Cisco Wireless ISR & HWIC Access Point
Cisco Wireless ISR & HWIC Access Point
Configuration Guide
December 2006
Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 526-4100
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCVP, the Cisco Logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of
Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo,
Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step,
Follow Me Browsing, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick
Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet,
StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and
certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0612R)
Preface 9
Audience 9
Purpose 9
Organization 10
Conventions 10
Related Publications 12
Obtaining Documentation 13
Cisco.com 13
Product Documentation DVD 14
Ordering Documentation 14
Documentation Feedback 14
CHAPTER 1 Overview 1
Configuration Overview 3
Configuring the Local Authenticator Access Point 3
Configuring Other Access Points to Use the Local Authenticator 8
Configuring EAP-FAST Settings 9
Limiting the Local Authenticator to One Authentication Type 11
Unblocking Locked Usernames 11
Viewing Local Authenticator Statistics 11
Using Debug Messages 12
12
Understanding VLANs 2
Related Documents 3
Incorporating Wireless Devices into VLANs 4
Configuring VLANs 4
Configuring a VLAN 5
Assigning Names to VLANs 7
Using a RADIUS Server to Assign Users to VLANs 7
Viewing VLANs Configured on the Access Point 8
VLAN Configuration Example 9
MIB List 1
GLOSSARY
INDEX
Audience
This guide is for the networking professional who installs and manages Cisco stationary routers with
wireless capabilities. You should have experience working with the Cisco IOS software and be familiar
with the concepts and terminology of wireless LANs.
This document provides information for the following interfaces:
• Access Point High-speed WAN Interface Card (AP HWIC)
• Cisco 800 series routers with wireless capabilities
• Cisco 1800 series routers with wireless capabilities.
Purpose
This guide provides the information you need to install and configure your Cisco wireless device, for
example, AP HWIC, Cisco 800 series and Cisco 1800 series routers. This guide provides procedures for
using the Cisco IOS software commands that have been created or changed for use with the wireless
device. It does not provide detailed information about these commands. For information about the
standard Cisco IOS software commands, see the Cisco IOS software documentation set available from
the Cisco.com home page at Service and Support > Technical Documents. On the Cisco Product
Documentation home page, select Release 12.4 from the Cisco IOS Software drop-down list.
Organization
This guide consists of the following chapters:
Chapter 1, “Overview,” lists the software and hardware features of the wireless device and describes the
role of the wireless device in your network.
Chapter 2, “Configuring Radio Settings,” describes how to configure settings for the wireless device
radio such as the role in the radio network, data rates, transmit power, channel settings, and others.
Chapter 3, “Configuring Multiple SSIDs,” describes how to configure and manage multiple service set
identifiers (SSIDs) and multiple basic SSIDs (BSSIDs) on your wireless device. You can configure up
to 16 SSIDs and 16 BSSIDs on your wireless device and assign different configuration settings to each.
Chapter 4, “Configuring an Access Point as a Local Authenticator,” describes how to configure the
wireless device to act as a local RADIUS server for your wireless LAN. If the WAN connection to your
main RADIUS server fails, the wireless device acts as a backup server to authenticate wireless devices.
Chapter 5, “Configuring Encryption Types,” describes how to configure the cipher suites required to use
authenticated key management, Wired Equivalent Privacy (WEP), and WEP features.
Chapter 6, “Configuring Authentication Types,” describes how to configure authentication types on the
wireless device. Client devices use these authentication methods to join your network.
Chapter 7, “Configuring RADIUS Servers,” describes how to enable and configure the RADIUS, which
provides detailed accounting information and flexible administrative control over authentication and
authorization processes.
Chapter 8, “Configuring VLANs,” describes how to configure your wireless device to interoperate with
the VLANs set up on your wired LAN.
Chapter 9, “Configuring QoS,” describes how to configure quality of service (QoS) on your wireless
device. With this feature, you can provide preferential treatment to certain traffic at the expense of
others.
Appendix A, “Channel Settings,” lists the wireless device radio channels and the maximum power levels
supported by the world’s regulatory domains.
Appendix B, “Protocol Filters,” lists some of the protocols that you can filter on the wireless device.
Appendix C, “Supported MIBs,” lists the Simple Network Management Protocol (SNMP) Management
Information Bases (MIBs) that the wireless device supports for this software release.
Appendix D, “Error and Event Messages,” lists the CLI error and event messages and provides an
explanation and recommended action for each message.
Conventions
This publication uses these conventions to convey instructions and information:
Command descriptions use these conventions:
• Commands and keywords are in boldface text.
• Arguments for which you supply values are in italic.
• Square brackets ([ ]) mean optional elements.
• Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements.
• Braces and vertical bars within square brackets ([{ | }]) mean a required choice within an optional
element.
Tip Means the following will help you solve a problem. The tips information might not be troubleshooting
or even an action, but could be useful information.
Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in
this manual.
Caution Means reader be careful. In this situation, you might do something that could result equipment damage
or loss of data.
Warning This warning symbol means danger. You are in a situation that could cause bodily injury. Before you
work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar
with standard practices for preventing accidents. (To see translations of the warnings that appear
in this publication, refer to the appendix “Translated Safety Warnings.”)
Waarschuwing Dit waarschuwingssymbool betekent gevaar. U verkeert in een situatie die lichamelijk letsel kan
veroorzaken. Voordat u aan enige apparatuur gaat werken, dient u zich bewust te zijn van de bij
elektrische schakelingen betrokken risico’s en dient u op de hoogte te zijn van standaard
maatregelen om ongelukken te voorkomen. (Voor vertalingen van de waarschuwingen die in deze
publicatie verschijnen, kunt u het aanhangsel “Translated Safety Warnings” (Vertalingen van
veiligheidsvoorschriften) raadplegen.)
Varoitus Tämä varoitusmerkki merkitsee vaaraa. Olet tilanteessa, joka voi johtaa ruumiinvammaan. Ennen
kuin työskentelet minkään laitteiston parissa, ota selvää sähkökytkentöihin liittyvistä vaaroista ja
tavanomaisista onnettomuuksien ehkäisykeinoista. (Tässä julkaisussa esiintyvien varoitusten
käännökset löydät liitteestä "Translated Safety Warnings" (käännetyt turvallisuutta koskevat
varoitukset).)
Attention Ce symbole d’avertissement indique un danger. Vous vous trouvez dans une situation pouvant
entraîner des blessures. Avant d’accéder à cet équipement, soyez conscient des dangers posés par
les circuits électriques et familiarisez-vous avec les procédures courantes de prévention des
accidents. Pour obtenir les traductions des mises en garde figurant dans cette publication, veuillez
consulter l’annexe intitulée « Translated Safety Warnings » (Traduction des avis de sécurité).
Warnung Dieses Warnsymbol bedeutet Gefahr. Sie befinden sich in einer Situation, die zu einer
Körperverletzung führen könnte. Bevor Sie mit der Arbeit an irgendeinem Gerät beginnen, seien Sie
sich der mit elektrischen Stromkreisen verbundenen Gefahren und der Standardpraktiken zur
Vermeidung von Unfällen bewußt. (Übersetzungen der in dieser Veröffentlichung enthaltenen
Warnhinweise finden Sie im Anhang mit dem Titel “Translated Safety Warnings” (Übersetzung der
Warnhinweise).)
Avvertenza Questo simbolo di avvertenza indica un pericolo. Si è in una situazione che può causare infortuni.
Prima di lavorare su qualsiasi apparecchiatura, occorre conoscere i pericoli relativi ai circuiti
elettrici ed essere al corrente delle pratiche standard per la prevenzione di incidenti. La traduzione
delle avvertenze riportate in questa pubblicazione si trova nell’appendice, “Translated Safety
Warnings” (Traduzione delle avvertenze di sicurezza).
Advarsel Dette varselsymbolet betyr fare. Du befinner deg i en situasjon som kan føre til personskade. Før du
utfører arbeid på utstyr, må du være oppmerksom på de faremomentene som elektriske kretser
innebærer, samt gjøre deg kjent med vanlig praksis når det gjelder å unngå ulykker. (Hvis du vil se
oversettelser av de advarslene som finnes i denne publikasjonen, kan du se i vedlegget "Translated
Safety Warnings" [Oversatte sikkerhetsadvarsler].)
Aviso Este símbolo de aviso indica perigo. Encontra-se numa situação que lhe poderá causar danos
fisicos. Antes de começar a trabalhar com qualquer equipamento, familiarize-se com os perigos
relacionados com circuitos eléctricos, e com quaisquer práticas comuns que possam prevenir
possíveis acidentes. (Para ver as traduções dos avisos que constam desta publicação, consulte o
apêndice “Translated Safety Warnings” - “Traduções dos Avisos de Segurança”).
¡Advertencia! Este símbolo de aviso significa peligro. Existe riesgo para su integridad física. Antes de manipular
cualquier equipo, considerar los riesgos que entraña la corriente eléctrica y familiarizarse con los
procedimientos estándar de prevención de accidentes. (Para ver traducciones de las advertencias
que aparecen en esta publicación, consultar el apéndice titulado “Translated Safety Warnings.”)
Varning! Denna varningssymbol signalerar fara. Du befinner dig i en situation som kan leda till personskada.
Innan du utför arbete på någon utrustning måste du vara medveten om farorna med elkretsar och
känna till vanligt förfarande för att förebygga skador. (Se förklaringar av de varningar som
förekommer i denna publikation i appendix "Translated Safety Warnings" [Översatta
säkerhetsvarningar].)
Related Publications
Related Cisco technical documentation include the following:
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several
ways to obtain technical assistance and other technical resources. These sections explain how to obtain
technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/techsupport
Ordering Documentation
Beginning June 30, 2005, registered Cisco.com users may order Cisco documentation at the Product
Documentation Store in the Cisco Marketplace at this URL:
http://www.cisco.com/go/marketplace/
Cisco will continue to support documentation orders using the Ordering tool:
• Registered Cisco.com users (Cisco direct customers) can order documentation from the
Ordering tool:
http://www.cisco.com/en/US/partner/ordering/
• Instructions for ordering documentation using the Ordering tool are at this URL:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm
• Nonregistered Cisco.com users can order documentation through a local account representative by
calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in
North America, by calling 1 800 553-NETS (6387).
Documentation Feedback
You can rate and provide feedback about Cisco technical documents by completing the online feedback
form that appears with the technical documents on Cisco.com.
Tip We encourage you to use Pretty Good Privacy (PGP) or a compatible product to encrypt any sensitive
information that you send to Cisco. PSIRT can work from encrypted information that is compatible with
PGP versions 2.x through 8.x.
Never use a revoked or an expired encryption key. The correct public key to use in your correspondence
with PSIRT is the one linked in the Contact Summary section of the Security Vulnerability Policy page
at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.htm
The link on this page has the current PGP key ID in use.
Note Use the Cisco Product Identification (CPI) tool to locate your product serial number before submitting
a web or phone request for service. You can access the CPI tool from the Cisco Technical Support &
Documentation website by clicking the Tools & Resources link under Documentation & Tools. Choose
Cisco Product Identification Tool from the Alphabetical Index drop-down list, or click the Cisco
Product Identification Tool link under Alerts & RMAs. The CPI tool offers three search options: by
product ID or model name; by tree view; or for certain products, by copying and pasting show command
output. Search results show an illustration of your product with the serial number label location
highlighted. Locate the serial number label on your product and record the information before placing a
service call.
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone.
(S1 or S2 service requests are those in which your production network is down or severely degraded.)
Cisco engineers are assigned immediately to S1 and S2 service requests to help keep your business
operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447
For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
• iQ Magazine is the quarterly publication from Cisco Systems designed to help growing companies
learn how they can use technology to increase revenue, streamline their business, and expand
services. The publication identifies the challenges facing these companies and the technologies to
help solve them, using real-world case studies and business strategies to help readers make sound
technology investment decisions. You can access iQ Magazine at this URL:
http://www.cisco.com/go/iqmagazine
or view the digital edition at this URL:
http://ciscoiq.texterity.com/ciscoiq/sample/
• Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering
professionals involved in designing, developing, and operating public and private internets and
intranets. You can access the Internet Protocol Journal at this URL:
http://www.cisco.com/ipj
• Networking products offered by Cisco Systems, as well as customer support services, can be
obtained at this URL:
http://www.cisco.com/en/US/products/index.html
• Networking Professionals Connection is an interactive website for networking professionals to share
questions, suggestions, and information about networking products and technologies with Cisco
experts and other networking professionals. Join a discussion at this URL:
http://www.cisco.com/discuss/networking
• World-class networking training is available from Cisco. You can view current offerings at
this URL:
http://www.cisco.com/en/US/learning/index.html
Cisco wireless devices provide a secure, affordable, and easy-to-use wireless LAN solution that
combines mobility and flexibility with the enterprise-class features required by networking
professionals. With a management system based on Cisco IOS software, Cisco wireless devices are
Wi-Fi certified, 802.11b-compliant, 802.11g-compliant, or 802.11a-compliant wireless LAN
transceivers.
This document provides information for the following devices:
• Access Point High-speed WAN Interface Card (AP HWIC)
• Cisco 800 Series routers with wireless capabilities
• Cisco 1800 Series routers with wireless capabilities
This chapter provides information on the following topics:
• Wireless Device Management
• Network Configuration Example
• Features
Features
This section lists features supported on access points running Cisco IOS software.
• Access Point Link Role Flexibility—This feature allows the user to configure root and non-root
bridging mode functionality, universal client mode, and support of a WGB client device, in addition
to a root access point on the radio interface.
Note Root/Non-Root bridging mode is supported only on modular ISR platforms, such as Cisco
3800 series , Cisco 2800 and Cisco 1841 series. Fixed ISR platforms, such as the Cisco 800
and Cisco 1800 do not support this feature.
• QoS Basic Service Set (QBSS) support—This feature aligns Cisco QBSS implementation with the
evolving 802.11e standard. The QBSS element of the access point’s beacon advertises channel load
instead of traffic load. A new configuration command, dot11 phone dot11e has been added in
Release 12.4 that allows the standard QBSS Load element to be sent in the beacon. This command
should be used when compatible phones are employed in the network.
• Secure Shell version 2 (SSHv2) support—SSH v2 is a standards-based protocol to provide secure
Telnet capability for router configuration and administration.
• Support for Multiple BSSIDs—This feature permits a single access point to appear to the WLAN as
multiple virtual access points. It does this by assigning an access point with multiple Basic Service
Set IDs (MBSSIDs) or MAC addresses.
To determine whether a radio supports multiple basic SSIDs, enter the show controllers command
for the radio interface. The radio supports multiple basic SSIDs if the results include this line:
Number of supported simultaneous BSSID on radio_interface: 8
• Support for Wi-Fi 802.11h and Dynamic Frequency Selection (DFS)—This feature allows access
points configured at the factory for use in Europe to detect radar signals such as military and weather
sources and switch channels on the access points.
• SNMPv3—This feature enables SNMPv3 support on Cisco wireless devices to provide an additional
level of security.
• World mode—Use this feature to communicate the access point’s regulatory setting information,
including maximum transmit power and available channels, to world mode-enabled clients. Clients
using world mode can be used in countries with different regulatory settings and automatically
conform to local regulations. World mode is supported only on the 2.4-GHz radio.
• Multiple SSIDs—Create up to 16 SSIDs on the wireless device and assign any combination of these
settings to each SSID:
– Broadcast SSID mode for guests on your network
– Client authentication methods
– Maximum number of client associations
– VLAN identifier
– RADIUS accounting list identifier
– A separate SSID for infrastructure devices such as repeaters and workgroup bridges
Note Only 10 SSIDs are supported on the Cisco 800 series platforms.
• VLANs—Assign VLANs to the SSIDs on the wireless device (one VLAN per SSID) to differentiate
policies and services among users.
• QoS—Use this feature to support quality of service for prioritizing traffic from the Ethernet to the
access point. The access point also supports the voice-prioritization schemes used by 802.11b
wireless phones such as the Cisco 7920 and Spectralink's Netlink™.
• RADIUS Accounting—Enable accounting on the access point to send accounting data about
wireless client devices to a RADIUS server on your network.
• Enhanced security—Enable three advanced security features to protect against sophisticated attacks
on your wireless network's WEP keys: Message Integrity Check (MIC), WEP key hashing, and
broadcast WEP key rotation.
• Enhanced authentication services—Set up repeater access points to authenticate to your network
like other wireless client devices. After you provide a network username and password for the
repeater, it authenticates to your network using Light Extensible Authentication Protocol (LEAP),
Cisco's wireless authentication method, and receives and uses dynamic WEP keys.
• Wi-Fi Protected Access (WPA)—Wi-Fi Protected Access is a standards-based, interoperable
security enhancement that strongly increases the level of data protection and access control for
existing and future wireless LAN systems. It is derived from and will be forward-compatible with
the upcoming IEEE 802.11i standard. WPA leverages Temporal Key Integrity Protocol (TKIP) for
data protection and 802.1X for authenticated key management.
• Access point as backup or stand-alone authentication server—You can configure an access point to
act as a local authentication server to provide authentication service for small wireless LANs
without a RADIUS server or to provide backup authentication service in case of a WAN link or a
server failure. The number of clients supported varies based on platform, with up to 1000 user
accounts supported on the higher end platforms.
• Support for 802.11g radios—Cisco IOS Releases 12.4(2)T or later support the standard 802.11g,
2.4-GHz radio.
• Support for Cisco 802.11a Radios—The 802.11a radios support all access point features introduced
in Cisco IOS Release 12.4 and later.
• AES-CCMP—This feature supports Advanced Encryption Standard-Counter Mode with Cipher
Block Chaining Message Authentication Code Protocol (AES-CCMP). AES-CCMP is required for
Wi-Fi Protected Access 2 (WPA2) and IEEE 802.11i wireless LAN security.
• IEEE 802.1X Local Authentication Service for EAP-FAST—This feature expands wireless domain
services (WDS) IEEE 802.1X local authentication to include support for Extensible Authentication
Protocol-Flexible Authentication via Secure Tunneling (EAP-FAST).
• Wi-Fi Multimedia (WMM) Required Elements—This feature supports the required elements of
WMM. WMM is designed to improve the user experience for audio, video, and voice applications
over a Wi-Fi wireless connection. WMM is a subset of the IEEE 802.11e Quality of Service (QoS)
draft standard. WMM supports QoS prioritized media access via the Enhanced Distributed Channel
Access (EDCA) method. Optional elements of the WMM specification including call admission
control using traffic specifications (TSPEC) are not supported in this release.
• VLAN Assignment By Name—This feature allows the RADIUS server to assign a client to a virtual
LAN (VLAN) identified by its VLAN name. In releases before Cisco IOS Release 12.4(5)T, the
RADIUS server identified the VLAN by ID. This feature is important for deployments where VLAN
IDs are not used consistently throughout the network.
• Microsoft WPS IE SSIDL—This feature allows the access point to broadcast a list of configured
SSIDs (the SSIDL) in the Microsoft Wireless Provisioning Services Information Element (WPS IE).
A client with the ability to read the SSIDL can alert the user to the availability of the SSIDs. This
feature provides a bandwidth-efficient, software-upgradeable alternative to multiple broadcast
SSIDs (MB/SSIDs).
• HTTP Web Server v1.1—This feature provides a consistent interface for users and applications by
implementing the HTTP 1.1 standard (see RFC 2616). In previous releases, Cisco software
supported only a partial implementation of HTTP 1.0. The integrated HTTP Server API supports
server application interfaces. When combined with the HTTPS and HTTP 1.1 Client features,
provides a complete, secure solution for HTTP services to and from Cisco devices.
This chapter describes how to configure radio settings for the wireless device. This chapter includes
these sections:
• Enabling the Radio Interface, page 2-2
• Roles in Radio Network, page 2-2
• Configuring Network or Fallback Role, page 2-3
• Sample Bridging Configuration, page 2-4
• Universal Client Mode, page 2-7
• Configuring Universal Client Mode, page 2-7
• Configuring Radio Data Rates, page 2-10
• Configuring Radio Transmit Power, page 2-12
• Configuring Radio Channel Settings, page 2-14
• Enabling and Disabling World Mode, page 2-20
• Enabling and Disabling Short Radio Preambles, page 2-21
• Configuring Transmit and Receive Antennas, page 2-22
• Disabling and Enabling Access Point Extensions, page 2-23
• Configuring the Ethernet Encapsulation Transformation Method, page 2-23
• Enabling and Disabling Reliable Multicast to Workgroup Bridges, page 2-24
• Enabling and Disabling Public Secure Packet Forwarding, page 2-25
• Configuring Beacon Period and DTIM, page 2-26
• Configuring RTS Threshold and Retries, page 2-27
• Configuring Maximum Data Retries, page 2-27
• Configuring Fragmentation Threshold, page 2-28
• Enabling Short Slot Time for 802.11g Radios, page 2-28
• Performing a Carrier Busy Test, page 2-29
Note In Cisco IOS Release 12.4 there is no default SSID. You must create a Radio Service Set Identifier
(SSID) before you can enable the radio interface.
Beginning in privileged EXEC mode, follow these steps to enable the wireless device radio:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 ssid Enter the SSID. The SSID can consist of up to 32 alphanumeric
characters. SSIDs are case sensitive.
Step 4 no shutdown Enable the radio port.
Step 5 end Return to privileged EXEC mode.
Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.
Cisco 800 s Cisco 1800 Cisco 1841 Cisco 2800 Cisco 3800
Role in Radio Network eries ISRs series ISRs series series ISRs series ISRs
Root access point X X X X X
Root bridge with or without clients – – X X X
Non-root bridge without clients – – X X X
Universal client mode X X X X X
Support of Workgroup bridge X X X X X
clients
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 station-role Sets the wireless device role to universal client mode.
• Set the role to non-root bridge with or without wireless
non-root {bridge | return}
clients, repeater access point, root access point or bridge,
scanner, or workgroup bridge.
root {fallback | repeater | wireless
clients | shutdown]} • The bridge mode radio supports point-to-point
configuration only.
• The Ethernet port is shut down when any one of the radios
is configured as a repeater. Only one radio per access point
may be configured as a workgroup bridge or repeater.
• The dot11radio 0|1 antenna-alignment command is
available when the access point is configured as a repeater.
• Spanning Tree Protocol (STP) is configurable on Cisco
ISR series access points in bridge modes.
• (Optional) Select the root access point’s fallback role. If
the wireless device’s Ethernet port is disabled or
disconnected from the wired LAN, the wireless device can
either shut down its radio port or become a repeater access
point associated to any nearby root access point.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
!
resource policy
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
dot11 ssid airlink2-bridge
vlan 1
authentication open
authentication key-management wpa
wpa-psk ascii 0 12345678
!
dot11 priority-map avvid
ip cef
!
!
bridge irb
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
!
interface Dot11Radio0/1/0
no ip address
!
encryption vlan 1 mode ciphers tkip
!
ssid airlink2-bridge
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role non-root bridge
!
interface Dot11Radio0/1/0.1
encapsulation dot1Q 1 native
no snmp trap link-status
bridge-group 1
bridge-group 1 spanning-disabled
!
interface BVI1
ip address 20.0.0.5 255.0.0.0
!
ip route 0.0.0.0 0.0.0.0 20.0.0.1
!
!
ip http server
no ip http secure-server
!
!
control-plane
!
bridge 1 route ip
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end
Note In other Cisco wireless products such as the Cisco AP1232, station-role non-root operates the same as
station-role non-root bridge. On the ISRs, the two commands are different: station-role non-root is
considered the universal client mode and station-role non-root bridge is considered the non-root bridge
mode.
c2801(config-if)#station-role ?
non-root Non-root (bridge)
root Root access point or bridge
c2801(config-if)#station-role non-root ?
bridge Bridge non-rootThis CLI enables non-root bridge mode.
<cr> This CLI enables universal client mode
DHCP
IP DHCP addressing is supported in the Dot11Radio interface configured in universal client mode. The
following is an example of Dot11Radio configured with "ip address dhcp":
dot11 ssid test10
authentication open
!
interface Dot11Radio0/1/0
ip address dhcp
!
ssid test10
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role non-root
Issuing a "show ip interface brief" will show the Virtual-Dot11Radio interface getting the IP address
from the DHCP server.
c2801_uc#sh ip int brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 unassigned YES NVRAM administratively down down
FastEthernet0/1 unassigned YES NVRAM administratively down down
Dot11Radio0/1/0 unassigned YES DHCP up up
Dot11Radio0/1/1 unassigned YES NVRAM administratively down down
Virtual-Dot11Radio0 200.1.1.2 YES DHCP up up
c2801_uc#
Note NAT fails to translate with a DHCP address on the dot11 interface running in universal client mode.
no service password-encryption
!
hostname C1803W_UC
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
no logging console
!
no aaa new-model
!
resource policy
!
!
dot11 ssid hurricane
authentication open
authentication key-management wpa
wpa-psk ascii 0 allyouneedislove
!
dot11 ssid tsunami
authentication open
guest-mode
!
dot11 priority-map avvid
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 100.1.1.1
!
ip dhcp pool jimmy
network 100.1.1.0 255.255.255.0
default-router 100.1.1.1
!
!
!
!
!
!
controller DSL 0
line-term cpe
!
!
bridge irb
!
interface Dot11Radio0
ip address 100.1.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache cef
no ip route-cache
!
ssid tsunami
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
rts threshold 2312
no cdp enable
!
interface Dot11Radio1
ip address dhcp
ip nat outside
ip virtual-reassembly
!
encryption mode ciphers tkip
!
ssid hurricane
!
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
station-role non-root
!
End
You can use the Data Rate settings to set an access point to serve client devices operating at specific data
rates. For example, to set the 2.4-GHz radio for 11 megabits per second (Mbps) service only, set the
11-Mbps rate to Basic and set the other data rates to Disabled. To set the wireless device to serve only
client devices operating at 1 and 2 Mbps, set 1 and 2 to Basic and set the rest of the data rates to
Disabled. To set the 2.4-GHz, 802.11g radio to serve only 802.11g client devices, set any Orthogonal
Frequency Division Multiplexing (OFDM) data rate (6, 9, 12, 18, 24, 36, 48, 54) to Basic. To set the
5-GHz radio for 54 Mbps service only, set the 54-Mbps rate to Basic and set the other data rates to
Disabled.
You can configure the wireless device to set the data rates automatically to optimize either the range or
the throughput. When you enter range for the data rate setting, the wireless device sets the 1 Mbps rate
to basic and the other rates to enabled. When you enter throughput for the data rate setting, the wireless
device sets all four data rates to basic.
Beginning in privileged EXEC mode, follow these steps to configure the radio data rates:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Command Purpose
Step 3 speed Set each data rate to basic or enabled, or enter range to
optimize range or throughput to optimize throughput.
These options are available for the
802.11b, 2.4-GHz radio: • (Optional) Enter 1.0, 2.0, 5.5, and 11.0 to set these data
rates to enabled on the 802.11b, 2.4-GHz radio.
{[1.0] [11.0] [2.0] [5.5] [basic-1.0]
[basic-11.0] [basic-2.0] [basic-5.5] | Enter 1.0, 2.0, 5.5, 6.0, 9.0, 11.0, 12.0, 18.0, 24.0, 36.0,
range | throughput} 48.0, and 54.0 to set these data rates to enabled on the
802.11g, 2.4-GHz radio.
These options are available for the
802.11g, 2.4-GHz radio: Enter 6.0, 9.0, 12.0, 18.0, 24.0, 36.0, 48.0, and 54.0 to set
these data rates to enabled on the 5-GHz radio.
{[1.0] [2.0] [5.5] [6.0] [9.0] [11.0]
[12.0] [18.0] [24.0] [36.0] [48.0] • (Optional) Enter basic-1.0, basic-2.0, basic-5.5, and
[54.0] [basic-1.0] [basic-2.0] basic-11.0 to set these data rates to basic on the 802.11b,
[basic-5.5] [basic-6.0] [basic-9.0] 2.4-GHz radio.
[basic-11.0] [basic-12.0]
Enter basic-1.0, basic-2.0, basic-5.5, basic-6.0, basic-9.0,
[basic-18.0] [basic-24.0]
basic-11.0, basic-12.0, basic-18.0, basic-24.0, basic-36.0,
[basic-36.0] [basic-48.0]
basic-48.0, and basic-54.0 to set these data rates to basic
[basic-54.0] | range |
on the 802.11g, 2.4-GHz radio.
throughput [ofdm] | default }
Note The client must support the basic rate that you select or
These options are available for the
it cannot associate to the wireless device. If you select
5-GHz radio:
12 Mbps or higher for the basic data rate on the 802.11g
{[6.0] [9.0] [12.0] [18.0] [24.0] radio, 802.11b client devices cannot associate to the
[36.0] [48.0] [54.0] [basic-6.0] wireless device’s 802.11g radio.
[basic-9.0] [basic-12.0] [basic-18.0]
[basic-24.0] [basic-36.0] Enter basic-6.0, basic-9.0, basic-12.0, basic-18.0,
[basic-48.0] [basic-54.0] | basic-24.0, basic-36.0, basic-48.0, and basic-54.0 to set
range | throughput |default } these data rates to basic on the 5-GHz radio.
• (Optional) Enter range or throughput to automatically
optimize radio range or throughput. When you enter
range, the wireless device sets the lowest data rate to basic
and the other rates to enabled. When you enter
throughput, the wireless device sets all data rates to basic.
(Optional) On the 802.11g radio, enter speed throughput
ofdm to set all OFDM rates (6, 9, 12, 18, 24, 36, and 48)
to basic (required) and set all the CCK rates (1, 2, 5.5, and
11) to disabled. This setting disables 802.11b protection
mechanisms and provides maximum throughput for
802.11g clients. However, it prevents 802.11b clients from
associating to the access point.
• (Optional) Enter default to set the data rates to factory
default settings (not supported on 802.11b radios).
On the 802.11g radio, the default option sets rates 1, 2, 5.5,
and 11 to basic, and rates 6, 9, 12, 18, 24, 36, 48, and 54 to
enabled. These rate settings allow both 802.11b and
802.11g client devices to associate to the wireless device’s
802.11g radio.
On the 5-GHz radio, the default option sets rates 6.0, 12.0,
and 24.0 to basic, and rates 9.0, 18.0, 36.0, 48.0, and 54.0
to enabled.
Command Purpose
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of the speed command to remove one or more data rates from the configuration. This
example shows how to remove data rates basic-2.0 and basic-5.5 from the configuration:
router# configure terminal
router(config)# interface dot11radio 0
router(config-if)# no speed basic-2.0 basic-5.5
router(config-if)# end
dBm -1 2 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
mW 1 2 3 4 5 6 8 10 12 15 20 25 30 40 50 60 80 100 125 150 200 250
Beginning in privileged EXEC mode, follow these steps to set the transmit power on access point radios:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 power local Set the transmit power for the 802.11g, 2.4-GHz radio to one of
power settings should be: the power levels allowed in your regulatory domain. All
settings are in mW.
{3 | 4 | 5 | 6 | 7 | 10 | 13 | 15 | 17 | 18 |
On the 2.4-GHz, 802.11g radio, you can set Orthogonal
20 | maximum}
Frequency Division Multiplexing (OFDM) power levels and
Complementary Code Keying (CCK) power levels. CCK
modulation is supported by 802.11b and 802.11g devices.
OFDM modulation is supported by 802.11g and 802.11a
devices.
Note See the hardware installation guide for your access
point to determine the power settings for your
regulatory domain.
Use the no form of the power command to return the power setting to maximum, the default setting.
Note Cisco AVVID documentation uses the term Dynamic Power Control (DTPC) to refer to limiting the
power level on associated client devices.
Beginning in privileged EXEC mode, follow these steps to specify a maximum allowed power setting on
all client devices that associate to the wireless device:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Command Purpose
Step 3 power client Set the maximum power level allowed on client devices that
associate to the wireless device.
These options are available for
802.11b, 2.4-GHz clients (in mW): Note The settings allowed in your regulatory domain might
differ from the settings listed here.
{ 1 | 5 | 20 | 30 | 50 | 100 | maximum}
These options are available for
802.11g, 2.4-GHz clients (in mW):
{ 1 | 5 | 10 | 20 | 30 | 50 | 100 |
maximum}
These options are available for 5-GHz
clients (in mW):
{ 5 | 10 | 20 | 40 | maximum }
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of the client power command to disable the maximum power level for associated clients.
Note Access Point extensions must be enabled to limit the power level on associated client devices. Access
Point extensions are enabled by default.
Note Too many access points in the same vicinity creates radio congestion that can reduce throughput. A
careful site survey can determine the best placement of access points for maximum radio coverage and
throughput.
Beginning in privileged EXEC mode, follow these steps to set the wireless device’s radio channel:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio {0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 channel Set the default channel for the wireless device radio. Table 2-3
frequency | least-congested through Table 2-6 show the available channels and frequencies for
all radios. To search for the least-congested channel on startup,
enter least-congested.
Note The channel command is disabled for 5-GHz radios that
comply with European Union regulations on dynamic
frequency selection (DFS). See the “DFS Automatically
Enabled on Some 5-GHz Radio Channels” section on
page 2-19 for more information.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config (Optional) Save your entries in the configuration file.
startup-config
Table 2-3 shows the available channels and frequencies for the IEEE 802.11b 2.4-GHz radio.
Table 2-3 Channels and Frequencies for 802.11b 2.4 GHz Radio
Regulatory Domains
Channel Center Americas China EMEA Japan
Identifier Frequency (MHz) (–A) (–C) (–E) (–J)
1 2412 X X X X
2 2417 X X X X
3 2422 X X X X
4 2427 X X X X
5 2432 X X X X
6 2437 X X X X
7 2442 X X X X
8 2447 X X X X
9 2452 X X X X
10 2457 X X X X
11 2462 X X X X
12 2467 – – X X
13 2472 – – X X
14 2484 – – – –
Table 2-4 shows the available frequencies for the 802.11g 2.4 GHz radio.
Table 2-4 Channels and Available Frequencies for 802.11g 2.4 GHz Radio
Regulatory Domains
Center
Channel Frequency Americas (–A) EMEA (–E) Japan (–J)
Identifier (MHz) CCK OFDM CCK OFDM CCK OFDM
1 2412 X X X X X X
2 2417 X X X X X X
3 2422 X X X X X X
4 2427 X X X X X X
5 2432 X X X X X X
6 2437 X X X X X X
7 2442 X X X X X X
8 2447 X X X X X X
9 2452 X X X X X X
10 2457 X X X X X X
11 2462 X X X X X X
12 2467 – – X X X X
13 2472 – – X X X X
14 2484 – – – – X –
Table 2-5 shows the available channels and frequencies for the RM20A IEEE 802.11a radio
Table 2-5 Channels and Available Frequencies for the 802.11a Radio
Regulatory Domains
Center
Channel Frequency Americas (–A) EMEA (–N) Japan (–P)
Identifier (MHz) CCK OFDM CCK OFDM CCK OFDM
1 2412 X X X X X X
2 2417 X X X X X X
3 2422 X X X X X X
4 2427 X X X X X X
5 2432 X X X X X X
6 2437 X X X X X X
7 2442 X X X X X X
8 2447 X X X X X X
9 2452 X X X X X X
10 2457 X X X X X X
11 2462 X X X X X X
12 2467 – – X X X X
Regulatory Domains
Center
Channel Frequency Americas (–A) EMEA (–N) Japan (–P)
Identifier (MHz) CCK OFDM CCK OFDM CCK OFDM
13 2472 – – X X X X
14 2484 – – – – X –
Table 2-6 shows the available frequencies for the RM21A and RM22A IEEE 802.11a 5-GHz radios.
Table 2-6 Channels and Available Frequencies for the 802.11a 5-GHz Radios
Note The frequencies allowed in your regulatory domain might differ from the frequencies listed here.
Note You cannot manually select a channel for DFS-enabled 5-GHz radios.
When DFS is enabled, the access point monitors its operating frequency for radar signals. If it detects
radar signals on the channel, the access point takes these steps:
• Blocks new transmissions on the channel.
• Flushes the power-save client queues.
• Broadcasts an 802.11h channel-switch announcement.
• Disassociates remaining client devices.
• Randomly selects a different 5-GHz channel.
• If the channel selected is one of the channels in Table 2-7, scans the new channel for radar signals
for 60 seconds.
• If there are no radar signals on the new channel, enables beacons and accepts client associations.
Note The maximum legal transmit power is greater for some 5-GHz channels than for others. When it
randomly selects a 5-GHz channel on which power is restricted, the access point automatically reduces
transmit power to comply with power limits for that channel.
Note We recommend that you use the world-mode dot11d country-code configuration interface command to
configure a country code on DFS-enabled radios. The IEEE 802.11h protocol requires access points to
include the country information element (IE) in beacons and probe responses. By default, however, the
country code in the IE is blank. You use the world-mode command to populate the country code IE.
This example shows how to unblock frequencies 5.150 to 5.350 for DFS:
router(config-if)# no dfs band 1 2 block
Beginning in privileged EXEC mode, follow these steps to enable world mode:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1} Enter interface configuration mode for the radio interface.
Step 3 world-mode Enable world mode.
dot11d country_code code
• Enter the dot11d option to enable 802.11d world mode.
{ both | indoor | outdoor }
| legacy – When you enter the dot11d option, you must enter a
two-character ISO country code (for example, the ISO
country code for the United States is US). You can find
a list of ISO country codes at the ISO website.
– After the country code, you must enter indoor,
outdoor, or both to indicate the placement of the
wireless device.
• Enter the legacy option to enable Cisco legacy world
mode.
Note Access Point extensions must be enabled for legacy
world mode operation, but Access Point extensions are
not required for 802.11d world mode. Access Point
extensions are enabled by default.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 } Enter interface configuration mode for the 2.4-GHz radio
interface.
Command Purpose
Step 3 no preamble-short Disable short preambles and enable long preambles.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Short preambles are enabled by default. Use the preamble-short command to enable short preambles if
they are disabled.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 antenna receive Set the receive antenna to diversity, left, or right.
{diversity | left | right} Note For best performance, leave the receive antenna setting
at the default setting, diversity.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 no dot11 extension aironet Disable Access Point extensions.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the dot11 extension aironet command to enable Access Point extensions if they are disabled.
Beginning in privileged EXEC mode, follow these steps to configure the encapsulation transformation
method:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 payload-encapsulation Set the encapsulation transformation method to RFC1042
snap | dot1h (snap) or 802.1h (dot1h, the default setting).
Note This feature is best suited for use with stationary workgroup bridges. Mobile workgroup bridges might
encounter spots in the wireless device's coverage area where they do not receive multicast packets and
lose communication with the wireless device even though they are still associated to it.
A Cisco Access Point Workgroup Bridge provides a wireless LAN connection for up to eight
Ethernet-enabled devices.
This feature is not supported on the 5-GHz radio.
Beginning in privileged EXEC mode, follow these steps to configure the encapsulation transformation
method:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 } Enter interface configuration mode for the 2.4-GHz radio
interface.
Step 3 infrastructure-client Enable reliable multicast messages to workgroup bridges.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of the command to disable reliable multicast messages to workgroup bridges.
Note To prevent communication between clients associated to different access points, you must set up
protected ports on the switch to which the wireless devices are connected. See the “Configuring
Protected Ports” section on page 2-26 for instructions on setting up protected ports.
To enable and disable PSPF using CLI commands on the wireless device, you use bridge groups. You
can find a detailed explanation of bridge groups and instructions for implementing them in this
document:
• Cisco IOS Bridging and IBM Networking Configuration Guide, Release 12.2. Click this link to
browse to the Configuring Transparent Bridging chapter:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fibm_c/bcfpart1/bcftb.
htm
You can also enable and disable PSPF using the web-browser interface. The PSPF setting is on the Radio
Settings pages.
PSPF is disabled by default. Beginning in privileged EXEC mode, follow these steps to enable PSPF:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 bridge-group group port-protected Enable PSPF.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface interface-id Enter interface configuration mode, and enter the type and
number of the switchport interface to configure, such as
gigabitethernet0/1.
Step 3 switchport protected Configure the interface to be a protected port.
Step 4 end Return to privileged EXEC mode.
Step 5 show interfaces interface-id Verify your entries.
switchport
Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.
To disable protected port, use the no switchport protected interface configuration command.
For detailed information on protected ports and port blocking, see the “Configuring Port-Based Traffic
Control” chapter in the Catalyst 3550 Multilayer Switch Software Configuration Guide, 12.1(12c)EA1
at:
http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_book09186a
008011591c.html
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Command Purpose
Step 3 beacon period value Set the beacon period. Enter a value in Kilomicroseconds.
Step 4 beacon dtim-period value Set the DTIM. Enter a value in Kilomicroseconds.
Step 5 end Return to privileged EXEC mode.
Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 rts threshold value Set the RTS threshold. Enter an RTS threshold from 0 to 2347.
Step 4 rts retries value Set the maximum RTS retries. Enter a setting from 1 to 128.
Step 5 end Return to privileged EXEC mode.
Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of the command to reset the RTS settings to defaults.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 packet retries value Set the maximum data retries. Enter a setting from 1 to 128.
Command Purpose
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 fragment-threshold value Set the fragmentation threshold. Enter a setting from 256 to
2346 bytes for the 2.4-GHz radio. Enter a setting from 256 to
2346 bytes for the 5-GHz radio.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Step 1 router(config-if)# slot-time-short In radio interface mode, enter this command to enable short slot
time.
Step 2 no slot-time-short (optional) Enter no slot-time-short to disable short slot time.
For interface-number, enter dot11radio 0 to run the test on the 2.4-GHz radio, or enter dot11radio 1 to
run the test on the 5-GHz radio.
Use the show dot11 carrier busy command to re-display the carrier busy test results.
This chapter describes how to configure and manage multiple service set identifiers (SSIDs) on the
access point. This chapter contains the following sections:
• Understanding Multiple SSIDs, page 3-2
• Configuring Multiple SSIDs, page 3-3
• Configuring Multiple Basic SSIDs, page 3-6
• Enabling MBSSID and SSIDL at the same time, page 3-7
Note For detailed information on client authentication types, see Chapter 6, “Configuring
Authentication Types.”
Cisco IOS Release 12.4(15)T supports configuration of SSID parameters at the interface level on the
CLI, but the SSIDs are stored in global mode. Storing all SSIDs in global mode ensures that the SSID
configuration remains correct when you upgrade to release later than Cisco IOS Release 12.4(15)T.
If you need to upgrade to a release later than 12.4(15)T, you should first upgrade to Cisco IOS Release
12.4(15)T, save the configuration file, upgrade to the target release, and load the saved configuration file.
This process ensures that your interface-level SSID configuration correctly translates to global mode.
If you upgrade directly from 12.4(15)T release or earlier to a 12.4(15)T or later release, your
interface-level SSID configuration is deleted.
Note In Cisco IOS Release 12.4(15)T and later, you configure SSIDs globally and then apply them to a
specific radio interface. Follow the instructions in the “Creating an SSID Globally” section on page 3-3
to configure SSIDs globally.
Note SSIDs created in Cisco IOS Releases 12.3(7)JA and later become invalid if you downgrade the software
version to an earlier release.
Beginning in privileged EXEC mode, follow these steps to create an SSID globally. After you create an
SSID, you can assign it to specific radio interfaces.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 dot11 ssid ssid-string Create an SSID and enter SSID configuration mode for the new
SSID. The SSID can consist of up to 32 alphanumeric
characters. SSIDs are case sensitive.
Note +, ., ], ?, $, TAB, and trailing spaces are invalid
characters for SSIDs.
Step 3 authentication client (Optional) Set an authentication username and password that
username username the access point uses to authenticate to the network when in
password password repeater mode. Set the username and password on the SSID that
the repeater access point uses to associate to a root access point,
or with another repeater.
Step 4 accounting list-name (Optional) Enable RADIUS accounting for this SSID. For
list-name, specify the accounting method list. Click this link
for more information on method lists:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios
122/122cgcr/fsecur_c/fsaaa/scfacct.htm#xtocid2
Command Purpose
Step 5 vlan vlan-id (Optional) Assign the SSID to a VLAN on your network. Client
devices that associate using the SSID are grouped into this
VLAN. You can assign only one SSID to a VLAN.
Step 6 guest-mode (Optional) Designate the SSID as your access point’s
guest-mode SSID. The access point includes the SSID in its
beacon and allows associations from client devices that do not
specify an SSID.
Step 7 infrastructure-ssid [optional] (Optional) Designate the SSID as the SSID that other access
points and workgroup bridges use to associate to this access
point. If you do not designate an SSID as the infrastructure
SSID, infrastructure devices can associate to the access point
using any SSID. If you designate an SSID as the infrastructure
SSID, infrastructure devices must associate to the access point
using that SSID unless you also enter the optional keyword.
Step 8 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface to
which you want to assign the SSID. The 2.4-GHz radio is radio
0, and the 5-GHz radio is radio 1.
Step 9 ssid ssid-string Assign the global SSID that you created in Step 2 to the radio
interface.
Step 10 end Return to privileged EXEC mode.
Step 11 copy running-config startup-config (Optional) Save your entries in the configuration file.
Note You use the ssid command’s authentication options to configure an authentication type for each SSID.
See Chapter 6, “Configuring Authentication Types,” for instructions on configuring authentication
types.
Use the no form of the command to disable the SSID or to disable SSID features.
This example shows how to:
• Name an SSID
• Configure the SSID for RADIUS accounting
• Set the maximum number of client devices that can associate using this SSID to 15
• Assign the SSID to a VLAN
• Assign the SSID to a radio interface
router# configure terminal
router(config)# dot11 ssid batman
router(config-ssid)# accounting accounting-method-list
router(config-ssid)# max-associations 15
router(config-ssid)# vlan 3762
router(config-ssid)# exit
router(config)# interface dot11radio 0
router(config-if)# ssid batman
ssid buffalo
vlan 17
authentication open
ssid buffalo
vlan 7
authentication open
However, this sample output from a show dot11 associations privileged EXEC command shows the
spaces in the SSIDs:
SSID [buffalo] :
SSID [buffalo ] :
SSID [buffalo ] :
The allowed list of SSIDs from the RADIUS server are in the form of Cisco VSAs. The Internet
Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific
information between the access point and the RADIUS server by using the vendor-specific attribute
(attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended attributes
not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option by
using the format recommended in the specification. Cisco’s vendor-ID is 9, and the supported option has
vendor-type 1, which is named cisco-avpair. The Radius server is allowed to have zero or more SSID
VSAs per client.
In this example, the following AV pair adds the SSID batman to the list of allowed SSIDs for a user:
cisco-avpair= ”ssid=batman”
For instructions on configuring the access point to recognize and use VSAs, see the “Configuring the
Access Point to Use Vendor-Specific RADIUS Attributes” section on page 7-14.
Note Devices on your wireless LAN that are configured to associate to a specific access point based on the
access point MAC address (for example, client devices, repeaters, hot standby units, or workgroup
bridges) might lose their association when you add or delete a multiple BSSID. When you add or delete
a multiple BSSID, check the association status of devices configured to associate to a specific access
point. If necessary, reconfigure the disassociated device to use the BSSID’s new MAC address.
• When multiple BSSIDs are enabled on the access point, the SSIDL IE does not contain a list of
SSIDs; it contains only extended capabilities.
• Any Wi-Fi certified client device can associate to an access point using multiple BSSIDs.
• You can enable multiple BSSIDs on access points that participate in WDS.
You can also use the dot11 mbssid global configuration command to simultaneously enable multiple
BSSIDs on all radio interfaces that support multiple BSSIDs.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface.
Step 3 ssid ssid-string Enter configuration mode for a specific SSID.
Step 4 information-element ssidl Include an SSIDL IE in the access point beacon that advertises
[advertisement] [wps] the access point’s extended capabilities, such as 802.1x and
support for Microsoft Wireless Provisioning Services (WPS).
Use the advertisement option to include the SSID name and
capabilities in the SSIDL IE. Use the wps option to set the WPS
capability flag in the SSIDL IE.
!
dot11 ssid 1841-tkip-psk
vlan 2
authentication open
authentication key-management wpa
wpa-psk ascii 0 12345678
information-element ssidl advertisement
!
dot11 ssid 1841-aes-psk
vlan 3
authentication open
authentication key-management wpa
wpa-psk ascii 0 12345678
information-element ssidl advertisement wps
!
interface Dot11Radio0/0/0
no ip address
no snmp trap link-status
!
encryption vlan 1 key 1 size 128bit 0 12345678901234567890123456 transmit-key
encryption vlan 1 key 2 size 128bit 0 12345678901234567890123456
encryption vlan 1 mode ciphers wep128
!
encryption vlan 2 mode ciphers tkip
!
encryption vlan 3 mode ciphers aes-ccm
!
ssid 1841-wep128
!
ssid 1841-tkip-psk
!
ssid 1841-aes-psk
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
This chapter describes how to configure the access point as a local authenticator to serve as a stand-alone
authenticator for a small wireless LAN or to provide backup authentication service. As a local
authenticator, the access point performs LEAP, EAP-FAST, and MAC-based authentication for up to
1000 client devices. This chapter contains these sections:
• Understand Local Authentication, page 4-2
• Configure a Local Authenticator, page 4-2
Note If your wireless LAN contains only one access point, you can configure the access point as both
the 802.1x authenticator and the local authenticator. However, users associated to the local
authenticator access point might notice a drop in performance when the access point
authenticates client devices.
You can configure your access points to use the local authenticator when they cannot reach the main
servers, or you can configure your access points to use the local authenticator or as the main
authenticator if you do not have a RADIUS server. When you configure the local authenticator as a
backup to your main servers, the access points periodically check the link to the main servers and stop
using the local authenticator automatically when the link to the main servers is restored.
Caution The access point you use as an authenticator contains detailed authentication information for your
wireless LAN, so you should secure it physically to protect its configuration.
Configuration Overview
You complete four major steps when you set up a local authenticator:
1. On the local authenticator, create a list of access points authorized to use the authenticator to
authenticate client devices. Each access point that uses the local authenticator is a network access
server (NAS).
Note If your local authenticator access point also serves client devices, you must enter the local
authenticator access point as a NAS. When a client associates to the local authenticator
access point, the access point uses itself to authenticate the client.
2. On the local authenticator, create user groups and configure parameters to be applied to each group
(optional).
3. On the local authenticator, create a list of up to 50 LEAP users, EAP-FAST users, or MAC addresses
that the local authenticator is authorized to authenticate.
Note You do not have to specify which type of authentication that you want the local authenticator
to perform. It automatically performs LEAP, EAP-FAST, or MAC-address authentication for
the users in its user database.
4. On the access points that use the local authenticator, enter the local authenticator as a RADIUS
server.
Note If your local authenticator access point also serves client devices, you must enter the local
authenticator as a RADIUS server in the local authenticator’s configuration. When a client
associates to the local authenticator access point, the access point uses itself to authenticate
the client.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 aaa new-model Enable AAA.
Command Purpose
Step 3 radius-server local Enable the access point as a local authenticator and enter
configuration mode for the authenticator.
Step 4 nas ip-address key shared-key Add an access point to the list of units that use the local
authenticator. Enter the access point’s IP address and the shared
key used to authenticate communication between the local
authenticator and other access points. You must enter this shared
key on the access points that use the local authenticator. If your
local authenticator also serves client devices, you must enter the
local authenticator access point as a NAS.
Note Leading spaces in the key string are ignored, but spaces
within and at the end of the key are used. If you use spaces
in your key, do not enclose the key in quotation marks
unless the quotation marks are part of the key.
Repeat this step to add each access point that uses the local
authenticator.
Step 5 group group-name (Optional) Enter user group configuration mode and configure a
user group to which you can assign shared settings.
Step 6 vlan vlan (Optional) Specify a VLAN to be used by members of the user
group. The access point moves group members into that VLAN,
overriding other VLAN assignments. You can assign only one
VLAN to the group.
Step 7 ssid ssid (Optional) Enter up to 20 SSIDs to limit members of the user
group to those SSIDs. The access point checks that the SSID that
the client used to associate matches one of the SSIDs in the list.
If the SSID does not match, the client is disassociated.
Step 8 reauthentication time seconds (Optional) Enter the number of seconds after which access points
should reauthenticate members of the group. The
reauthentication provides users with a new encryption key. The
default setting is 0, which means that group members are never
required to reauthenticate.
Step 9 block count count (Optional) To help protect against password guessing attacks, you
time { seconds | infinite } can lock out members of a user group for a length of time after a
set number of incorrect passwords.
• count—The number of failed passwords that triggers a
lockout of the username.
• time—The number of seconds the lockout should last. If you
enter infinite, an administrator must manually unblock the
locked username. See the “Unblocking Locked Usernames”
section on page 4-11 for instructions on unblocking client
devices.
Step 10 exit Exit group configuration mode and return to authenticator
configuration mode.
Command Purpose
Step 11 user username Enter the LEAP and EAP-FAST users allowed to authenticate
{ password | nthash } password using the local authenticator. You must enter a username and
[ group group-name ] password for each user. If you only know the NT value of the
[mac-auth-only] password, which you can often find in the authentication server
database, you can enter the NT hash as a string of hexadecimal
digits.
To add a client device for MAC-based authentication, enter the
client’s MAC address as both the username and password. Enter
12 hexadecimal digits without a dot or dash between the numbers
as the username and the password. For example, for the MAC
address 0009.5125.d02b, enter 00095125d02b as both the
username and the password.
To limit the user to MAC authentication only, enter
mac-auth-only.
To add the user to a user group, enter the group name. If you do
not specify a group, the user is not assigned to a specific VLAN
and is never forced to reauthenticate.
Step 12 end Return to privileged EXEC mode.
Step 13 copy running-config (Optional) Save your entries in the configuration file.
startup-config
This example shows how to set up a local authenticator used by three access points with three user groups
and several users:
router# configure terminal
router(config)# radius-server local
router(config-radsrv)# nas 10.91.6.159 key 110337
router(config-radsrv)# nas 10.91.6.162 key 110337
router(config-radsrv)# nas 10.91.6.181 key 110337
router(config-radsrv)# group clerks
router(config-radsrv-group)# vlan 87
router(config-radsrv-group)# ssid batman
router(config-radsrv-group)# ssid robin
router(config-radsrv-group)# reauthentication time 1800
router(config-radsrv-group)# block count 2 time 600
router(config-radsrv-group)# group cashiers
router(config-radsrv-group)# vlan 97
router(config-radsrv-group)# ssid deer
router(config-radsrv-group)# ssid antelope
router(config-radsrv-group)# ssid elk
router(config-radsrv-group)# reauthentication time 1800
router(config-radsrv-group)# block count 2 time 600
router(config-radsrv-group)# group managers
router(config-radsrv-group)# vlan 77
router(config-radsrv-group)# ssid mouse
router(config-radsrv-group)# ssid chipmunk
router(config-radsrv-group)# reauthentication time 1800
router(config-radsrv-group)# block count 2 time 600
router(config-radsrv-group)# exit
router(config-radsrv)# user jsmith password twain74 group clerks
router(config-radsrv)# user stpatrick password snake100 group clerks
router(config-radsrv)# user nick password uptown group clerks
router(config-radsrv)# user 00095125d02b password 00095125d02b group clerks mac-auth-only
!
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
!
interface BVI1
ip address 192.168.1.66 255.255.255.0
no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
!
radius-server local
eapfast authority id 12345678901234567890123456789012
eapfast authority info sample_eap-fast
eapfast server-key primary 7 41754A0073F16A0E093EA2089A3FDECD32
nas 192.168.1.66 key 7 110A1016141D
group EAP_FAST-usr
eapfast pac expiry 30 grace 120
!
user cisco nthash 7 06532C791C1E2F4856364128295C7C0E007A6661723723422656050A09
760D2F51
!
radius-server host 192.168.1.66 auth-port 1812 acct-port 1813 key 7 060506324F41
!
control-plane
!
bridge 1 route ip
!
!
!
line con 0
transport preferred all
transport output all
line vty 0 4
transport preferred all
transport input all
transport output all
line vty 5 15
transport preferred all
transport input all
transport output all
!
end
Note If your local authenticator access point also serves client devices, you must configure the local
authenticator to use itself to authenticate client devices.
On the access points that use the local authenticator, use the radius-server host command to enter the
local authenticator as a RADIUS server. The order in which the access point attempts to use the servers
matches the order in which you enter the servers in the access point configuration. If you are configuring
the access point to use RADIUS for the first time, enter the main RADIUS servers first, and enter the
local authenticator last.
Note You must enter 1812 as the authentication port and 1813 as the accounting port. The local
authenticator listens on UDP port 1813 for RADIUS accounting packets. It discards the
accounting packets but sends acknowledge packets back to RADIUS clients to prevent clients
from assuming that the server is down.
Use the radius-server deadtime command to set an interval during which the access point does not
attempt to use servers that do not respond, thus avoiding the wait for a request to time out before trying
the next configured server. A server marked as dead is skipped by additional requests for the duration of
minutes that you specify, up to 1440 (24 hours).
This example shows how to set up two main servers and a local authenticator with a server deadtime of
10 minutes:
router(config)# aaa new-model
router(config)# radius-server host 172.20.0.1 auth-port 1000 acct-port 1001 key 77654
router(config)# radius-server host 172.10.0.1 auth-port 1645 acct-port 1646 key 77654
router(config)# radius-server host 10.91.6.151 auth-port 1812 acct-port 1813 key 110337
router(config)# radius-server deadtime 10
In this example, if the WAN link to the main servers fails, the access point completes these steps when
a LEAP-enabled client device associates:
1. It tries the first server, times out multiple times, and marks the first server as dead.
2. It tries the second server, times out multiple times, and marks the second server as dead.
3. It tries and succeeds using the local authenticator.
If another client device needs to authenticate during the 10-minute dead-time interval, the access point
skips the first two servers and tries the local authenticator first. After the dead-time interval, the access
point tries to use the main servers for authentication. When setting a dead time, you must balance the
need to skip dead servers with the need to check the WAN link and begin using the main servers again
as soon as possible.
Each time the access point tries to use the main servers while they are down, the client device trying to
authenticate might report an authentication timeout. The client device retries and succeeds when the
main servers time out and the access point tries the local authenticator. You can extend the timeout value
on Cisco client devices to accommodate expected server timeouts.
To remove the local authenticator from the access point configuration, use the no radius-server host
hostname | ip-address global configuration command.
You can limit the number of days for which PACs are valid, and a grace period during which PACs are
valid after they have expired. By default, PACs are valid for infinite days, with a grace period of infinite
days. You apply the expiration time and the grace period settings to a group of users.
Use this command to configure the expiration time and grace period for PACs:
router(config-radsrv-group)# [no] eapfast pac expiry days [grace days]
Enter a number of days from 2 to 4095. Enter the no form of the command to reset the expiration time
or grace period to infinite days.
In this example, PACs for the user group expire in 100 days with a grace period of two days:
router(config-radsrv-group)# eapfast pac expiry 100 grace 2
The local authenticator automatically generates PACs for EAP-FAST clients that request them. However,
you might need to generate a PAC manually for some client devices. When you enter the command, the
local authenticator generates a PAC file and writes it to the network location that you specify. The user
imports the PAC file into the client profile.
Use this command to generate a PAC manually:
router# radius local-server pac-generate filename username [password password] [expiry days]
When you enter the PAC filename, enter the full path to which the local authenticator writes the PAC file
(such as tftp://172.1.1.1/test/user.pac). The password is optional and, if not specified, a default password
understood by the CCX client is used. Expiry is also optional and, if not specified, the default period is
1 day.
In this example, the local authenticator generates a PAC for the username joe, password-protects the file
with the password bingo, sets the PAC to expire in 10 days, and writes the PAC file to the TFTP server
at 10.0.0.5:
router# radius local-server pac-generate tftp://10.0.0.5 joe password bingo expiry 10
Configuring an Authority ID
All EAP-FAST authenticators are identified by an authority identity (AID). The local authenticator sends
its AID to an authenticating client, and the client checks its database for a matching AID. If the client
does not recognize the AID, it requests a new PAC.
Use these commands to assign an AID to the local authenticator:
router(config-radserv)# [no] eapfast authority id identifier
The eapfast authority id command assigns an AID that the client device uses during authentication.
Keys can contain up to 32 hexadecimal digits. Enter 0 before the key to enter an unencrypted key. Enter
7 before the key to enter an encrypted key. Use the no form of the commands to reset the local
authenticator to the default setting, which is to use a default value as a primary key.
Because all authentication types are enabled by default, you enter the no form of the command to disable
authentication types. For example, if you want the authenticator to perform only LEAP authentication,
you enter these commands:
router(config-radsrv)# no authentication eapfast
router(config-radsrv)# no authentication mac
NAS : 10.91.6.158
Successes : 0 Unknown usernames : 0
Client blocks : 0 Invalid passwords : 0
Corrupted packet : 0 Unknown RADIUS message : 0
No username attribute : 0 Missing auth attribute : 0
Shared key mismatch : 0 Invalid state attribute: 0
Unknown EAP message : 0 Unknown EAP auth type : 0
Auto provision success : 0 Auto provision failure : 0
PAC refresh : 0 Invalid PAC received : 0
The first section of statistics lists cumulative statistics from the local authenticator.
The second section lists stats for each access point (NAS) authorized to use the local authenticator. The
EAP-FAST statistics in this section include these stats:
• Auto provision success—the number of PACs generated automatically
• Auto provision failure—the number of PACs not generated because of an invalid handshake packet
or invalid username or password
• PAC refresh—the number of PACs renewed by clients
• Invalid PAC received—the number of PACs received that were expired, that the authenticator could
not decrypt, or that were assigned to a client username not in the authenticator’s database
The third section lists stats for individual users. If a user is blocked and the lockout time is set to infinite,
blocked appears at the end of the stat line for that user. If the lockout time is not infinite, Unblocked in
x seconds appears at the end of the stat line for that user.
Use this privileged exec mode command to reset local authenticator statistics to zero:
router# clear radius local-server statistics
This chapter describes how to configure the encryption types required to use WPA authenticated key
management, Wired Equivalent Privacy (WEP), AES-CCM, Temporal Key Integrity Protocol (TKIP),
and broadcast key rotation. This chapter contains these sections:
• Understand Encryption Types, page 5-2
• Configure Encryption Types, page 5-3
Note Client devices using static WEP cannot use the access point when you enable broadcast key
rotation. When you enable broadcast key rotation, only wireless client devices using 802.1x
authentication (such as LEAP, EAP-TLS, or PEAP) can use the access point.
Note You need to configure static WEP keys only if your access point needs to support client devices that use
static WEP. If all the client devices that associate to the access point use key management (WPA or
802.1x authentication) you do not need to configure static WEP keys.
Beginning in privileged EXEC mode, follow these steps to create a WEP key and set the key properties:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Command Purpose
Step 3 encryption Create a WEP key and set up its properties.
[vlan vlan-id]
• (Optional) Select the VLAN for which you want to create
key 1-4 a key.
size { 40 | 128 } encryption-key
[0|7] • Name the key slot in which this WEP key resides. You can
[transmit-key] assign up to 4 WEP keys for each VLAN.
• Enter the key and set the size of the key, either 40-bit or
128-bit. 40-bit keys contain 10 hexadecimal digits; 128-bit
keys contain 26 hexadecimal digits.
• (Optional) Specify whether the key is encrypted (7) or
unencrypted (0).
• (Optional) Set this key as the transmit key. The key in slot
1 is the transmit key by default.
Note Using security features such as authenticated key
management can limit WEP key configurations. See the
“WEP Key Restrictions” section on page 5-4 for a list
of features that impact WEP keys.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
This example shows how to create a 128-bit WEP key in slot 3 for VLAN 22 and sets the key as the
transmit key:
router# configure terminal
router(config)# interface dot11radio 0
router(config-if)# encryption vlan 22 key 3 size 128 12345678901234567890123456
transmit-key
router(config-ssid)# end
2 – 09876543210987654321fedcba x 09876543210987654321fedcba
Because the access point’s WEP key 1 is selected as the transmit key, WEP key 1 on the other device
must have the same contents. WEP key 4 on the other device is set, but because it is not selected as the
transmit key, WEP key 4 on the access point does not need to be set at all.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Command Purpose
Step 3 encryption Enable a cipher suite containing the encryption you need.
[vlan vlan-id] Table 5-3 lists guidelines for selecting a cipher suite that
mode ciphers matches the type of authenticated key management you
{[aes-ccm | tkip]} {[wep128 | configure.
wep40]}
• (Optional) Select the VLAN for which you want to enable
WEP and WEP features.
• Set the cipher options and WEP level. You can combine
TKIP with 128-bit or 40-bit WEP.
Note You can also use the encryption mode wep command
to set up static WEP. However, you should use
encryption mode wep only if no clients that associate
to the access point are capable of key management. See
the Cisco IOS Command Reference for Cisco Access
Points and Bridges for a detailed description of the
encryption mode wep command.
Note When you configure AES-CCM-only, TKIP-only, or AES-CCM + TKIP cipher TKIP encryption (not
including any WEP 40 or WEP 128) on a radio interface or VLAN, every SSID on that radio or
VLANmust be set to use the WPA key management. If you configure AES-CCM or TKIP on a radio or
VLAN but do not configure key management on the SSIDs, client authentication fails on the SSIDs.
For a complete description of WPA and instructions for configuring authenticated key management, see
the “Using WPA Key Management” section on page 6-6.
Note Client devices using static WEP cannot use the access point when you enable broadcast key rotation.
When you enable broadcast key rotation, only wireless client devices using 802.1x authentication (such
as LEAP, EAP-TLS, or PEAP) can use the access point.
Beginning in privileged EXEC mode, follow these steps to enable broadcast key rotation:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Command Purpose
Step 3 broadcast-key Enable broadcast key rotation.
change seconds
• Enter the number of seconds between each rotation of the
[ vlan vlan-id ] broadcast key.
[ membership-termination ]
[ capability-change ] • (Optional) Enter a VLAN for which you want to enable
broadcast key rotation.
• (Optional) If you enable WPA authenticated key
management, you can enable additional circumstances
under which the access point changes and distributes the
WPA group key.
– Membership termination—the access point generates
and distributes a new group key when any
authenticated client device disassociates from the
access point. This feature protects the privacy of the
group key for associated clients. However, it might
generate some overhead if clients on your network
roam frequently.
– Capability change—the access point generates and
distributes a dynamic group key when the last non-key
management (static WEP) client disassociates, and it
distributes the statically configured WEP key when the
first non-key management (static WEP) client
authenticates. In WPA migration mode, this feature
significantly improves the security of
key-management capable clients when there are no
static-WEP clients associated to the access point.
See Chapter 6, “Configuring Authentication Types,” for
detailed instructions on enabling authenticated key
management.
Step 4 end Return to privileged EXEC mode.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of the encryption command to disable broadcast key rotation.
This example enables broadcast key rotation on VLAN 22 and sets the rotation interval to 300 seconds:
router# configure terminal
router(config)# interface dot11radio 0
routerrouter(config-if)# broadcast-key vlan 22 change 300
router(config-ssid)# end
• TKIP
• AES
• TKIP+AES
• WEP 40-bit
• WEP 128-bit
The access point is configured with AES+TKIP WPA-PSK encryption. The universal client will display
the following system message when there is a mismatch in the encryption types during association
between the AP and the universal client:
%DOT11-4-CANT_ASSOC: Interface Dot11Radio0/1/0, cannot associate: WPAIE invalid multicast
suite exp=0x0050F204 act=0x0050F202
In this example, the universal client would have the multicast suite of 0x0050F204 (for TKIP) but instead
received the multicast suite of 0x0050F202 (for AES+ TKIP). Here are the different scenarios:
• If the universal client is configured for AES WPAv2 (encryption mode ciphers aes-ccm), the access
point must be configured for AES WPAv2. The universal client will associate with AES encryption.
• If the universal client is configured for TKIP (encryption mode ciphers tkip) The access point must
be configured for either 1. TKIP WPA or 2. TKIP+AES. The universal client will associate with
TKIP encryption.
• If the universal client is configured for AES+TKIP (encryption mode ciphers tkip aes) The access
point must be configured for TKIP+AES. The universal client will associate with AES encryption.
• If the access point is configured for AES WPAv2 WPAv2 (encryption mode ciphers aes-ccm), and
the universal client is configured with TKIP+AES (encryption mode ciphers aes-ccm tkip), you will
get a system message stating the multicast suite was not found.
Debugging
To determine if the universal client has associated to the access point, the user can issue the 'show dot11
association all' command for a detailed output of which access point it was associating to and how it has
associated to the access point.
The "show dot11 association" command will have the following output:
c2801_uc#
c2801_uc#sh dot11 ass all
Address : 0015.2b06.17d0 Name : ap
IP Address : 200.1.1.1 Interface : Dot11Radio0/1/0
Device : ap1200-Parent Software Version : 12.3
CCX Version : NONE
c2801_uc#
Caveats
When the Cisco dot11radio is in the universal client mode and associates to a 3rd party access point,
there are some additional caveats. The first is on the "show dot11 association" output. The "Device" area
shows a result of "unknown" when associated to a 3rd party access point (non-Cisco). In the example
below, a Cisco 876W universal client is associated to a Symbol 4131 Access Point. The "Software
Version" and "Name" fields also result in "NONE". This is because the Cisco Aironet messages between
Cisco devices carry this information and not between 3rd party and Cisco devices.
Example:
c876#sh dot11 assoc
SSID [symbol] :
c876#
This chapter describes how to configure authentication types on the access point. This chapter contains
these sections:
• Understand Authentication Types, page 6-2
• Configure Authentication Types, page 6-9
• Matching Access Point and Client Device Authentication Types, page 6-16
Note By default, the access point sends reauthentication requests to the authentication server with the
service-type attribute set to authenticate-only. However, some Microsoft IAS servers do not support the
authenticate-only service-type attribute. Changing the service-type attribute to login-only ensures that
Microsoft IAS servers recognize reauthentication requests from the access point. Use the dot11 aaa
authentication attributes service-type login-only global configuration command to set the
service-type attribute in reauthentication requests to login-only.
The access point uses several authentication mechanisms or types and can use more than one at the same
time. These sections explain each authentication type:
• Open Authentication to Access Point, page 6-2
• Shared Key Authentication to Access Point, page 6-3
• EAP Authentication to Network, page 6-4
• MAC Address Authentication to the Network, page 6-5
• Combining MAC-Based, EAP, and Open Authentication, page 6-6
• Using WPA Key Management, page 6-6
• Using WPA Key Management, page 6-6
54583
Shared Key Authentication to Access Point
Cisco provides shared key authentication to comply with the IEEE 802.11b standard. However, because
of shared key’s security flaws, Cisco recommends that you avoid using it.
During shared key authentication, the access point sends an unencrypted challenge text string to any
device attempting to communicate with the access point. The device requesting authentication encrypts
the challenge text and sends it back to the access point. If the challenge text is encrypted correctly, the
access point allows the requesting device to authenticate. Both the unencrypted challenge and the
encrypted challenge can be monitored, however, which leaves the access point open to attack from an
intruder who calculates the WEP key by comparing the unencrypted and encrypted text strings. Because
of this weakness, shared key authentication can be less secure than open authentication. Like open
authentication, shared key authentication does not rely on a RADIUS server on your network.
Figure 6-2 shows the authentication sequence between a device trying to authenticate and an access point
using shared key authentication. In this example the device’s WEP key matches the access point’s key,
so it can authenticate and communicate.
Wired LAN
1. Authentication request
2. Authentication success
3. Association request
65584
4. Association response
(block traffic from client)
5. Authentication request
6. Success
Wired LAN
1. Authentication request
2. Identity request
3. Username (relay to server)
(relay to client) 4. Authentication challenge
5. Authentication response (relay to server)
(relay to client) 6. Authentication success
7. Authentication challenge (relay to server)
(relay to client) 8. Authentication response
65583
In Steps 1 through 9 in Figure 6-3, a wireless client device and a RADIUS server on the wired LAN use
802.1x and EAP to perform a mutual authentication through the access point. The RADIUS server sends
an authentication challenge to the client. The client uses a one-way encryption of the user-supplied
password to generate a response to the challenge and sends that response to the RADIUS server. Using
information from its user database, the RADIUS server creates its own response and compares that to
the response from the client. When the RADIUS server authenticates the client, the process repeats in
reverse, and the client authenticates the RADIUS server.
When mutual authentication is complete, the RADIUS server and the client determine a WEP key that
is unique to the client and provides the client with the appropriate level of network access, thereby
approximating the level of security in a wired switched segment to an individual desktop. The client
loads this key and prepares to use it for the logon session.
During the logon session, the RADIUS server encrypts and sends the WEP key, called a session key, over
the wired LAN to the access point. The access point encrypts its broadcast key with the session key and
sends the encrypted broadcast key to the client, which uses the session key to decrypt it. The client and
access point activate WEP and use the session and broadcast WEP keys for all communications during
the remainder of the session.
There is more than one type of EAP authentication, but the access point behaves the same way for each
type: it relays authentication messages from the wireless client device to the RADIUS server and from
the RADIUS server to the wireless client device. See the “Assigning Authentication Types to an SSID”
section on page 6-9 for instructions on setting up EAP on the access point.
Note If you use EAP authentication, you can select open or shared key authentication, but you don’t have to.
EAP authentication controls authentication both to your access point and to your network.
Tip If you don’t have a RADIUS server on your network, you can create a list of allowed MAC addresses on
the access point’s Advanced Security: MAC Address Authentication page. Devices with MAC addresses
not on the list are not allowed to authenticate.
Tip If MAC-authenticated clients on your wireless LAN roam frequently, you can enable a MAC
authentication cache on your access points. MAC authentication caching reduces overhead because the
access point authenticates devices in its MAC-address cache without sending the request to your
authentication server. See the “Configuring MAC Authentication Caching” section on page 6-14 for
instructions on enabling this feature.
Wired LAN
1. Authentication request
2. Authentication success
3. Association request
65584
4. Association response
(block traffic from client)
5. Authentication request
6. Success
Note In Cisco IOS releases 12.3(4)JA and later, you cannot enable both MAC-address authentication and
WPA-PSK.
Note Unicast and multicast cipher suites advertised in WPA information element (and negotiated during
802.11 association) may potentially mismatch with the cipher suite supported in an explicitly assigned
VLAN. If the RADIUS server assigns a new vlan ID which uses a different cipher suite from the
previously negotiated cipher suite, there is no way for the access point and client to switch back to the
new cipher suite. Currently, the WPA protocol does not allow the cipher suite to be changed after the
initial 802.11 cipher negotiation phase. In this scenario, the client device is disassociated from the
wireless LAN.
See the “Assigning Authentication Types to an SSID” section on page 6-9 for instructions on configuring
WPA key management on your access point.
Figure 6-5 shows the WPA key management process.
Wired LAN
Client and server authenticate to each other, generating an EAP master key
Table 6-1 Software and Firmware Requirements for WPA and WPA-TKIP
Key Management and Encryption Third Party Host Supplicant1 Supported Platform Operating
Protocol Required? Systems
LEAP with WPA-TKIP No Windows XP and 2000
LEAP with WPA No Windows XP and 2000
Host-based EAP (such as PEAP, No2 Windows XP
EAP-SIM, and EAP-TLS) with
WPA
Host-based EAP (such as PEAP, Yes Windows 2000
EAP-SIM, and EAP-TLS) with
WPA
WPA-PSK Mode No2 Windows XP
WPA-PSK Mode Yes Windows 2000
1. Such as Funk Odyssey Client supplicant version 2.2 or Meetinghouse Data Communications Aegis Client version 2.1.
2. Windows XP does not require a third-party supplicant, but you must install Windows XP Service Pack 1 and Microsoft support
patch 815485.
Note When you configure AES-CCM and TKIP-only cipher encryption (not TKIP + WEP 128 or TKIP +
WEP 40) on any radio interface or VLAN, every SSID on that radio or VLAN must be set to use WPA
key management. If you configure TKIP on a radio or VLAN but you do not configure key management
on the SSIDs, client authentication fails on the SSIDs.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 dot11 ssid ssid-string Create an SSID and enter SSID configuration mode for the new
SSID. The SSID can consist of up to 32 alphanumeric
characters. SSIDs are case sensitive.
Command Purpose
Step 3 authentication open (Optional) Set the authentication type to open for this SSID.
[mac-address list-name [alternate]] Open authentication allows any device to authenticate and then
[[optional] eap list-name] attempt to communicate with the access point.
Command Purpose
Step 4 authentication shared (Optional) Set the authentication type for the SSID to shared
[mac-address list-name] key.
[eap list-name]
Note Because of shared key's security flaws, Cisco
recommends that you avoid using it.
Command Purpose
Step 7 end Return to privileged EXEC mode.
Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of the SSID commands to disable the SSID or to disable SSID features.
This example sets the authentication type for the SSID batman to Network-EAP authenticated key
management. Client devices using the batman SSID authenticate using the adam server list.
router# configure terminal
router(config)# interface dot11radio 0
router(config-if)# ssid batman
router(config-ssid)# authentication network-eap adam
router(config-ssid)# authentication key-management optional
router(config-ssid)# end
To support WPA on a wireless LAN where 802.1x-based authentication is not available, you must
configure a pre-shared key on the access point. You can enter the pre-shared key as ASCII or
hexadecimal characters. If you enter the key as ASCII characters, you enter between 8 and 63 characters,
and the access point expands the key using the process described in the Password-based Cryptography
Standard (RFC2898). If you enter the key as hexadecimal characters, you must enter 64 hexadecimal
characters.
In the last step in the WPA process, the access point distributes a group key to the authenticated client
device. You can use these optional settings to configure the access point to change and distribute the
group key based on client association and disassociation:
• Membership termination—the access point generates and distributes a new group key when any
authenticated device disassociates from the access point. This feature keeps the group key private
for associated devices, but it might generate some overhead traffic if clients on your network roam
frequently among access points.
• Capability change—the access point generates and distributes a dynamic group key when the last
non-key management (static WEP) client disassociates, and it distributes the statically configured
WEP key when the first non-key management (static WEP) client authenticates. In WPA migration
mode, this feature significantly improves the security of key-management capable clients when
there are no static-WEP clients associated to the access point.
Beginning in privileged EXEC mode, follow these steps to configure a WPA pre-shared key and group
key update options:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3 ssid ssid-string Enter SSID configuration mode for the SSID.
Step 4 wpa-psk { hex | ascii } [ 0 | 7 ] Enter a pre-shared key for client devices using WPA that also
encryption-key use static WEP keys.
Enter the key using either hexadecimal or ASCII characters. If
you use hexadecimal, you must enter 64 hexadecimal
characters to complete the 256-bit key. If you use ASCII, you
must enter a minimum of 8 letters, numbers, or symbols, and
the access point expands the key for you. You can enter a
maximum of 63 ASCII characters.
Step 5 end Return to privileged EXEC mode.
Command Purpose
Step 6 broadcast-key [ vlan vlan-id ] Use the broadcast key rotation command to configure
{ change seconds } additional updates of the WPA group key.
[ membership-termination ]
[ capability-change ]
Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.
This example shows how to configure a pre-shared key for clients using WPA and static WEP, with group
key update options:
ap# configure terminal
ap(config)# interface dot11radio 0
ap(config-if)# ssid batman
ap(config-ssid)# wpa-psk ascii batmobile65
ap(config-ssid)# exit
ap(config-if)# exit
ap(config)# broadcast-key vlan 87 membership-termination capability-change
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 dot11 aaa authentication Enable MAC authentication caching on the access point.
mac-authen filter-cache [timeout Use the timeout option to configure a timeout value for MAC
seconds]
addresses in the cache. Enter a value from 30 to 65555 seconds.
The default value is 1800 (30 minutes). When you enter a
timeout value, MAC-authentication caching is enabled
automatically.
Step 3 exit Return to privileged EXEC mode.
Step 4 show dot11 aaa authentication Show entries in the MAC-authentication cache. Include client
mac-authen filter-cache [address] MAC addresses to show entries for specific clients.
Step 5 clear dot11 aaa authentication Clear all entries in the cache. Include client MAC addresses to
mac-authen filter-cache [address] clear specific clients from the cache.
Step 6 end Return to privileged EXEC mode.
Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of the dot11 aaa mac-authen filter-cache command to disable MAC authentication
caching. This example shows how to enable MAC authentication caching with a one-hour timeout:
ap# configure terminal
ap(config)# dot11 aaa authentication mac-authen filter-cache timeout 3600
ap(config)# end
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 dot11 holdoff-time seconds Enter the number of seconds a client device must wait before it
can reattempt to authenticate following a failed authentication.
The holdoff time is invoked when a client fails three login
attempts or fails to respond to three authentication requests
from the access point. Enter a value from 1 to 65555 seconds.
Step 3 interface dot11radio { 0 | 1 } Enter interface configuration mode for the radio interface. The
2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 4 dot1x client-timeout seconds Enter the number of seconds the access point should wait for a
reply from a client attempting to authenticate before the
authentication fails. Enter a value from 1 to 65555 seconds.
Step 5 dot1x reauth-period { seconds | Enter the interval in seconds that the access point waits before
server } forcing an authenticated client to reauthenticate.
Enter the server keyword to configure the access point to use
the reauthentication period specified by the authentication
server. If you use this option, configure your authentication
server with RADIUS attribute 27, Session-Timeout. This
attribute sets the maximum number of seconds of service to be
provided to the client before termination of the session or
prompt. The server sends this attribute to the access point when
a client device performs EAP authentication.
Note If you configure both MAC address authentication and
EAP authentication for an SSID, the server sends the
Session-Timeout attribute for both MAC and EAP
authentications for a client device. The access point
uses the Session-Timeout attribute for the last
authentication that the client performs. For example, if
a client performs MAC address authentication and then
performs EAP authentication, the access point uses the
server’s Session-Timeout value for the EAP
authentication. To avoid confusion on which
Session-Timeout attribute is used, configure the same
Session-Timeout value on your authentication server
for both MAC and EAP authentication.
Command Purpose
Step 6 countermeasure tkip hold-time Configure a TKIP MIC failure holdtime. If the access point
seconds detects two MIC failures within 60 seconds, it blocks all the
TKIP clients on that interface for the holdtime period.
Step 7 end Return to privileged EXEC mode.
Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of these commands to reset the values to default settings.
Note Some non-Cisco client adapters do not perform 802.1x authentication to the access point unless you
configure Open authentication with EAP. To allow both the Cisco access point clients using LEAP and
non-Cisco clients using LEAP to associate using the same SSID, you might need to configure the SSID
for both Network EAP authentication and Open authentication with EAP.
802.1x authentication and Enable any 802.1x authentication Select a cipher suite and enable
WPA method Open authentication and WPA for
the SSID (you can also enable
Network-EAP authentication in
addition to or instead of Open
authentication)
Note To allow both WPA clients
and non-WPA clients to use
the SSID, enable optional
WPA.
802.1x authentication and Enable any 802.1x authentication Select a cipher suite and enable
WPA-PSK method Open authentication and WPA for
the SSID (you can also enable
Network-EAP authentication in
addition to or instead of Open
authentication). Enter a WPA
pre-shared key.
Note To allow both WPA clients
and non-WPA clients to use
the SSID, enable optional
WPA.
EAP-TLS authentication
If using ACU to Enable Host Based EAP and Use Set up and enable WEP and enable
configure card Dynamic WEP Keys in ACU and EAP and Open authentication for
select Enable network access the SSID
control using IEEE 802.1X and
Smart Card or Other Certificate as
the EAP Type in Windows 2000
(with Service Pack 3) or
Windows XP
If using Windows XP Select Enable network access Set up and enable WEP and enable
to configure card control using IEEE 802.1X and EAP and Open Authentication for
Smart Card or other Certificate as the SSID
the EAP Type
This chapter describes how to enable and configure the Remote Authentication Dial-In User Service
(RADIUS), that provides detailed accounting information and flexible administrative control over
authentication and authorization processes. RADIUS is facilitated through AAA and can be enabled only
through AAA commands.
Note You can configure your access point as a local authenticator to provide a backup for your main server or
to provide authentication service on a network without a RADIUS server. See Chapter 6, “Configuring
Authentication Types,” for detailed instructions on configuring your access point as a local authenticator.
Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS
Security Command Reference for Release 12.2.
Understanding RADIUS
RADIUS is a distributed client/server system that secures networks against unauthorized access.
RADIUS clients run on supported Cisco devices and send authentication requests to a central RADIUS
server, which contains all user authentication and network service access information. The RADIUS host
is normally a multiuser system running RADIUS server software from Cisco (Cisco Secure Access
Control Server version 3.0), Livingston, Merit, Microsoft, or another software provider. For more
information, refer to the RADIUS server documentation.
Use RADIUS in these network environments, which require access security:
• Networks with multiple-vendor access servers, each supporting RADIUS. For example, access
servers from several vendors use a single RADIUS server-based security database. In an IP-based
network with multiple vendors’ access servers, dial-in users are authenticated through a RADIUS
server that is customized to work with the Kerberos security system.
• Turnkey network security environments in which applications support the RADIUS protocol, such
as an access environment that uses a smart card access control system. In one case, RADIUS has
been used with Enigma’s security cards to validate users and to grant access to network resources.
• Networks already using RADIUS. You can add a Cisco access point containing a RADIUS client to
the network.
• Networks that require resource accounting. You can use RADIUS accounting independently of
RADIUS authentication or authorization. The RADIUS accounting functions allow data to be sent
at the start and end of services, showing the amount of resources (such as time, packets, bytes, and
so forth) used during the session. An Internet service provider might use a freeware-based version
of RADIUS access control and accounting software to meet special security and billing needs.
RADIUS is not suitable in these network security situations:
• Multiprotocol access environments. RADIUS does not support AppleTalk Remote Access (ARA),
NetBIOS Frame Control Protocol (NBFCP), NetWare Asynchronous Services Interface (NASI), or
X.25 PAD connections.
• Switch-to-switch or router-to-router situations. RADIUS does not provide two-way authentication.
RADIUS can be used to authenticate from one device to a non-Cisco device if the non-Cisco device
requires authentication.
• Networks using a variety of services. RADIUS generally binds a user to one service model.
RADIUS Operation
When a wireless user attempts to log in and authenticate to an access point whose access is controlled
by a RADIUS server, authentication to the network occurs in the steps shown in Figure 7-1:
Wired LAN
1. Authentication request
2. Identity request
3. Username (relay to server)
(relay to client) 4. Authentication challenge
5. Authentication response (relay to server)
(relay to client) 6. Authentication success
7. Authentication challenge (relay to server)
(relay to client) 8. Authentication response
65583
9. Successful authentication (relay to server)
In Steps 1 through 9 in Figure 7-1, a wireless client device and a RADIUS server on the wired LAN use
802.1x and EAP to perform a mutual authentication through the access point. The RADIUS server sends
an authentication challenge to the client. The client uses a one-way encryption of the user-supplied
password to generate a response to the challenge and sends that response to the RADIUS server. Using
information from its user database, the RADIUS server creates its own response and compares that to
the response from the client. When the RADIUS server authenticates the client, the process repeats in
reverse, and the client authenticates the RADIUS server.
When mutual authentication is complete, the RADIUS server and the client determine a WEP key that
is unique to the client and provides the client with the appropriate level of network access, thereby
approximating the level of security in a wired switched segment to an individual desktop. The client
loads this key and prepares to use it for the logon session.
During the logon session, the RADIUS server encrypts and sends the WEP key, called a session key, over
the wired LAN to the access point. The access point encrypts its broadcast key with the session key and
sends the encrypted broadcast key to the client, which uses the session key to decrypt it. The client and
access point activate WEP and use the session and broadcast WEP keys for all communications during
the remainder of the session.
There is more than one type of EAP authentication, but the access point behaves the same way for each
type: it relays authentication messages from the wireless client device to the RADIUS server and from
the RADIUS server to the wireless client device. See the “Assigning Authentication Types to an SSID”
section on page 6-9 for instructions on setting up client authentication using a RADIUS server.
Configuring RADIUS
This section describes how to configure your access point to support RADIUS. At a minimum, you must
identify the host or hosts that run the RADIUS server software and define the method lists for RADIUS
authentication. You can optionally define method lists for RADIUS authorization and accounting.
A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep
accounts on a user. You can use method lists to designate one or more security protocols to be used, thus
ensuring a backup system if the initial method fails. The software uses the first method listed to
authenticate, to authorize, or to keep accounts on users; if that method does not respond, the software
selects the next method in the list. This process continues until there is successful communication with
a listed method or the method list is exhausted.
You should have access to and should configure a RADIUS server before configuring RADIUS features
on your access point.
This section contains this configuration information:
• Default RADIUS Configuration, page 7-4
• Identifying the RADIUS Server Host, page 7-5 (required)
• Configuring RADIUS Login Authentication, page 7-7 (required)
• Defining AAA Server Groups, page 7-9 (optional)
• Configuring RADIUS Authorization for User Privileged Access and Network Services, page 7-11
(optional)
• Starting RADIUS Accounting, page 7-12 (optional)
• Selecting the CSID Format, page 7-13 (optional)
• Configuring Settings for All RADIUS Servers, page 7-13 (optional)
• Configuring the Access Point to Use Vendor-Specific RADIUS Attributes, page 7-14 (optional)
• Configuring the Access Point for Vendor-Proprietary RADIUS Server Communication, page 7-15
(optional)
• Configuring WISPr RADIUS Attributes, page 7-16 (optional)
Note The RADIUS server CLI commands are disabled until you enter the aaa new-model command.
Note If you configure both global and per-server functions (timeout, retransmission, and key commands) on
the access point, the per-server timer, retransmission, and key value commands override global timer,
retransmission, and key value commands. For information on configuring these setting on all RADIUS
servers, see the “Configuring Settings for All RADIUS Servers” section on page 7-13.
You can configure the access point to use AAA server groups to group existing server hosts for
authentication. For more information, see the “Defining AAA Server Groups” section on page 7-9.
Beginning in privileged EXEC mode, follow these steps to configure per-server RADIUS server
communication. This procedure is required.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 aaa new-model Enable AAA.
Command Purpose
Step 3 radius-server host {hostname | Specify the IP address or host name of the remote RADIUS server host.
ip-address} [auth-port port-number]
• (Optional) For auth-port port-number, specify the UDP destination
[acct-port port-number] [timeout
port for authentication requests.(Optional) For acct-port
seconds] [retransmit retries] [key
port-number, specify the UDP destination port for accounting
string]
requests.
• (Optional) For timeout seconds, specify the time interval that the
access point waits for the RADIUS server to reply before
retransmitting. The range is 1 to 1000. This setting overrides the
radius-server timeout global configuration command setting. If no
timeout is set with the radius-server host command, the setting of
the radius-server timeout command is used.
• (Optional) For retransmit retries, specify the number of times a
RADIUS request is resent to a server if that server is not responding
or responding slowly. The range is 1 to 1000. If no retransmit value is
set with the radius-server host command, the setting of the
radius-server retransmit global configuration command is used.
• (Optional) For key string, specify the authentication and encryption
key used between the access point and the RADIUS daemon running
on the RADIUS server.
Note The key is a text string that must match the encryption key used
on the RADIUS server. Always configure the key as the last item
in the radius-server host command. Leading spaces are ignored,
but spaces within and at the end of the key are used. If you use
spaces in your key, do not enclose the key in quotation marks
unless the quotation marks are part of the key.
To configure the access point to recognize more than one host entry
associated with a single IP address, enter this command as many times as
necessary, making sure that each UDP port number is different. The
access point software searches for hosts in the order in which you specify
them. Set the timeout, retransmit, and encryption key values to use with
the specific RADIUS host.
Step 4 dot11 ssid ssid-string Enter SSID configuration mode for an SSID on which you need to enable
accounting. The SSID can consist of up to 32 alphanumeric characters.
SSIDs are case sensitive.
Step 5 accounting list-name Enable RADIUS accounting for this SSID. For list-name, specify the
accounting method list. Click this URL for more information on method
lists:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cg
cr/fsecur_c/fsaaa/scfacct.htm#xtocid2
Note To enable accounting for an SSID, you must include the
accounting command in the SSID configuration. Click this URL
to browse to a detailed description of the SSID configuration
mode accounting command:
http://www.cisco.com/en/US/products/hw/wireless/ps4570/prod
ucts_command_reference_chapter09186a008041757f.html#wp2
449819
Command Purpose
Step 6 end Return to privileged EXEC mode.
Step 7 show running-config Verify your entries.
Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.
To remove the specified RADIUS server, use the no radius-server host hostname | ip-address global
configuration command.
This example shows how to configure one RADIUS server to be used for authentication and another to
be used for accounting:
router(config)# radius-server host 172.29.36.49 auth-port 1612 key rad1
router(config)# radius-server host 172.20.36.50 acct-port 1618 key rad2
This example shows how to configure host1 as the RADIUS server and to use the default ports for both
authentication and accounting:
router(config)# radius-server host host1
Note You also need to configure some settings on the RADIUS server. These settings include the IP address
of the access point and the key string to be shared by both the server and the access point. For more
information, refer to the RADIUS server documentation.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 aaa new-model Enable AAA.
Command Purpose
Step 3 aaa authentication login {default | Create a login authentication method list.
list-name} method1 [method2...]
• To create a default list that is used when a named list is not specified
in the login authentication command, use the default keyword
followed by the methods that are to be used in default situations. The
default method list is automatically applied to all interfaces. For more
information on list names, click this link:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/1
22cgcr/fsecur_c/fsaaa/scfathen.htm#xtocid2
• For method1..., specify the actual method the authentication
algorithm tries. The additional methods of authentication are used
only if the previous method returns an error, not if it fails.
Select one of these methods:
• line—Use the line password for authentication. You must define a
line password before you can use this authentication method. Use the
password password line configuration command.
• local—Use the local username database for authentication. You must
enter username information in the database. Use the username
password global configuration command.
• radius—Use RADIUS authentication. You must configure the
RADIUS server before you can use this authentication method. For
more information, see the “Identifying the RADIUS Server Host”
section on page 7-5.
Step 4 line [console | tty | vty] line-number Enter line configuration mode, and configure the lines to which you want
[ending-line-number] to apply the authentication list.
Step 5 login authentication {default | Apply the authentication list to a line or set of lines.
list-name}
• If you specify default, use the default list created with the aaa
authentication login command.
• For list-name, specify the list created with the aaa authentication
login command.
Step 6 radius-server attribute 32 Configure the access point to send its system name in the NAS_ID
include-in-access-req format %h attribute for authentication.
Step 7 end Return to privileged EXEC mode.
Step 8 show running-config Verify your entries.
Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file.
To disable AAA, use the no aaa new-model global configuration command. To disable AAA
authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global
configuration command. To either disable RADIUS authentication for logins or to return to the default
value, use the no login authentication {default | list-name} line configuration command.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 aaa new-model Enable AAA.
Command Purpose
Step 3 radius-server host {hostname | Specify the IP address or host name of the remote RADIUS server host.
ip-address} [auth-port port-number]
• (Optional) For auth-port port-number, specify the UDP destination
[acct-port port-number] [timeout
port for authentication requests.
seconds] [retransmit retries] [key
string] • (Optional) For acct-port port-number, specify the UDP destination
port for accounting requests.
• (Optional) For timeout seconds, specify the time interval that the
access point waits for the RADIUS server to reply before
retransmitting. The range is 1 to 1000. This setting overrides the
radius-server timeout global configuration command setting. If no
timeout is set with the radius-server host command, the setting of
the radius-server timeout command is used.
• (Optional) For retransmit retries, specify the number of times a
RADIUS request is resent to a server if that server is not responding
or responding slowly. The range is 1 to 1000. If no retransmit value is
set with the radius-server host command, the setting of the
radius-server retransmit global configuration command is used.
• (Optional) For key string, specify the authentication and encryption
key used between the access point and the RADIUS daemon running
on the RADIUS server.
Note The key is a text string that must match the encryption key used
on the RADIUS server. Always configure the key as the last item
in the radius-server host command. Leading spaces are ignored,
but spaces within and at the end of the key are used. If you use
spaces in your key, do not enclose the key in quotation marks
unless the quotation marks are part of the key.
To configure the access point to recognize more than one host entry
associated with a single IP address, enter this command as many times as
necessary, making sure that each UDP port number is different. The
access point software searches for hosts in the order in which you specify
them. Set the timeout, retransmit, and encryption key values to use with
the specific RADIUS host.
Step 4 aaa group server radius group-name Define the AAA server-group with a group name.
This command puts the access point in a server group configuration mode.
Step 5 server ip-address Associate a particular RADIUS server with the defined server group.
Repeat this step for each RADIUS server in the AAA server group.
Each server in the group must be previously defined in Step 2.
Step 6 end Return to privileged EXEC mode.
Step 7 show running-config Verify your entries.
Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.
Step 9 Enable RADIUS login authentication. See the “Configuring RADIUS
Login Authentication” section on page 7-7.
To remove the specified RADIUS server, use the no radius-server host hostname | ip-address global
configuration command. To remove a server group from the configuration list, use the no aaa group
server radius group-name global configuration command. To remove the IP address of a RADIUS
server, use the no server ip-address server group configuration command.
In this example, the access point is configured to recognize two different RADIUS group servers (group1
and group2). Group1 has two different host entries on the same RADIUS server configured for the same
services. The second host entry acts as a fail-over backup to the first entry.
router(config)# aaa new-model
router(config)# radius-server host 172.20.0.1 auth-port 1000 acct-port 1001
router(config)# radius-server host 172.10.0.1 auth-port 1645 acct-port 1646
router(config)# aaa group server radius group1
router(config-sg-radius)# server 172.20.0.1 auth-port 1000 acct-port 1001
router(config-sg-radius)# exit
router(config)# aaa group server radius group2
router(config-sg-radius)# server 172.20.0.1 auth-port 2000 acct-port 2001
router(config-sg-radius)# exit
Configuring RADIUS Authorization for User Privileged Access and Network Services
AAA authorization limits the services available to a user. When AAA authorization is enabled, the
access point uses information retrieved from the user’s profile, which is in the local user database or on
the security server, to configure the user’s session. The user is granted access to a requested service only
if the information in the user profile allows it.
Note This section describes setting up authorization for access point administrators, not for wireless client
devices.
You can use the aaa authorization global configuration command with the radius keyword to set
parameters that restrict a user’s network access to privileged EXEC mode.
The aaa authorization exec radius local command sets these authorization parameters:
• Use RADIUS for privileged EXEC access authorization if authentication was performed by using
RADIUS.
• Use the local database if authentication was not performed by using RADIUS.
Note Authorization is bypassed for authenticated users who log in through the CLI even if authorization has
been configured.
Beginning in privileged EXEC mode, follow these steps to specify RADIUS authorization for privileged
EXEC access and network services:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 aaa authorization network radius Configure the access point for user RADIUS authorization for all
network-related service requests.
Step 3 aaa authorization exec radius Configure the access point for user RADIUS authorization to determine if
the user has privileged EXEC access.
The exec keyword might return user profile information (such as
autocommand information).
Step 4 end Return to privileged EXEC mode.
Step 5 show running-config Verify your entries.
Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.
To disable authorization, use the no aaa authorization {network | exec} method1 global configuration
command.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 aaa accounting network start-stop Enable RADIUS accounting for all network-related service requests.
radius
Step 3 ip radius source-interface bvi1 Configure the access point to send its BVI IP address in the
NAS_IP_ADDRESS attribute for accounting records.
Step 4 aaa accounting update periodic minutes Enter an accounting update interval in minutes.
Step 5 end Return to privileged EXEC mode.
Step 6 show running-config Verify your entries.
Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.
To disable accounting, use the no aaa accounting {network | exec} {start-stop} method1... global
configuration command.
To return to the default CSID format, use the no form of the dot11 aaa csid command, or enter
dot11 aaa csid default.
Note You can also use the aaa csid command to select the CSID format.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 radius-server key string Specify the shared secret text string used between the access point and all
RADIUS servers.
Note The key is a text string that must match the encryption key used on
the RADIUS server. Leading spaces are ignored, but spaces within
and at the end of the key are used. If you use spaces in your key, do
not enclose the key in quotation marks unless the quotation marks
are part of the key.
Step 3 radius-server retransmit retries Specify the number of times the access point sends each RADIUS request
to the server before giving up. The default is 3; the range 1 to 1000.
Step 4 radius-server timeout seconds Specify the number of seconds an access point waits for a reply to a
RADIUS request before resending the request. The default is 5 seconds; the
range is 1 to 1000.
Step 5 radius-server deadtime minutes Use this command to cause the Cisco IOS software to mark as “dead” any
RADIUS servers that fail to respond to authentication requests, thus
avoiding the wait for the request to time out before trying the next
configured server. A RADIUS server marked as dead is skipped by
additional requests for the duration of minutes that you specify, up to a
maximum of 1440 (24 hours).
Note If you set up more than one RADIUS server, you must configure the
RADIUS server deadtime for optimal performance.
Command Purpose
Step 6 radius-server attribute 32 Configure the access point to send its system name in the NAS_ID attribute
include-in-access-req format %h for authentication.
Step 7 end Return to privileged EXEC mode.
Step 8 show running-config Verify your settings.
Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file.
To return to the default setting for retransmit, timeout, and deadtime, use the no forms of these
commands.
Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and
value are an appropriate AV pair defined in the Cisco TACACS+ specification, and sep is = for
mandatory attributes and the asterisk (*) for optional attributes. This allows the full set of features
available for TACACS+ authorization to also be used for RADIUS.
For example, the following AV pair activates Cisco’s multiple named ip address pools feature during IP
authorization (during PPP’s IPCP address assignment):
cisco-avpair= ”ip:addr-pool=first“
The following example shows how to provide a user logging in from an access point with immediate
access to privileged EXEC commands:
cisco-avpair= ”shell:priv-lvl=15“
Other vendors have their own unique vendor IDs, options, and associated VSAs. For more information
about vendor IDs and VSAs, refer to RFC 2138, “Remote Authentication Dial-In User Service
(RADIUS).”
Beginning in privileged EXEC mode, follow these steps to configure the access point to recognize and
use VSAs:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 radius-server vsa send [accounting | Enable the access point to recognize and use VSAs as defined by RADIUS
authentication] IETF attribute 26.
• (Optional) Use the accounting keyword to limit the set of recognized
vendor-specific attributes to only accounting attributes.
• (Optional) Use the authentication keyword to limit the set of
recognized vendor-specific attributes to only authentication attributes.
If you enter this command without keywords, both accounting and
authentication vendor-specific attributes are used.
Step 3 end Return to privileged EXEC mode.
Step 4 show running-config Verify your settings.
Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.
For a complete list of RADIUS attributes or more information about VSA 26, refer to the “RADIUS
Attributes” appendix in the Cisco IOS Security Configuration Guide for Release 12.2.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 radius-server host {hostname | ip-address} non-standard Specify the IP address or host name of the remote
RADIUS server host and identify that it is using a
vendor-proprietary implementation of RADIUS.
Command Purpose
Step 3 radius-server key string Specify the shared secret text string used between the
access point and the vendor-proprietary RADIUS
server. The access point and the RADIUS server use
this text string to encrypt passwords and exchange
responses.
Note The key is a text string that must match the
encryption key used on the RADIUS server.
Leading spaces are ignored, but spaces within
and at the end of the key are used. If you use
spaces in your key, do not enclose the key in
quotation marks unless the quotation marks
are part of the key.
Step 4 end Return to privileged EXEC mode.
Step 5 show running-config Verify your settings.
Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.
To delete the vendor-proprietary RADIUS host, use the no radius-server host {hostname | ip-address}
non-standard global configuration command. To disable the key, use the no radius-server key global
configuration command.
This example shows how to specify a vendor-proprietary RADIUS host and to use a secret key of rad124
between the access point and the server:
router(config)# radius-server host 172.20.30.15 nonstandard
router(config)# radius-server key rad124
Beginning in privileged EXEC mode, follow these steps to specify WISPr RADIUS attributes on the
access point:
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 snmp-server location location Specify the WISPr location-name attribute. The
WISPr Best Current Practices for Wireless Internet
Service Provider (WISP) Roaming document
recommends that you enter the location name in this
format:
hotspot_operator_name,location
Step 3 dot11 location isocc ISO-country-code cc country-code Specify ISO and ITU country and area codes that the
ac area-code access point includes in accounting and
authentication requests.
• isocc ISO-country-code—specifies the ISO
country code that the access point includes in
RADIUS authentication and accounting requests
• cc country-code—specifies the ITU country code
that the access point includes in RADIUS
authentication and accounting requests
• ac area-code—specifies the ITU area code that
the access point includes in RADIUS
authentication and accounting requests
Step 4 end Return to privileged EXEC mode.
Step 5 show running-config Verify your settings.
Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.
This example shows how to configure the ISO and ITU location codes on the access point:
router# dot11 location isocc us cc 1 ac 408
This example shows how the access point adds the SSID used by the client device and formats the
location-ID string:
isocc=us,cc=1,ac=408,network=ACMEWISP_NewarkAirport
Note When DNS is configured on the access point, the show running-config command sometimes displays a
server’s IP address instead of its name.
Note You can configure the access point to include in its RADIUS accounting and authentication requests
attributes recommended by the Wi-Fi Alliance’s WISPr Best Current Practices for Wireless Internet
Service Provider (WISP) Roaming document. Refer to the “Configuring WISPr RADIUS Attributes”
section on page 7-16 for instructions.
Attribute ID Description
1 User-Name
4 NAS-IP-Address
5 NAS-Port
12 Framed-MTU
30 Called-Station-ID (MAC address)
31 Calling-Station-ID (MAC address)
32 NAS-Identifier1
61 NAS-Port-Type
79 EAP-Message
80 Message-Authenticator
1. The access point sends the NAS-Identifier if attribute 32 (include-in-access-req) is configured.
Attribute ID Description
25 Class
27 Session-Timeout
64 Tunnel-Type1
65 Tunnel-Medium-Type1
79 EAP-Message
80 Message-Authenticator
81 Tunnel-Private-Group-ID1
VSA (attribute 26) LEAP session-key
VSA (attribute 26) Auth-Algo-Type
VSA (attribute 26) SSID
1. RFC2868; defines a VLAN override number.
Attribute ID Description
1 User-Name
4 NAS-IP-Address
5 NAS-Port
6 Service-Type
25 Class
41 Acct-Delay-Time
44 Acct-Session-Id
61 NAS-Port-Type
VSA (attribute 26) SSID
VSA (attribute 26) NAS-Location
VSA (attribute 26) Cisco-NAS-Port
VSA (attribute 26) Interface
Attribute ID Description
1 User-Name
4 NAS-IP-Address
5 NAS-Port
6 Service-Type
25 Class
41 Acct-Delay-Time
42 Acct-Input-Octets
43 Acct-Output-Octets
44 Acct-Session-Id
46 Acct-Session-Time
47 Acct-Input-Packets
48 Acct-Output-Packets
61 NAS-Port-Type
VSA (attribute 26) SSID
VSA (attribute 26) NAS-Location
VSA (attribute 26) VLAN-ID
VSA (attribute 26) Connect-Progress
VSA (attribute 26) Cisco-NAS-Port
VSA (attribute 26) Interface
Attribute ID Description
1 User-Name
4 NAS-IP-Address
5 NAS-Port
6 Service-Type
25 Class
41 Acct-Delay-Time
42 Acct-Input-Octets
43 Acct-Output-Octets
44 Acct-Session-Id
46 Acct-Session-Time
47 Acct-Input-Packets
48 Acct-Output-Packets
49 Acct-Terminate-Cause
61 NAS-Port-Type
VSA (attribute 26) SSID
VSA (attribute 26) NAS-Location
VSA (attribute 26) Disc-Cause-Ext
VSA (attribute 26) VLAN-ID
VSA (attribute 26) Connect-Progress
VSA (attribute 26) Cisco-NAS-Port
VSA (attribute 26) Interface
VSA (attribute 26) Auth-Algo-Type
Note By default, the access point sends reauthentication requests to the authentication server with the
service-type attribute set to authenticate-only. However, some Microsoft IAS servers do not support the
authenticate-only service-type attribute. Changing the service-type attribute to login-only ensures that
Microsoft IAS servers recognize reauthentication requests from the access point. Use the dot11 aaa
authentication attributes service-type login-only global configuration command to set the
service-type attribute in reauthentication requests to login-only.
This chapter describes how to configure your access point to operate with the VLANs set up on your
wired LAN. These sections describe how to configure your access point to support VLANs:
• Understanding VLANs, page 8-2
• Configuring VLANs, page 8-4
• VLAN Configuration Example, page 8-9
Understanding VLANs
A VLAN is a switched network that is logically segmented, by functions, project teams, or applications
rather than on a physical or geographical basis. For example, all workstations and servers used by a
particular workgroup team can be connected to the same VLAN, regardless of their physical connections
to the network or the fact that they might be intermingled with other teams. You use VLANs to
reconfigure the network through software rather than physically unplugging and moving devices or
wires.
A VLAN can be thought of as a broadcast domain that exists within a defined set of switches. A VLAN
consists of a number of end systems, either hosts or network equipment (such as bridges and routers),
connected by a single bridging domain. The bridging domain is supported on various pieces of network
equipment such as LAN switches that operate bridging protocols between them with a separate group
for each VLAN.
VLANs provide the segmentation services traditionally provided by routers in LAN configurations.
VLANs address scalability, security, and network management. You should consider several key issues
when designing and building switched LAN networks:
• LAN segmentation
• Security
• Broadcast control
• Performance
• Network management
• Communication between VLANs
You extend VLANs into a wireless LAN by adding IEEE 802.11Q tag awareness to the access point.
Frames destined for different VLANs are transmitted by the access point wirelessly on different SSIDs
with different WEP keys. Only the clients associated with that VLAN receive those packets. Conversely,
packets coming from a client associated with a certain VLAN are 802.11Q tagged before they are
forwarded onto the wired network.
Figure 8-1 shows the difference between traditional physical LAN segmentation and logical VLAN
segmentation with wireless devices connected.
Related Documents
These documents provide more detailed information pertaining to VLAN design and configuration:
• Cisco IOS Switching Services Configuration Guide. Click this link to browse to this document:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fswtch_c/index.htm
• Cisco Internetwork Design Guide. Click this link to browse to this document:
http://www.cisco.com/univercd/cc/td/doc/cisintwk/idg4/index.htm
• Cisco Internetworking Technology Handbook. Click this link to browse to this document:
http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/index.htm
• Cisco Internetworking Troubleshooting Guide. Click this link to browse to this document:
http://www.cisco.com/univercd/cc/td/doc/cisintwk/itg_v1/index.htm
Note You cannot configure multiple VLANs on repeater access points. Repeater access points support only
the native VLAN.
Configuring VLANs
These sections describe how to configure VLANs on your access point:
• Configuring a VLAN, page 8-5
• Assigning Names to VLANs, page 8-7
• Using a RADIUS Server to Assign Users to VLANs, page 8-7
• Viewing VLANs Configured on the Access Point, page 8-8
Configuring a VLAN
Note When you configure VLANs on access points, the Native VLAN must be VLAN1. In a single
architecture, client traffic received by the access point is tunneled through an IP-GRE tunnel, which is
established on the access point’s Ethernet interface native VLAN. Because of the IP-GRE tunnel, some
users may confgure another switch port as VLAN1. This misconfiguration causes errors on the switch
port.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 interface dot11radio 0 | 1 Enter interface configuration mode for the radio interface.
Step 3 ssid ssid-string Create an SSID and enter SSID configuration mode for the new
SSID. The SSID can consist of up to 32 alphanumeric
characters. SSIDs are case sensitive.
Note You use the ssid command’s authentication options to
configure an authentication type for each SSID. See
Chapter 6, “Configuring Authentication Types,” for
instructions on configuring authentication types.
Step 4 vlan vlan-id (Optional) Assign the SSID to a VLAN on your network. Client
devices that associate using the SSID are grouped into this
VLAN. Enter a VLAN ID from 1 to 4095. You can assign only
one SSID to a VLAN.
Tip If your network uses VLAN names, you can also assign
names to the VLANs on your access point. See the
“Assigning Names to VLANs” section on page 8-7 for
instructions.
Step 5 exit Return to interface configuration mode for the radio interface.
Step 6 interface dot11radio 0.x | 1.x Enter interface configuration mode for the radio VLAN sub
interface.
Command Purpose
Step 7 encapsulation dot1q vlan-id Enable a VLAN on the radio interface.
[native]
(Optional) Designate the VLAN as the native VLAN. On many
networks, the native VLAN is VLAN 1.
Step 8 exit Return to global configuration mode.
Step 9 interface fastEthernet0.x Enter interface configuration mode for the Ethernet VLAN
subinterface.
Step 10 encapsulation dot1q vlan-id Enable a VLAN on the Ethernet interface.
[native]
(Optional) Designate the VLAN as the native VLAN. On many
networks, the native VLAN is VLAN 1.
Step 11 end Return to privileged EXEC mode.
Step 12 copy running-config startup-config (Optional) Save your entries in the configuration file.
Note If clients on your wireless LAN require seamless roaming, Cisco recommends that you assign
the same VLAN name to the same VLAN ID across all access points, or that you use only VLAN
IDs without names.
• Every VLAN configured on your access point must have an ID, but VLAN names are optional.
• VLAN names can contain up to 32 ASCII characters. However, a VLAN name cannot be a number
between 1 and 4095. For example, vlan4095 is a valid VLAN name, but 4095 is not. The access point
reserves the numbers 1 through 4095 for VLAN IDs.
Command Purpose
Step 1 configure terminal Enter global configuration mode.
Step 2 dot11 vlan-name name vlan vlan-id Assign a VLAN name to a VLAN ID. The name can contain up
to 32 ASCII characters.
Step 3 end Return to privileged EXEC mode.
Step 4 copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of the command to remove the name from the VLAN. Use the show dot11 vlan-name
privileged EXEC command to list all the VLAN name and ID pairs configured on the access point.
Note Unicast and multicast cipher suites advertised in WPA information element (and negotiated during
802.11 association) may potentially mismatch with the cipher suite supported in an explicitly assigned
VLAN. If the RADIUS server assigns a new vlan ID which uses a different cipher suite from the
previously negotiated cipher suite, there is no way for the access point and client to switch back to the
new cipher suite. Currently, the WPA protocol does not allow the cipher suite to be changed after the
initial 802.11 cipher negotiation phase. In this scenario, the client device is disassociated from the
wireless LAN.
Managers configure their wireless client adapters to use SSID boss, faculty members configure their
clients to use SSID teach, and students configure their wireless client adapters to use SSID learn. When
these clients associate to the access point, they automatically belong to the correct VLAN.
You would complete these steps to support the VLANs in this example:
1. Configure or confirm the configuration of these VLANs on one of the switches on your LAN.
2. On the access point, assign an SSID to each VLAN.
3. Assign authentication types to each SSID.
4. Configure VLAN 1, the Management VLAN, on both the fastEthernet and dot11radio interfaces on
the access point. You should make this VLAN the native VLAN.
5. Configure VLANs 2 and 3 on both the fastEthernet and dot11radio interfaces on the access point.
6. Configure the client devices.
Table 8-2 shows the commands needed to configure the three VLANs in this example.
Table 8-3 shows the results of the configuration commands in Table 8-2. Use the show running
command to display the running configuration on the access point.
Notice that when you configure a bridge group on the radio interface, these commands are set
automatically:
bridge-group 2 subscriber-loop-control
bridge-group 2 block-unknown-source
no bridge-group 2 source-learning
no bridge-group 2 unicast-flooding
bridge-group 2 spanning-disabled
When you configure a bridge group on the FastEthernet interface, these commands are set automatically:
no bridge-group 2 source-learning
bridge-group 2 spanning-disabled
This chapter describes how to configure quality of service (QoS) on your access point. With this feature,
you can provide preferential treatment to certain traffic at the expense of others. Without QoS, the access
point offers best-effort service to each packet, regardless of the packet contents or size. It sends the
packets without any assurance of reliability, delay bounds, or throughput.
This chapter consists of these sections:
• Understanding QoS for Wireless LANs, page 9-2
• Configuring QoS, page 9-4
Note When you enable QoS, the access point uses Wi-Fi Multimedia (WMM) mode by default. See the “Using
Wi-Fi Multimedia Mode” section on page 9-4 for information on WMM.
QoS on the wireless LAN focuses on downstream prioritization from the access point. Figure 9-1 shows
the upstream and downstream traffic flow.
• The radio downstream flow is traffic transmitted out the access point radio to a wireless client
device. This traffic is the main focus for QoS on a wireless LAN.
• The radio upstream flow is traffic transmitted out the wireless client device to the access point. QoS
for wireless LANs does not affect this traffic.
• The Ethernet downstream flow is traffic sent from a switch or a router to the Ethernet port on the
access point. If QoS is enabled on the switch or router, the switch or router might prioritize and
rate-limit traffic to the access point.
• The Ethernet upstream flow is traffic sent from the access point Ethernet port to a switch or router
on the wired LAN. The access point does not prioritize traffic that it sends to the wired LAN based
on traffic classification.
Note Even if you have not configured a QoS policy, the access point always honors tagged 802.1P
packets that it receives over the radio interface.
2. QoS Element for Wireless Phones setting—If you enable the QoS Element for Wireless Phones
setting, dynamic voice classifiers are created for some of the wireless phone vendor clients, which
allows the wireless phone traffic to be a higher priority than other clients’ traffic. Additionally, the
QoS Basic Service Set (QBSS) is enabled to advertise channel load information in the beacon and
probe response frames. Some IP phones use QBSS elements to determine which access point to
associate to, based on the traffic load.
You can use the Cisco IOS command dot11 phone dot11e command to enable the future upgrade
of the 7920 Wireless Phone firmware to support the standard QBSS Load IE. The new 7920 Wireless
Phone firmware will be announced at a later date.
Note This release continues to support existing 7920 wireless phone firmware. Do not attempt to use
the new standard (IEEE 802.11e draft 13) QBSS Load IE with the 7920 Wireless Phone until
new phone firmware is available for you to upgrade your phones.
This example shows how to enable IEEE 802.11 phone support with the legacy QBSS Load
element:
AP(config)# dot11 phone
This example shows how to enable IEEE 802.11 phone support with the standard (IEEE 802.11e
draft 13) QBSS Load element:
AP(config)# no dot11 phone dot11e
This example shows how to stop or disable the IEEE 802.11 phone support:
AP(config)# no dot11 phone
3. Policies you create on the access point—QoS Policies that you create and apply to VLANs or to the
access point interfaces are third in precedence after previously classified packets and the QoS
Element for Wireless Phones setting.
4. Default classification for all packets on VLAN—If you set a default classification for all packets on
a VLAN, that policy is fourth in the precedence list.
Configuring QoS
QoS is disabled by default (however, the radio interface always honors tagged 802.1P packets even when
you have not configured a QoS policy). This section describes how to configure QoS on your access
point. It contains this configuration information:
• Configuration Guidelines, page 9-5
• Adjusting Radio Access Categories, page 9-5
• Disabling IGMP Snooping Helper, page 9-6
Configuration Guidelines
Before configuring QoS on your access point, you should be aware of this information:
• The most important guideline in QoS deployment is to be familiar with the traffic on your wireless
LAN. If you know the applications used by wireless client devices, the applications’ sensitivity to
delay, and the amount of traffic associated with the applications, you can configure QoS to improve
performance.
• QoS does not create additional bandwidth for your wireless LAN; it helps control the allocation of
bandwidth. If you have plenty of bandwidth on your wireless LAN, you might not need to configure
QoS.
Class of Service Min Contention Window Max Contention Window Fixed Slot Time Transmit Opportunity
Background 4 10 7 0
Best Effort 4 10 3 0
Video <100ms Latency 3 4 2 3008
Voice <100ms Latency 2 3 2 1504
Note In this release, clients are blocked from using an access category when you select Enable for Admission
Control.
Using the Admission Control check boxes, you can control client use of the access categories. When you
enable admission control for an access category, clients associated to the access point must complete the
WMM admission control procedure before they can use that access category. However, access points do
not support the admission control procedure in this release, so clients cannot use the access category
when you enable Admission Control.
This appendix lists the radio channels supported by Cisco access products in the regulatory domains of
the world.
Regulatory Domains
Channel Center Frequency Americas EMEA Japan
Identifier (MHz) (–A) (–E) (–J)
1 2412 X X X
2 2417 X X X
3 2422 X X X
4 2427 X X X
5 2432 X X X
6 2437 X X X
7 2442 X X X
8 2447 X X X
9 2452 X X X
10 2457 X X X
11 2462 X X X
12 2467 – X X
13 2472 – X X
14 2484 – - -
Note Mexico is included in the Americas ( –A) regulatory domain; however, channels 1 through 8 are for
indoor use only while channels 9 through 11 can be used indoors and outdoors. Users are responsible for
ensuring that the channel set configuration is in compliance with the regulatory standards of Mexico.
Regulatory Domains
Center
Channel Frequency Americas (–A) EMEA (–E) Japan (–J)
Identifier (MHz) CCK OFDM CCK OFDM CCK OFDM
1 2412 X X X X X X
2 2417 X X X X X X
3 2422 X X X X X X
4 2427 X X X X X X
5 2432 X X X X X X
6 2437 X X X X X X
7 2442 X X X X X X
8 2447 X X X X X X
9 2452 X X X X X X
10 2457 X X X X X X
11 2462 X X X X X X
12 2467 – – X X X X
13 2472 – – X X X X
14 2484 – – – – – –
Note All channel sets are restricted to indoor usage except the Americas (–A), which allows for indoor and
outdoor use on channels 52 through 64 in the United States.
The tables in this appendix list some of the protocols that you can filter on the access point. The tables
include:
• Table A-1, Ethertype Protocols
• Table A-2, IP Protocols
• Table A-3, IP Port Protocols
In each table, the Protocol column lists the protocol name, the Additional Identifier column lists other
names for the same protocol, and the ISO Designator column lists the numeric designator for each
protocol.
This appendix lists the Simple Network Management Protocol (SNMP) Management Information Bases
(MIBs) that the access point supports for this software release. The Cisco IOS SNMP agent supports both
SNMPv1 and SNMPv2. This appendix contains these sections:
• MIB List, page C-1
• Using FTP to Access the MIB Files, page C-2
MIB List
• IEEE802dot11-MIB
• Q-BRIDGE-MIB
• P-BRIDGE-MIB
• CISCO-DOT11-IF-MIB
• CISCO-WLAN-VLAN-MIB
• CISCO-IETF-DOT11-QOS-MIB
• CISCO-IETF-DOT11-QOS-EXT-MIB
• CISCO-DOT11-ASSOCIATION-MIB
• CISCO-DOT11-QOS-MIB
• CISCO-DOT11-SSID-SECURITY-MIB
• CISCO-L2-DEV-MONITORING-MIB
• CISCO-IP-PROTOCOL-FILTER-MIB
• CISCO-SYSLOG-EVENT-EXT-MIB
• CISCO-TBRIDGE-DEV-IF-MIB
• BRIDGE-MIB
• CISCO-CDP-MIB
• CISCO-CONFIG-COPY-MIB
• CISCO-CONFIG-MAN-MIB
• CISCO-FLASH-MIB
• CISCO-IMAGE-MIB
• CISCO-MEMORY-POOL-MIB
• CISCO-PROCESS-MIB
• CISCO-PRODUCTS-MIB
• CISCO-SMI-MIB
• CISCO-TC-MIB
• CISCO-SYSLOG-MIB
• ENTITY-MIB
• IF-MIB
• OLD-CISCO-CHASSIS-MIB
• OLD-CISCO-SYS-MIB
• OLD-CISCO-SYSTEM-MIB
• OLD-CISCO-TS-MIB
• RFC1213-MIB
• RFC1398-MIB
• SNMPv2-MIB
• SNMPv2-SMI
• SNMPv2-TC
Note You can also access information about MIBs on the Cisco web site:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
FACILITY is a code consisting of two or more uppercase letters that indicate the facility to which the
message refers. A facility can be a hardware device, a protocol, or a module of the system software. You
can see a complete list of mainline facility codes for Cisco IOS Release 12.3 on Cisco.com. Go to this
URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123sup/123sems/123semv1/emgove
r1.htm
SEVERITY is a single-digit code from 0 to 7 that reflects the severity of the condition. The lower the
number, the more serious the situation. Table D-1 lists the severity levels.
Level Description
0 – emergency System unusable
1 – alert Immediate action needed
2 – critical Critical condition
3 – error Error condition
4 – warning Warning condition
5 – notification Normal but significant condition
6 – informational Informational message only
7 – debugging Appears during debugging only
Explanation 802.11 Association and management uses a table-driven state machine to keep track and
transition an Association through various states. A state transition occurs when an Association
receives one of many possible events. When this error occurs, it means that an Association received
an event that it did not expect while in this state.
Recommended Action The system can continue but may lose the Association that generates this error.
Copy the message exactly as it appears and report it to your technical service representative.
Explanation The indicated station roamed to the indicated new access point.
Explanation The encryption setting of the indicated interface and indicated station may be
mismatched.
Recommended Action Check the encryption configuration of this interface and the failing station to
ensure that the configurations match.
Explanation When scanning for an unused frequency, the unit recognized another radio using the
displayed frequency.
Explanation After scanning for an unused frequency, the unit selected the displayed frequency.
Explanation No infrastructure SSID was configured and the indicated interface was not started.
Recommended Action Add at least one infrastructure SSID to the radio configuration.
Explanation When starting the indicated interface, the access point found the wrong firmware
version. The radio will be loaded with the required version.
Explanation When trying to re-flash the radio firmware on the indicated interface, the access point
recognized that the indicated radio firmware packaged with the Cisco IOS software had the incorrect
version.
Explanation The radio’s internal temperature exceeds maximum limits on the indicated radio
interface.
Recommended Action Take steps necessary to reduce the internal temperature. These steps will vary
based on your specific installation.
Explanation The radio’s internal temperature has returned to normal limits on the indicated radio
interface.
Explanation The transmitter power level is outside the normal range on the indicated radio interface.
Explanation The radio phase lock loop (PLL) circuit is unable to lock the correct frequency on the
indicated interface.
Explanation The radio intermediate frequency (IF) PLL is unable to lock the correct frequency on
the indicated interface.
Explanation Starting a scan for a least congested frequency on the interface indicated for a the time
period indicated.
Explanation No frequency is available, likely because RADAR has been detected within the previous
30 minutes.
Explanation The device has completed its Dynamic Frequency Scan (DFS) frequency scanning
process on the displayed frequency.
Recommended Action None. The channel will be placed on the non-occupancy list for 30 minutes and
a new channel will be selected.
Error Message DOT11-4-DFS_STORE_FAIL: DFS: could not store the frequency statistics
Explanation All SSIDs were deleted from the configuration. At least one must be configured for the
radio to run.
Explanation No SSID was configured for a VLAN. The indicated interface was not started.
Recommended Action At least one SSID must be configured per VLAN. Add at least one SSID for
the VLAN on the indicated interface.
Explanation No VLAN configured in MBSSID mode. The indicated interface was not started.
Recommended Action Add at least one SSID with the VLAN on the indicated interface configuration.
Explanation Not more than one SSID can have shared authentication method when MBSSID is not
enabled.
Recommended Action Remove SSID from Dot22Radio radio interface or change authentication mode
for SSIC to open configuration.
Explanation The network filesystem was not running or not ready when trying to flash new firmware
into the indicated interface. Loading the identified firmware file has been delayed.
Recommended Action Make sure the network is up and ready before attempting to reflash the new
firmware.
Explanation The radio type could not be determined when the user attempted to flash new firmware
into the indicated interface.
Recommended Action Reboot the system and see if the firmware upgrade completes.
Explanation The indicated repeater has associated to the indicated root access point. Clients can now
associate to the indicated repeater and traffic can pass.
Explanation The connection to the parent access point failed for the displayed reason. The uplink
will stop its connection attempts.
Recommended Action Try resetting the uplink interface. Contact Technical Support if the problem
persists.
Explanation The indicated interface device could not associate to an indicated parent access point.
Recommended Action Check the configuration of the parent access point and this unit to make sure
there is a match.
Explanation The initialization process used by the indicated interface failed for some reason,
possibly a transient error.
Recommended Action Perform a reload of the access point. If this fails to rectify the problem, perform
a power cycle. If this still fails, try downgrading the access point firmware to the previous version.
Explanation An unrecoverable error occurred that could not be resolved by a soft reset.
Error Message DOT11-4-MAXRETRIES: Packet to client [chars] [mac] reached max retries
[int], remove the client
Explanation A packet sent to the client has not been successfully delivered many times, and the max
retries limit has been reached. The client is deleted from the association table.
Recommended Action Force re authentication from the client to reassociate to the router.
Explanation Indicated interface does not support the radio management feature.
Explanation A radio management request discovered that the interface either does not exist or is not
a radio interface.
Recommended Action Investigate and correct the power source and settings.
Explanation The indicated frequency is invalid for operation. A channel scan is being performed to
select a valid frequency.
Explanation A critical error was detected while attempting to initialize the radio subsystem.
Recommended Action Enter the username and/or password and try again.
Explanation When attempting to apply a beacon or probe response to the radio, the beacon or probe
was undefined on the indicated SSID index.
Explanation The indicated interface radio has been stopped to load the indicated new firmware.
Explanation The indicated interface radio has been stopped to load new indicated firmware.
Explanation When trying to flash new firmware, the file for the radio was not found in the Flash file
system.
Recommended Action The wrong image has been loaded into the unit. Locate the correct image based
on the type of radio used.
Explanation When trying to Flash new firmware into the indicated interface the indicated radio
firmware file was found to be invalid.
Recommended Action Make sure the correct firmware image file is located in the place where the unit
expects to find it.
Explanation The radio driver found a severe error and is shutting down.
Recommended Action Shut/no shut the interface. If that fails, reboot router.
Explanation The indicated interface radio firmware flash is complete, and the radio will be restarted
with the new firmware.
Explanation The connection to the parent access point on the indicated interface was lost for the
reason indicated. The unit will try to find a new parent access point.
Explanation The unit could not establish a connection to a parent access point for the displayed
reason.
Recommended Action Verify that the basic configuration settings (SSID, WEP, and others) of the
parent access point and this unit match.
Explanation The indicated workgroup bridge reported the address of one of its indicated Ethernet
clients and the access point already had that address marked as being somewhere else on the
network.
Recommended Action Click Refresh on the Associations page on the access point GUI, or enter the
clear dot11 statistics command on the CLI.
Explanation The Indicated AIR-RM21A radio module does not support the high-gain position for the
external antenna (the high-gain position is folded flat against the access point). The access point
automatically disables the radio when the antenna is in the high-gain position.
Recommended Action Fold the antenna on the AIR-RM21A radio module so that it is oriented 90
degrees to the body of the access point.
Explanation Radio loopback test failed at a given frequency for the indicated interface.
Recommended Action Verify that the user entered the correct username and password, and verify that
the authentication server is online.
Explanation TKIP Michael MIC failure was detected from the indicated station on a unicast frame
decrypted locally with the indicated pairwise key.
Recommended Action A failure of the Michael MIC in a packet usually indicates an active attack on
your network. Search for and remove potential rogue devices from your wireless LAN.
Explanation The access point received an EAPOL-key from the indicated station notifying the access
point that TKIP Michael MIC failed on a packet transmitted by this access point.
Explanation Two TKIP Michael MIC failures were detected within the indicated time on the
indicated interface. Because this usually indicates an active attack on your network, the interface
will be put on hold for the indicated time. During this hold time, stations using TKIP ciphers are
disassociated and cannot reassociate until the hold time ends. At the end of the hold time, the
interface operates normally.
Recommended Action MIC failures usually indicate an active attack on your network. Search for and
remove potential rogue devices from your wireless LAN. If this is a false alarm and the interface
should not be on hold this long, use the countermeasure tkip hold-time command to adjust the hold
time.
Explanation No VLAN is configured for client devices attached to the workgroup bridge.
Recommended Action Configure a VLAN to accommodate client devices attached to the workgroup
bridge.
Explanation An internal error occurred on the indicated line number in the indicated filename in the
controller ASIC.
Explanation Received an 802.1Q VLAN tag which could not be parsed correctly. The received
packet was encapsulated or de encapsulated incorrectly.
Recommended Action
Explanation The local RADIUS server received an authentication request but does not recognize the
IP address of the network access server (NAS) that forwarded the request.
Recommended Action Make sure that every access point on your wireless LAN is configured as a
NAS on your local RADIUS server.
Explanation The local RADIUS server received an authentication request but the message signature
indicates that the shared key text does not match.
Recommended Action Correct the shared key configuration on either the NAS or on the local
RADIUS server.
Explanation A user failed authentication the number of times configured to trigger a block, and the
account been disabled.
Recommended Action Use the clear radius local-server user username privileged EXEC command
to unblock the user, or allow the block on the user to expire by the configured lockout time.
802.11 The IEEE standard that specifies carrier sense media access control and physical
layer specifications for 1- and 2-megabit-per-second (Mbps) wireless LANs
operating in the 2.4-GHz band.
802.11a The IEEE standard that specifies carrier sense media access control and physical
layer specifications for wireless LANs operating in the 5-GHz frequency band.
802.11b The IEEE standard that specifies carrier sense media access control and physical
layer specifications for 5.5- and 11-Mbps wireless LANs operating in the
2.4-GHz frequency band.
802.11g The IEEE standard that specifies carrier sense media across control and physical
layer specifications for 6, 9, 12, 18, 24, 36, 48, and 54 Mbps LANs operating in
the 2.4-GHz frequency band.
802.3af The IEEE standard that specifies a mechanism for Power over Ethernet (PoE).
The standard provides the capability to deliver both power and data over
standard Ethernet cabling.
A
access point A wireless LAN data transceiver that uses radio waves to connect a wired
network with wireless stations.
antenna gain The gain of an antenna is a measure of the antenna’s ability to direct or focus
radio energy over a region of space. High gain antennas have a more focused
radiation pattern in a specific direction.
B
backoff time The random length of time that a station waits before sending a packet on the
LAN. Backoff time is a multiple of slot time, so a decrease in slot time ultimately
decreases the backoff time, which increases throughput.
beacon A wireless LAN packet that signals the availability and presence of the wireless
device. Beacon packets are sent by access points and base stations; however,
client radio cards send beacons when operating in computer to computer (Ad
Hoc) mode.
BOOTP Boot Protocol. A protocol used for the static assignment of IP addresses to
devices on the network.
broadcast packet A single data message (packet) sent to all addresses on the same subnet.
C
CCK Complementary code keying. A modulation technique used by IEEE
802.11b-compliant wireless LANs for transmission at 5.5 and 11 Mbps.
cell The area of radio range or coverage in which the wireless devices can
communicate with the base station. The size of the cell depends upon the speed
of the transmission, the type of antenna used, and the physical environment, as
well as other factors.
client A radio device that uses the services of an Access Point to communicate
wirelessly with other devices on a local area network.
CSMA Carrier sense multiple access. A wireless LAN media access method specified
by the IEEE 802.11 specification.
D
data rates The range of data transmission rates supported by a device. Data rates are
measured in megabits per second (Mbps).
DHCP Dynamic host configuration protocol. A protocol available with many operating
systems that automatically issues IP addresses within a specified range to
devices on the network. The device retains the assigned address for a specific
administrator-defined period.
dipole A type of low-gain (2.2-dBi) antenna consisting of two (often internal) elements.
domain name The text name that refers to a grouping of networks or network resources based
on organization-type or geography; for example: name.com—commercial;
name.edu—educational; name.gov—government; ISPname.net—network
provider (such as an ISP); name.ar—Argentina; name.au—Australia; and so on.
DNS Domain Name System server. A server that translates text names into IP
addresses. The server maintains a database of host alphanumeric names and their
corresponding IP addresses.
DSSS Direct sequence spread spectrum. A type of spread spectrum radio transmission
that spreads its signal continuously over a wide frequency band.
E
EAP Extensible Authentication Protocol. An optional IEEE 802.1x security feature
ideal for organizations with a large user base and access to an EAP-enabled
Remote Authentication Dial-In User Service (RADIUS) server.
Ethernet The most widely used wired local area network. Ethernet uses carrier sense
multiple access (CSMA) to allow computers to share a network and operates at
10, 100, or 1000 Mbps, depending on the physical layer used.
F
file server A repository for files so that a local area network can share files, mail, and
programs.
G
gateway A device that connects two otherwise incompatible networks together.
GHz Gigahertz. One billion cycles per second. A unit of measure for frequency.
I
IEEE Institute of Electrical and Electronic Engineers. A professional society serving
electrical engineers through its publications, conferences, and standards
development activities. The body responsible for the Ethernet 802.3 and wireless
LAN 802.11 specifications.
IP subnet mask The number used to identify the IP subnetwork, indicating whether the IP
address can be recognized on the LAN or if it must be reached through a
gateway. This number is expressed in a form similar to an IP address; for
example: 255.255.255.0.
M
MAC Media Access Control address. A unique 48-bit number used in Ethernet data
packets to identify an Ethernet device, such as an access point or your client
adapter.
modulation Any of several techniques for combining user information with a transmitter’s
carrier signal.
multipath The echoes created as a radio signal bounces off of physical objects.
O
omni-directional This typically refers to a primarily circular antenna radiation pattern.
P
packet A basic message unit for communication across a network. A packet usually
includes routing information, data, and sometimes error detection information.
Q
Quadruple Phase A modulation technique used by IEEE 802.11b-compliant wireless LANs for
Shift Keying transmission at 2 Mbps.
R
range A linear measure of the distance that a transmitter can send a signal.
receiver sensitivity A measurement of the weakest signal a receiver can receive and still correctly
translate it into data.
roaming A feature of some Access Points that allows users to move through a facility
while maintaining an unbroken connection to the LAN.
RP-TNC Reverse Polarity Threaded Neill Concelman connector. Part 15.203 of the FCC
rules covering spread spectrum devices limits the types of antennas that may be
used with transmission equipment. In compliance with this rule, Cisco, like all
other wireless LAN providers, equips its radios and antennas with a unique
connector to prevent attachment of non-approved antennas to radios.
S
slot time The amount of time a device waits after a collision before retransmitting a
packet. Short slot times decrease the backoff time, which increases throughput.
spread spectrum A radio transmission technology that spreads the user information over a much
wider bandwidth than otherwise required in order to gain benefits such as
improved interference tolerance and unlicensed operation.
SSID Service Set Identifier (also referred to as Radio Network Name). A unique
identifier used to identify a radio network and which stations must use to be able
to communicate with each other or to an access point. The SSID can be any
alphanumeric entry up to a maximum of 32 characters.
T
transmit power The power level of radio transmission.
U
UNII Unlicensed National Information Infrastructure—regulations for UNII devices
operating in the 5.15 to 5.35 GHz and 5.725 to 5.825 GHz frequency bands.
UNII-1 Regulations for UNII devices operating in the 5.15 to 5.25 GHz frequency band.
UNII-2 Regulations for UNII devices operating in the 5.25 to 5.35 GHz frequency band.
UNII-3 Regulations for UNII devices operating in the 5.725 to 5.825 GHz frequency
band.
W
WEP Wired Equivalent Privacy. An optional security mechanism defined within the
802.11 standard designed to make the link integrity of wireless devices equal to
that of a cable.
EAP 4, 3
Numerics
authentication types
802.11d 20 Network-EAP 4
802.11e 2 open 2
802.11g 28 shared key 3
802.1H 23 authenticator 1
802.1x authentication 2 authorization
with RADIUS 11
encryption command 4
J
error and event messages 1
how to read 1 jitter 2
guest-mode command 4
guest SSID 2
M
quality of service
N
See QoS
names, VLAN 7
Network-EAP 4
R
radio
O
activity 29
OFDM 13 congestion 14
Orthogonal Frequency Division Multiplexing (OFDM) interface 2
See OFDM preamble 21
RADIUS
P attributes
CSID format, selecting 13
packet retries command 27 sent by the access point 18
packet size (fragment) 28 vendor-proprietary 15
payload-encapsulation command 24 vendor-specific 14
PEAP authentication WISPr 16
setting on client and access point 18 configuring
ports, protected 26 access point as local server 2
power client command 14 accounting 12
power level authentication 7
on client devices 13 authorization 11
radio 23 communication, global 5, 13
power-save client device 26 communication, per-server 5
preferential treatment of traffic multiple UDP ports 5
See QoS default configuration 4
pre-shared key 13 defining AAA server groups 9
prioritization 2 displaying the configuration 17
protected ports 26 identifying the server 5
Public Secure Packet Forwarding (PSPF) 25 limiting the services to the user 11
local authentication 2
S VLAN
local authentication 2
security features 4
names 7
synchronizing 16
SSID 4, 2
service set identifiers (SSIDs)
vlan command 4, 5
See SSID
service-type attribute 2
shared key 6 W
short slot time 28
WEP
show dot11 associations command 5
key example 5
slot-time-short command 28
key hashing 4
SNMP, FTP MIB files 2
with EAP 4
snooping helper, IGMP 6
Wi-Fi Multimedia 4
spaces in an SSID 5
Wi-Fi Protected Access
speed command 11
See WPA
SSID 2
Wi-Fi Protected Access (WPA) 4
guest mode 2
WISPr RADIUS attributes 16
multiple SSIDs 1
WMM 4
support 3
workgroup bridge 24
using spaces in 5
world mode 3, 20, 23
VLAN 2
world-mode command 21
WPA 6
WPA migration mode 12
wpa-psk command 13