding Mode Support1086
- Understanding Basic System Defaults1088
- Understanding Default Management User Roles1096
- Understanding Default Open Ports1099
DHCP with Vendor-Specific Options1102
- Configuring a Windows-Based DHCP Server1102
- Enabling DHCP Relay Agent Information Option (Option-82)1105
- Enabling Linux DHCP Servers1107
802.1X Configuration for IAS and Windows Clients1109
- Configuring Microsoft IAS1109
- Configuring Management Authentication Using IAS1111
- Window XP Wireless Client Sample Configuration1113
Glossary of Terms1116