Allen-Bradley Stratix 5100 - Configuring Access Points to Support Fast Secure Roaming

To Next Page

To Previous Page

394 Rockwell Automation Publication 1783-UM006A-EN-P - May 2014

Chapter 13 Configuring WDS, Fast Secure Roaming, Radio Management, and Wireless Intrusion Detection Services

Configuring Access Points to Support Fast Secure Roaming

To support fast, secure roaming, the access points on your wireless LAN must be

configured to participate in WDS and they must allow CCKM authenticated

key management for at least one SSID. Follow these steps to configure CCKM

for an SSID:

1. Browse to the Encryption Manager page on the access point GUI.

This figure shows the top section of the Encryption Manager page.

Figure 105 - Encryption Manager Page

2. Click Cipher.

3. From the Cipher pull-down menu, choose CKIP + CMIC.

4. Click Apply.

Main Page

Default Chapter2
- Important User Information2
- Table of Contents3
- Audience17
- Purpose17
- Organization18
- Additional Resources19
  - Rockwell Automation Support20
- Conventions19
Chapter 1 Configuring the Access Point23
- Management Options23
- Regulatory Domains23
- Roaming Client Devices24
- Network Configuration Examples25
  - Root Access Point25
- Repeater Access Point26
- Unpacking28
- Items Shipped with the WAP29
Chapter 2 Stratix 5100 WAP Specifications32
- Ethernet Cable Recommendation32
- Ports and Connections32
- External Antennas33
  - Antenna Cable Extensions Recommendation33
- Initial Configuration36
- Preparing the Access Point36
- Prevent Damage to the WAP36
- Install the WAP37
- Grounding the Access Point39
- Securing the Access Point40
  - Securing the Access Point to the Mounting Plate40
  - Using a Security Cable41
- Mounting the Access Point41
- Deploying the Access Point on the Wireless Network47
  - Access Point Status Indicators48
  - Checking Power49
- Configure the Access Point50
- Using Device Manager52
- Before You Start53
Chapter 353
- Login to the Stratix 5100 WAP53
- Connect to the Stratix 5100 WAP Access Point Locally54
- Default Radio Settings54
- Obtain and Assign an IP Address54
  - Default IP Address Behavior54
- Reset the WAP to Default Settings55
  - Reset to WAP Default Settings by Using MODE55
  - Reset to Default Settings by Using the GUI55
- Configure the Basic Settings for an Access Point57
- Logging into the Access Point57
- Using Online Help57
- Enable the Radio on the Network61
- Using Vlans63
- Configuring Security64
- CLI Configuration Example74
- Deleting an HTTPS Certificate75
- Disabling the Web Browser Interface75
- Device Manager System Management Tabs79
Chapter 4 Easy Setup Network Configuration Page80
- Network Configuration Settings on the Easy Setup Page81
- Radio Configuration Settings on the Easy Setup Page83
- Security Configuration Settings on the Easy Setup Page85
- Network Page86
- Association Page104
- Wireless Page105
  - Wds107
- Security Page111
- Services Page135
- Management Page164
  - Webauth Login165
- Software Page166
- Event Log Page171
  - Configuration Options Page173
- Cisco IOS Command Modes175
Chapter 5 Getting Help176
- Abbreviating Commands177
- Using no and Default Forms of Commands177
- Understanding CLI Messages178
- Using Command History178
  - Changing the Command History Buffer Size178
- Recalling Commands179
  - Disabling the Command History Feature179
- Using Editing Features179
- Accessing CLI182
  - Opening CLI with Telnet182
- Searching and Filtering Output of Show and more Commands182
- Opening CLI with Secure Shell183
  - Reset Default Settings by Using CLI183
- Security CLI Configuration Examples184
- Assign an IP Address by Using CLI193
- Configuring the 802.1X Supplicant194
- Using a Terminal Application Session to Access CLI194
- Creating a Credentials Profile195
- Creating and Applying EAP Method Profiles197
Administering the WAP Access199
Chapter 6200
- Disabling the Mode Button200
- Preventing Unauthorized Access to Your Access Point201
- Protecting Access to Privileged EXEC Commands201
- Default Password and Privilege Level Configuration202
- Setting or Changing a Static Enable Password202
- Protecting Enable and Enable Secret Passwords with Encryption204
- Configuring Username and Password Pairs205
- Configuring Multiple Privilege Levels207
  - Setting the Privilege Level for a Command207
  - Logging into and Exiting a Privilege Level208
- Controlling Access Point Access with RADIUS208
  - Default RADIUS Configuration209
  - Configuring RADIUS Login Authentication209
  - Defining AAA Server Groups211
  - Configuring RADIUS Authorization for User Privileged Access and Network Services213
  - Displaying the RADIUS Configuration214
- Controlling Access Point Access with TACACS215
  - Default TACACS+ Configuration215
  - Configuring TACACS+ Login Authentication215
  - Configuring TACACS+ Authorization for Privileged EXEC Access217
  - And Network Services217
  - Displaying the TACACS+ Configuration218
- Configuring Ethernet Speed and Duplex Settings218
- Configuring the Access Point for Wireless Network Management219
- Configuring the Access Point for Local Authentication220
  - And Authorization220
- Configuring the Authentication Cache and Profile221
- Configuring the Access Point to Provide DHCP Service225
  - Setting up the DHCP Server225
- Monitoring and Maintaining the DHCP Server Access Point227
  - Show Commands227
  - Clear Commands227
  - Debug Command227
- Configuring the Access Point for Secure Shell228
  - Understanding SSH228
  - Configuring SSH228
- Configuring Client ARP Caching229
  - Optional ARP Caching229
  - Configuring ARP Caching229
- Managing the System Time and Date230
  - Configuring SNTP230
  - Configuring Time and Date Manually231
  - Setting the System Clock231
  - Displaying the Time and Date Configuration232
  - Configuring the Time Zone232
  - Configuring Summer Time (Daylight Saving Time)233
- Configuring a System Name and Prompt235
- Defining HTTP Access235
- Default System Name and Prompt Configuration236
  - Configuring a System Name236
- Understanding DNS237
  - Default DNS Configuration237
  - Setting up DNS237
  - Displaying the DNS Configuration239
Configuring Radio Settings241
Chapter 7242
- Configuring the Role in Radio Network242
- Enabling the Radio Interface242
- Configuring Dual-Radio Fallback245
- Universal Workgroup Bridge Mode245
- Fast Ethernet Tracking246
- Radio Tracking246
- Configuring Radio Data Rates247
- MAC-Address Tracking247
- Access Points Send Multicast and Management Frames249
  - At Highest Basic Rate249
- Configuring MCS Rates251
- Configuring Radio Transmit Power253
- Limiting the Power Level for Associated Client Devices254
- Configuring Radio Channel Settings255
- 802.11N Channel Widths256
- Dynamic Frequency Selection257
  - Radar Detection on a DFS Channel259
- CLI Commands259
  - Confirming that DFS Is Enabled259
- Configuring a Channel260
  - Blocking Channels from DFS Selection261
- Setting the 802.11N Guard Interval262
- Configuring Location-Based Services263
  - Understanding Location-Based Services263
  - Configuring LBS on Access Points264
- Disabling and Enabling Short Radio Preambles265
- Configuring Transmit and Receive Antennas266
- Enabling and Disabling Gratuitous Probe Response267
- Disabling and Enabling Aironet Extensions268
- Configuring the Ethernet Encapsulation Transformation Method270
- Enabling and Disabling Reliable Multicast to Workgroup Bridges270
- Enabling and Disabling Public Secure Packet Forwarding272
- Configuring Protected Ports273
- Configuring the Beacon Period and the DTIM273
- Configure RTS Threshold and Retries274
- Configuring the Fragmentation Threshold275
- Configuring the Maximum Data Retries275
- Enabling Short Slot Time for 802.11G Radios276
- Configuring Clientlink277
  - Using CLI to Configure Clientlink277
- Performing a Carrier Busy Test277
- Debugging Radio Functions278
Chapter 8279
- Understanding Multiple Ssids279
Configuring Multiple Ssids280
- Effect of Software Versions on Ssids280
- Configuring Multiple Ssids281
- Restrict Ssids by Using a RADIUS Server285
- Configuring Multiple Basic Ssids286
- Assigning IP Redirection for an SSID291
  - Guidelines for Using IP Redirection292
  - Configuring IP Redirection292
- Including an SSID in an SSIDL IE293
- NAC Support for MBSSID294
- Configuring NAC for MBSSID297
Chapter 9301
Configuring Spanning Tree Protocol301
- Understanding Spanning Tree Protocol (STP)301
- Access Point/Bridge Protocol Data Units302
- Election of the Spanning-Tree Root304
- Spanning-Tree Timers304
- Creating the Spanning-Tree Topology305
- Configuring STP Features308
  - Default STP Configuration309
  - Configuring STP Settings309
- STP Configuration Examples310
- Displaying Spanning-Tree Status318
- Understanding Local Authentication319
Chapter 10 Configuring a Local Authenticator320
- Configuration Overview320
- Configuring/Enabling Local MAC Authentication321
  - Configuring the SSID321
  - Creating Local MAC Address Lists322
- Creating and Enabling MAC Authentication323
- Configuring Network EMAP327
  - Configuring Advanced EAP Parameters330
- Configuring the Local Authenticator Access Point by Using CLI331
  - Local Authenticator332
- Configuring EAP-FAST Settings336
- Limiting the Local Authenticator to One Authentication Type339
- Unblocking Locked Usernames339
  - Viewing Local Authenticator Statistics339
- Using Debug Messages341
- Understanding Cipher Suites and WEP343
Chapter 11 Configuring Cipher Suites and WEP345
- Creating WEP Keys345
- WEP Key Restrictions346
- Example WEP Key Setup347
- Enabling Cipher Suites and WEP347
- Matching Cipher Suites with WPA or CCKM348
- Enabling and Disabling Broadcast Key Rotation349
- Understanding Authentication Types351
Chapter 12 Open Authentication to the Access Point352
- Shared Key Authentication to the Access Point352
- EAP Authentication to the Network353
- MAC Address Authentication to the Network354
- Combining MAC-Based, EAP, and Open Authentication355
- Using CCKM for Authenticated Clients356
- Using WPA Key Management357
  - Wpa-Tkip358
- Configuring Authentication Types359
  - Assigning Authentication Types to an SSID359
  - Configuring WPA Migration Mode363
- Configuring Additional WPA Settings364
- Configuring Authentication Hold-Off, Timeout, and Interval368
- Creating and Applying EAP Method Profiles370
- Matching Access Point and Client Device Authentication Types372
- Authentication Type373
- Understanding WDS375
Chapter 13376
- Role of the WDS Device376
- Role of Access Points by Using the WDS Device377
- Understanding Fast Secure Roaming377
- Understanding Layer 3 Mobility379
- Understanding Radio Management379
- Understanding Wireless Intrusion Detection Services381
- Configuring WDS382
- Configuring Access Points as Potential WDS Devices384
  - Configure a Group of Servers387
  - Configuring Access Points to Use the WDS Device390
- CLI Configuration Example391
- Configuring Fast Secure Roaming393
- Configuring Management Frame Protection396
- Management Frame Protection397
- Client MFP for Access Points in Root Mode398
  - Configuring Client MFP398
- Configuring Radio Management400
  - CLI Configuration Example402
- Configuring Access Points to Participate in WIDS402
- Configuring WLSM Failover406
  - Resilient Tunnel Recovery406
  - Active/Standby WLSM Failover406
- Configuring and Enabling RADIUS407
Chapter 14409
- RADIUS Operation409
- Configuring RADIUS410
- Default RADIUS Configuration410
- Identifying the RADIUS Server Host410
- Configuring RADIUS Login Authentication414
- Defining AAA Server Groups416
- Configuring RADIUS Authorization for User Privileged Access and Network Services418
- Configuring Packet of Disconnect419
- Starting RADIUS Accounting421
- Selecting the CSID Format422
  - Configuring Settings for All RADIUS Servers422
- Configuring the Access Point to Use Vendor-Specific424
  - RADIUS Attributes424
- Configuring the Access Point for Vendor-Proprietary RADIUS Server425
- Configuring and Enabling TACACS431
Chapter 15 Understanding Vlans441
- Related Documents443
- Incorporating Wireless Devices into Vlans444
Configuring Vlans441
- Configuring Vlans445
- VLAN Configuration Example450
  - Using Stratix 5100 Device Manager454
  - Set the Encryption for the VLAN455
Chapter 16 Understanding Qos for Wireless Lans457
- Qos for Wireless Lans Versus Qos on Wired Lans458
- Impact of Qos on a Wireless LAN458
- Precedence of Qos Settings459
Configuring Qos457
- Configure Qos by Using Straitx 5100 Device Manager460
  - Using Wi-Fi Multimedia Mode465
- Configuring Qos466
Chapter 17477
Configuring Filters477
- Understanding Filters477
- Configuring Filters by Using CLI Commands478
  - Creating a Time-Base ACL478
- Configuring Filters by Using Stratix 5100 Device Manager480
Chapter 18499
- Understanding CDP499
- Configuring CDP500
- Monitoring and Maintaining CDP503
Chapter 19 Understanding SNMP507
- SNMP Versions508
- SNMP Manager Functions509
- SNMP Agent Functions509
- SNMP Community Strings510
- Using SNMP to Access MIB Variables510
- Configuring SNMP510
- Displaying SNMP Status519
- Understanding Repeater Access Points521
Chapter 20 Configuring a Repeater Access Point523
- Default Configuration523
- Guidelines for Repeaters523
- Setting up a Repeater524
- Aligning Antennas525
- Verifying Repeater Operation526
- Setting up a Repeater as a LEAP Client527
- Setting up a Repeater as a WPA Client528
- Understanding Hot Standby529
- Configuring Hot Standby530
- Configuring a Hot Standby Access Point by Using CLI531
- Verifying Standby Operation534
- Understanding Workgroup Bridge Mode535
  - Or as Client Devices537
- Configuring a Workgroup Bridge for Limited Channel Scanning538
- Configuring a Workgroup Bridge for Roaming538
- Configuring Workgroup Bridge Mode540
- Workgroup Bridge VLAN Tagging540
- Using Workgroup Bridges in a Lightweight Environment542
  - In a Lightweight Environment543
- Sample Workgroup Bridge Configuration545
- Enabling Videostream Support on Workgroup Bridges546
Chapter 21547
Configuring System Message Logging547
- Understanding System Message Logging547
- Configuring System Message Logging548
- Displaying the Logging Configuration560
Chapter 22561
- Checking Basic Settings561
- Checking the Status Indicators561
Troubleshooting561
- Resetting to the Default Configuration563
  - Using the MODE Button563
- Using the Web Browser Interface563
- Using CLI564
- Reloading the Access Point Image566
Appendix A573
- Ethertype Protocols573
- IP Port Protocols574
- IP Protocols574
Appendix B579
- MIB List579
- Using FTP to Access the MIB Files580
Appendix C581
- Conventions581
- Software Auto Upgrade Messages582
- Association Management Messages583
- Unzip Messages583
- 802.11 Subsystem Messages584
- System Log Messages584
- Inter-Access Point Protocol Messages589
- Local Authenticator Messages589
- WDS Messages590
- Access Point/Bridge Messages591
- Cisco Discovery Protocol Messages591
- External Radius Server Error Messages591
- Mini IOS Messages591
- LWAPP Error Messages592
- Sensor Messages592
- SNMP Error Messages593
- SSH Error Messages593
- Documentation Feedback612

Allen-Bradley Stratix 5100 - Configuring Access Points to Support Fast Secure Roaming

Table of Contents

Other manuals for Allen-Bradley Stratix 5100