Home

User Guide PDF

1. IPv6 DNS 1 The primary and secondary DNS servers to use for IPv6 DNS 2 name to IPv6 address resolution Default IPv6 The default gateway for the IPv6 network interface Gateway To change the wired settings click the Edit link After you click Edit you are redirected to the VLAN and IPv4 Address page For information about configuring these settings see VLAN and IPv4 Address on page 29 Wireless Status The wireless settings show summary information about the radio interface configuration Table 5 describes the fields and configuration options available on the Wireless Status page Table 5 Wireless Status Field Description S AeroScout The status of the AeroScout protocol on the AP When Engine enabled AeroScout devices are recognized and data Communications is sent to an AeroScout Engine AE for analysis The AE Status determines the geographical location of 802 11 capable devices such as STAs APs and AeroScout s line of 802 11 enabled RFID devices or tags The AE communicates with APs that support the AE protocol in order to collect information about the RF devices detected by the APs Radio One and Radio Two MAC Address The MAC addresses for the interface This page shows the MAC addresses for Radio Interface One and Radio Interface Two AMAC address is a permanent unique hardware address for any device that represents an interface to the network The MAC address is assigned by t
2. Destination MAC Select this field and enter the destination MAC Address address to compare against an Ethernet frame Section 3 Configuring the Access Point Destination MAC Enter the destination MAC address mask specifying Mask which bits in the destination MAC to compare against an Ethernet frame A 0 indicates that the address bit is significant and an f indicates that the address bit is to be ignored A MAC mask of 00 00 00 00 00 00 matches a single MAC address VLAN ID Select this field and enter the VLAN IDs to compare against an Ethernet frame This field is located in the first only 802 1Q VLAN tag After you set the desired rule criteria click Save To delete an ACL select the Delete ACL option and click Save Class Map The Client QoS feature contains Differentiated Services DiffServ support that allows traffic to be classified into streams and given certain QoS treatment in accordance with defined per hop behaviors Standard IP based networks are designed to provide best effort data delivery service Best effort service implies that the network delivers the data in a timely fashion although there is no guarantee that it will During times of congestion packets may be delayed sent sporadically or dropped For typical Internet applications such as e mail and file transfer a slight degradation in service is acceptable and in many cases unnoticeable However on applications with strict timing requirements suc
3. Select this field to include a source port in the match condition for the rule The source port is identified in the datagram header Once you select the field choose the port name or enter the port number Select From List Select the keyword associated with the source port to match ftp ftpdata http smtp snmp telnet tftp WWW Each of these keywords translates into its equivalent port number Match to Port Enter the IANA port number to match to the source port identified in the datagram header The port range is 0 65535 and includes three different types of ports e 0 1023 Well Known Ports e 1024 49151 Registered Ports e 49152 65535 Dynamic and or Private Ports Select this field to require a packet s destination IP address to match the address listed here Enter an IP address in the appropriate field to apply this criterion Destination Port IP TOS Bits Section 3 Configuring the Access Point Select this field to include a destination port in the match condition for the rule The destination port is identified in the datagram header Once you select the field choose the port name or enter the port number Select From List Select the keyword associated with the destination port to match ftp ftpdata http smtp snmp telnet tftp bd WWW Each of these keywords translates into its equivalent port number Match to Port Enter the IANA port number to match to the destination port identifie
4. Stele f is fiel Some potis to keap immuna withiregard tatis Naldare Bytes The number of bytes sent from the AP to the wireless e If the AP security mode is None or Static WEP the client authentication and association status of clients showing on the Client Associations tab will be in Drop Packets The number of packets that the AP attempted to send to line with what is expected that is if a client shows the wireless client but were dropped 7 autienticated to the AF imail oe anle toitransmit Drop Bytes The number of bytes that the AP attempted to send to and receive data This is because Static WEP uses ihe wireless cient but were drobbed only IEEE 802 11 authentication PRSS If the AP uses IEEE 802 1X or WPA security however TS Violate The number of packets sent from the AP to a wireless it is possible for a client association to show on this Packets client in excess of its active TS downlink bandwidth or tab as authenticated via the IEEE 802 11 security for an access category requiring admission control to but actually not be authenticated to the AP via the which the wireless client has not been admitted second layer of security From Station These fields report information about traffic sent from a wireless client to Link Integ rity Monitoring the ne The access point provides link integrity monitoring to continually verify its Packets The number of packets received from the wireless client connection to each associa
5. HTTP Port 80 Range 1025 65535 Default 80 HTTP Redirect to HTTPS Enabled Disabled HTTPS Server Status Enabled Disabled HTTPS Port 443 Range 1025 65535 Default 443 Maximum Sessions 5 Range 1 10 Default 5 Session Timeout minutes 10 Range 1 1440 minutes Default 10 Generate SSL Certificate SSL Certificate File Status Certificate File Present yes Certficate Expiration Date Dec 27 00 00 28 1989 GMT Certificate Issuer Common Name CN 192 168 1 252 To Get the Current SSL Certificate Click the Download button to save the current HTTP SSL Certificate as a backup file to your PC To save the Certificate to an external TFTP server click the TFTP radio button and enter the TFTP server information Download Method HTTPIHTTPS TFTP Download Upload SSL Certificate Browse to the location where your certificate file is stored and click the Generate button To upload from a TFTP server click the TFTP radio button and enter the TFTP server information Upload Method HTTPIHTTPS TFTP HTTP SSL Certificate File inii Table 21 HTTP HTTPS Service Ic in HTTP Server Status Enable or disable access through HTTP This setting is independent of the HTTPS server status setting HTTP Port Specify the port number for HTTP traffic default is 80 HTTP Redirect to HTTPS HTTPS Server Status HTTPS Port Maximum Sessions Session Timeout Redirecting all tr
6. Pv6 Add ress a VLAN ID i F i l The IPv6 Address page contains settings that allow the LAPAC1750PRO Access By default all traffic on the access point uses VLAN 1 which Point to be managed over an IPv6 network Use this page to configure the IPv6 is the default untagged VLAN This means that all traffic is management interface settings untagged until you disable the untagged VLAN change the untagged traffic VLAN ID or change the VLAN ID for a By default the DHCPv6 client on the access point automatically broadcasts 7 F requests for network information If you want to use a static IPv6 address you VAP or client using RADIUS i must disable the DHCPv6 client and manually configure the Static IPv6 address Untagged Provide a number between 1 and 4094 for the untagged and other network information VLAN ID VLAN ID Traffic on the VLAN that you specify in this field To configure the settings that allow system management over an IPv6 network will not be tagged with a VLAN ID click the Configuration gt LAN gt IPv6 Address tab Connection If you select DHCP the access point acquires its IP address Figure 23 IPv6 Address Type subnet mask DNS and gateway information from a DHCP IPv6 Address server IPv6 Connection Type DHCPv6 X If you select Static IP you must enter information in the IPv6 Admin Mode Enabled Disabled Static IP Address Subnet Mask and Default Gateway fields IPv6 Auto Config Admin Mode Enabled
7. Range 0 1440 Default 60 Session Timeout 0 Min Range 0 1440 Default 0 Max Bandwidth Upstream 0 Mbps Range 0 300 Default 0 Max Bandwidth Downstream 0 Mbps Range 0 300 Default 0 Locale Count 0 Delete this Instance a The following table describes the fields on the CP Instance Configuration page The fields that appear on the page depend on the option selected from the Captive Portal Instances menu 90 LAPAC1750PRO Access Point Software User Manual Table 56 Captive Portal Instance Configuration E ad Captive Portal Instances Instance Name Select an existing instance to view or configure its settings or select Create to configure a new CP instance The access point supports two instances If both instances have been configured you must delete an instance before you can create a new one This field is available only if Create is selected from the Captive Portal Instances field Specify a name for the new CP instance The CP instance identifier For an existing instance this field cannot be configured When creating a new CP instance the ID cannot be used by another CP instance If you attempt to assign an Instance ID that is in use an error message is displayed Admin Mode Select the option to enable the administrative mode of the selected CP instance or clear the option to disable it Protocol Specifies HTTP or HTTPs as the protocol for the CP instance to use during the ve
8. User Guide LAPAC1750PRO LAPAC1750PRO Access Point Software User Manual Table of Contents Table of Contents Section 1 Getting Started 0 eee eens 1 DECUMY Gadd ered dW Re eee eS RES Hae HERS S ae HS 63 Administrator s Computer Requirements 1 QosS and Access Control naan Kee oe ROR R Eee a eH 66 Wireless Client Requirements 00 00 eee eee 2 SINE sca d we ow ee Wo Get hw ON AS SH WAS OS 81 Online Help Supported Browsers and Limitations 2 Captive Portal viv actes 460 dX ne abe woe SAREE RES 88 Dynamic and Static IP Addressing onthe AP 3 CIUSUGR aaae ae a a w aE GOR aE Sk eR A Gem e428 101 Installing the Access Point se ad oe au oy ae ae ee ee 3 Section 4 Maintenance of the Access Point 110 Configuring the Ethernet Settings 0 0005 5 Maintenance cs 2 2 dda ware oo Sa WS eee Ho Ee d 110 Configuring IEEE 802 1X Authentication 6 DIdQNOSUCS ccs eee eee EE Ae eee eae eee 114 Configuring Security on the Wireless Access Point 6 Section 2 Viewing Access Point System Status 7 System SUNNY eae ea 0 446 2 ae ee ee ok oe eo wl 7 Network Interfaces 2 0 ke eee es 8 Radio Statistics a Saw as dae wa eed EUR WR kudura 10 Workgroup BIGGS 2 0 26 aed Cd 4406 646 dabe reas 13 Associated Client 2 0 ee ee eee 13 TSPEC Client Associations sc vacates a van ead ee ws 15 TSPEC Status and Statistics aaa aa
9. WAP EDCA Parameters Queues are defined for different types of data transmitted from AP to station e Data 0 Voice High priority queue minimum delay Time sensitive data such as VoIP and streaming media are automatically sent to this queue Data 1 Video High priority queue minimum delay Time sensitive video data is automatically sent to this queue Data 2 best effort Medium priority queue medium throughput and delay Most traditional IP data is sent to this queue Data 3 Background Lowest priority queue high throughput Bulk data that requires maximum throughput and is not time sensitive is sent to this queue FTP data for example Arbitration Inter Frame Spacing AIFS specifies a wait time for data frames The wait time is measured in slots Valid values for AIFS are 1 through 255 Section 3 Configuring the Access Point cwMin Minimum This parameter is input to the algorithm that Contention Window cwMax Maximum Contention Window determines the initial random backoff wait time window for retry of a transmission The value specified for Minimum Contention Window is the upper limit in milliseconds of a range from which the initial random backoff wait time is determined The first random number generated will be a number between 0 and the number specified here If the first random backoff wait time expires before the data frame is sent a retry counter is incremented and the rando
10. each VAP For example you can configure one VAP to use an IPv6 RADIUS server while other VAPs use the global IPv4 RADIUS server settings you configure To set up multiple VAPs click Configuration gt Security gt RADIUS Server Figure 35 Setting RADIUS Server RADIUS Server Global RADIUS Server Settings RADIUS IP Address Type IPv4 RADIUS IP Address RADIUS IP Address 1 RADIUS IP Address 2 RADIUS IP Address 3 RADIUS Key eeeeceee RADIUS Key 1 RADIUS Key 2 RADIUS Key 3 E Enable RADIUS accounting 192 168 1 1 IPv6 900 200 300 100 001 200 200 200 OOOO XXX 00000000X Range 1 64 characters Range 1 64 characters Range 1 64 characters Range 1 64 characters 63 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Virtual Access Point Settings describes the fields and configuration options on the VAP page w a RADIUS IP Address Type RADIUS IP Address RADIUS IPv6 Address RADIUS IP or IPv6 Address 1 3 Table 43 RADIUS Server Settings Specify the IP version that the RADIUS server uses You can toggle between the address types to configure IPv4 and IPv6 global RADIUS address settings but the AP contacts only the RADIUS server or servers for the address type you select in this field Enter the IPv4 or IPv6 address for the primary global RADIUS server By default each VAP uses the global RADIUS settings t
11. A fixed global password used NOPASSWORD to lookup a client MAC entry 54 LAPAC1750PRO Access Point Software User Manual WDS Bridge The Wireless Distribution System WDS allows you to connect multiple Access Points With WDS APs communicate with one another without wires in a standardized way This capability is critical in providing a seamless experience for roaming clients and for managing multiple wireless networks It can also simplify the network infrastructure by reducing the amount of cabling required You can configure the AP in point to point or point to multipoint bridge mode based on the number of links to connect In the point to point mode the AP accepts client associations and communicates with wireless clients and other repeaters The AP forwards all traffic meant for the other network over the tunnel that is established between the APs The bridge does not add to the hop count It functions as a simple OS layer 2 network device In the point to multipoint bridge mode one AP acts as the common link between multiple APs In this mode the central AP accepts client associations and communicates with the clients and other repeaters All other APs associate only with the central AP that forwards the packets to the appropriate wireless bridge for routing purposes The access point can also act as a repeater In this mode the AP serves as a connection between two APs that might be too far apart to be within cell rang
12. Disabled Advertise Interval 30 Seconds Range 5 32768 Default 30 PoE Priority Unknown v Table 22 LLDP Settings E Field Description o O LLDP Mode Enables or disables LLDP The default is Enabled Advertise Specifies the number of seconds between LLDP message Interval transmissions The default transmission interval is 30 seconds and can be set from 5 to 32768 seconds PoE Priority The priority level transmitted by the AP in the Extended Power information element The PoE priority level helps the Power Sourcing Equipment PSE such as a switch determine which powered devices should be given priority in power allocation when the PSE doesn t have enough capacity to supply power to all connected devices The PoE priority can be one of the following e Low e High e Critical e Unknown Click Save to apply the changes and save the changes to startup configuration file Discovery Bonjour Bonjour is a software feature that allows the wireless access point and its services to be discovered on a local network using multicast Domain Name System mDNS service records You can either enable or disable the Bonjour component systemwide The feature is not configurable on any specific network interface To set Bonjour status click the Configuration gt Administrator gt Discovery Bonjour tab Figure 21 Discovery Bonjour Discovery Bonjour Bonjour Status Enabled Disabled Tabl
13. Radio Select the radio on which to configure Workgroup Bridge mode Select one of the following options for MAC authentication Infrastructure Client Interface VLAN ID The VLAN associated with the BSS The SSID of the Basic Service Set BSS The BSS includes upstream access point and all of its connected clients STAs Security The type of security to use for authenticating as a client station on the upstream access point Choices are Authentication pisabled The set of clients in the APs BSS that can Type access the upstream network is not restricted to the clients specified in a MAC address list Local The set of clients in the AP s BSS that can access the upstream network is restricted to the clients specified in a locally defined MAC address list RADIUS The set of clients in the AP s BSS that can access the upstream network is restricted to the clients specified in a MAC address list on a RADIUS server If you select Local or RADIUS see MAC Filter for instructions on creating the MAC filter list None Static WEP WPA Personal WPA Enterprise Connection The Infrastructure Client Interface will be associated to the Status upstream access point with the configured credentials The access point may obtain its IP address from a DHCP server on the upstream link Alternatively you can assign a static IP address The Connection Status field indicates whether the WAP is connected to the upstream access p
14. The AP uses a TFTP client for firmware upgrades You can also use HTTP to perform firmware upgrades After you upload new firmware and the system reboots the newly added firmware becomes the primary image If the upgrade fails the original firmware remains as the primary image NOTE When you upgrade the firmware the access point retains the existing configuration information Use the following steps to upgrade the firmware on an access point by using TFTP 1 Select TFTP for Upload Method 2 Enter a name 1 to 256 characters for the image file in the Image Filename field including the path to the directory that contains the image to upload For example to upload the ap_upgrade tar image located in the share builds ap directory enter share builds ap ap_upgrade tar in the New Firmware Image field The firmware upgrade file supplied must be a tar file Do not attempt to use bin files or files of other formats for the upgrade these types of files will not work 3 Enter the IP address of the TFTP server Firmware Active Image Active Image Firmware Version 1 0 1 build 12 Inactive Image Firmware Version 5 8 10 36 Firmware Upgrade Upload Method HTTP HTTPS TFTP Image Filename upgrade_1 0 1 build 12 tar Range 1 128 characters Server IP 192 168 20 71 peepee Caution Uploading the new firmware may take several minutes Please do not refresh the page or navigate to another page while uploading the
15. 100 100 IPv6 Address 1 900001000 30001 2000 2000072000300003000K IPv6 Address 2 000000000000000000C00000000X IPv6 Address 3 000000000000000000X000000C00X IPv6 Address 4 1000 20001 200010000 00000010001 200 IPv6 Address 5 10001000 900030000 2000 2000100003000 Table 20 Management Access ae e E Management Enable or disable the management ACL feature At least one IPv4 or IPv6 address should be configured before enabling Management ACL Mode If enabled only the IP addresses you specify will have Web and SNMP access to the management interface IP Address Enter up to five IPv4 addresses that are allowed 1 5 management access to the AP Use dotted decimal format for example 192 168 10 10 IPv6 Address Enter up to five IPv6 addresses that are allowed 1 5 management access to the AP Use the standard IPv6 address format for example 2001 0db8 1234 abcd NOTE After you configure the settings click Save to apply the changes and to save the settings 25 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point HTTP HTTPS Service The AP can be managed through HTTP or secure HTTP HTTPS sessions By default both HTTP and HTTPS access are enabled Either access type can be disabled separately To configure Web server settings click the Services gt Web Server tab Figure 19 HTTP HTTPS Service HTTP HTTPS Service HTTP Server Status Enabled Disabled
16. After you configure the VAP settings you must click Save to apply the changes and save the changes to startup configuration file Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low None Plain text If you select None as your security mode no further options are configurable on the AP This mode means that any data transferred to and from the access point is not encrypted This security mode can be useful during initial network configuration or for problem solving but it is not recommended for regular use on the internal network because it is not secure Static WEP Wired Equivalent Privacy WEP is a security algorithm for 802 11 wireless networks WEP uses static 64 bit 40 bit secret key 24 bit initialization vector IV or 128 bit 104 bit secret key 24 bit IV shared key for data encryption between wireless stations and access points WEP uses the stream cipher RC4 for encryption Static WEP is an easily broken security algorithm but it offers more protection than setting the security mode to None Plain text as it does prevent an outsider from easily sniffing out unencrypted wireless traffic 45 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point rs CE re Transfer Key Index Key Length Key Type WEP Keys Ta
17. Content the network The range is from 0 to 256 characters The default is You are now authorized and connected to the network Delete Locale To delete the current locale select this option and click Save Web Customization Preview Use the Web Customization Preview page to view an example of the authentication page a CP user sees upon connecting to the access point Click the Configuration gt Captive Portal gt Web Customization Preview tab to access the page which the following figure shows Figure 52 CP Web Customization Preview Web Customization Preview Captive Portal Web Locale ETEN Captive Portal Web Locale Parameters Preview LINCSYS Welcome to the Wireless Network Acceptance Use Policy Check here to indicate that you have read and accepted the Accep Policy To preview a CP authentication page select the Web locale from the menu Upload Custom Images When users initiate access to a VAP that is associated to a captive portal instance an authentication page displays You can customize this page with your own logo and other graphics Up to 18 images can be uploaded assuming six locales with each locale having three images Click the Configuration gt Captive Portal gt Upload Custom Images tab to access the page which the following figure shows Figure 53 Upload Custom Images Upload Custom Images Upload Web Customization Image Browse Upload Delete Web Custom
18. Disabled Static IP Enter the static IP address in the text boxes This field is pees Address disabled if you use DHCP as the connection type Sagat tari eg 9 Range 0 128 Default 0 Static IPv6 Address Status Subnet Mask Enter the Subnet Mask in the text boxes IPv6 Link Local Address fe80 b675 eff fe1a eb00 64 IPv6 Autoconfigured Global Addresses Default Enter the Default Gateway in the text boxes Default IPv6 Gateway Gateway IPv6 DNS Name Servers Dynamic Manual DNS Name Select the mode for the DNS Servers In Dynamic mode the IP addresses for the DNS servers are assigned automatically via DHCP This option is only ka available if you specified DHCP for the Connection Type In Manual mode you must assign static IP addresses to resolve domain names NOTE After you configure the wired settings you must click Save to apply the changes and save the changes to startup configuration file Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low 30 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Table 26 IPv6 Address Settings e a IPv6 Select the option to determine how the IPv6 address for Connection the management interface is configured Type DHCPv6 The Access Point acquires its IPv6
19. IPv6 Link Local Shows the IPv6 Link Local address which is the IPv6 Address address used by the local physical link The link local address is not configurable and is assigned by using the IPv6 Neighbor Discovery process Default IPv6 Enter the IPv6 address of the default IPv6 gateway Gateway IPv6 DNS Name Select the method to use to configure the IPv6 address Servers of the DNS server s to use for name to IPv6 address resolution e Dynamic The IPv6 addresses for the DNS servers are assigned automatically via DHCPv 6 This option is only available if you specified DHCPv6 for the Connection Type Manual You must assign static IPv6 addresses to resolve domain names NOTE After you configure the wired settings you must click Save to apply the changes and save the changes to startup configuration file Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low 31 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point IPv6 Tunnel The access point supports the Intra Site Automatic Tunnel Addressing Protocol ISATAP which enables the AP to transmit IPv6 packets over the LAN encapsulated within IPv4 packets The protocol enables the access point to communicate with remote IPv6 capable hosts even when the LAN that connects them
20. MAC address It is provided here for informational purposes as a unique identifier for an interface LAPAC1750PRO Access Point Software User Manual Station Isolation The Mode defines the Physical Layer PHY standard the radio uses Note The modes available depend on the country code setting and radio Select one of the following modes for each radio interface e EEE 802 11b g 802 11b and 802 11g clients can connect to the AP IEEE 802 11b g n 802 11b 802 11g and 802 11n clients operating in the 2 4 GHz frequency can connect to the AP IEEE 802 11n Only 802 11n clients operating in the 2 4 GHz frequency can connect to the AP IEEE 802 11a Only 802 11a clients can connect to the AP This mode is available only on Radio 2 IEEE 802 1 1a n ac 802 11a 802 11n and 802 11ac clients operating in the 5 GHz frequency can connect to the AP This mode is available only on Radio 2 IEEE 802 11n ac 802 11n clients and 802 11ac clients operating in the 5 GHz frequency can connect to the AP This mode is available only on Radio 2 To enable Station Isolation select the check box directly beside it When Station Isolation is disabled wireless clients can communicate with one another normally by sending traffic through the AP When Station Isolation is enabled the AP blocks communication between wireless clients on the same VAP The AP still allows data traffic between its wireless clients and wired
21. QoS prioritization and coordination of wireless medium access is on With WMM enabled QoS settings on the access point control downstream traffic flowing from the AP to client station AP EDCA parameters and the upstream traffic flowing from the station to the AP station EDCA parameters Disabling WMM deactivates QoS control of station EDCA parameters on upstream traffic flowing from the station to the AP With WMM disabled you can still set some parameters on the downstream traffic flowing from the AP to the client station AP EDCA parameters To disable WMM extensions click Disabled To enable WMM extensions click Enabled Section 3 Configuring the Access Point Station EDCA Parameters AIFS Inter Frame Space cwMin Minimum Contention Window Queues are defined for different types of data transmitted from station to AP e Data 0 Voice Highest priority queue minimum delay Time sensitive data such as VoIP and streaming media are automatically sent to this queue Data 1 Video Highest priority queue minimum delay Time sensitive video data is automatically sent to this queue Data 2 best effort Medium priority queue medium throughput and delay Most traditional IP data is sent to this queue Data 3 Background Lowest priority queue high throughput Bulk data that requires maximum throughput and is not time sensitive is sent to this queue FTP data for example Arbitration Inte
22. RADIUS Key The shared secret key that the access point uses to authenticate to the primary RADIUS server You can use up to 63 standard alphanumeric and special characters The key is case sensitive and must match the key configured on the RADIUS server The text you enter will be displayed as characters RADIUS Backup The RADIUS key associated with the configured backup RADIUS servers The server at RADIUS IP Address 1 uses RADIUS Key 1 RADIUS IP Address 2 uses RADIUS Key 2 and so on Locale Count The number of locales associated with the instance You can create and assign up to three different locales to each CP instance from the Web Customization page Delete Instance To delete the current instance select this option and click Save LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Instance Association Web Portal Customization Use the Instance Association page to associate a CP instance to a VAP When users initiate access to a VAP that is associated with a captive portal The associated CP instance settings will apply to users who attempt to instance an authentication page displays You can use the page to create authenticate on the VAP unique pages for different locales on your network and to customize the Click the Configuration gt Captive Portal gt Instance Association tab to access textual and graphic elements of the pages Use this page to create and the page wh
23. Section 3 Configuring the Access Point Mark Class of Service Mark IP DSCP Mark IP Precedence Disassociate Class Map Member Classes Delete Policy Map Select this field to mark all packets for the associated traffic stream with the specified class of service value in the priority field of the 802 1p header If the packet does not already contain this header one is inserted The CoS value is an integer from 0 7 Select this field to mark all packets for the associated traffic stream with the IP DSCP value you select from the list or specify Select from List Select from a list of DSCP types Select this field to mark all packets for the associated traffic stream with the specified IP precedence value The IP precedence value is an integer from 0 7 Select this option and click Save to remove the class selected in the Class Map Name menu from the policy selected in the Policy Map Name menu Lists all DiffServ classes currently defined as members of the selected policy If no class is associated with the policy the field is empty Select this field to delete the policy map showing in the Policy Map Name menu To delete a Policy Map select the Delete Policy Map option and click Save Client QoS Status The Client QoS each client cur Status page shows the client QoS settings that are applied to rently associated with the AP To view QoS settings for an associated client click the Configuration
24. Time Settings page when the manual option is selected Figure 14 Setting the Time Manually Time Settings System Time Thu May 8 2014 03 51 29 PDT System Clock Source Network Time Protocol NTP System Date May 8 2014 System Time 0B v Sv Time Zone USA Pacific X Adjust Time for Daylight Savings V Daylight Savings Start Second v Sunday vi in March vat 02 v 0 v Daylight Savings End First ad Sunday v November v at 02 vy Ov Daylight Savings Offset 60 v Figure 15 shows the Time Settings page when the Use Network Time Protocol NTP option is selected Figure 15 Setting the Time Using an NTP Server Time Settings System Time Thu May 8 2014 03 51 29 PDT System Clock Source Network Time Protocol NTP Manually POLO 0LOOOOCOC OCC NTP Server IPv4 IPv6 Addr Name pool ntp org Bacarra arena Time Zone USA Pacific X Adjust Time for Daylight Savings V Daylight Savings Start Second v Sunday v in March at 2 v 00 Daylight Savings End First X Sunday n November v at 02 v Ov Daylight Savings Offset 6 20 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Table 16 Time Settings ic a ee System Clock Set the system time Source To permit the AP to poll an NTP server select Network Time Protocol NTP To manually configure the time and date select Manually When this option
25. Version 1 0 1 build 12 Inactive Image Firmware Version 5 8 10 36 z Firmware Upgrade Upload Method HTTP HTTPS TFTP New Firmware Image Caution Uploading the new firmware may take several minutes Please do not refresh the page or navigate to another page while uploading the new firmware or the firmware upload will be aborted When the process is complete the access point will restart and resume normal operation Upgrade Table 74 Firmware Information and Management Field Description o Active Image Identifies the firmware images on the system e Active Image Firmware Version The version number of the image that is loaded during system boot Inactive Image Firmware Version The version number of the inactive backup image on the system Upload Method The method to use to upload a new firmware image to the HTTP Use a Web browser TFTP Use a TFTP server New Firmware Click Browse to find and select the new firmware image Image HTTP located on an administrative system Upload Image Filename The path and filename of the firmware image to upload TFTP Upload Server IP TFTP The IP address of the TFTP server where the new firmware Upload image is located 110 LAPAC1750PRO Access Point Software User Manual Section 4 Maintenance of the Access Point Use the buttons to perform the following tasks e Switch Use the secondary image as the primary image The change takes effect
26. a simple authentication mechanism to restrict the machines on the network that can request data to the SNMP agent The name functions as a password and the request is assumed to be authentic if the sender knows the password The community name can be in any alphanumeric format Read Write If you have enabled SNMP set requests you can set a Community read write community name The valid range is 1 256 characters Setting a community name is similar to setting a password Only requests from the machines that identify themselves with this community name will be accepted The community name can be in any alphanumeric format You can restrict the source of permitted SNMP requests To restrict the source of permitted SNMP requests select Enabled Management Station Restriction To permit any source submitting an SNMP request select Disabled 82 LAPAC1750PRO Access Point Software User Manual NMS IPv4 Specify the IPv4 DNS hostname or subnet of the Address Name machines that can execute get and set requests to the managed devices The valid range is 1 256 characters As with community names this provides a level of security on SNMP settings The SNMP agent will only accept requests from the hostname or subnet specified here To specify a subnet enter one or more subnetwork address ranges in the form address mask_length where address is an IP address and mask_length is the number of mask bits Both address mask and address ma
27. and failed Click the Configuration gt Captive Portal gt Failed Authenticated Clients tab to access the page which the following figure shows Figure 57 CP Failed Authenticated Clients Failed Authentication Clients Total Number of Fail Authenticated Clients 0 MAC Address IP Address User Name Verify Mode VAP ID Radio ID Captive Portal ID Failure Time The following table describes the fields on the CP Failed Authenticated Clients page Table 65 Captive Portal Failed Authenticated Client List pea peen O erone eaer Verify Mode The method the client attempted to use to authenticate on the Captive Portal which can be one of these values Guest The user does not need to be authenticated by a database Local The Access Point uses a local database to authenticated users RADIUS The Access Point uses a database on a remote RADIUS server to authenticate users VAP ID The VAP that the user attempted to associated with Radio ID The ID of the radio that the user attempted to connect to Captive The ID of the Captive Portal instance to which the user Portal ID attempted to associate Failure Time The time that the authentication failure occurred A timestamp is included that shows the time of the failure 100 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Cluster The access point supports AP clusters A cluster provides a single point of administration and lets you vi
28. be between 8 and 32 characters in length If you wish to use a space in the phrase you must use quotation marks ex Admin 123 or the phrase will be truncated as Admin This field shows the users that have been defined on the AP Use the buttons on the page to perform the following tasks Add Add the new user to the SNMP Users table e Remove Remove the selected user from the SNMP Users table Save Apply and save the changed SNMP user settings Captive Portal This section describes the Captive Portal CP feature which allows you to block wireless clients from accessing the network until user verification has been established You can configure CP verification to allow access for both guest and authenticated users The access point CP feature supports both IPv4 and IPv6 clients Authenticated users must be validated against a database of authorized Captive Portal groups or users before access is granted The database can be stored locally on the access point or on a RADIUS server Captive Portal consists of two CP instances Each instance can be configured independently with different verification methods for each VAP or SSID The AP operates concurrently with some VAPs configured for CP authentication and other VAPs configured for normal wireless authentication methods such as WPA or WPA Enterprise This section describes the following features e Global ConfigurationAuthenticated Clients e Failed Authenticati
29. bridge feature cannot be operational with a peer Access Point WDS is a better solution and is preferred over the Workgroup Bridge solution The Workgroup Bridge feature should be used only when connecting to AP devices from a different manufacturer When the Workgroup Bridge feature is enabled the VAP configurations are not applied only the Workgroup Bridge configuration is applied NOTE The WDS feature does not work when the Workgroup Bridge mode is enabled on the access point In Workgroup Bridge mode the BSS managed by the access point while operating in access point mode is referred to as the access point interface and associated STAs as downstream STAs The BSS managed by the other access point that is the one to which the access point associates as an STA is referred to as the infrastructure client interface and the other access point is referred as the upstream AP 57 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point The devices connected to the wired interface of the access point as well as the downstream stations associated to the access point s access point interface can access the network connected by the infrastructure client interface To allow the bridging of packets the VLAN configuration for the access point interface and wired interface should match that of the infrastructure client interface Workgroup Bridge mode can be used as range extender to enable the BSS to pr
30. configured for each user See the Local Users page The user s away timeout value has precedence over the value configured here The amount of time to wait before terminating a session A user is logged out after the session timeout is reached If the value is set to 0 the timeout is not enforced The range is from 0 to 1440 minutes The default value is 0 The maximum upload speed in megabits per second that a client can transmit traffic when using the captive portal This setting limits the bandwidth at which the client can send data into the network The range is from 0 to 300 Mbps The default value is 0 The maximum download speed in megabits per second that a client can receive traffic when using the captive portal This setting limits the bandwidth at which the client can receive data from the network The range is from 0 to 300 Mbps The default value is 0 The user group associated with this instance Each CP user is associated with a group and a group is associated with a CP instance 91 LAPAC1750PRO Access Point Software User Manual Global RADIUS If the Verification Mode is RADIUS select to specify that the default Global RADIUS server list is used to authenticating clients If you want the CP feature to use a different set of RADIUS servers clear this setting and configure the servers in the fields on this page RADIUS Enables tracking and measuring the resources a Accounting particular user has consumed
31. context of the same session A client station can roam between APs and maintain the session To manage sessions associated with the cluster click the Cluster gt Sessions tab Figure 59 Cluster Sessions Sessions You may sort the following table by clicking on any of the column names AP Location User MAC Idle Rate Mbps Signal Rx Total Tx Total Error Rate not set 9C 2A 70 88 56 81 0 144 88 662 566 0 You may restrict the number of columns displayed by selecting a field other than all in the choice box above By seleting a specific field the table will show only User AP Location User MAC and the selected field for each session Click the Go button to apply the new selection Details about the session information are described in the following table Table 68 Cluster Sessions ca in AP Location Indicates the location of the access point This is derived from the location description specified on the System Settings tab User MAC Indicates the MAC address of the wireless client device A MAC address is a hardware address that uniquely identifies each node of a network Indicates the amount of time this station has remained inactive A station is considered to be idle when it is not receiving or transmitting data 103 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Indicates the strength of the radio frequency RF signal the client receives from the
32. does not support IPv6 The access point acts as an initiator of the tunnel and allows communication with remote IPv6 hosts An ISATAP router acts as the end of the tunnel within the network to help Access Point to auto configure ISATAP tunnel interface From the IPv6 Tunnel page you can enable configure and display ISATAP global operational and configuration parameters To configure the ISATAP settings on the access point click the Configuration gt LAN gt IPv6 Tunnel tab Figure 24 IPv6 Tunnel Settings IPv6 Tunnel ISATAP Status Enabled Disabled ISATAP Capable Host isatap 000 00 00 0 Hostname max 253 characters Default isatap ISATAP Query Interval 120 Sec Range 120 3600 Default 120 ISATAP Solicitation Interval 120 Sec Range 120 3600 Default 120 ISATAP IPv6 Link Local Address ISATAP IPv6 Global Address The following table describes the fields to view or configure on the IPv6 Tunnel page Table 27 IPv6 Tunnel Settings i A rr ISATAP Status Select Enable or Disable for the administrative mode of ISATAP ISATAP Specify the IP address or DNS name of the ISATAP router Capable The default value is isatap Host ISATAP Query Specify how often the AP should send queries to the Interval DNS server to attempt to resolve the ISATAP host name into an IP address The AP sends router solicitation messages only when the IP address of an ISATAP router is unknown The valid range
33. enable You can configure up to 8 VAPs per radio that simulate multiple APs in one physical access point By default only one VAP is enabled For each VAP you can configure a unique security mode to control wireless client access Each radio has 8 VAPs with VAP IDs from 0 7 By default only VAP 0 on each radio is enabled VAPO has the following default settings e VLAN ID 1 e Broadcast SSID Enabled SSID LinksysSMB24G for Radio 1 2 4GHz and LinksysSMB5G for Radio 2 5GHz e Security None e MAC Authentication Type None e Redirect Mode None All other VAPs are disabled by default The default SSID for VAPs 1 7 is Virtual Access Point x where x is the VAP ID To prevent unauthorized access to the access point we recommend that you select and configure a security option other than None for the default VAP and for each VAP that you enable For information about how to configure the security settings on each VAP see Virtual Access Point VAP on page 43 LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status Section 2 Viewing Access Point System Status This section describes the information you can view from the tabs under the Status and Statistics heading on the Administration Web UI Status and Statistics This topic contains the following subsections System Summary e Network Interfaces e Radio Statistics e Workgroup Bridge e Associated C
34. frames that are transmitted to or received from a WLAN client with a specified MAC address Client Filter MAC Address Specify a MAC address for WLAN client filtering Note The MAC filter is active only when capture is performed on an 802 11 interface NOTE Changes to packet capture configuration parameters take affect after packet capture is restarted Modifying the parameters while the packet capture is running doesn t affect the current packet capture session In order to begin using new parameter values an existing packet capture session must be stopped and re started Packet File Capture In Packet File Capture mode the AP stores captured packets in the RAM file system Upon activation the packet capture proceeds until one of the following occurs e The capture time reaches configured duration e The capture file reaches its maximum size e The administrator stops the capture During the capture you can monitor the capture status elapsed capture time and the current capture file size This information can be updated while the capture is in progress by clicking Refresh Table 77 describes the fields to configure the packet capture status 116 LAPAC1750PRO Access Point Software User Manual Section 4 Maintenance of the Access Point Table 77 Packet File Capture Capture Interface Select an AP Capture Interface name from the drop down menu AP capture interface names are eligible for packet captu
35. gt QoS and Access Control Client QoS Status Station Global QoS Mode Client QoS Mode Bandwidth Limit Up Bandwidth Limit Down ACL Type Up ACL Name Up ACL Type Down ACL Name Down DiffServ Policy Up DiffServ Policy Down gt Client QoS Status tab Figure 41 Client QoS Status a0 0b ba 1b cc 5e v Down Disabled 0 0 None None Table 49 Client QoS Status a ine QoS Mode Bandwidth Limit Up The Station menu contains the MAC address of each client currently associated with the AP To view the QoS settings applied to a client select its MAC address from the list Shows whether the QOS mode for the selected client is up enabled or down disabled Note For the QoS Mode to be enabled on a client it must be globally enabled on the AP and enabled on the VAP the client is associated with Use the Global Settings page to enable the QoS Global Admin mode and the per VAP QoS Mode Shows the maximum allowed transmission rate from the client to the AP in bits per second bps The valid range is 0 4294967295 bps 80 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Bandwidth Limit Down ACL Type Up ACL Name Up ACL Type Down ACL Name Down DiffServ Policy Up DiffServ Policy Down Shows the maximum allowed transmission rate from the AP to the client in bits per second bps The valid range is 0 4294967295 bps Shows the
36. idle before deleting it Timeout TSPEC Station Specify the amount of time for an AP to detect an uplink Inactivity TS as idle before deleting it Timeout TSPEC Legacy Select On to allow intermixing of legacy traffic on queues WMM Queue operating as ACM Map Mode Use the Radio page to configure both Radio 1 and Radio 2 The settings on the page apply only to the radio that you choose from the Radio drop down list After you configure settings for one of the radios click Save and then select and configure the other radio Be sure to click Save to apply the second set of configuration settings for the other radio NOTE Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low Rogue AP Detection A Rogue AP is an access point that has been installed on a secure network without explicit authorization from a system administrator Rogue access points pose a security threat because anyone with access can mistakenly or maliciously install a wireless AP that can potentially allow unauthorized parties to access the network The status page for Rogue AP Detection provides real time statistics for all APs detected by the LAPAC1750PRO Access Point in the vicinity of the network If the AP listed as a rogue is actually a legitimate AP you can add it to the Known AP List Click Refresh to
37. indicates that all bits are important and a mask of 0 0 0 0 indicates that no bits are important The opposite is true with an ACL wild card mask For example to match the criteria to a single host address use a mask of 255 255 255 255 To match the criteria to a 24 bit subnet for example 192 168 10 0 24 use a mask of 255 255 255 0 Destination IP Mask IPv6 Class Maps Source IPv6 Select this field to require a packet s source IPv6 address Address to match the address listed here Enter an IPv6 address in the appropriate field to apply this criterion Source IPv 6 Prefix Enter the prefix length of the source IPv6 address Length Destination IPv6 Select this field to require a packet s destination IPv6 Address address to match the address listed here Enter an IPv6 address in the appropriate field to apply this criterion Destination IPv6 Enter the prefix length of the destination IPv6 address Prefix Length IPv6 Flow Label Flow label is 20 bit number that is unique to an IPv6 packet It is used by end stations to signify QoS handling in routers range 0 to 1048575 Section 3 Configuring the Access Point IPv4 and IPv6 Class Maps Source Port Select this field to include a source port in the match condition for the rule The source port is identified in the datagram header Once you select the field choose the port name or enter the port number Select From List Select the keyword associated with the sou
38. interference can be reduced by 25 percent or more Channels will be re assigned even if the network is busy The appropriate channel sets will be used b g for APs using IEEE 802 11b g and a for APs using IEEE 802 1 1a The default settings are designed to satisfy most scenarios where you would need to implement channel management Use Advanced Settings to modify the interference reduction potential that triggers channel re assignment change the schedule for automatic updates and re configure the channel set used for assignments If there are no fields showing in the Advanced section click the toggle button to display the settings that modify timing and details of the channel planning algorithm 106 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Table 71 Channel Management Advanced Settings aS Change channels if interference is Specify the minimum percentage of reduced by at least interference reduction a proposed plan must achieve in order to be applied The default is 75 percent Use the drop down menu to choose percentages ranging from 5 percent to 75 percent This setting lets you set a gating factor for channel re assignment so that the network is not continually disrupted for minimal gains in efficiency For example if channel interference must be reduced by 75 percent and the proposed channel assignments will only reduce interference by 30 percent then channels will not b
39. is selected the AP does not attempt to poll an NTP server NTP Server IPv4 If NTP is enabled specify the NTP server to use IPv6 Addr Name You can specify the NTP server by hostname IPv4 address or IPv6 address although using the IPv4 IPv6 address is not recommended as these can change more readily Ifyou specify a hostname note the following requirements The length must be between 1 253 characters Upper and lower case characters numbers and hyphens are accepted The first character must be a letter a z or A Z or number 0 9 and the last character cannot be a hyphen Time Zone Select your local time zone from the menu The default is USA Pacific Adjust Time System will adjust the reported time for Daylight Savings for Daylight Time DST which is also known as Summer Time When Savings selected fields to configure Daylight Savings Time settings will appear Daylight Savings Configure the date and time to begin Daylight Savings Start Time for the System Time Daylight Saving Configure the date and time to end Daylight Savings Time End for the System Time Daylight Savings Select the number of minutes to offset DST The default is Offset 60 minutes NOTE After you configure the Time settings you must click Save to apply the changes and save the changes to startup configuration file Changing some settings might cause the AP to stop and restart system processes If this happens wireless cl
40. nanoseconds to 400 nanoseconds Reducing the guard interval can yield a 10 improvement in data throughput Select one of the following options e Yes The AP transmits data using a 400 nanosecond guard Interval when communicating with clients that also support the short guard interval No The AP transmits data using an 800 nanosecond guard interval 36 LAPAC1750PRO Access Point Software User Manual Multidomain Regulatory Mode STBC Mode This feature is configurable on a per radio basis By default it is enabled Multidomain Regulatory Mode World Mode causes the AP to broadcast which country it is operating in as a part of its beacons and probe responses This allows client stations to operate in any country without reconfiguration Disabling this feature prevents the country code setting from being broadcast in the beacons However this only applies to radios configured to operate in the g band 2 4 GHz band For radios operating in the a band 5 GHz band the AP software configures support for 802 11h When 802 11h is supported the country code information is broadcast in the beacons This field is available only if the selected radio mode includes 802 11n Space Time Block Coding STBC is an 802 11n technique intended to improve the reliability of data transmissions The data stream is transmitted on multiple antennas so the receiving system has a better chance of detecting at least one of the data str
41. new firmware or the firmware upload will be aborted When the process is complete the access point will restart and resume normal operation 4 Click Upgrade Upon clicking Upgrade for the firmware upgrade a popup confirmation window is displayed that describes the upgrade process 111 LAPAC1750PRO Access Point Software User Manual Section 4 Maintenance of the Access Point 5 Click OK to confirm the upgrade and start the process NOTE The firmware upgrade process begins once you click Upgrade and then OK in the popup confirmation window The upgrade process may take several minutes during which time the access point will be unavailable Do not power down the access point while the upgrade is in process When the upgrade is complete the access point restarts The AP resumes normal operation with the same configuration settings it had before the upgrade 6 To verify that the firmware upgrade completed successfully check the firmware version shown on the Firmware page or the System Summary tab If the upgrade was successful the updated version name or number is indicated Use the following steps to upgrade the firmware on an access point by using HTTP 1 Select HTTP for Upload Method 2 If you know the path to the new firmware image file enter it in the New Firmware Image field Otherwise click the Browse button and locate the firmware image file The firmware upgrade file supplied must be a ta
42. plans will not re assign the AP to a different channel as a part of the optimization strategy Instead APs with locked channels will be factored in as requirements for the plan If you click Save you will see that locked APs show the same channel for the Current Channel and Proposed Channel fields Locked APs will keep their current channels Viewing the Last Proposed Set of Changes The Proposed Channel Assignments shows the last channel plan The plan lists all access points in the cluster by IP address and shows the current and proposed channels for each AP Locked channels will not be re assigned and the optimization of channel distribution among APs will take into account the fact that locked APs must remain on their current channels APs that are not locked may be assigned to different channels than they were previously using depending on the results of the plan Table 70 Last Proposed Changes Li a ee IP Address Specifies the IP address for the access point Radio Indicates the radio channel on which this access point is currently broadcasting Proposed Indicates the radio channel to which this access point Channel would be re assigned if the channel plan is executed Configuring Advanced Settings Advanced settings allow you to customize and schedule the channel plan for the cluster If you use Channel Management as provided without updating Advanced Settings channels are automatically fine tuned once every hour if
43. refresh the page NOTE The detected Rogue AP List and Known AP List provide information The LAPAC1750PRO Access Point does not have any control over the APs on the lists and cannot apply any security policies to APs detected through the RF scan When AP detection is enabled the radio will periodically switch from its operating channel to scan other channels within the same band Neighbor AP detection can be configured independently on each radio Click Save to refresh the screen and display the most current information NOTE Note Rogue AP detection does not have any refresh mechanism and the SSID are retained in the database once detected To view information about other access points on the wireless network click the Status gt Rogue AP Detection tab 40 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Figure 26 Viewing Rogue AP Detection The available action depends on which list an AP is in Rogue AP Detection e e Ifthe AP is in the Detected Rogue AP List the Grant SETTINGS button is available Click Grant to move the AP from the AP DeleciontorRadio t Enabled Disaniea Detected Rogue AP List to the Trusted AP List ii a If the AP is in the Trusted AP List the Delete button is E available Click Delete to move the AP from the Trusted TATE T EEE a AP list to the Detected Rogue AP List pr suse Voi Kat RE SO KR ed EEE as Va Sea RE Note The Detected Rogue AP List and Kn
44. the following topics e Administrator s Computer Requirements e Wireless Client Requirements e Online Help Supported Browsers and Limitations Dynamic and Static IP Addressing Installing the Access Point Configuring the Ethernet Settings Configuring IEEE 802 1X Authentication e Configuring Security on the Access Point To manage the access point by using the Web interface the AP needs an IP address If you use VLANs or IEEE 802 1X Authentication port security on your network you might need to configure additional settings on the AP before it can connect to the network NOTE The access point is not designed to function as a gateway to the Internet To connect your WLAN to other LANs or the Internet you need a gateway device Administrator s Computer Requirements The following table describes the minimum requirements for the administrator s computer for configuration and administration of the access point through a Web based user interface UI Table 1 Requirements for the Administrator s Computer Required Software or Description Component Ethernet Connection to The computer used to configure the first access the Access Point point must be connected to the access point by an Ethernet cable Wireless Connectionto After initial configuration and launch of the first the Network access point on your new wireless network you can make subsequent configuration changes through the Administration Web pag
45. the next time the AP boots For more information see Switching Firmware Image e Upgrade Upload the specified firmware image to the AP For more information about the firmware upgrade procedures see Firmware Upgrade Click Maintenance gt Firmware to display the Manage Firmware page From the Manage Firmware page you can View the current firmware version for the primary and secondary image Switch the firmware image running on the AP e Upload a new firmware version Switching Firmware Image The AP always tries to boot with the primary image If the primary image fails to load then the secondary image is used to boot the AP Whenever such a failover occurs the system creates a log message to help you troubleshoot the firmware failure Use the following steps to switch the firmware image running on the AP 1 Click Switch A dialog box displays confirming the firmware image switch and subsequent reboot 2 Click OK to proceed The process may take several minutes during which time the access point will be unavailable Do not power down the access point while the image switch is in process When the image switch is complete the access point restarts The AP resumes normal operation with the same configuration settings it had before the upgrade Firmware Upgrade As new versions of the access point firmware become available you can upgrade the firmware on your devices to take advantage of new features and enhancements
46. to startup configuration file Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low MAC Filtering A Media Access Control MAC address is a hardware address that uniquely identifies each node of a network All IEEE 802 network devices share a common 48 bit MAC address format usually displayed as a string of 12 hexadecimal digits separated by colons for example 00 DC BA 09 87 65 Each wireless network interface card NIC used by a wireless client has a unique MAC address You can use the Administrator UI on the AP or use an external RADIUS server to control access to the network through the AP based on the MAC address of the wireless client This feature is called MAC Filtering To control access you configure a global list of MAC addresses locally on the AP or on an external RADIUS server Then you set a filter to specify whether the clients with those MAC addresses are allowed or denied access to the network When a wireless client attempts to associate with an AP the AP looks up the MAC address of the client in the local stations list or on the RADIUS server If it is found the global allow or deny setting is applied If it is not found the opposite is applied On the Virtual Access Point VAP page MAC Filtering Type controls whether the AP uses the station list configu
47. two or more APs to other systems on the network By configuring VAPs you can maintain better control over broadcast and multicast traffic which affects network performance You can configure each VAP to use a different VLAN or you can configure multiple VAPs to use the same VLAN whether the VLAN is on the same radio or on a different radio VAPO which is always enabled on both radios is assigned to the default VLAN 1 The AP adds VLAN ID tags to wireless client traffic based on the VLAN ID you configure on the VAP page or by using the RADIUS server assignment If you use an external RADIUS server you can configure multiple VLANs on each VAP The external RADIUS server assigns wireless clients to the VLAN when the clients associate and authenticate If wireless clients use a security mode that does not communicate with the RADIUS server or if the RADIUS server does not provide the VLAN information you can assign a VLAN ID to each VAP The AP assigns the VLAN to all wireless clients that connect to the AP through that VAP About the RADIUS server setting please see RADIUS Server on page 64 NOTE Before you configure VLANs on the AP be sure to verify that the switch and DHCP server the AP uses can support IEEE 802 1Q VLAN encapsulation To set up multiple VAPs click Configuration gt Wireless gt Virtual Access Points VAP Figure 27 Virtual Access Points VAP Virtual Access Points VAP Select Your Radio Radio Ra
48. with each other directly without the use of a traditional AP Ad Hoc Mode is an IEEE 802 11 Wireless Networking Framework also referred to as peer to peer mode or an Independent Basic Service Set IBSS To disable neighbor AP detection on Radio 1 select Disabled If you change the AP detection setting click Save AP Detection To enable Radio 2 to perform neighbor AP detection and for Radio 2 collect information about neighbor APs select Enabled To disable neighbor AP detection on Radio 2 select Disabled If you change the AP detection setting click Save 41 LAPAC1750PRO Access Point Software User Manual The Service Set Identifier SSID for the AP The SSID is an alphanumeric string of up to 32 characters that uniquely identifies a wireless local area network It is also referred to as the Network Name Privacy Indicates whether there is any security on the neighboring device Off indicates that the Security mode on the neighboring device is set to None no security e On indicates that the neighboring device has some security in place Security is configured on the AP from the VAP page WPA Indicates whether WPA security is on or off for this AP This indicates the IEEE 802 11 mode being used on this AP For example IEEE 802 11a IEEE 802 11b IEEE 802 11g The number shown indicates the mode according to the following map e 24 indicates IEEE 802 11b 802 11g or 802 11n mode or a combinati
49. 1 To Address 2 To Address 3 Email Subject Specify the IP address or hostname of the SMTP server on the network Specify whether to use SMTP over SSL TLSv1 or no security Open for authentication with the mail server The default is TLSv1 Configures the TCP port number for SMTP The range is a valid port number from 0 to 65535 The default is 465 which is the standard port for SMTP Specify the username to use when authentication with the mail server is required The username is a 64 byte character string with all printable characters The default is admin Specify the password associated with the username configured in the previous field Configure the first email address to which alert messages are sent The address must be a valid email address By default no address is configured Optionally configure the second email address to which alert messages are sent The address must be a valid email address By default no address is configured Optionally configure the third email address to which alert messages are sent The address must be a valid email address By default no address is configured Specify the text to be displayed in the subject of the email alert message The subject can contain up to 255 alphanumeric characters The default is Log message from AP 24 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point NOTE After you configure th
50. 50PRO Access Point Software User Manual Section 3 Configuring the Access Point Start Time The time when the radio or VAP will be operationally enabled The time is in HH MM 24 hour format The range is lt 00 23 gt lt 00 59 gt The default is 00 00 End Time The time when the radio or VAP will be operationally disabled The time is in HH MM 24 hour format The range is lt 00 23 gt lt 00 59 gt The default is 00 00 After you select a profile from the Select Profile field the rules that have been added to the selected profile appear in the table below the Rule Configuration area When you add a new rule to a profile it appears in the table Use the Modify Rule and Remove Rule buttons to manage the rules associated with a profile Use the buttons to perform the following tasks e Add To add a scheduler profile specify the name of the profile in the appropriate field and click Add e Remove To remove a scheduler profile select it from the Select Profile field in the Rule Configuration table and click Remove e Add Rule After you configure the rule settings click Add Rule to add the rule to the selected profile e Modify Rule To change an existing rule select the rule update the values in the Rule Configuration area and click Modify Rule e Remove Rule To delete a rule from a profile select the rule and click Remove Rule Save After making any modifications click Save to apply the changes and to save
51. A EB 00 not set 192 168 20 120 B4 75 0E 1A EB 08 7 not set Neighbors 52 LinksysSMB24G Linksys SMBSG Linksys SMB24G Linksys SMBSG 5 cisco radiot data133 cisco radio2 data111 m r Table 72 Wireless Neighborhood Information Field Description Display Click one of the following radio buttons to change the neighboring view APs In cluster Shows only neighbor APs that are members of the cluster Not in cluster Shows only neighbor APs that are not cluster members Both Shows all neighbor APs cluster members and non members The Cluster list at the top of the table shows IP addresses for all access points in the cluster This is the same list of cluster members shown on the Cluster gt Access Points tab If there is only one AP in the cluster only a single IP address column will be displayed here indicating that the AP is clustered with itself You can click on an IP address to view more details on a particular AP Neighbors Access points which are neighbors of one or more of the clustered APs are listed in the left column by SSID Network Name An access point which is detected as a neighbor of a cluster member can also be a cluster member itself Neighbors who are also cluster members are always shown at the top of the list with a heavy bar above and include a location indicator The colored bars to the right of e
52. AC addresses for this AP For each WDS link on a two radio AP the local address reflects the MAC address for the internal interface on the selected radio Radio 1 on wlan0 or Radio 2 on wlan1 Local Address 56 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point WPA PSK on WDS Links The following table describes the additional fields that appear when you select WPA PSK as the encryption type NOTE In order to configure WPA PSK on any WDS link VAPO of the selected radio must be configured for WPA PSK or WPA Enterprise Table 40 WPA PSK on WDS Links pa pemn Encryption WPA PSK Enter an appropriate name for the new WDS link you have created This SSID should be different from the other SSIDs used by this AP However it is important that the same SSID is also entered at the other end of the WDS link If this SSID is not the same for both APs on the WDS link they will not be able to communicate and exchange data The SSID can be any alphanumeric combination Enter a unique shared key for the WDS bridge This unique shared key must also be entered for the AP at the other end of the WDS link If this key is not the same for both APs they will not be able to communicate and exchange data The WPA PSK key is a string of at least 8 characters to a maximum of 63 characters Acceptable characters include upper and lower case alphabetic letters the numeric digits and special s
53. ACL Protocol Source IP Address Wild Card Mask Select the Protocol field to use a Layer 3 or Layer 4 protocol match condition based on the value of the IP Protocol field in IPv4 packets or the Next Header field of IPv6 packets Once you select the field choose the protocol to match by keyword or enter a protocol ID Select From List Select one of the following protocols from the list IP ICMP IGMP TCP UDP Match to Value To match a protocol that is not listed by name enter the protocol ID The protocol ID is a standard value assigned by the IANA The range is a number from 0 255 Select this field to require a packet s source IP address to match the address listed here Enter an IP address in the appropriate field to apply this criterion Specifies the source destination IP address wildcard mask The wild card mask determines which bits are used and which bits are ignored A wild card mask of 255 255 255 255 indicates that no bit is important A wildcard of 0 0 0 0 indicates that all of the bits are important This field is required when Source IP Address is checked A wild card mask is in essence the inverse of a subnet mask For example to match the criteria to a single host address use a wildcard mask of 0 0 0 0 To match the criteria to a 24 bit subnet for example 192 168 10 0 24 use a wild card mask of 0 0 0 255 70 LAPAC1750PRO Access Point Software User Manual Source Port Destination Address
54. AP did not acquire an IP address from a DHCP server on your network enter 192 168 1 252 the default IP address of the AP in the address field of your browser If you used a DHCP server on your network to automatically configure network information for the AP enter the new IP address of the AP into the Web browser When prompted enter admin for the user name and admin for the password then click Log In LINCSYS LAPAC1750PRO AC1750 Pro Dual Band Access Point AUTHENTICATION REQUIRED as Ses yin When you first log in the System Summary page for access point administration is displayed as the following figure shows LAPAC1750PRO Access Point Software User Manual Section 1 Getting Started Figure 2 System Summary Page System Summary IPv4 Address 192 168 20 114 IPv6 Address IPv6 Address Status IPv6 Link Local Address fe80 222 44ff fea2 3400 64 IPv6 Autoconfigured Global Addresses DEVICE INFORMATION Device Name lapa23400 Model Number LAPAC1750PRO Serial Number 53012 MAC Address 00 22 44 42 34 00 Firmware Version 1 0 1 build 12 Hardware Version 1 System Uptime 0 days 0 hours 28 minutes Power Source Power Adapter 5 Verify the settings on the System Summary page e Review access point description For information about the fields on the System Summary page see System Summary on page 7 6 If you do not have a DHCP server on the management network and do not plan to use o
55. APAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point ACL Name ACL Type Add ACL ACL RULE SETTING Select Your ACL And Rule ACL Name and Type Rule Rule Settings Action Match Every Protocol Source IP Address Source Port Destination IP Address Destination Port Service Type IP DSCP IP Precedence IP TOS Bits Delete ACL Figure 38 ACL 1 31 characters Pye v acl ipv4 ipv4 v New Rule x Deny kai v SelectFromList LP _ Match to Value _ 000 200 3000 Wild Card Mask Select From List Match to Port of Goovoouoowox Wild Card Mask Select From List Match to Port Select FromList lt Match to Value j 7 00 FF IP TOS Mask 00 FF o 255 00009000100 0K Ss 65535 000 2001 100K 0X S 65535 0 63 ACL ACL Type ACL RULE SETTING Table 46 ACL Configuration C Enter a name to identify the ACL The name can contain from 1 31 alphanumeric characters and the following special characters hyphen underscore backslash and colon Spaces are not allowed Select the type of ACL to configure e IPv4 IPv6 MAC IPv4 and IPv6 ACLs control access to network resources based on Layer 3 and Layer 4 criteria MAC ACLs control access based on Layer 2 criteria ACL Name and Type Select the ACL to configure with the new rule The list contai
56. B4 75 0E 1A EB 08 AINIAC 149 up B not set 192 168 20 120 B4 75 0E 1A EB 00 B G N 11 up not set 192 168 20 138 00 22 44 A2 05 08 AINIAC 149 up m not set 192 168 20 138 00 22 44 A2 05 00 BIGIN 6 up a No new channels proposed in the last iteration Proposed Channel Assignments ago AP Location IP Address Radio Proposed Channel ADVANCED SETTINGS Change channels if interference is 75 v reduced by atleast Determine if there is better set of channel settings every 1 Hour hd From this page you can view channel assignments for all APs in the cluster and stop or start automatic channel management By using the advanced settings on the page you can modify the interference reduction potential that triggers channel re assignment change the schedule for automatic updates and re configure the channel set used for assignments Stopping Starting Automatic Channel Assignment By default automatic channel assignment is disabled off NOTE Channel Management overrides the default cluster behavior which is to synchronize radio channels of all APs across a cluster When Channel Management is enabled the radio channel is not synced across the cluster to other APs e Click Start to resume automatic channel assignment e When automatic channel assignment is enabled the Channel Manager periodically maps radio channels used by clustered access points and if necessary re assigns channels on clustered APs to reduce interference with cluster
57. Hz 80 The information on this page is read only To change the wired or wireless interface settings click the Edit link associated with the appropriate section LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status LAN Status Management Interface LAN Status shows information about the internal Ethernet interface which is the primary interface used to manage the AP Table 4 LAN Interface Settings a ee MAC Address The MAC address for the LAN interface for the Ethernet port on this AP This is a read only field that you cannot change VLAN ID The management VLAN ID This is the VLAN associated with the IP address you use to access the AP management interface The default management VLAN ID is 1 IPv4 Address The IP address of the management interface The subnet mask associated with the management IP address Ee The primary and secondary DNS servers to use for name to IP address resolution Default Gateway The default gateway for the IPv4 network interface IPv6 Address The IPv6 address of the management interface IPv6 If the AP has been assigned one or more IPv6 addresses Autoconfigured automatically the addresses are listed Global Addresses IPv6 Link Local The IPv6 Link Local address which is the IPv6 address Address used by the local physical link The Link Local address is not configurable and is assigned by using the IPv6 Neighbor Discovery process
58. MAC Mask Match to Value 0600 FFFF Match to Value 0 63 PTOS Mask 00 FF 74 LAPAC1750PRO Access Point Software User Manual Table 47 DiffServ Class Map Class Map Configuration Class Map Name Match Layer 3 Protocol The name can range from 1 to 31 alphanumeric characters Specify whether to classify IPv4 or IPv6 packets Match Criteria Configuration Class Map Name Match Every Select name of the class to configure Use the fields in the Match Criteria Configuration area to match packets to a class Select the check box for each field to be used as a criterion for a class and enter data in the related field You can have multiple match criteria in a class Note The match criteria fields that are available depend on whether the class map is an IPv4 or IPv6 class map Select Match Every to specify that the match condition is true to all the parameters in a Layer 3 packet All Layer 3 packets will match a Match Every match condition Protocol IPv4 Class Maps Section 3 Configuring the Access Point Select the Protocol field to use a Layer 3 or Layer 4 protocol match condition based on the value of the IP Protocol field in IPv4 packets or the Next Header field of IPv6 packets Once you select the field choose the protocol to match by keyword or enter a protocol ID Select From List Select one of the following protocols from the list IP ICMP IPv6 ICMPv6 IGMP TCP UDP Match t
59. P Port 0 occ pea Ga rary Additional HTTP Port HTTP traffic uses port 80 but you can configure Additional HTTPS Port 0 aoe RPE Oy an additional port for HTTP traffic Enter a port number between 1025 65535 Port number 80 or 443 cannot be used and the HTTP and HTTPs Captive Portal Counters Instance Count 0 ports cannot be the same Group Count 1 ae S Additional HTTPS Port HTTP traffic over SSL HTTPS uses port 443 but you can configure an additional port for HTTPS traffic Enter a port number between 1025 65535 Port number 80 or 443 cannot be used and the HTTP and HTTPs ports cannot be the same Instance Count The number of CP instances currently configured on the AP Up to two instances can be configured Group Count The number of CP groups currently configured on the AP Up to two groups can be configured Default Group exists by default and cannot be deleted User Count The number of CP users currently configured on the AP Up to 128 users can be configured The following table describes the fields on the CP Global Configuration page 89 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Instance Configuration You can create up to two Captive Portal instances each CP instance is a defined set of instance parameters Instances can be associated with one or more VAPs Different instances can be configured to respond differently to users as they attempt to access t
60. P address of the TFTP server in the Server IP field FIGURATION Browse to the location where your saved configuration file is stored and click the Restore button To restore from a TFTP server click the TFTP radio button and enter the TFTP server information Upload Method HTTP HTTPS TFTP Filename Aestapifp_ap xml Range 1 256 characters Server IP 192 168 20 71 900 200 200 100 4 Click the Restore button The AP will reboot A reboot confirmation dialog and follow on rebooting status message will pop up Please wait for the reboot process to complete which might take several minutes The Administration Web UI is not accessible until the AP has rebooted Use the following steps to save a copy of the current settings on an AP toa backup configuration file by using HTTP 1 Select HTTP for Upload Method 2 Use the Browse button to select the file to restore 3 Click the Restore button A File Upload or Choose File dialog box will pop up 4 Navigate to the directory that contains the file select the file to upload and click Open Only those files created with the Backup function and saved as xml backup configuration files are valid to use with Restore for example ap_ config xml 5 Click the Restore button A dialog box will open asking you to verify the restore 6 Click OK to proceed The AP will reboot A reboot confirmation dialog and follow on rebooting status message will pop up P
61. PA2 or both WPA and WPA2 you can enable pre authentication for WPA2 clients Click Enable pre authentication if you want WPA2 wireless clients to send a pre authentication packet The pre authentication information will be relayed from the AP the client is currently using to the target AP Enabling this feature can help speed up authentication for roaming clients who connect to multiple APs This option does not apply if you selected WPA for WPA versions because the original WPA does not support this feature Select the cipher suite you want to use TKIP e CCMP AES TKIP and CCMP AES By default both TKIP and CCMP are selected When both TKIP and CCMP are selected client stations configured to use WPA with RADIUS must have one of the following e A valid TKIP RADIUS IP address and RADIUS Key e A valid CCMP AES IP address and RADIUS key By default each VAP uses the global RADIUS settings that you define for the AP at the top of the VAP page However you can configure each VAP to use a different set of RADIUS servers To use the global RADIUS server settings make sure the check box is selected To use a separate RADIUS server for the VAP clear the check box and enter the RADIUS server IP address and key in the following fields Section 3 Configuring the Access Point RADIUS IP Address Specify the IP version that the RADIUS server uses RADIUS IP Address RADIUS IPv6 Address RADIUS IP or IPv6 Add
62. Summary Indicates the total number of accepted and for Voice ACM the total number of rejected voice Traffic Streams Total Voice Indicates the total number of TS voice packets sent in Packets Transmit table or received in Received table by this AP for this VAP i TSPE isti Indi h f Total Voice Indicates the total TS voice bytes sent in Transmit table or He ae mae Has ee pee ae Bytes received in Received table by this AP for this VAP i Streams Click Refresh to refresh the page 17 LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status Email Alert Status The Email Alert Status page provides information about the email alerts sent based on the syslog messages generated in the AP To view the Email Alert Operational Status click the System Status gt Email Alert Status tab To configure the email alerts see Email Alert on page 23 Figure 11 Email Alert Status Email Alert Status Email Alert Status down Number of Email Sent 0 Number of Email Failed 0 Time Since Last Email Sent notsent Table 13 Email Alert Status pa o pe Email Alert The Email Alert operational status The status is either Up Status or Down The default is Down Number of The total number of emails sent so far The range is an Email Sent unsigned integer of 32 bits The default is 0 Number of The total number of email failures so far The range is an Email Failed unsigned int
63. able wireless client to an AP requesting a certain amount of network access for the traffic stream TS it represents A traffic stream is a collection of data packets identified by the wireless client as belonging to a particular user priority An example of a voice traffic stream is a Wi Fi certified telephone handset that marks its codec generated data packets as voice priority traffic An example of a video traffic stream is a video player application on a wireless laptop that prioritizes a video conference feed from a corporate server To view TSPEC Client Association statistics click the System Status gt TSPEC Client Associations tab Figure 8 TSPEC Client Associations TSPEC Client Association Status Table Network SSID Station TSidentifier Access Category Direction User Priority Medium Time Excess Usage Events VAP MAC Address Statistics Table Network Station TS Identifier Access Category Direction From Station To Station Table 10 TSPEC Client Associations ee eee Radio interface used by the client SSD The service set identifier associated with this TS client Station Client station MAC address TS Identifier TSPEC Traffic Session Identifier range 0 7 Access Category TS Access Category voice or video The traffic direction for this TS e Uplink e Downlink e Bidirectional User Priority The User Priority UP for this TS The UP is sent with each packet in the UP portion of the IP header Typical v
64. access point The measure used for this is a value known as Received Signal Strength Indication RSSI and will be a value between 0 and 100 RSSI is determined by a mechanism implemented on the network interface card NIC of the client station The speed at which this access point is transferring data to the specified client The data transmission rate is measured in megabits per second Mbps This value should fall within the range of the advertised rate set for the mode in use on the access point For example 6 to 54 Mbps for 802 11a Rx Total Indicates number of total packets received from the client during the current session Tx Total Indicates number of total packets transmitted to the client during this session Error Rate Indicates the percentage of time frames are dropped during transmission on this access point Sorting Session Information To sort the information shown in the tables by a particular indicator click the column label by which you want to order things For example if you want to see the table rows ordered by signal strength click the Signal column label The entries will be sorted by signal strength Channel Management When Channel Management is enabled the access point automatically assigns radio channels used by clustered access points The automatic channel assignment reduces mutual interference or interference with other access points outside of its cluster and maximizes Wi Fi bandwidth to
65. access point and perform diagnostics Use the tabs under the Configuration heading on the Administration Web UI e System Settings e Time Settings e Log Settings e Email Alert e Management Access e HTTP HTTPS Service e Discovery LLDP e Discovery Bonjour System Settings From the System Settings page you can change the administrator password and system settings e g device name system contact We strongly recommended you choose a new password based on the standard guidelines for strong password security instead of using default password which is admin Figure 13 shows the System Settings page Figure 13 System Settings System Settings ACCOUNT SETTINGS Username admin Range 1 32 characters New Password Range 1 32 characters Confirm New Password Range 1 32 characters SYSTEM SETTINGS Device Name lapa23400 Range 1 63 characters System Contact Range 0 255 characters System Location Range 0 255 characters a Table 15 System Settings page a a New Password Enter a new administrator password The characters you enter are displayed as bullets to prevent others from seeing your password as you type The password can be up to 32 characters Do not use special characters or spaces Note As an immediate first step in securing your wireless network we recommend that you change the administrator password from the default Confirm New Re enter the new administrat
66. access point indicates that the current mode is standalone and provides a button for adding the access point to a cluster group 3 Click Start Clustering The access point is now a cluster member Status Mode on the Configuration gt Cluster gt Access Points tab now indicates cluster instead of Not Clustered Navigating to Configuration Information for a Specific AP In general the access point is designed for central management of clustered access points All access points in a cluster reflect the same configuration In this case it does not matter which access point you actually connect to for administration 102 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point There may be situations however when you want to view or manage information on a particular access point For example you might want to check status information such as client associations or events for an access point In this case you can navigate to the Administration Web interface for individual access points by clicking the IP address links on the Access Points tab All clustered access points are shown on the Cluster gt Access Points page To navigate to clustered access points you can simply click on the IP address for a specific cluster member shown in the list Navigating to an AP by Using its IP Address in a URL You can also link to the Administration Web pages of a specific access point by entering th
67. access point to maintain the speed and performance of the wireless network as clients associate and disassociate with the AP The load balancing settings apply to both radios but the load of each radio is calculated independently With load balancing you can ensure that all access points on the network handle a proportionate share of wireless traffic and that no single access point gets overloaded To configure load balancing and set limits and behavior to be triggered by a specified utilization rate of the access point click the Configuration gt Wireless gt Bandwidth Utilization tab and save the fields shown in the following figure Figure 30 Bandwidth Utilization Bandwidth Utilization Bandwidth Utilization Enabled Disabled Maximum Utilization 0 Range 0 100 0 disables 52 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Table 36 Bandwidth Utilization a i Bandwidth To enable load balancing on this AP click Enabled Utilization To disable load balancing on this AP click Disabled Maximum Provide the percentage of network bandwidth utilization allowed on the radio before the AP stops accepting new client associations Utilization The default is 0 which means that all new associations will be allowed regardless of the utilization rate NOTE After you configure the load balancing settings you must click Save to apply the changes and save the changes
68. ach AP in the Neighbors list shows the signal strength for each of the neighbor APs as detected by the cluster member whose IP address is shown at the top of the column The color of the bar indicates the signal strength Dark Blue Bar A dark blue bar and a high signal strength number for example 50 indicates good signal strength detected from the neighbor seen by the AP whose IP address is listed above that column Lighter Blue Bar A lighter blue bar anda lower signal strength number for example 20 or lower indicates medium or weak signal strength from the neighbor seen by the AP whose IP address is listed above that column e White Bar A white bar and the number 0 indicates that a neighboring AP that was detected by one of the cluster members cannot be detected by the AP whose IP address if listed above that column Light Gray Bar A light gray bar and no signal strength number indicates a neighbor that is detected by other cluster members but not by the AP whose IP address is listed above that column e Dark Gray Bar A dark gray bar and no signal strength number indicates this is the AP whose IP address is listed above that column since it is not applicable to show how well the AP can detect itself 108 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Viewing Details for a Cluster Member Indicates the strength of the radio signal emitting To view details
69. add The name can contain up to 31 alphanumeric characters Policy Class Definition R a Policy Map Name Select the policy to associate with a Blam ates Policy Class Definition member class Class Map Name CLMap1 v faire re ane Class Map Name Select the member class to associate Committed Burst 1 204800000 bytes oon with this policy name oe ice ia Police Simple Select this option to establish the washes paren traffic policing style for the class ist aft z e BORY ania The simple form of the policing style Mark IP Pi di E R 0 7 X Pi ee ee uses a single data rate and burst size Disassociate Class Map 4 resulting in two outcomes conform Member Classes a and nonconform Delete Policy Map Committed Rate Enter the committed rate in Kbps to save which traffic must conform Committed Burst Enter the committed burst size in bytes to which traffic must conform Ideally burst size should be 1 5 times the committed rate in bytes for Rate Limiting to work properly For example if the committed rate is 1 Gbps then the committed burst size should be 187500000 bytes Select Send to specify that all packets for the associated traffic stream are to be forwarded if the class map criterion is met Select Drop to specify that all packets for the associated traffic stream are to be dropped if the class map criterion is met 79 LAPAC1750PRO Access Point Software User Manual
70. address DNS and gateway information from a DHCPVv6 server Static IPv6 You must enter information in the Static IPv6 Address Prefix length and Default Gateway fields Note If the selected connection type is DHCPv6 only the IPv6 Connection Type IPv6 Admin Mode and IPv6 Auto Config Admin Mode can be configured All other fields are for static IPv6 configuration only IPv6 Admin Enable or disable IPv6 management access to the AP Mode IPv6 Auto Enable or disable IPv6 auto address configuration on the Config Admin AP Mode When IPv6 Auto Config Mode is enabled automatic IPv6 address configuration and gateway configuration is allowed by processing the Router Advertisements received on the LAN port The AP can have multiple auto configured IPv6 addresses Static IPv6 Enter a static IPv6 address The AP can have a static IPv6 Address address even if addresses have already been configured automatically Static IPv6 Enter the static IPv6 prefix length which is an integer in Address Prefix the range of 0 128 Length Static IPv6 Shows the operational status of the static IPv6 address Address Status assigned to the management interface of the AP The possible values are Operational and Tentative Note If an IPv6 address has not been manually configured the field is blank IPv6 If the AP has been assigned one or more IPv6 addresses Autoconfigured automatically the addresses are listed Global Addresses
71. affic from HTTP to HTTPS and make sure users always access the site securely This field is available only when HTTP access disabled Enable or disable access through a Secure HTTP Server HTTPS Specify the port number for HTTPS traffic default is 443 When a user logs in to the AP web interface a session is created This session is maintained until the user logs off or the session inactivity timer expires Enter the number web sessions including both HTTP and HTTPS that can exist at the same time The range is 1 10 sessions The default is 5 If the maximum number of sessions is reached the next user who attempts to log on to the AP web interface receives an error message about the session limit Enter the maximum amount of time in minutes an inactive user remains logged on to the AP web interface When the configured timeout is reached the user is automatically logged off the AP The range is 1 1440 minutes 1440 minutes 1 day The default is 60 minutes 26 LAPAC1750PRO Access Point Software User Manual Generate SSL Certificate Generate SSL Click Generate to generate a new HTTP SSL certificate Certificate for the secure Web server This should be done once the access point has an IP address to ensure that the common name for the certificate matches the IP address of the access point Generating a new SSL certificate will restart the secure Web server The secure connection will not work until
72. al address add square brackets around the IPv6 address For example if the AP global IPv6 address is 2520 230 abff fe00 2420 type the following address into the IE7 address field http 2520 230 abff fe00 2420 To connect to the iPv6 Link Local address replace the colons with hyphens add the interface number preceded by an s then add ipv6 literal net For example if the AP Link Local address is fe80 230 abff fe00 2420 and the Windows interface is defined as 6 type the following address into the IE7 address field http fe80 230 abff fe00 2420s6 ipv6 literal net System Status gt Status and Statistics gt Network Interfaces tab Network Interfaces EZE LAN STATU Management Interface MAC Address VLAN ID IPv4 Address Subnet Mask DNS 1 DNS 2 Default Gateway IPv6 Address IPv6 Link Local Address IPv6 Autoconfigured Global Addresses IPv6 DNS 1 IPv6 DNS 2 Default IPv6 Gateway AeroScout Engine Communications Status Radio 1 2 4 GHz MAC Address Mode Channel Operational Bandwidth Radio 2 5 GHz MAC Address Mode Channel Operational Bandwidth NOTE Figure 3 Viewing Network Interfaces Edit B4 75 0E 1A EB 00 1 192 168 20 120 255 255 255 0 10 58 85 212 192 168 50 2 192 168 20 254 fe80 675 eff fe1a eb00 64 Edt down B4 75 0E 1A EB 00 IEEE 802 11b g n 11 2462 MHz 20 B4 75 0E 1A EB 08 IEEE 802 11a n ac 149 5745 M
73. ally configured or leased from a DHCPV6 server the field is blank a aaa nanan Shows each sutomatically configured global IPv address for the L ated management interface of the E G Shows the Pv6 Link Local address which is the IPv6 address used by the local physical link The link local address is not See Rees ae HNO Lak Local nares configurable and is assigned by using the Pv6 Neighbor Discovery process SNMP Device Name Generic name to identity the type of hardware gt Captive Portal Custer Model Number Identifies the AP hardware model gt Maintenance Serial Number Shows the AP serial number emer Shows the MAC address of the AP The address shown here is Support aka eres the MAC address associated with the management interface This is the address by which the AP is known externally to other networks Shows version information about the firmware currently installed Firmware Version on the AP As new versions of the WLAN AP firmware become avaliable you can update your AP Hardware Version Identifies the AP hardware version System Uptime Provides information about the system start up time u ee The power source of montor system is the power adapter or Connecting to the AP Web Interface Using the IPv6 Address To connect to the AP by using the IPv global address or v6 Link Local address you must enter the AP address into your browser in a special format Note The folowing instructions and examples work with Microsoft Inte
74. alues are e 60o0r7 for voice e 4or5 for video The value may differ depending on other priority traffic sessions Medium Time The time that the TS traffic occupies the transmission medium The number of times the client has exceeded the Excess Usage Events medium time established for its TSPEC Minor infrequent violations are ignored VAP MAC Address The VAP MAC address Network Radio interface used by the client Station Client station MAC address TS Identifier TSPEC Traffic Session Identifier range 0 7 Access Category TS Access Category voice or video The traffic direction for this TS Direction can be e Uplink e Downlink e Bidirectional 15 LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status The number of packets and bytes received from the Figure 9 TSPEC Status and Statistics wireless client and the number of packets and bytes that were dropped after being received Also the number of packets e in excess of an admitted TSPEC e for which no TSPEC has been established when admission is required by the AP To Station The number of packets and bytes transmitted from the AP to the client and the number of packets and bytes that were dropped upon transmission Also the number of packets e in excess of an admitted TSPEC e for which no TSPEC has been established when admission is required by the AP GURTETETETPT TT PE PERLE G if
75. ame linksys_bkg jpg v T ERN EN Captive Portal Web Local Parameters Foreground Color 999999 z gt z x r i Background Color BFEFBF Web Locale This field is displayed only if Create is selected from the es sorerar Name Captive Portal Web Locale menu Enter a Web Locale Locale Label English Name to assign to the page The name can be from 1 to tgs on 32 alphanumeric characters Account Image login_key jpg hd Account Labet Enter Your Username Captive Portal This field is displayed only if Create is selected from EERE peers Instances the Captive Portal Web Locale menu From the Captive E Saswat Portal Instances list select the CP instance that this Button Label Connect a locale is associated with Fonts arial sans serif I othic a You can associate multiple locales with an instance TRA ra When a user attempts to access a particular VAP that is associated with a CP instance the locales that are associated with that instance display as links on the Browser Content Welcome to the Wireless Network authentication page The user can select a link to switch Content To start using this service enter your to that locale credentials and click the connect button A R Locale ID The ID that is automatically assigned to the locale when Acceptance Use Policy Acceptance Use Policy a it is created The ID cannot be configured Accept Label Sr eee e have The ID of the CP instance associated with the locale T
76. an AP to a backup configuration file by using HTTP 1 Select HTTP for Download Method 2 Click the Backup button A dialog box will pop up to verify the download 3 To proceed with the download select OK A dialog box will open asking you to view or save the file 4 Select the Save File option and select OK 5 Use the file browser to navigate to the directory where you want to save the file and click OK to save the file You can keep the default file name config xml or rename the backup file but be sure to save the file with an xml extension 113 LAPAC1750PRO Access Point Software User Manual Section 4 Maintenance of the Access Point Restoring Configuration You can use HTTP or TFTP to transfer files to and from the access point After you download a configuration file to the management station you can manually edit the file which is in XML format Then you can upload the edited configuration file to apply those configuration settings to the AP Use the following procedures to restore the configuration on an AP to previously saved settings by using TFTP 1 Select TFTP for Upload Method 2 Enter a name 1 to 256 characters for the backup file in the Filename field including the xml file name extension and the path to the directory that contains the configuration file to upload NOTE File name should not contain spaces lt gt amp 4 2 and successive 3 Enter the I
77. and other network information The management VLAN is VLAN 1 by default This VLAN is also the default untagged VLAN If you already have a management VLAN configured on your network with a different VLAN ID you must change the VLAN ID of the management VLAN on the AP To configure the LAN settings click the Configuration gt LAN gt VLAN and IPv4 Address tab Figure 22 VLAN and IPv4 Address VLAN and IPv4 Address LAN Interface Settings MAC Address B4 75 0E 1A EB 00 Management VLAN ID 1 Range 1 4094 Default 1 VLAN Tagging Untagged Tagged Untagged VLAN ID 1 Range 1 4094 Default 1 Connection Type DHCP v Static IP Address 192 168 1 Subnet Mask ZOD 225 EZEN ou Default Gateway 192 168 1 DNS Name Servers Dynamic Manual save The following table describes the fields to view or configure on the VLAN and IPv4 Address page Table 25 VLAN and IPv4 Address C MAC Address Shows the MAC address for the LAN interface for the Ethernet port on this AP This is a read only field that you cannot change Management The management VLAN is the VLAN associated with the IP VLAN ID address you use to access the AP The default management VLAN ID is 1 Provide a number between 1 and 4094 for the management VLAN ID 29 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point VLAN Tagging If you disable the untagged VLAN all traffic is tagged with
78. ble 31 Static WEP The Transfer Key Index indicates which WEP key the AP uses to encrypt the data it transmits with WPA devices Key indexes 1 through 4 are available The default is 1 Select the length of the key e 64bits e 128 bits Select the length of the key e ASCII e Hex There are four WEP keys can be set The keys you enter depend on the key type selected e ASCII Includes uppercase and lowercase alphabetic letters the numeric digits and special symbols such as and e Hex Hexadecimal base 16 characters 0 9 and A F Use the same number of characters for each key as specified in the Characters Required field These are the RC4 WEP keys shared with the stations using the access point Each client station must be configured to use one of these same WEP keys in the same slot as specified on the access point The number of characters you enter into the WEP Key fields is determined by the key length and key type you select For example if you use 128 bit ASCII keys you must enter 26 characters in the WEP key The number of characters required updates automatically based on how you set the key length and key type Authentication NOTE The authentication algorithm defines the method used to determine whether a client station is allowed to associate with the access point when static WEP is the security mode e Open System authentication allows any client station to associate with the WAP device w
79. cate transmit and receive totals since the reboot Wireless netwonk name Also known as the SSID this alphanumeric key uniquely identifies a To view transmit and receive statistics click the System Status gt Interface wireless local area network Statistics tab i D The SSID is set on the VAP tab See Virtual Figure 5 Interface Statistics Access Point VAP on page 43 Shows whether the interface is enabled up or disabled down Iteace ame 50 Sts UAC Adress vano MAC Address MAC address for the specified interface LAN up B475 0E 1A B 00 isatap0 down The AP has a unique MAC address for each interface Each radio has a different MAC address for each interface on each of its two radios VLAN ID Virtual LAN VLAN ID radiot vap0 LinksysSMB24G up B475 0E 1A 8 00 radiot vapt Virtual Access Point 1 down radiot vap2 Virtual Access Point 2 down radiot vap3 Virtual Access Point 3 down radiot vap4 Virtual Access Point 4 down radiot vap5 Virtual Access Point 5 down radiot vap Virtual Access Point 6 down radiot vap7 Virtual Access Point 7 down LinksysSMBSC up B4 75 0E 1A 8 08 You can use VLANs to establish multiple internal and guest networks on the same AP Virtual Access Point 1 down radio2 vap2 Virtual Access Point 2 down radio2vap3 Virtual Access Point 3 down radio2 vap4 Virtual Access Point 4 down The VLAN ID is set on the VAP tab See Virtual Access Point VAP on page 43 radio2 va
80. cters By default no address is configured This duration in minutes determines how frequently the non critical messages are sent to the SMTP Server The range is 30 1440 minutes The default is 30 minutes Configures the severity level for log messages that are considered to be urgent Messages in this category are sent immediately The security level you select and all higher levels are urgent e Emergency indicates system is unusable It is the highest level of severity Alert indicates action must be taken immediately Critical indicates critical conditions Error indicates error conditions Warning indicates warning conditions Notice indicates normal but conditions significant Informational indicates informational messages Debug indicates debug level messages Configures the severity level for log messages that are considered to be non urgent Messages in this category are collected and sent in a digest form at the time interval specified by the Log Duration field The security level you select and all levels up to but not including the lowest urgent level are considered non urgent Messages below the security level you specify are not sent via email See the Urgent Message field description for information about the security levels Section 3 Configuring the Access Point Mail Server Configuration Mail Server Address Mail Server Security Mail Server Port Message Configuration To Address
81. d backup RADIUS servers The server at RADIUS IP Address 1 uses RADIUS Key 1 RADIUS IP Address 2 uses RADIUS Key 2 and so on 48 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Enable RADIUS Accounting Active Server Broadcast Key Refresh Rate Session Key Refresh Rate Select this option to track and measure the resources a particular user has consumed such as system time amount of data transmitted and received and so on If you enable RADIUS accounting it is enabled for the primary RADIUS server and all backup servers The RADIUS IP address and key for up to four RADIUS servers can be configured on the AP Select which of the four RADIUS servers the VAP should contact to authenticate wireless clients Enter a value to set the interval at which the AP will refresh session unicast keys for each client associated to the VAP The valid range is 0 86400 seconds A value of 0 indicates that the broadcast key is not refreshed Enter a value to set the interval at which the AP will refresh session unicast keys for each client associated to the VAP Scheduler The Radio and VAP Scheduler is a standalone LAPAC1750PRO Access Point feature To configure the Radio and VAP scheduler select the Scheduler tab in the Manage section The Radio and VAP Scheduler allows you to configure a rule with a specific time interval for VAPs or radios to be operational thereby automat
82. d by the user e RW A read write group using authentication and data encryption Users in this group use an MD5 key password for authentication and a DES key password for encryption Both the MD5 and DES key passwords must be defined By default users of this group will have read and write access to default all MIB view which can be modified by the user NOTE The default groups RO and RW cannot be deleted NOTE The Access Point supports a maximum of 8 groups To define additional groups navigate to the Configuration gt SNMP gt Groups page and configure the settings that Table 52 describes Figure 44 SNMP Groups Groups Name Security Level Write Views Read Views noAuthentication noPrivacy X view all X view all X SNMPv3 GROUPS RO authPriv view none view all RW authPriv view all view alll Table 52 SNMP Groups es ee Specify a name to use to identify the group The default group names are RW and RO Group names can contain up to 32 alphanumeric characters Security Level Select one of the following security levels for the group e noAuthentication noPrivacy No authentication and no data encryption no security Authentication noPrivacy Authentication but no data encryption With this security level users send SNMP messages that use an MD5 key password for authentication but not a DES key password for encryption Authentication Privacy Authentication and data encryption W
83. d in the datagram header The port range is 0 65535 and includes three different types of ports e 0 1023 Well Known Ports e 1024 49151 Registered Ports e 49152 65535 Dynamic and or Private Ports Select this field and enter a value to use the packet s Type of Service bits in the IP header as match criteria The IP TOS field in a packet is defined as all eight bits of the Service Type octet in the IP header The TOS Bits value is a two digit hexadecimal number from 00 to ff The high order three bits represent the IP precedence value The high order six bits represent the IP Differentiated Services Code Point DSCP value LAPAC1750PRO Access Point Software User Manual IP TOS Mask Enter an IP TOS mask value to identify the bit positions in the TOS Bits value that are used for comparison against the IP TOS field in a packet The TOS Mask value is a two digit hexadecimal number from 00 to ff representing an inverted i e wildcard mask The zero valued bits in the TOS Mask denote the bit positions in the TOS Bits value that are used for comparison against the IP TOS field of a packet For example to check for an IP TOS value having bits 7 and 5 set and bit 1 clear where bit 7 is most significant use a TOS Bits value of a0 and a TOS Mask of 00 This is an optional configuration IPv6 ACL Protocol Select the Protocol field to use a Layer 3 or Layer 4 protocol match condition based on the value of the IP Protocol field i
84. d in the drop down list is simply to help you identify the correct MAC address for the destination AP This SSID is a separate SSID to that which you set for the WDS link The two do not and should not be the same value or name You can use no encryption or WPA PSK on the WDS link If you are unconcerned about security issues on the WDS link you may decide not to set any type of encryption Alternatively if you have security concerns you can choose WPA PSK In WPA PSK mode the AP uses WPA2 PSK with CCMP AES encryption over the WDS link Note In order to configure WPA PSK on any WDS link VAPO of the selected radio must be configured for WPA PSK or WPA Enterprise C Spanning Tree Spanning Tree Protocol STP prevents switching loops If you select None as your preferred WDS encryption option you will not be asked to fill in any more fields on the WDS Bridge page All data transferred Mode STP is recommended if you configure WDS links between the two APs on the WDS link will be unencrypted Select Enabled to use STP NOTE Select Disabled to turn off STP links not recommended To disable a WDS link you must remove the value configured in the Remote Address field For each WDS link on a two radio AP select Radio 1 or Radio 2 The rest of the settings for the link apply to the radio selected in this field The read only local address will change depending on which radio you select in this field Indicates the M
85. de The radios configured in 2 4 GHz IEEE 802 11 mode or any of the 5GHZ modes cannot detect AeroScout tags Note The AE protocol allows access points to mark detected APs as rogue devices The LAPAC1750PRO APs do not support this feature and never report detected APs as rogues 35 LAPAC1750PRO Access Point Software User Manual Channel Channel Bandwidth 802 11n and 802 11ac modes only Select the Channel The range of available channels is determined by the mode of the radio interface and the country code setting If you select Auto for the channel setting the AP scans available channels and selects a channel where no traffic is detected The channel defines the portion of the radio spectrum the radio uses fortransmitting and receiving Each mode offers a number of channels depending on how the spectrum is licensed by national and transnational authorities such as the Federal Communications Commission FCC or the International Telecommunication Union ITU R When automatic channel assignment is enabled on the Channel Management page for Clustering the channel policy for the radio is automatically set to static mode and the Auto option is not available for the Channel field This allows the automatic channel feature to set the channels for the radios in the cluster The 802 11n specification allows a 40 MHz wide channel in addition to the legacy 20 MHz channel available with other modes The 40 MHz channel enabl
86. devices on the network across a Wireless Distribution System WDS link and with other wireless clients associated with a different VAP but not among wireless clients AeroScout Engine Protocol Support Section 3 Configuring the Access Point Options are Enabled or Disabled The default is Disabled When enabled Aeroscout devices are recognized and data is sent to an Aeroscout Engine AE for analysis The AE determines the geographical location of 802 11 capable devices such as STAs APs and AeroScout s line of 802 11 enabled RFID devices or tags The AE communicates with APs that support the AE protocol in order to collect information about the RF devices detected by the APs Using the AE protocol LAPAC1750PRO supports direct communication between AE and the APs When operating in managed mode the AE is configured with the IP address of the managed access points from which it collects information The Wireless Switch cannot communicate with the AE Note Only AeroScout tag hardware of types T2 and T3 are explicitly supported Other tag models are also supported only if their implementation of the AeroScout protocol conforms to the AeroScout Engine Access Point Interface Specification version 2 1 Note AeroScout tags operate only in 802 11 b g mode Therefore network administrators who use the AeroScout tags must configure at least one radio on APs that are expected to detect tags in either 802 11b g or 802 11b g n mo
87. dio 1 2 4 GHz v Virtual Access Point VAP Table Broadcast Band VAP Enabled VLANID SSID as Steer Security MAC Authentication 0 I 1 LinksysSMB24G 7 C None v Disabed v 1 i 1 rtual Access Point 1 a id None Disabled 2 E 1 tual Access Point 2 _None v disables 3 1 t Disabled v 4 A 1 Virtual Access t None 1 5 1 t 6 E 7 1 t e o Table 30 Virtual Access Point Settings Gaa a Select the radio to configure VAPs are configured independently on each radio You can configure up to eight VAPs for each radio VAPO is the physical radio interface so to disable VAPO you must disable the radio Enabled You can enable or disable a configured network If you disable the specified network you will lose the VLAN ID you entered LAPAC1750PRO Access Point Software User Manual VLAN ID When a wireless client connects to the AP using this Broadcast SSID VAP the AP tags all traffic from the wireless client with the VLAN ID you enter in this field unless you enter the untagged VLAN ID or use a RADIUS server to assign a wireless client to a VLAN The range for the VLAN ID is 1 4094 If you use RADIUS based authentication for clients you can optionally add the following attributes to the appropriate file in the RADIUS or AAA server to configure a VLAN for the client e Tunnel Type Tunnel Medium Type e Tunnel Private Group ID The RADIUS assign
88. displays in the page body below the user name and password text boxes The range is from 0 to 256 characters The default is To start using this service enter your credentials and click the connect button The text that appears in the Acceptance Use Policy box The range is from 0 to 8192 characters The default is Acceptance Use Policy The text that instructs users to select the check box to acknowledge reading and accepting the Acceptance Use Policy The range is from 0 to 128 characters The default is Check here to indicate that you have read and accepted the Acceptance Use Policy The text that displays in a pop up window when a user submits login credentials without selecting the Acceptance Use Policy check box The range is from 1 to 128 characters The default is Error You must acknowledge the Acceptance Use Policy before connecting The text that displays during authentication The range is from 1 to 128 characters The default is Connecting please be patient The text that displays when a user fails authentication The range is from 1 to 128 characters The default is Error Invalid Credentials please try again The text that displays when the client has authenticated to the VAP The range is from 1 to 128 characters The default is Congratulations LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Welcome The text that displays when the client has connected to
89. e When acting as a repeater the AP does not have a wired connection to the LAN and repeats signals by using the wireless connection No special configuration is required for the AP to function as a repeater and there are no repeater mode settings Wireless clients can still connect to an AP that is operating as a repeater To specify the details of traffic exchange from this access point to others click the Configuration gt Wireless gt WDS Bridge tab Section 3 Configuring the Access Point Figure 32 WDS Bridge WDS Bridge Spanning Tree Mode WDS0 Status Radio Local Address WDS Interface Remote Address Encryption WDS1 Status Radio Local Address WDS Interface Remote Address Encryption WDS2 Status Radio Local Address WDS Interface Remote Address Encryption WDS3 Status Radio Local Address WDS Interface Remote Address Encryption Enabled Disabled down Radio 1 2 4GHz B4 75 0E 1A EB 00 Enabled Disabled eo text gt down Radio 1 2 4 GHz v B4 75 0E 1A EB 00 Enabled Disabled Non t down Radio 1 2 4 GHz v 75 0E 1A EB 00 Enabled Disabled E down Radio 1 2 4 GHz v B4 75 0E 1A EB 00 Enabled Disabled 55 LAPAC1750PRO Access Point Software User Manual Before you configure WDS on the AP note the following guidelines When using WDS be sure to configure WDS settings on both APs participating in t
90. e re assigned However if you re set the minimal channel interference benefit to 25 percent and click Save the proposed channel plan will be implemented and channels re assigned as needed Determine if there is better set of Use the drop down menu to specify channels every the schedule for automated updates A range of intervals is provided from 30 minutes to 6 months The default is 1 Hour channel usage re assessed and the resulting channel plan applied every hour Click Save under Advanced settings to apply these settings Advanced settings will take affect when they are applied and influence how automatic channel management is performed Wireless Neighborhood The Wireless Neighborhood shows up to 20 access points per radio within range of every member of the cluster shows which access points are within range of which cluster members and distinguishes between cluster members and nonmembers NOTE The Wireless Neighborhood page shows up to 20 access points per radio To see all the access points detected on a given cluster access point navigate to that cluster member s web interface For each neighbor access point the Configuration gt Cluster gt Wireless Neighborhood view shows identifying information SSID or Network Name IP address MAC address along with radio statistics signal strength channel beacon interval You can click on an AP to get additional statistics about the APs in radio range of t
91. e 23 Discovery Bonjour Field Description S O Bonjour Enables or disables Bonjour The default is Enabled Status The access point uses a default AP IP address assignment if a DHCP server is absent in the network There is no implementation of IPv4 Link Local Addressing or IPv6 Stateless Address Auto configuration for the access point DNS SD and mDNS are used for advertisement of services and hostname lookup The service types listed in the following table are defined by the DNS SD records and advertised via mDNS by the Bonjour component The Bonjour component works in both IPv4 and IPv6 networks Table 24 Bonjour Status Service Types AP management Web UI https AP switch management Web UI 28 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point LAN This section describes how to manage the access point and contains the following subsections e VLAN and IPv4 Address e Pv6 Address IPv6 Tunnel The configuration pages for the features in this section are located under the Manage heading on the Administration Web UI VLAN and IPv4 Address The default wired interface settings which include DHCP and VLAN information might not work for all networks By default the DHCP client on the access point automatically broadcasts requests for network information If you want to use a static IP address you must disable the DHCP client and manually configure the IP address
92. e DiffServ policies and to associate a collection of classes with one or more policy statements The access point supports up to 50 policy maps Packets are classified and processed based on defined criteria The classification criteria are defined by class on the Class Map page The processing is defined by a policy s attributes on the Policy Map page Policy attributes may be defined on a per class instance basis and it is these attributes that are applied when a match occurs A policy map can contain up to 10 class maps When the policy is active the actions taken depend on which class matches the packet Packet processing begins by testing the class match criteria for a packet A policy is applied to a packet when a class match within that policy is found NOTE The Policy Map page displays the policy configuration fields only if a policy map has been created To create a policy map enter a name in the Policy Map Name field and click Add Policy Map To create a DiffServ policy click the Configuration gt Qos and Access Control gt Policy Map tab The following image shows the page after a policy map has been created 78 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Figure 40 QoS DiffServ Policy Map Table 48 DiffServ Policy Map Policy Map Configuration eee ree Policy Map Name Enter then name of the policy map to s 1 31 characters i
93. e Email Alert settings you must click Save to apply the changes and save the changes to startup configuration file NOTE Hostnames are composed of a series of labels joined with dots as are all domain names Each label must be between 1 and 63 characters long and the entire hostname including dots has a maximum of 253 characters To validate the configured email server credentials click Test Mail You can send a test email once the email server details are configured The following text shows an example of an email alert sent from the AP to the network administrator From AP 192 168 2 10 mailserver com Sent Wednesday February 08 2012 11 16 AM To administrator mailserver com Subject log message from AP TIME Message Feb 8 03 48 25 login 1457 root login on ttyp0 Feb 8 03 48 26 info mini_http ssl 1175 Max concurrent connections of 20 reached Management Access You can create an access control list ACL that lists up to five IPv4 hosts and five IPv6 hosts that are authorized to access the AP management interface If this feature is disabled anyone can access the management interface from any network client by supplying the correct AP user name and password Figure 18 Management Access Management Access Management ACL Mode Enabled Disabled IP Address 1 006 200 100 100 IP Address 2 001 200 200 200 IP Address 3 100 200 200 100 IP Address 4 9001 20 20 2001 IP Address 5 006 200
94. e IP address for that access point as a URL directly into a Web browser address bar in the following form http IPAddressOfAccessPoint where IPAddressOfAccessPoint is the address of the particular access point you want to monitor or configure Sessions The Sessions page shows information on client stations associated with access points in the cluster Each client is identified by its MAC address along with the AP location to which it is currently connected This page shows a maximum of 20 clients per radio of the clustered APs See all clients associated with a particular AP view the Status and Statistics gt Associations Clients web page directly on that AP To view a particular statistic for client sessions select an item from the Display drop down list and click Go You can view information about idle time data rate signal strength and so on all of which are described in detail in the table below A session in this context is the period of time in which a user on a client device station with a unique MAC address maintains a connection with the wireless network The session begins when the client logs on to the network and the session ends when the client either logs off intentionally or loses the connection for some other reason NOTE A session is not the same as an association which describes a client connection to a particular access point A client network connection can shift from one clustered AP to another within the
95. e Known AP List it will not be detected as a rogue To import an AP list from a file use the following steps 1 Choose whether to replace the existing Known AP List or add the entries in the imported file to the Known AP List e Select Replace to import the list and replace the contents of the Known AP List e Select Merge to import the list and add the APs in the imported file to the APs currently displayed in the Known AP List 2 Click Browse and choose the file to import The file you import must be a plain text file with a txt or cfg extension Entries in the file are MAC addresses in hexadecimal format with each octet separated by colons for example 00 1 1 22 33 44 55 Separate entries with a single space For the AP to accept the file it must contain only MAC addresses 3 Click Import Once the import is complete the screen refreshes and the MAC addresses of the APs in the imported file appear in the Known AP List 42 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Virtual Access Point VAP Virtual Access Points VAPs segment the wireless LAN into multiple broadcast domains that are the wireless equivalent of Ethernet VLANs VAPs simulate multiple APs in one physical AP Each radio supports up to 8 VAPs For each VAP you can customize the security mode to control wireless client access Each VAP can also have a unique SSID Multiple SSIDs make a single AP look like
96. e e the Acceptance Ree T Instance Name The user configured name of the CP instance Acceptance Use Policy before connecting i Background The image to display as the page background You can a Image Name click Upload Delete Custom Image to upload images to X the AP for use with Captive Portal instances Denied Text Bowe Credentials please try an i Logo Image The image file to display on the top left corner of the Welcome Tite Congratulations 5 Name page This image is used for branding purposes such as A the company logo If you uploaded a custom logo image Welcome Content You are now autorize ana z to the access point you can select it from the list Delete Locale a 94 LAPAC1750PRO Access Point Software User Manual Foreground color Background color Section 3 Configuring the Access Point The HTML code for the foreground color in 6 digit Browser Title The text to display in the browser title bar The range is hexadecimal format The range is from 1 to 32 from 1 to 128 characters The default is Captive Portal characters The default is 999999 Browser The HTML code for the background color in 6 digit Content hexadecimal format The range is from 1 to 32 characters The default is BFBFBF Content The HTML code for the color of the thick horizontal line that separates the page header from the page body in 6 digit hexadecimal format The range is from 1 to 32 character
97. e following subsections General Views Groups Targets Users General Simple Network Management Protocol SNMP defines a standard for recording storing and sharing information about network devices SNMP facilitates network management troubleshooting and maintenance The AP supports SNMP versions 1 2 and 3 Unless specifically noted all configuration parameters on this page apply to SNMPv1 and SNMPv2c only Key components of any SNMP managed network are managed devices SNMP agents and a management system The agents store data about their devices in Management Information Bases MIBs and return this data to the SNMP manager when requested Managed devices can be network nodes such as APs routers switches bridges hubs servers or printers The access point can function as an SNMP managed device for seamless integration into network management systems such as HP OpenView Download LAPAC1750PRO specific MIB files at www linksys com business support From the SNMP page under the Services heading you can start or stop control of SNMP agents configure community passwords access MIBs and configure SNMP Trap destinations To configure SNMP click the Configuration gt SNMP gt General tab and save the fields described in Table 50 on page 82 81 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Figure 42 SNMP General General Global Sett
98. e is from 0 to 300 Mbps The default is 0 Delete User To delete the current user select this option and click Save Authenticated Clients The Authenticated Clients page provides information about clients that have authenticated on any captive portal instance Click the Configuration gt Captive Portal gt Authenticated Clients tab to access the page which the following figure shows Figure 56 CP Authenticated Clients Authenticated Clients Total Number of Authenticated Clients 0 MAC Address IPAddress UserName Protocol Mode Verify Mode VAPID RadiolD Captive PortaliD Session Time Out AwayTime Out Rx Packets TxPackets RxBytes Tx Bytes The following table describes the fields on the CP Authenticated Clients page Table 64 Captive Portal Authenticated Client List a ae Total Number of The number of clients that have successfully Authenticated authenticated on any CP instance This Clients number includes only clients that are currently authenticated MAC Address The MAC address of the client IP Address The IPv4 or IPv6 address of the client If the client has a valid IPv4 address assigned it will be displayed here otherwise a global IPv6 address either from DHCPv6 or Autoconfiguration or statically configured will be used UserName The client s Captive Portal user name Protocol Mode The protocol the user used to establish the connection HTTP or HTTPS Verify Mode The method used to authenticate the us
99. e online help is a subset of the information available in the LAPAC1750PRO Access Point Administrator s Guide Online help information corresponds to each page on the access point Administration UI For information about the settings on the current page click the link on the right side of a page or the More link at the bottom of the help panel on the UI The following figure shows an example of the online help available from the links on the user interface LAPAC1750PRO Access Point Software User Manual Section 1 Getting Started Figure 1 Administrator UI Online Help t System Summary From the System Summary page you can view various information about the access point AP including IP and MAC address information Field Description Shows the IP address assigned to the AP This field is not Pv4 Address editable on this page because the IP address is already assigned ether by DHCP or statically through the Ethernet Settings page TSPEC Client Association Shows the IPv6 address assigned to the AP This field is not editable on this page because the IP address is already assigned iS se od Sea pitta ether by DHCPY6 or statically through the Management IPv6 TSPEC AP Statist page i Shows the operational status of the static IPv6 address assigned eee to the management interface of the AP The possible values are system Log IPV6 Address Status Operational and Tentative Note if an Pv6 address has not been manu
100. e selected upload method is TFTP this field displays a text box Enter the filename of the certificate to upload to the AP Note File name should not contain spaces lt gt amp 3 2 and successive The IPv4 or IPv6 address of the TFTP server where the file is located The default is 0 0 0 0 NOTE Click Save to apply the changes and save the changes to startup configuration file If you disable the protocol you are currently using to access the AP management interface the current connection will end and you will not be able to access the AP by using that protocol until it is enabled 27 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Discovery LLDP Link Layer Discovery Protocol LLDP is defined by the IEEE 802 1AB standard and allows the access point to advertise information about itself such as the system name port name system capabilities and power requirements This information can help you identify system topology and detect bad configurations on the LAN The AP also supports the Link Layer Discovery Protocol for Media Endpoint Devices LLDP MED which standardizes additional information elements that devices can pass to each other to improve network management To configure LLDP settings click the Services gt LLDP tab and update the fields as described in Table 22 Figure 20 Discovery LLDP Discovery LLDP LLDP Mode Enabled
101. e wireless network Associated Client The associated clients are displayed along with information about packet traffic transmitted and received for each station Click the System Status gt Associations Client tab Figure 7 Association Client Associated Clients Total Number of Associated Clients 0 Associated Client Table Network Station Status From Station To Station Avensis Associates pacteis Bries Oop Pacieis Drop Bytes TS viete te Paces Bytes Drop Facets ropes TS Voete Pes Table 9 Associated Clients ee ee ee Shows which VAP the client is associated with For example an entry of wlanOvap2 means the client is associated with Radio 1 VAP 2 An entry of wlan0 means the client is associated with VAP 0 on Radio 1 An entry of wlan1 means the client is associated with VAP 0 on Radio 2 aaa Shows the MAC address of the associated wireless client 13 LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status The Authenticated and Associated Status shows the To Station underlying IEEE 802 11 authentication and association status which is present no matter which type of security the client uses to connect to the AP This status does not show other IEEE 802 1X authentication or association The number of packets sent from the AP to the wireless status client These fields report information about traffic sent from the AP to a wireless client
102. eams Select one of the following options e On The AP transmits the same data stream on multiple antennas at the same time Off The AP does not transmit the same data on multiple antennas Protection Beacon Interval DTIM Period Section 3 Configuring the Access Point The protection feature contains rules to guarantee that 802 11 transmissions do not cause interference with legacy stations or applications By default these protection mechanisms are enabled Auto With protection enabled protection mechanisms will be invoked if legacy devices are within range of the AP You can disable Off these protection mechanisms When protection is off legacy clients or APs within range can be affected by 802 11n transmissions Protection is also available when the mode is 802 11b g When protection is enabled in this mode it protects 802 11b clients and APs from 802 11g transmissions Note This setting does not affect the ability of the client to associate with the AP Beacon frames are transmitted by an AP at regular intervals to announce the existence of the wireless network The default behavior is to send a beacon frame once every 100 milliseconds or 10 per second Enter a value from 20 to 2000 milliseconds Specify a DTIM period from 1 to 255 beacons The Delivery Traffic Information Map DTIM message is an element included in some beacon frames It indicates which client stations currently sleeping in lo
103. ed VLAN ID overrides the VLAN ID you configure on the VAP page You configure the untagged and management VLAN IDs on the VLAN and IPv4 Address page Enter a name for the wireless network The SSID is an alphanumeric string of up to 32 characters You can use the same SSID for multiple VAPs or you can choose a unique SSID for each VAP Note If you are connected as a wireless client to the same AP that you are administering resetting the SSID will cause you to lose connectivity to the AP You will need to reconnect to the new SSID after you save this new setting Band Steer Section 3 Configuring the Access Point Specify whether to allow the AP to broadcast the Service Set Identifier SSID in its beacon frames The Broadcast SSID parameter is enabled by default When the VAP does not broadcast its SSID the network name is not displayed in the list of available networks on a client station Instead the client must have the exact network name configured in the supplicant before it is able to connect To enable the SSID broadcast select the Broadcast SSID check box e To prohibit the SSID broadcast clear the Broadcast SSID check box Note Disabling the broadcast SSID is sufficient to prevent clients from accidentally connecting to your network but it will not prevent even the simplest of attempts by a hacker to connect or monitor unencrypted traffic Suppressing the SSID broadcast offers a very minimal level of pr
104. eger of 32 bits The default is 0 Time Since The time and date when the last email alert was sent The Last Email Sent AP uses the system time to report the information If an email has not been sent since the device was reset the status is not sent System Log From the System Log page you can view the most recent system log generated by this AP To view the Email Alert Operational Status click the System Status gt System Log tab To configure the Log settings see Log Settings on page 21 Figure 12 System Log System Log Time Settings Type Service Description May 8 2014 02 21 17 info dman 1061 The AP startup configuration was updated successfully May 8 2014 02 21 17 info dman 1061 The AP startup configuration was updated successfully Table 14 System Log pe eee Time Settings The system time when the event occurred Specify the type of the log messages to write to non volatile memory emerg emergency alert alert crit critical err error warn warning notice notice info info e debug debug Service The software component associated with the log 18 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Section 3 Configuring the Access Point e Administration e LAN e Wireless e Security e QoS and Access Control SNMP e Captive Portal e Cluster Administration This section describes how to set up your
105. ents that support the original WPA Table 32 WPA Personal me a E WPA Select the types of client stations you want to support Versions WPA If all client stations on the network support the original WPA but none support the newer WPA2 then select WPA WPA2 If all client stations on the network support WPA2 we suggest using WPA2 which provides the best security per the IEEE 802 11i standard WPA and WPA2 If you have a mix of clients some of which support WPA2 and others which support only the original WPA select both of the check boxes This lets both WPA and WPA2 client stations associate and authenticate but uses the more robust WPA2 for clients who support it This WPA configuration allows more interoperability at the expense of some security Cipher Select the cipher suite you want to use Suites e TKIP CCMP AES TKIP and CCMP AES TKIP and AES clients can associate with the AP WPA clients must have one of the following to be able to associate with the AP Avalid TKIP key Avalid AES CCMP key Clients not configured to use WPA Personal will not be able to associate with the AP The pre shared key is the shared secret key for WPA Personal Enter a string of between 8 and 63 characters Acceptable characters include upper and lower case alphabetic letters the numeric digits and special symbols such as and Broadcast Enter a value to set the interval at which the broadcast group K
106. er handheld portable or stationary device equipped with a Wi Fi adapter and supporting drivers In order to connect to the access point wireless clients need the software and hardware described in the following table Table 2 Requirements for Wireless Clients Wi Fi Client Adapter Portable or built in Wi Fi client adapter that supports one or more of the IEEE 802 11 modes in which you plan to run the access point IEEE 802 11a 802 11b 802 11g 802 11n and 802 11ac modes are supported Section 1 Getting Started Wireless Client Client software such as Microsoft Windows Software Supplicant configured to associate with the access point Client Security Security should be disabled on the client used to Settings do initial configuration of the access point If the Security Mode on the access point is set to anything other than plain text wireless clients will need to set a profile to the authentication mode used by the access point and provide a valid username and password certificate or similar user identity proof Security modes are Static WEP IEEE 802 1X WPA with RADIUS server and WPA PSK For information about configuring security on the access point see Virtual Access Point VAP Online Help Supported Browsers and Limitations Online help for the access point Administration Web pages provides information about all fields and features available from the user interface Ul The information in th
107. er on the Captive Portal which can be one of these values Guest The user does not need to be authenticated by a database Local The access point uses a local database to authenticated users RADIUS The access point uses a database on a remote RADIUS server to authenticate users LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point VAP ID The VAP that the user is associated with Radio ID The ID of the radio Because the WAP321 has a single radio this field always displays Radio1 Captive Portal ID The ID of the Captive Portal instance to which the user is associated Session Timeout The time remaining in seconds for the CP session to be valid After the time reaches zero the client is deauthenticated Away Timeout The time remaining in seconds for the client to be valid The timer starts when the client dissociates from the CP After the time reaches zero the client is deauthenticated Rx Packets The number of IP packets received by the access point from the user station Tx Packets The number of IP packets transmitted from the access point to the user station Rx Bytes The number of bytes received by the access point from the user station The number of bytes transmitted from the access point to the user station Failed Authentication Clients The Failed Authenticated Clients page lists information about clients that attempted to authenticate on a Captive Portal
108. eric format Special characters are not permitted Host Type Specify whether the enabled host is an IPv4 host or an IPv6 host Hostname or Enter the DNS hostname of the computer to which IP address you want to send SNMP traps The valid range is 1 256 characters An example of a DNS hostname is snmptraps foo com Since SNMP traps are sent randomly from the SNMP agent it makes sense to specify where exactly the traps should be sent You can add up to a maximum of three DNS hostnames Ensure you select the Enabled check box beside the appropriate hostname NOTE After you configure the SNMP settings you must click Save to apply the changes Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low NOTE Hostnames are composed of series of labels concatenated with dots as are all domain names Each label must be between 1 and 63 characters long and the entire hostname including the delimiting dots has a maximum of 253 characters 83 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Views A MIB view is a family of view subtrees which is a pairing of an OID subtree value together with a bit string mask value Each MIB view is defined by two sets of view subtrees included in or excluded from the MIB view You can create MIB vi
109. ers Users Name Group Authentication Type Authentication Key Encryption Type Encryption Key RO MDS DES SNMPv3 USERS Table 54 describes the fields to configure SNMP users Table 54 SNMP Users Enter the user name to identify the SNMP user User names can contain up to 32 alphanumeric characters Map the user to a group The default groups are RW and RO You can define additional groups on the SNMP Groups page Authentication Select the type of authentication to use on SNMP Type requests from the user e MD5 Require MD5 authentication on SNMP requests from the user None SNMP requests from this user require no authentication 87 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Authentication Key If you specify MD5 as the authentication type enter a password to enable the SNMP agent to authenticate requests sent by the user Note The passphrase must be between 8 and 32 characters in length If you wish to use a space in the phrase you must use quotation marks ex Admin 123 or the phrase will be truncated as Admin Encryption Type Select the type of privacy to use on SNMP requests from the user e DES Use DES encryption on SNMP requests from the user e None SNMP requests from this user require no privacy Encryption Key If you specify DES as the privacy type enter a key to use to encrypt the SNMP requests Note The passphrase must
110. es higher data rates but leaves fewer channels available for use by other 2 4 GHz and 5 GHz devices The 802 11ac specification allows an 80 MHz wide channel in addition to the 20 MHz and 40 MHz channels Set the field to 20 MHz to restrict the use of the channel bandwidth to a 20 MHz channel For the 802 11ac mode set the field to 40 MHz to prevent the radio from using the 80 MHz channel bandwidth Primary Channel 802 11n modes only Short Guard Interval Supported Section 3 Configuring the Access Point This setting can be changed only when the channel bandwidth is set to 40 MHz A 40 MHz channel can be considered to consist of two 20 MHz channels that are contiguous in the frequency domain These two 20 MHz channels are often referred to as the Primary and Secondary channels The Primary Channel is used for 802 11n clients that support only a 20 MHz channel bandwidth and for legacy clients Select one of the following options e Upper Set the Primary Channel as the upper 20 MHz channel in the 40 MHz band Lower Set the Primary Channel as the lower 20 MHz channel in the 40 MHz band This field is available only if the selected radio mode includes 802 11n The guard interval is the dead time in nanoseconds between OFDM symbols The guard interval prevents Inter Symbol and Inter Carrier Interference ISI ICI The 802 11n mode allows for a reduction in this guard interval from the a and g definition of 800
111. es using a wireless connection to the internal network For wireless connection to the access point your administration device will need Wi Fi capability similar to that of any wireless client a portable or built in Wi Fi client adapter that supports one or more of the IEEE 802 11 modes in which you plan to run the access point LAPAC1750PRO Access Point Software User Manual Web Browser and Operating System Configuration and administration of the access point is provided through a Web based user interface hosted on the access point We recommend using one of the following supported Web browsers to access the access point Administration Web pages e Microsoft Internet Explorer version 9 x or 11 x with up to date patch level for either major version e Mozilla Firefox version 26 x Google Chrome version 32 x e Safari version 5 x The administration Web browser must have JavaScript enabled to support the interactive features of the administration interface Security Settings Ensure that security is disabled on the wireless client used to initially configure the access point Wireless Client Requirements The access point provides wireless access to any client with a properly configured Wi Fi client adapter for the 802 11 mode in which the access point is running The access point supports multiple client operating systems Clients can be laptop or desktop computers personal digital assistants PDAs or any oth
112. etry limit or the long retry limit Transmit Retry Number of times an MSDU is successfully transmitted after Count one or more retries Section 2 Viewing Access Point System Status Multiple Retry Number of times an MSDU is successfully transmitted after Count more than one retry RTS Success Count of CTS frames received in response to an RTS frame Count RTS Failure Count of CTS frames not received in response to an RTS Count frame ACK Failure Count of ACK frames not received when expected Count FCS Error Count Count of FCS errors detected in a received MPDU frame Transmitted Count of each successfully transmitted MSDU Frame Count Count of encrypted frames received where EE 1 The key configuration of the transmitter indicates that Count the frame should not have been encrypted 2 The frame was discarded due to the receiving station not implementing the privacy option LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status nterface Stati stics Table 7 Interface Statistics The Interface Statistics page provides some basic information about the AP and Field Description sid a real time display of transmit and receive statistics for the Ethernet interface Interface Status Table on the AP and for the VAPs on both radio interfaces All transmit and receive statistics shown are totals since the AP was last started If you reboot the AP these figures indi
113. ew deploy configure and secure the wireless network as a single entity rather than a series of separate wireless devices e Access Points Sessions e Channel Management e Wireless Neighborhood Access Points The AP cluster is a dynamic configuration aware group of APs in the same subnet of a network Each cluster can have up to 10 members Only one cluster per wireless network is supported however a network subnet can have multiple clusters Clusters can share various configuration information such as VAP settings and QoS queue parameters A cluster can be formed between two APs if the following conditions are met e The APs use the same radio mode for example radio 1 uses 802 119 e The APs are connected on the same bridged segment e The APs joining the cluster have the same Cluster Name e Clustering mode is enabled on both APs NOTE For two APs to be in the same cluster they do not need to have the same number of radios however the supported capabilities of the radios should be same Clustering Single and Dual Radio APs Clusters can contain a mixture of APs with two radios and APs with a single radio When the configuration of a single radio AP in the cluster changes the AP propagates the change to the first radio of all cluster members The configuration of the second radio on any dual radio APs in the cluster is not affected If a cluster contains only single radio APs and a dual radio AP joins the clus
114. ews to control the OID range that SNMP users can access Note that the access point supports a maximum of 16 views The following notes summarize some critical guidelines regarding SNMP View configuration Please read all the notes before proceeding with SNMP View configuration NOTE A MIB view called all is created by default in the system This view contains all management objects supported by the system NOTE By default view all and view none SNMP views are created on the AP These views cannot be deleted but OID Masks and Type fields can be modified Figure 43 SNMP Views Configuration Views View Name Type OID Mask included X SNMPv3 VIEWS view al included 1 view none excluded 1 To display the SNMP Views Configuration page click the Configuration gt SNMP gt Views tab Table 51 describes the fields you can configure on the Views page Table 51 SNMP Views C ee View Name Enter a name to identify the MIB view View names can contain up to 32 alphanumeric characters Type Specifies whether to include or exclude the view subtree or family of subtrees from the MIB view Enter an OID string for the subtree to include or exclude from the view For example the system subtree is specified by the OID string 1 3 6 1 2 1 1 A family mask is used to define a family of view subtrees The family mask indicates which sub identifiers of the associated family OID string are significant to the family
115. ey Refresh key is refreshed for clients associated to this VAP the default Rate is 300 The valid range is 0 86400 seconds A value of 0 indicates that the broadcast key is not refreshed WPA Enterprise WPA Enterprise with RADIUS is an implementation of the Wi Fi Alliance IEEE 802 111 standard which includes CCMP AES and TKIP mechanisms The Enterprise mode requires the use of a RADIUS server to authenticate users This security mode is backwards compatible with wireless clients that support the original WPA Table 33 WPA Enterprise Field Description S WPA Versions Select the types of client stations you want to support e WPA If all client stations on the network support the original WPA but none support the newer WPA2 then select WPA WPA2 If all client stations on the network support WPA2 we suggest using WPA2 which provides the best security per the IEEE 802 11i standard WPA and WPA2 If you have a mix of clients some of which support WPA2 and others which support only the original WPA select both WPA and WPA2 This lets both WPA and WPA2 client stations associate and authenticate but uses the more robust WPA2 for clients who support it This WPA configuration allows more interoperability at the expense of some security 47 LAPAC1750PRO Access Point Software User Manual Enable pre authentication Cipher Suites Use Global RADIUS Server Settings If for WPA versions you select only W
116. figure mail server settings to set the severity level that triggers alerts and to add up to three email addresses where urgent and non urgent email alerts are sent Figure 17 Configuring Email Alert Email Alert Global Configuration Admin Mode Enabled amp Disabled From Email Address Range 1 255 characters Log Duration 30 minutes Range 30 1440 Default 30 Urgent Message Severity Alert hd Non Urgent Severity Warning bd Mail Server Configuration Mail Server Address 00 00 00 00 Hostname max 255 characters Mail Server Security nsi v Mail Server Port 465 Range 0 65535 Default 465 Username Range 1 64 characters Password Range 1 64 characters Message Configuration To Address 1 Range 0 255 characters To Address 2 Range 0 255 characters To Address 3 Range 0 255 characters Email Subject Log message from AP Range 1 255 characters a Table 19 Email Alert Configuration Pe SS Global Configuration Admin Mode Globally enable or disable the Email Alert feature on the AP By default email alerts are disabled 23 LAPAC1750PRO Access Point Software User Manual From Email Address Log Duration Urgent Message Severity Non Urgent Severity Specify the email address that appears in the From field of alert messages sent from the AP for example AP23 foo com The address can be a maximum of 255 characters and can contain only printable chara
117. following procedures a Disconnect the cable from the computer and the access point b Connect an Ethernet cable from the access point to the LAN c Connect your computer to the LAN by using an Ethernet cable ora wireless card 2 Test LAN connectivity with wireless clients Test the access point by trying to detect it and associate with it from some wireless client devices For information about requirements for these clients see Wireless Client Requirements on page 2 3 Secure and configure the access point by using advanced features Once the wireless network is up and you can connect to the AP with some wireless clients you can add in layers of security create multiple virtual access points VAPs and configure performance settings NOTE The WLAN AP is not designed for multiple simultaneous configuration changes If more than one administrator is logged onto the Administration Web pages and making changes to the configuration there is no guarantee that all configuration changes specified by multiple users will be applied By default no security is in place on the access point so any wireless client can associate with it and access your LAN An important next step is to configure security as described in Virtual Access Point VAP on page 43 Configuring Security on the Wireless Access Point You configure secure wireless client access by configuring security for each virtual access point VAP that you
118. g Table 67 Clustering Options Enter a description of where the access point is physically located Cluster Name Enter the name of the cluster for the AP to join The cluster name is not sent to other APs in the cluster You must configure the same cluster name on each AP that is a member of the cluster The cluster name must be unique for each cluster you configure on the network Clustering IP Specify the IP version that the APs in the cluster use to Version communicate with each other Removing an Access Point from the Cluster To remove an access point from the cluster do the following 1 Goto the Administration Web pages for the clustered access point The Administration Web pages for the standalone access point are displayed 2 Click the Configuration gt Cluster gt Access Points tab in the Administration pages 3 Click Stop Clustering The change will be reflected under Status for that access point the access point will now show as standalone instead of cluster Adding an Access Point to a Cluster To add an access point that is currently in standalone mode back into a cluster do the following 1 Go to the Administration Web pages for the standalone access point The Administration Web pages for the standalone access point are displayed 2 Click the Configuration gt Cluster gt Access Points tab in the Administration pages for the standalone access point The Access Points tab for a standalone
119. ges e Qos 33 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Radio Table 28 Radio Settings aM Select Radio 1 or Radio 2 to specify which radio to configure Radio 1 stands for 2 4GHz radio and Radio Radio settings directly control the behavior of the radio devices in the AP and determine how and what type of electromagnetic waves the AP emits Different settings display depending on the mode you select All settings are described in Table 28 2 stands for 5GHz radio The rest of the settings on this Figure 25 Radio Settings tab apply to the radio you select in this field Be sure to Radio configure settings for both radios Select Your Radio Radio Radio 1 2 4 GHz v Status Enabled Disabled MAC Address B4 75 0E 1A EB 00 Mode EEE 802 11b gin v a ET A Status On Off Specify whether you want the radio on or off by selecting AeroScout Engine Protocol Support Disabled v On or Off PAS el If you turn off a radio the AP sends disassociation frames Channel Bandwidth 20 MHz sao cee to all the wireless clients it is currently supporting so that Mutidomain Regulatory Mode Enae 7 the radio can be gracefully shutdown and the clients can Short Guard intervat Supported ves ov start the association process with other available APs STBC Mode of v Protection Auto v Beacon Interval DTIM Period Fragmentation Threshold RTS Threshold Maximum Stations Tra
120. h as voice or multimedia any degradation of service has undesirable effects By classifying the traffic and creating policies that define how to handle these traffic classes you can make sure that time sensitive traffic is given precedence over other traffic The access point supports up to 50 class maps 73 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Defining DiffServ To use DiffServ for Client QoS use the Configuration gt Qos and Access Control gt Class Map and Configuration gt Qos and Access Control gt Policy Map pages to define the following categories and their criteria Class create classes and define class criteria Policy create policies associate classes with policies and define policy statements Once you define the class and associate it with a policy apply the policy to a specified VAP on the Global Settings page Packets are classified and processed based on defined criteria The classification criteria are defined by class The processing is defined by a policy s attributes Policy attributes may be defined on a per class instance basis and it is these attributes that are applied when a match occurs A policy can contain multiple classes When the policy is active the actions taken depend on which class matches the packet Packet processing begins by testing the class match criteria for a packet A policy is applied to a packet when a class match wi
121. hat you define for the AP at the top of the VAP page see Virtual Access Point VAP When the first wireless client tries to authenticate with the AP the AP sends an authentication request to the primary server If the primary server responds to the authentication request the AP continues to use this RADIUS server as the primary server and authentication requests are sent to the address you specify If the IPv4 RADIUS IP Address Type option is selected in the previous field enter the IP address of the RADIUS server that all VAPs use by default for example 192 168 10 23 If the IPv6 RADIUS IP Address Type option is selected enter the IPv6 address of the primary global RADIUS server for example 2001 0db8 1234 abcd Enter up to three IPv4 or IPv6 addresses to use as the backup RADIUS servers The field label is RADIUS IP Address when the IPv4 RADIUS IP Address Type option is selected and RADIUS IPv6 Address when the IPv6 RADIUS IP Address Type option is selected If authentication fails with the primary server each configured backup server is tried in sequence The IPv4 or IPv6 address must be valid in order for the AP to attempt to contact the server RADIUS Key RADIUS Key 1 3 Enable RADIUS Accounting NOTE Enter the RADIUS key in the text box The RADIUS key is the shared secret key for the global RADIUS server You can use up to 63 standard alphanumeric and special characters The key is case sensit
122. he WDS link You can have only one WDS link between any pair of APs That is a remote MAC address may appear only once on the WDS Bridge page for a particular AP Both APs participating in a WDS link must be on the same radio channel and using the same IEEE 802 11 mode See Radio for information on configuring the Radio mode and channel When 802 1 1h is operational setting up two WDS links can be difficult If you use WPA encryption on the WDS link over Radio 1 VAPO of Radio 1 must use WPA Personal or WPA Enterprise as the security mode If you use WPA on a WDS link over Radio 2 VAPO of Radio 2 must use WPA Personal or WPA Enterprise as the security mode Channel auto setting is not recommended for all WDS link device both APs participating in the WDS link To configure WDS on this AP describe each AP intended to receive hand offs and send information to this AP For each destination AP configure the fields listed in Table 39 Table 39 WDS Bridge Remote Address Encryption Section 3 Configuring the Access Point Specify the MAC address of the destination AP that is the AP on the other end of the WDS link to which data will be sent or handed off and from which data will be received Note Click the drop down arrow to the right of the Remote Address field to see a list of all the available MAC addresses and their associated SSIDs on the network Select the appropriate MAC address from the list The SSID displaye
123. he associated VAP Click the Configuration gt Captive Portal gt Instance Configuration tab to access the page Figure 48 shows the CP Instance Configuration page when the Create option is selected from the Captive Portal Instances menu Figure 48 CP Instance Configuration Create Instance Configuration Captive Portal Instances Create v Captive Portal Instance Parameters Instance Name 1 32 characters Figure 49 on this page shows the CP Instance Configuration page when a CP instance has been created and is selected from the Captive Portal Instances menu The fields available also change depending on the option selected from the Verification menu In Figure 49 on this page the verification method is RADIUS Figure 49 CP Instance Configuration Instance Configuration Captive Portal Instances Instancel v Captive Portal Instance Parameters Instance ID 1 Admin Mode Enabled Disabled Protocol http v Verification d Global Radius on of Radius Accounting On Off Radius IP Network ipv4 Radius IP 001 200 200 200 Radius Backup IP 1 00 2001 1000 100 Radius Backup IP 2 000000000 Radius Backup IP 3 00002000X Radius Key Range 1 64 characters Radius Backup Key 1 Range 1 64 characters Radius Backup Key 2 Range 1 64 characters Radius Backup Key 3 Range 1 64 characters Redirect Enabled Disabled Redirect URL 0 256 characters Away Time 60 Min
124. he currently selected AP The Wireless Neighborhood view can help you e Detect and locate unexpected or rogue access points in a wireless domain so that you can take action to limit associated risks e Verify coverage expectations By assessing which APs are visible at what signal strength from other APs you can verify that the deployment meets your planning goals e Detect faults Unexpected changes in the coverage pattern are evident at a glance in the color coded table To view neighboring access points click the Configuration gt Cluster gt Wireless Neighborhood tab 107 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Figure 61 Wireless Neighborhood Wireless Neighborhood The Wireless Neighborhood table shows all access points within range of any AP in the cluster Cluster members who are also neighbors are shown atthe top of Neighbors list and identified by a heavy bar Clustered above the Network Name The colored bars and numbers to the right of each AP in the Neighbors list indicate signal strength for each neighboring AP This signal strength is detected by the cluster member whose IP address is at the top of the column g 2 Access Points Display Neighboring APs incluster Notin cluster Both Cluster 192 168 20 138 00 22 44 A2 05 00 not set 192 168 20 138 00 22 44 A2 05 08 not set 192 168 20 120 B4 75 0E 1
125. he manufacturer You cannot change the MAC address It is provided here for informational purposes as a unique identifier for an interface LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status The Physical Layer PHY standard the radio uses e IEEE 802 11b g 802 11b and 802 11g clients can connect to the AP IEEE 802 11b g n 802 11b 802 11g and 802 11n clients operating in the 2 4 GHz frequency can connect to the AP IEEE 802 11n Only 802 11n clients operating in the 2 4 GHz frequency can connect to the AP IEEE 802 11a Only 802 11a clients can connect to the AP This mode is available only on Radio 2 IEEE 802 11a n ac 802 11a 802 11n and 802 11ac clients operating in the 5 GHz frequency can connect to the AP This mode is available only on Radio 2 IEEE 802 11n ac 802 11n clients and 802 11ac clients operating in the 5 GHz frequency can connect to the AP This mode is available only on Radio 2 Channel The current operating channel The channel defines the portion of the radio spectrum the radio uses for transmitting and receiving Each mode offers a number of channels depending on how the spectrum is licensed by national and transnational authorities such as the Federal Communications Commission FCC or the International Telecommunication Union ITU R Operational The size of the bandwidth in MHz the current channel Bandwidth is using To change t
126. he radio mode or channel settings click the Edit link After you click Edit you are redirected to the Radio page For information about configuring these settings see Radio on page 34 Radio Statistics The Radio Statistics page provides detailed information about the packets and bytes transmitted and received on the radio wireless interface of this access point To view Radio Statistics click the System Status gt Radio Statistics tab Figure 4 Radio Statistics Radio Statistics m STATISTICS DATA Select Your Radio Radio Radio 1 2 4GHz v WLAN Packets Received 0 WLAN Bytes Received 0 WLAN Packets Transmitted 732 WLAN Bytes Transmitted 80006 WLAN Packets Receive Dropped 0 WLAN Bytes Receive Dropped 0 WLAN Packets Transmit Dropped 0 WLAN Bytes Transmit Dropped 0 Fragments Received 0 Fragments Transmitted 0 Multicast Frames Received 0 Multicast Frames Transmitted 732 Duplicate Frame Count 10972 Failed Transmit Count 0 Transmit Retry Count 0 Multiple Retry Count 0 RTS Success Count 0 RTS Failure Count 0 ACK Failure Count 0 FCS Error Count 20783 Transmitted Frame Count 732 WEP Undecryptable Count 0 The following table describes details about the Radio Statistics information Table 6 Radio Statistics Information Field Description O O Choose either radio 1 or radio 2 WLAN Packets Total packets received by the AP on this radio interface Received WLAN Bytes Total bytes received by the AP
127. help maintain the efficiency of communication over the wireless network You must start channel management to get automatic channel assignments it is disabled by default on a new AP At a specified interval the Channel Manager maps APs to channel use and measures interference levels in the cluster If significant channel interference is detected the Channel Manager automatically re assigns some or all of the APs to new channels per an efficiency algorithm or automated channel plan If the Channel Manager determines that a change is necessary that information is sent to all members of the cluster and a syslog message is generated indicating the sender AP new and old channel assignments The Channel Management page shows previous current and planned channel assignments for clustered access points By default automatic channel assignment is disabled You can start channel management to optimize channel usage across the cluster on a scheduled interval To configure and view the channel assignments for the cluster members click the Configuration gt Cluster gt Channel Management tab 104 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Figure 60 Cluster Channel Management Channel Management CURRENT AND PLANNED CHANNEL Bs torsicatyre sssigring channels Current Channel Assignments AP Location IP Address Radio Band Channel Status Locked not set 192 168 20 120
128. hen you upload a configuration file to the AP the configuration information in the XML file is applied to the AP NOTE When you click Restore the access point will reboot Please wait for the reboot process to complete a minute or two The AP Administration Web pages will not be accessible until the AP has rebooted Upon reboot you should see the configuration settings restored to those contained in the specified backup file When you upload a configuration file to the AP the configuration information in the XML file is applied to the AP Click the Maintenance gt Configuration Backup Restore tab to access the configuration management page which the following figure shows 112 LAPAC1750PRO Access Point Software User Manual Section 4 Maintenance of the Access Point Figure 64 Configuration Backup Restore Configuration Backup Restore BACKUP CONFIGURATION Click the Backup button to save the current configuration as a backup file to your PC To save the configuration to an external TFTP server click the TFTP radio button and enter the TFTP server information Download Method HTTP HTTPS TFTP Configuration File Range 1 256 characters Server IP 001 100 200 200 RE CONFIGURATION RESTO Browse to the location where your saved configuration file is stored and click the Restore button To restore from a TFTP server click the TFTP radio button and enter the TFTP server information Up
129. her and reduce the value of the transmit power This helps reduce overlap and interference among APs A lower transmit power setting can also keep your network more secure because weaker wireless signals are less likely to propagate outside of the physical location of your network Select the multicast traffic transmission rate you want the AP to support LAPAC1750PRO Access Point Software User Manual Legacy Rate Sets Broadcast Multicast Rate Limiting Rate Limit Burst Check the transmission rate sets you want the AP to support and the basic rate sets you want the AP to advertise e Rates are expressed in megabits per second e Supported Rate Sets indicate rates that the AP supports You can check multiple rates click a check box to select or deselect a rate The AP will automatically choose the most efficient rate based on factors like error rates and distance of client stations from the AP Basic Rate Sets indicate rates that the AP will advertise to the network for the purposes of setting up communication with other APs and client stations on the network It is generally more efficient to have an AP broadcast a subset of its supported rate sets Enabling multicast and broadcast rate limiting can improve overall network performance by limiting the number of packets transmitted across the network By default the Multicast Broadcast Rate Limiting option is disabled Until you enable Multicast Broadcast Rate Li
130. hether that client station has the correct WEP key or not This algorithm is also used in plaintext IEEE 802 1X and WPA modes When the authentication algorithm is set to Open System any client can associate with the access point Shared Key authentication requires the client station to have the correct WEP key in order to associate with the access point When the authentication algorithm is set to Shared Key a station with an incorrect WEP key cannot associate with the access point Open System and Shared Key When you select both authentication algorithms client stations configured to use WEP in shared key mode must have a valid WEP key in order to associate with the access point Also client stations configured to use WEP as an open system shared key mode not enabled can associate with the access point even if they do not have the correct WEP key After you configure the security settings you must click Save to apply the changes and save the changes to startup configuration file 46 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point WPA Personal WPA Personal is a Wi Fi Alliance IEEE 802 11i standard which includes AES CCMP and TKIP mechanisms It employs a pre shared key instead of using IEEE 802 1X and EAP as is used in the Enterprise WPA security mode The PSK is used for an initial check of credentials only This security mode is backwards compatible for wireless cli
131. i Alliance in the Wi Fi MultiMedia WMM specification In normal use these values should not need to be changed Changing these values will affect the QoS provided NOTE The QoS settings apply to both radios but the traffic for each radio is queued independently To set up queues for QoS click the QoS tab under the Wireless heading and configure settings as described in Table 42 Figure 34 QoS Qos Select Your Radio Radio Radio 1 2 4GHz v EDCA Template Custom X QoS Settings WAP EDCA Parameters Queue AIFS cwMin cwMax Max Burst Data 0 Voice 1 3 X 7 X 1 5 Data 1 Video 1 7 X 15 gt 3 0 Data 2 Best Effort 3 j 6 7 Data 3 Background z i nd eli o Wi Fi Multimedia WMM Enabled Disabled Station EDCA Parameters Queue AIFS cwMin cwMax TXOP Limit Data 0 Voice 2 3 aa Da 47 Data 1 a eal a al Video 2 7 X 15 v 94 Data 2 er Fal rs Best Effort 3 15 v 1023 v 0 ita eer F 15 v 1023 v 0 No Acknowledgement Enabled Disabled APSD Enabled Disabled Table 42 QoS Settings cc e Radio Select the radio with the QoS settings to view or configure EDCA Template The AP has multiple templates with predefined EDCA parameters The menu includes the following templates Custom e Default e Optimized for Voice You can change the individual EDCA parameters only when the selected EDCA template is Custom 60 AIFS Inter Frame LAPAC1750PRO Access Point Software User Manual
132. ich the following figure shows customize the authentication page Figure 50 Instance Association Click the Configuration gt Captive Portal gt Web Portal Customization tab to Instance Association access the page which the following figure shows Select Your Radio Radio Radio 1 2 4 GHz v Instance to VAP Association Table VAP SSID Instance Name VAPO LinksysSMB24G g VAP1 Virtual Access Point 1 ad VAP2 Virtual Access Point 2 ud VAP3 Virtual Access Point 3 bd VAP4 Virtual Access Point 4 7 VAPS Virtual Access Point 5 i x VAP6 Virtual Access Point 6 kd VAPT Virtual Access Point 7 i bd E The following table describes the fields on the CP Instance Association page Table 57 Captive Portal Instance Association o E e RADIO Select the radio associated with the VAP to configure The list of VAP IDs A CP instance can be associated with multiple VAPs Instance Name Select the instance to associate with each VAP If the menu is blank no instance is associated with the VAP 93 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Figure 51 Web Portal Customization Table 58 Web Portal Customization Web Portal Customization Captive Portal Web Locale Engish v Cane oe heats ee Captive Portal To create anew Web locale select Create from the TR Locale available menu To view or update an existing Web TENSE eens locale select its name from the menu Background Image N
133. ients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low NOTE Hostnames are composed of a series of labels joined with dots as are all domain names Each label must be between 1 and 63 characters long and the entire hostname including dots has a maximum of 253 characters Log Settings The Log Settings page shows real time system logs on the AP such as wireless clients associating with the AP and being authenticated From the Log Settings page you can enable and configure persistent logging to write system logs to non volatile memory so that the events are not erased when the system reboots This page also gives you the option of enabling a remote log relay host to capture all system logs and errors in a kernel log To view system events click the Configuration gt Administration gt Log Settings tab Figure 16 Log Settings Log Settings Options Persistence Enabled Disabled Severity zoe Depth 512 Range 1 512 Remote Log Server Relay Log Enabled Disabled Relay Host ovun noo Hostname max 253 characters Relay Port 514 Range 1 65535 Default 514 21 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Configuring Persistent Logging Options If the system unexpectedly reboots log messages can be useful to diagnose the cause However log messages are erased when the system reboots unless you enable
134. igned address by connecting the AP to a network that has a DHCP server Discovering a Dynamically Assigned IP Address If you have access to the DHCP server on your network and know the MAC address of your AP you can view the new IP address associated with the MAC address of the AP NOTE The MAC address of access point is shown on product label and brown box label Installing the Access Point To access the Administration Web UI you enter the IP address of the AP into a Web browser You can use the default IP address of the AP 192 168 1 252 to log on to the AP and assign a static IP address or you can use a DHCP server on you network to assign network information to the AP The DHCP client on the AP is enabled by default To install the access point use the following steps 1 Connect the AP to an administrative PC by using a LAN connection or a direct cable connection LAPAC1750PRO Access Point Software User Manual Section 1 Getting Started e To use a LAN connection connect one end of an Ethernet cable to the network port on the access point and the other end to the same hub where your PC is connected as shown in the following figure The hub or switch you use must permit broadcast signals from the access point to reach all other devices on the network e To use a direct cable connection connect one end of an Ethernet straight through or crossover cable to the network port on the access point and the other e
135. igure on the QoS page Radio Select Radio 1 or Radio 2 to specify which radio to configure Specify the VAP that will have the Client QoS settings that you configure The QoS settings you configure for the selected VAP will not affect clients that access the network through other VAPs Client QoS Enable or disable QoS operation on the VAP selected in Mode the VAP menu QoS must be enabled globally from the Client QoS field and on the VAP for the Client QoS settings to be applied to wireless clients Bandwidth Enter the maximum allowed transmission rate from the Limit Down AP to the wireless client in bits per second The valid range is O 429496000 bits sec The value you enter must be a multiple of 8000 bits sec in other words the value must be n x 8000 bits sec where n 0 1 2 3 If you attempt to set the limit to a value that is not a multiple of 8000 bits sec the configuration will be rejected A value of 0 means that the bandwidth maximum limit is not enforced in this direction Bandwidth Enter the maximum allowed client transmission rate to Limit Up the AP in bits per second The valid range is 0 4294967295 bps The value you enter must be n x 8000 bits sec where n 0 1 2 3 If you attempt to set the limit to a value that is not a multiple of 8000 bits sec the configuration will be rejected A value of 0 means that the bandwidth maximum limit is not enforced in this direction LAPAC1750PRO Access Poin
136. ile download command is triggered Because the capture file is located in the RAM file system it disappears if the AP is reset Diagnostic Log The Diagnostic Log page provides a way to gather the diagnostic troubleshooting information about the AP beyond what is available through the Web UI Table 79 describes the field of diagnostic log Table 79 Diagnostic Log Field Description o Download To download the diagnostic information for support click Download button 118 Visit linksys com support for award winning technical support JOANN KOS
137. imit which traffic is sent to the Wireshark tool When capturing 802 11 traffic a large portion of the captured frames tends to be beacons typically sent every 100ms by all Access Points Although Wireshark supports a display filter for beacon frames it does not support a capture filter to prevent the AP from forwarding captured beacon packets to the Wireshark tool In order to reduce performance impact of capturing the 802 11 beacons you can disable the capture beacons mode The remote packet capture facility is a standard feature of the Wireshark tool for Windows NOTE Remote packet capture is not standard on the Linux version of Wireshark the Linux version doesn t work with the AP Wireshark is an open source tool and is available for free it can be downloaded from http www wireshark org Table 78 describes the fields to configure the packet capture status Table 78 Remote Packet Capture S i es Remote Capture Port Specify the remote port to use as the destination for packet captures Default port is 2002 Range 1025 to 65530 Packet Capture File Download Packet Capture File Download allows you to download the capture file by TFTP to a configured TFTP server or by HTTP S to a PC TFTP file name should not contain spaces lt gt amp 3 and successive The captured packets are stored in file tmp apcapture pcap on the AP A capture is automatically stopped when the capture f
138. ing the enabling or disabling of the VAPs and radios One of the ways you can use this feature is to schedule radios to operate only during the office working hours in order to achieve security and reduce power consumption You can also use the scheduler to allow access to VAPs for wireless clients only during specific times of day Each rule specifies the start time end time and day or days of the week the radio or VAP can be operational The rules are periodic in nature and are repeated every week A valid rule must contain all of the following parameters Days of the Week Start Time hour and minutes e End Time hour and minutes Only valid rules are added to the profile Up to 16 rules are grouped together to form a scheduling profile Any two entries belonging to the same profile must not overlap The time granularity for the schedules is one minute The LAPAC1750PRO Access Point supports up to 16 profiles 49 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Figure 28 Scheduler Configuration Table 34 Scheduler Configuration Scheduler een Global Scheduler Mode Enable Disable save Global A global switch to enable or disable the scheduler feature Scheduler Operational Status Scheduler The default is Disable Status down Mode Reason ConfigDown Scheduler Profile Configuration Scheduler Operational Status E mae aes range 1 22 characire z The operational status of
139. ings SNMP 1 Enabled Disabled UDP Port 161 Range 1025 65535 Default 161 SNMPv2c Settings Read Only Community public Range 1 256 characters Read Write Community private Range 1 256 characters Management Station Restriction Enabled Disabled NMS IPv4 Address Name oQKX0GW HOstname max 253 characters NMS IPv6 Address Name bocomecononecocodHostname max 253 characters SNMPv2 Trap Trap Community Range 1 256 characters Enabled Host Type Hostname iP Address Table 50 SNMP General Settings E SNMP You can specify the SNMP administrative mode on your Enabled Disabled network By default SNMP is enabled To enable SNMP click Enabled To disable SNMP click Disabled After changing the mode you must click Save to save your configuration changes Note If SNMP is disabled all remaining fields on the SNMP page are disabled This is a global SNMP parameter which applies to SNMPv1 SNMPv2c and SNMPv3 UDP Port By default an SNMP agent only listens to requests from port 161 However you can configure this so the agent listens to requests on another port Enter the port number on which you want the SNMP agents to listen to requests The valid range is 1 65535 Note This is a global SNMP parameter that applies to SNMPv1 SNMPv2c and SNMPv3 Read Only Enter a read only community name The valid range is Community 1 256 characters The community name as defined in SNMPv2c acts as
140. is 120 3600 seconds The default value is 120 seconds ISATAP Specify how often the AP should send router solicitation Solicitation messages to the ISATAP router s it learns about Interval through the DNS query messages The AP sends router solicitation messages only when there is no active ISATAP router The valid range is 120 3600 seconds The default value is 120 seconds ISATAP IPv6 Displays Link Local IPv6 address of the ISATAP interface Link Local Address ISATAP IPv6 Displays global IPv6 address of ISATAP the interface Global Address NOTE After you configure the wired settings you must click Save to apply the changes and save the changes to startup configuration file Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity 32 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point NOTE Wireless DNS name is composed of a series of labels joined with dots as are all domain names Each label must be between 1 and 63 characters long and the entire hostname including dots has a maximum of 253 characters Radio e Rogue AP Detection e Virtual Access Point VAP Scheduler The wireless features are located under the Configuration heading on the administration Web UI Scheduler Association e Bandwidth Utilization e MAC Filter e WDS Bridge e Workgroup Brid
141. ith this security level users send an MD5 key password for authentication and a DES key password for encryption For groups that require authentication encryption or both you must define the MD5 and DES key passwords on the SNMP Users page 85 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Select the write access to management objects MIBs for the group e write all The group can create alter and delete MIBs write none The group is not allowed to create alter or delete MIBS Read Views Select the read access to management objects MIBs for the group e view all The group is allowed to view and read all MIBs view none The group cannot view or read MIBs This field shows the default groups and the groups that have been defined on the AP Use the buttons on the page to perform the following tasks e Add Add the new group to the SNMP Groups table e Remove Remove the selected group from the SNMP Group table e Save Apply and save the changed SNMP group settings Targets An SNMP target receives trap messages and forwards them to the SNMP manager Inform messages are not supported Each target is associated with target IP address UDP port and SNMP user name NOTE Required SNMP user configuration Users on page 87 should be completed before configuring SNMP targets NOTE The access point supports a maximum of eight targets To disp
142. ititii TSPEC Status and Statistics The TSPEC Status and Statistics page provides e Summary information about TSPEC sessions by radio Summary information about TSPEC sessions by VAP e Real time transmit and receive statistics for the TSPEC VAPs on all radio interfaces All transmit and receive statistics shown are totals since the AP was last started If you reboot the AP these figures indicate transmit and receive totals since the reboot To view TSPEC status and statistics click the System Status gt TSPEC Status and Statistics tab The following image has been edited to show some of the transmit and receive statistics Total Vole Bytes Totsi Video Packets Total Viteo Byte 16 LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status Table 11 TSPEC Status and Statistics et eee Interface Indicates the name of the Radio or VAP interface Total Video Indicates the total number of TS video packets sent in Packets Transmit table or received in Received table by this AP for this VAP Total Video Indicates the total TS video bytes sent in Transmit table o Bytes received in Received table by this AP for this VAP Click Refresh to refresh the page Access Indicates Current Access Category associated with this Traffic Category Stream voice or video Indicates whether the TSPEC session is enabled up o disabled down for the corresponding Access Categ
143. ive and you must configure the same key on the AP and on your RADIUS server The text you enter will be displayed as characters to prevent others from seeing the RADIUS key as you type Enter the RADIUS key associated with the configured backup RADIUS servers The server at RADIUS IP Address 1 uses RADIUS Key 1 RADIUS IP Address 2 uses RADIUS Key 2 and so on Select this option to track and measure the resources a particular user has consumed such as system time amount of data transmitted and received and so on If you enable RADIUS accounting it is enabled for the primary RADIUS server and all backup servers After you configure the VAP settings you must click Save to apply the changes 64 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point 802 1X Supplicant 802 1X Supplicant settings allow the access point to gain access to a secured wired network Use these settings to enable the access point as an 802 1X supplicant client on the wired network An MD5 user name and password can be configured to allow the access point to authenticate via 802 1X On networks that use IEEE 802 1X port based network access control a supplicant cannot gain access to the network until the 802 1X authenticator grants access If your network uses 802 1X you must configure 802 1X authentication information that the AP can supply to the authenticator To configure the access point 802 1X
144. ization Image Delete Images will be resized to fit the specified dimensions For best results the logo and account images should be similar in proportion to the default images as follows Table 59 Captive Portal Default Images Image Type Use Default Width x Height Background Displays in the page 10 x 800 pixels background Displays above the login field to depict an authenticated login Displays at top left of 168 x 78 pixels page to provide branding information 295 x 55 pixels The following table describes the fields on the Captive Portal Upload Custom Images page 96 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Table 60 Captive Portal Upload Custom Images ee eee Upload Web To select an image to upload to the AP for use Customization in the CP authentication page click Browse and Image browse to the image to upload After you select the appropriate image click Upload Delete Web To remove an image that has been uploaded select Customization the name of the image from the available menu Image and click Delete Local Groups Each local user is assigned to a user group Each group is assigned to a CP instance The group facilitates managing the assignment of users to CP instances The user group named Default is built in and cannot be deleted You can create up to two additional user groups The fields available on the page depend on the option
145. l Access Point 2 Radio 2 VAP3 Virtual Access Point 3 Radio 2 VAP4 Virtual Access Point 4 Radio 2 VAPS Virtual Access Point 5 Radio 2 VAP6 Virtual Access Point 6 4 ABP Ap 4 a g 2 5 Radio 2 VAP7 Virtual Access Point 7 The scheduler profiles need to be associated to a radio interface or the VAP interface for applying the periodic rules to a specific radio or VAP 51 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Table 35 Scheduler Association Settings ee ee Per Radio Scheduler Association Radio Identifies the radio associated with the rest of the information in the row Scheduler Select the scheduler profile to associate with Radio 1 or Profile Radio 2 Operational The operational status of the scheduler which is either up Status or down Per VAP Scheduler Association Identifies the VAP associated with the rest of the information in the row Scheduler Select the scheduler profile to associate with the desired VAP Profile Operational The operational status of the scheduler which is either up Status or down NOTE After you associate a scheduler profile with a radio interface or a VAP interface you must click Save to apply the changes and to save the settings Bandwidth Utilization Use this page to load balance the distribution of wireless client connections across multiple access points You can set network utilization thresholds on the
146. lay the SNMP Targets Configuration page click the Configuration gt SNMP gt Targets tab Figure 45 SNMP Targets Targets IPv4 IPv6 Address Port Users SNMPv3 TARGETS 86 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Table 53 SNMP Targets Field Description S IPv4 IPv6 Address Enter the IP address of the remote SNMP target receiver Enter the UDP port to use for sending SNMP targets Enter the name of the SNMP user to associate with the target To configure SNMP users see Users on this page SNMP Targets This field shows the SNMP targets configured on the access point Use the buttons on the page to perform the following tasks e Add Add the new target to the SNMP Targets table e Remove Remove the selected target from the SNMP Targets table e Save Apply and save the changed SNMP target settings Users From the Users page you can define multiple users associate the desired security level to each user and configure per user security keys Each user is mapped to an SNMP group either from predefined or user defined groups configured for authentication and encryption types with authentication encryption pass phrases optional if authentication or encryption type is set to none For authentication only MD5 type is supported and for encryption only DES type is supported There are no default SNMP users on the access point Figure 46 SNMP Us
147. lease wait for the reboot process to complete which might take several minutes The Administration Web Ul is not accessible until the AP has rebooted Reset Reboot e To Restore the Factory Default Configuration If you are experiencing problems with the access point and have tried all other troubleshooting measures click Reset This restores factory defaults and clears all settings including settings such as a new password or wireless settings To Reboot the Access Point For maintenance purposes or as a troubleshooting measure you can reboot the access point To reboot the access point click the Reboot button on the Reset Reboot page Diagnostics This section include following subsections e Packet Capture e Diagnostic Log 114 LAPAC1750PRO Access Point Software User Manual Section 4 Maintenance of the Access Point Packet Capture 1 Wireless packet capture operates in two modes Capture file mode e Remote capture mode For capture file mode captured packets are stored in a file on the access point The AP can transfer the file to a TFTP server The file is formatted in pcap format and can be examined using tools such as Wireshark and OmniPeek For remote capture mode the captured packets are redirected in real time to an external PC running the Wireshark tool The AP can capture the following types of packets e 802 11 packets received and transmitted on radio interfaces Packets captured on radio in
148. lient e TSPEC Client Associations e TSPEC Status and Statistics e TSPEC AP Statistics e Email Alert Status e System Log System Summary From the System Summary page you can view various information about the access point AP including IP and MAC address information Table 3 describes the fields and configuration options on the System Summary page Table 3 System Summary Page Field Description i IPv4 Address Shows the IP address assigned to the AP This field is not editable on this page because the IP address is already assigned either by DHCP or statically through the Ethernet Settings page IPv6 Address Shows the IPv6 address assigned to the AP This field is not editable on this page because the IP address is already assigned either by DHCPv 6 or statically through the Management IPv6 page IPv6 Address Shows the operational status of the static IPv6 Status address assigned to the management interface of the AP The possible values are Operational and Tentative Note If an IPv6 address has not been manually configured or leased from a DHCPv6 server the field is blank IPv6 Shows each automatically configured global IPv6 Autoconfigured address for the management interface of the AP Global Addresses IPv6 Link Local Shows the IPv6 Link Local address which is the IPv6 Address address used by the local physical link The Link Local address is not configurable and is assigned by using the IPv6 Neighb
149. list select its 48 bit MAC address then click Remove The stations in the list will either be allowed or denied access based on how you set the filter in the previous field The Access Point allows up to 512 MAC addresses to be added to the station list Note If MAC authentication for the VAP is set to Local the AP uses the stations list to permit or deny the clients access to the network If the MAC authentication type is set to RADIUS the AP ignores the MAC addresses configured in this list and uses the list that is stored on the RADIUS server The MAC authentication type is set on the VAP page NOTE After you configure local MAC Authentication settings you must click Update to apply the changes and to save the settings Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low Configuring MAC Authentication on the RADIUS Server If you use RADIUS MAC authentication for MAC based access control you must configure a station list on the RADIUS server The station list contains client MAC address entries and the format for the list is described in the following table Table 38 Configuring MAC Authentication on the RADIUS Server RADIUS Server Description Value Attribute User Name 1 MAC address of the Valid Ethernet client station MAC address User Password 2
150. load Method HTTP HTTPS TFTP Filename Range 1 256 characters Server IP 000200030002000 Backup Configuration You can use HTTP or TFTP to transfer files to and from the access point After you download a configuration file to the management station you can manually edit the file which is in XML format Then you can upload the edited configuration file to apply those configuration settings to the AP Use the following steps to save a copy of the current settings on an AP toa backup configuration file by using TFTP 1 Select TFTP for Download Method 2 Enter a name 1 to 256 characters for the backup file in the Filename field including the xml file name extension and the path to the directory where you want to save the file NOTE File name should not contain spaces lt gt amp 3 and successive 3 Enter the IP address of the TFTP server Configuration Backup Restore BACKUP CONFIGURATION Click the Backup button to save the current configuration as a backup file to your PC To save the configuration to an external TFTP server click the TFTP radio button and enter the TFTP server information Download Method HTTP HTTPS TFTP Configuration File ftestap fp_ap xml Range 1 256 characters Server IP 192 168 20 71 000 200 2004 200 4 Click Backup to save the file Use the following steps to save a copy of the current settings on
151. m backoff value window is doubled Doubling will continue until the size of the random backoff value reaches the number defined in the Maximum Contention Window Valid values for cwMin are 1 3 7 15 31 63 127 255 511 or 1023 The value for cwMin must be lower than the value for cwMax The value specified for the Maximum Contention Window is the upper limit in milliseconds for the doubling of the random backoff value This doubling continues until either the data frame is sent or the Maximum Contention Window size is reached Once the Maximum Contention Window size is reached retries will continue until a maximum number of retries allowed is reached Valid values for cwMax are 1 3 7 15 31 63 127 255 511 or 1023 The value for cwMax must be higher than the value for cwMin 61 LAPAC1750PRO Access Point Software User Manual Max Burst Length The Max Burst Length is an AP EDCA parameter and only applies to traffic flowing from the AP to the client station This value specifies in milliseconds the maximum burst length allowed for packet bursts on the wireless network A packet burst is a collection of multiple frames transmitted without header information The decreased overhead results in higher throughput and better performance Valid values for maximum burst length are 0 0 through 999 Wi Fi Multimedia Settings Wi Fi Multimedia Wi Fi Multimedia WMM is enabled by default With WMM enabled
152. members or other APs outside the cluster e Click Stop to stop automatic channel assignment No channel usage maps or channel re assignments will be made Only manual updates will affect the channel assignment NOTE When automatic channel assignment is enabled the channel policy for the radio is automatically set to static mode and the Auto option is not available for the Channel field on the Wireless Settings or Radio pages This allows the automatic channel feature to set the channels for the radios in the cluster 105 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Viewing Current Channel Assignments and Setting Locks The Current Channel Assignments section shows a list of all access points in the cluster by IP address The display shows the band on which each AP is broadcasting a b g n the current channel used by each AP and an option to lock an AP on its current radio channel so that it cannot be re assigned to another Table 69 Channel Assignments eee E IP Address Specifies the IP address for the access point Identifies the MAC address of the radio Band Indicates the band on which the access point is broadcasting Current Indicates the radio channel on which this access point is currently broadcasting Click Locked to force the access point to remain on the current channel When Locked is selected enabled for an access point automated channel management
153. miting the following fields will be disabled Enter the rate limit you want to set for multicast and broadcast traffic The limit should be greater than 1 but less than 50 packets per second Any traffic that falls below this rate limit will always conform and be transmitted to the appropriate destination The default and maximum rate limit setting is 50 packets per second Setting a rate limit burst determines how far above the rate limit bursts can go before all traffic exceeds the rate limit This burst limit allows intermittent bursts of traffic on a network above the set rate limit The default and maximum rate limit burst setting is 75 packets per second TSPEC Mode TSPEC Violation Interval TSPEC Voice ACM Mode TSPEC Voice ACM Limit TSPEC Video ACM Mode Section 3 Configuring the Access Point Regulates the overall TSPEC mode on the AP e On The AP handles TSPEC requests according to the TSPEC settings you configure on the Radio page Use this setting if the AP handles traffic from QoS capable devices such as a Wi Fi certified phone Off The AP ignores TSPEC requests from client stations Use this setting if you do not want to use TSPEC to give QoS capable devices priority for time sensitive traffic Specify the time interval in seconds for the AP to report through the system log and SNMP traps associated clients that do not adhere to mandatory admission control procedures Regulates mandator
154. n IPv4 packets or the Next Header field of IPv6 packets Once you select the field choose the protocol to match by keyword or protocol ID Source IPv6 Select this field to require a packet s source IPv6 Address address to match the address listed here Enter an IPv6 address in the appropriate field to apply this criterion Source IPv6 Prefix Enter the prefix length of the source IPv6 address Len Source Port Select this option to include a source port in the match condition for the rule The source port is identified in the datagram header Once you select the option choose the port name or enter the port number Destination IPv6 Select this field to require a packet s destination IPv6 Address address to match the address listed here Enter an IPv6 address in the appropriate field to apply this criterion Destination IPv6 Prefix Len Source Port Range Destination Port IPv6 Flow Label Section 3 Configuring the Access Point Enter the prefix length of the destination IPv6 address Enter the port range to match to the source port identified in the datagram header The port range is 0 65535 and includes three different types of ports e 0 1023 Well Known Ports e 1024 49151 Registered Ports e 49152 65535 Dynamic and or Private Ports To specify a single port use the same value for the start and end range Select this option to include a destination port in the match condition for the rule The destinatio
155. n internal network running on the same access point must always have two different network names MAC Address Shows the MAC address of the neighboring access point A MAC address is a hardware address that uniquely identifies each node of a network Channel Shows the channel on which the access point is currently broadcasting The channel defines the portion of the radio spectrum that the radio uses for transmitting and receiving Rate Shows the rate in megabits per second at which this access point is currently transmitting The current rate will always be one of the rates shown in Supported Rates 109 LAPAC1750PRO Access Point Software User Manual Section 4 Maintenance of the Access Point Section 4 Maintenance of the Access Point This section describes how to maintain the access point and see system detailed information e Maintenance Diagnostics Maintenance From the access point Administrator Ul you can perform the following maintenance tasks Firmware e Switching Firmware Image e Firmware Upgrade Configuration Backup Restore e Backup Configuration e Restoring Configuration Reset Reboot e To Restore the Factory Default Configuration To Reboot the Access Point Firmware Use this page to select the firmware image that the AP loads when it boots and to upload a new firmware image to the device Figure 63 Firmware Maintenance Firmware Active Image Active Image Firmware
156. n port is identified in the datagram header Once you select the option choose the port name or enter the port number Flow label is 20 bit number that is unique to an IPv6 packet It is used by end stations to signify quality of service handling in routers range 0 to 1048575 LAPAC1750PRO Access Point Software User Manual MAC ACL EtherType Select the EtherType field to compare the match criteria against the value in the header of an Ethernet frame Select an EtherType keyword or enter an EtherType value to specify the match criteria Select from List Select Select one of the following protocol types appletalk arp ipv4 ipv6 ipx netbios pppoe Match to Value Enter a custom protocol identifier to which packets are matched The value is a four digit hexadecimal number in the range of 0600 FFFF Select this field and enter an 802 1p user priority to compare against an Ethernet frame The valid range is 0 7 This field is located in the first only 802 1Q VLAN tag Class of Service Source MAC Select this field and enter the source MAC address to Address compare against an Ethernet frame Source MAC Mask Select this field and enter the source MAC address mask specifying which bits in the source MAC to compare against an Ethernet frame A 0 indicates that the address bit is significant and an f indicates that the address bit is to be ignored A MAC mask of 00 00 00 00 00 00 matches a single MAC address
157. name apcapture pcap Server IP 0 0 0 0 115 LAPAC1750PRO Access Point Software User Manual Section 4 Maintenance of the Access Point Packet Capture Status Packet Capture Status allows you to view the status of packet capture on the AP Table 75 describes the fields to configure the packet capture status Table 75 Packet Capture Status Se ee Current Capture Status Shows whether packet capture is running or stopped Packet Capture Time Shows elapsed capture time Packet Capture File Size Shows the current capture file size Packet Capture Configuration Packet Capture Configuration allows you to configure parameters that affect how packet capture functions on the radio interfaces Table 76 describes the fields to configure the packet capture status Table 76 Packet Capture Configuration ee ee Capture Beacons Enable to capture the 802 11 beacons detected or transmitted by the radio Promiscuous Capture Enable to place the radio in promiscuous mode when the capture is active In promiscuous mode the radio receives all traffic on the channel including traffic that is not destined to this AP While the radio is operating in promiscuous mode it continues serving associated clients Packets not destined to the AP are not forwarded As soon as the capture is completed the radio reverts to non promiscuous mode operation Client Filter Enable Enable to use the WLAN client filter to capture only
158. nd of the cable to the Ethernet port on the PC as shown in the following figure You can also use a serial cable to connect the serial port on the AP to a serial port on the administrative computer Pi S For initial configuration with a direct Ethernet connection and no DHCP server be sure to set your PC to a static IP address in the same subnet as the default IP address on the access point The default IP address for the access point is 192 168 1 252 If you use this method you will need to reconfigure the cabling for subsequent startup and deployment of the access point so that the access point is no longer connected directly to the PC but instead is connected to the LAN either by using a hub or directly NOTE It is possible to detect access points on the network with a wireless connection However we strongly advise against using this method In most environments you may have no way of knowing whether you are actually connecting to the intended AP Also many of the initial configuration changes required will cause you to lose connectivity with the AP over a wireless connection NOTE Ethernet Port 1 and Port 2 can be used together in Link Aggregation Mode when supported by the connected devices Connect the power adapter to the power port on the back of the access point and then plug the other end of the power cord into a power outlet Use your Web browser to log on to the access point Administration Web pages If the
159. ne you must change the Connection Type from DHCP to Static IP You can either assign a new Static IP address to the AP or continue using the default address We recommend assigning a new Static IP address so that if you bring up another access point on the same network the IP address for each AP will be unique To change the connection type and assign a Static IP address see VLAN and IPv4 Address on page 29 7 If your network uses VLANs you might need to configure the management VLAN ID or untagged VLAN ID on the access point in order for it to work with your network For information about how to configure VLAN information see VLAN and IPv4 Address on page 29 8 If your network uses IEEE 802 1X port security for network access control you must configure the 802 1X supplicant information on the AP For information about how to configure the 802 1X user name and password see 802 1X Supplicant on page 65 Configuring the Ethernet Settings The default Ethernet settings which include DHCP and VLAN information might not work for all networks By default the DHCP client on the access point automatically broadcasts requests for network information If you want to use a static IP address you must disable the DHCP client and manually configure the IP address and other network information The management VLAN is VLAN 1 by default This VLAN is also the default untagged VLAN If you already have a management VLAN co
160. nfigured on your network with a different VLAN ID you must change the VLAN ID of the management VLAN on the access point For information about using the Web interface to configure the Ethernet settings see VLAN and IPv4 Address on page 29 LAPAC1750PRO Access Point Software User Manual Section 1 Getting Started Configuring IEEE 802 1X Authentication On networks that use IEEE 802 1X port based network access control a supplicant client cannot gain access to the network until the 802 1X authenticator grants access If your network uses 802 1X you must configure 802 1X authentication information that the AP can supply to the authenticator If your network uses IEEE 802 1X see 802 1X Supplicant on page 65 for information about how to configure 802 1X by using the Web interface Verifying the Installation Make sure the access point is connected to the LAN and associate some wireless clients with the network Once you have tested the basics of your wireless network you can enable more security and fine tune the AP by modifying advanced configuration features 1 Connect the access point to the LAN e Ifyou configured the access point and administrator PC by connecting both into a network hub then your access point is already connected to the LAN The next step is to test some wireless clients e Ifyou configured the access point by using a direct cable connection from your computer to the access point do the
161. ns all ACLs added in the ACL Configuration section To configure a new rule to add to the selected ACL select New Rule To add an existing rule to an ACL or to modify a rule select the rule number When an ACL has multiple rules the rules are applied to the packet or frame in the order in which you add them to the ACL There is an implicit deny all rule as the final rule 69 LAPAC1750PRO Access Point Software User Manual Match Every Specifies whether the ACL rule permits or denies an action e When you select Permit the rule allows all traffic that meets the rule criteria to enter or exit the AP depending on the ACL direction you select Traffic that does not meet the criteria is dropped When you select Deny the rule blocks all traffic that meets the rule criteria from entering or exiting the AP depending on the ACL direction you select Traffic that does not meet the criteria is forwarded unless this rule is the final rule Because there is an implicit deny all rule at the end of every ACL traffic that is not explicitly permitted is dropped Indicates that the rule which either has a permit or deny action will match the frame or packet regardless of its contents If you select this field you cannot configure any additional match criteria The Match Every option is selected by default for a new rule You must clear the option to configure other match fields Section 3 Configuring the Access Point IPv4
162. nsmit Power Fixed Multicast Rate Legacy Rate Sets TSPEC Mode TSPEC Violation Interval TSPEC Voice ACM Mode TSPEC Voice ACM Limit TSPEC Video ACM Mode TSPEC Video ACM Limit TSPEC AP Inactivity Timeout TSPEC Station Inactivity Timeout TSPEC Legacy WMM Queue Map Mode FrameBurst 100 Miliseconds Range 20 2000 Default 100 2 Range 1 255 Default 2 2346 Range 256 2346 Even Numbers Default 2346 2347 Range 0 2347 Default 2347 200 Range 0 200 Default 200 Full 100 Auto v Mbps Rate Mbps E 54 Supported Basic m E BroadcastMulticast Rate Limiting Rate Limit Rate Limit Burst 4 m El Packets Per Second Range 1 50 Default 50 Packets Per Second Range 1 75 Default 75 Off v 300 Sec Range 0 900 0 Disable Off v 20 Percent Range 0 70 Default 20 Off v 15 Percent Range 0 70 Default 15 30 Sec Range 0 120 0 Disable Default 30 30 Sec Range 0 120 0 Disable Default 30 of v Enabled Disabled MAC Address Indicates the Media Access Control MAC addresses for the interface This page shows the MAC addresses for Radio interface A MAC address is a permanent unique hardware address for any device that represents an interface to the network The MAC address is assigned by the manufacturer You cannot change the
163. o Value To match a protocol that is not listed by name enter the protocol ID The protocol ID is a standard value assigned by the IANA The range is a number from 0 255 Source IP Address Select this field to require a packet s source IP address Source IP Mask to match the address listed here Enter an IP address in the appropriate field to apply this criterion Enter the source IP address mask The mask for DiffServ is a network style bit mask in IP dotted decimal format indicating which part s of the destination IP Address to use for matching against packet content A DiffServ mask of 255 255 255 255 indicates that all bits are important and a mask of 0 0 0 0 indicates that no bits are important The opposite is true with an ACL wild card mask For example to match the criteria to a single host address use a mask of 255 255 255 255 To match the criteria to a 24 bit subnet for example 192 168 10 0 24 use a mask of 255 255 255 0 LAPAC1750PRO Access Point Software User Manual Destination IP Select this field to require a packet s destination IP Address address to match the address listed here Enter an IP address in the appropriate field to apply this criterion Enter the destination IP address mask The mask for DiffServ is a network style bit mask in IP dotted decimal format indicating which part s of the destination IP Address to use for matching against packet content A DiffServ mask of 255 255 255 255
164. of the certificate to upload to the access point Server The IPv4 or IPv6 address of the TFTP server where the file is IP TFTP located The default is 0 0 0 0 After you specify the filename pe and server IP click Upload to initiate the file transfer nly NOTE After you configure the settings on the 802 1X Supplicant page you must click Save to apply the changes Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low QoS and Access Control This section describes how to configure QoS settings that affect traffic from the wireless clients to the AP By using the access point Client QoS features you can limit bandwidth and apply ACLs and DiffServ policies to the wireless interface This section describes the following features Global Settings ACL Class Map Policy Map Client QoS Status 66 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Global Settings The client QoS features on the access point provide additional control over certain QoS aspects of wireless clients that connect to the network such as the amount of bandwidth an individual client is allowed to send and receive To control general categories of traffic such as HTTP traffic or traffic from a specific subnet you can configure ACLs and assign them to
165. oint Click Refresh to view the latest connection status Access Point Interface Status is indicated as Up Enable or Down disable If the downstream interface is down wireless clients cannot connect to the access point VLAN ID The VLAN ID on the local AP interface This VLAN ID should be the same VLAN ID as advertised on the Infrastructure Client Interface 59 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point QoS Quality of Service QoS provides you with the ability to specify parameters on multiple queues for increased throughput and better performance of differentiated wireless traffic like Voice over IP VoIP other types of audio video and streaming media as well as traditional IP data over the access point Configuring QoS on the access point consists of setting parameters on existing queues for different types of wireless traffic and effectively specifying minimum and maximum wait times through Contention Windows for transmission The settings described here apply to data transmission behavior on the AP only not to that of the client stations AP Enhanced Distributed Channel Access EDCA Parameters affect traffic flowing from the AP to the client station Station Enhanced Distributed Channel Access EDCA Parameters affect traffic flowing from the client station to the AP The default values for the AP and station EDCA parameters are those suggested by the Wi F
166. om 8 to 64 alphanumeric and special characters A user enter must enter the password to log into the network through the captive portal Away Time The amount of time a user remains in the CP authenticated client list after it disassociates from the AP If the time specified in this field expires before the client attempts to reauthenticate its entry is removed from the authenticated client list The range is from 0 to 1440 minutes The default value is 0 Note An away timeout value is also configured for a captive portal instance See the Instance Configuration page The timeout value configured for a local user has precedence over the value configured for the captive portal instance 98 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Group Name Select the group to which the user belongs Each CP instance is configured to support a particular group of users Maximum Bandwidth The maximum upload speed in megabits per Upstream second that a client can transmit traffic when using the captive portal This setting limits the client s bandwidth used to send data into the network The range is from 0 to 300 Mbps The default is 0 Maximum Bandwidth The maximum download speed in megabits per Downstream second at which a client can receive traffic when using the captive portal This setting limits the client s bandwidth used to receive data from the network The rang
167. on Clients Global Configuration e Instance Configuration e Instance Association e Web Portal Customization e Web Customization Preview e Upload Custom Images e Local Groups e Local Users e Authenticated Clients e Failed Authentication Clients 88 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Global Co nfig uration Table 55 Global Configuration The Captive Portal CP feature allows you to block wireless clients from Field Description accessing the network until user verification has been established Use the CP Captive Portal Mode Enables or disables the administrative mode of CP Global Configuration page to control the administrative state of the CP feature on the AP and configure global settings that affect all captive portal instances configured on the AP Authentication This field specifies the number of seconds the AP Click the Configuration gt Captive Portal gt Global Configuration tab to access Timeout keeps the unauthenticated client information the page which the following figure shows If the user does not enter authentication Figure 47 Global Configuration credentials within the authentication timeout Global Configuration period the client details are removed so that stale entries do not persist upon leaving The default ee ee eee authentication timeout is 300 seconds Authentication Timeout 300 Sec Range 60 600 Default 300 Additional HTT
168. on a cluster member AP click on the IP address of a cluster from this access point as measured in decibels Db member at the top of the page The following figure shows the Neighbor Beacon Interval Shows the beacon interval being used by this access Details for Radio 1 of the AP with an IP address of 192 168 20 97 point Figure 62 Details for a Cluster Member AP Beacon frames are transmitted by an access point at Neighbor Details l regular intervals to announce the existence of the wireless network The default behavior is to send a so MAC address Capelli Rate Street Beacon terval Beacon Age beacon frame once every 100 milliseconds or 10 per Dion Iras eating 02 CE 73 8E 04 80 11 1 11 100 Fri May 9 00 52 16 2014 second Mion lras amiina 02 CE 73 8E 04 82 11 1 23 100 Fri May 9 00 52 16 2014 ally wept 28 93 FE 4A 14 52 a 1 0 100 Fri May 9 00 55 23 2014 eee mae 7 a a Fri May 9 00 48 16 2014 Beacon Age Shows the date and time of the last beacon received cece 28 93 FE 4B 9F BA 1 1 32 100 Fri May 9 00 52 11 2014 from this access point Ow 58 6D 8F D2 68 1C 1 4 35 100 Fri May 9 00 52 11 2014 one fy C0 7B BC EA 06 24 1 1 100 100 Thu May 8 23 40 43 2014 Table 73 Cluster Member Details SSID The Service Set Identifier SSID for the access point The SSID is an alphanumeric string of up to 32 characters that uniquely identifies a wireless local area network It is also referred to as the Network Name A guest network and a
169. on of the modes 5 indicates IEEE 802 11a or 802 11n mode or both modes Channel Shows the channel on which the AP is currently broadcasting The channel defines the portion of the radio spectrum that the radio uses for transmitting and receiving Shows the rate in megabits per second at which this AP is currently transmitting The current rate will always be one of the rates shown in Supported Rates Indicates the strength of the radio signal emitting from this AP If you hover the mouse pointer over the bars a number appears and shows the strength in decibels dB Beacons Shows the total number of beacons received from this AP since it was first discovered Section 3 Configuring the Access Point Shows the date and time of the last beacon received from this AP Shows supported and basic advertised rate sets for the neighboring AP Rates are shown in megabits per second Mbps All Supported Rates are listed with Basic Rates shown in bold Rate sets are configured on the Radio page To save the Known AP List to a file click Save The list contains the MAC addresses of all APs that have been added to the Known AP List By default the filename is Rogue2 cfg You can use a text editor or Web browser to open the file and view its contents Use the Import feature to import a list of known APs from a saved list The list might be from another AP or created from a text file If the MAC address of an AP appears in th
170. on this radio interface Received WLAN Packets Total packets transmitted by the AP on this radio interface Transmitted 10 LAPAC1750PRO Access Point Software User Manual WLAN Bytes Total bytes transmitted by the AP on this radio interface Transmitted WLAN Packets Number of packets received by the AP on this radio Received interface that were dropped Dropped WLAN Bytes Number of bytes received by the AP on this radio interface Received that were dropped Dropped WLAN Packets Number of packets transmitted by the AP on this radio Transmit interface that were dropped Dropped WLAN Bytes Number of bytes transmitted by the AP on this radio Transmit interface that were dropped Dropped Fragments Count of successfully received MPDU frames of type data Received or management Fragments Number of transmitted MPDU with an individual address Transmitted or an MPDU with a multicast address of type data or management Multicast Count of MSDU frames received with the multicast bit set Frames in the destination MAC address Received Multicast Count of successfully transmitted MSDU frames where the Frames multicast bit is set in the destination MAC address Transmitted Duplicate Number of times a frame is received and the Sequence Frame Count Control field indicates it is a duplicate Failed Transmit Number of times an MSDU is not transmitted successfully due to transmit attempts exceeding either the short r
171. one or more VAPs In addition to controlling general traffic categories Client QoS allows you to configure per client conditioning of various micro flows through Differentiated Services DiffServ DiffServ policies are a useful tool for establishing general micro flow definition and treatment characteristics that can be applied to each wireless client both inbound and outbound when it is authenticated on the network From the Global Settings page you can enable the Client QoS feature specify client bandwidth limits and select the ACLs and DiffServ policies to use as default values for clients associated with the VAP when the client does not have their own attributes defined by a RADIUS server To enabled or disabled the Client QoS and to configure the QoS settings for a VAP click the Configuration gt QoS and Access Control gt Global Settings tab Figure 37 QoS Global Settings Global Settings Client Qos Enabled Disabled Select Your Interface Radio Radio 1 2 4GHz v VAP VAP 0 LinksysSMB24G QoS And ACL Mapping Client QoS Mode Enabled Disabled Bandwidth Limit Down 0 0 4294967295 Bandwidth Limit Up 0 ACL Type Down NONE v ACL Name Down z ACL Type Up NONE v ACL Name Up bd DiffServ Policy Down hd DiffServ Policy Up bi Table 45 QoS Global Settings CO er Client QoS Enable or disable Client QoS operation on the AP Changing this setting will not affect the WMM settings you conf
172. onfiguring the Log Relay Host for Kernel Messages The Kernel Log is a comprehensive list of system events shown in the System Log and kernel messages such as error conditions like dropping frames You cannot view kernel log messages directly from the Administration Web UI for an AP You must first set up a remote server running a syslog process and acting as a syslog log relay host on your network Then you can configure the access point to send syslog messages to the remote server Remote log server collection for AP syslog messages provides the following features e Allows aggregation of syslog messages from multiple APs e Stores a longer history of messages than kept on a single AP Triggers scripted management operations and alerts To use Kernel Log relaying you must configure a remote server to receive the syslog messages The procedure to configure a remote log host depends on the type of system you use as the remote host NOTE The syslog process will default to use port 514 We recommend keeping this default port However If you choose to reconfigure the log port make sure that the port number you assign to syslog is not being used by another process 22 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Enabling or Disabling the Log Relay Host on the Log Settings Page To enable and configure Log Relaying on the Log Settings page set the Log Relay options as desc
173. or Discovery process Parese i Generic name to identify the type of hardware Model Number Identifies the AP hardware model Serial Number Shows the AP serial number Device Name LAPAC1750PRO Access Point Software User Manual MAC Address Shows the MAC address of the AP The address shown here is the MAC address associated with the management interface This is the address by which the AP is known externally to other networks Section 2 Viewing Access Point System Status Network Interfaces This page displays the current settings for the wired Ethernet interface and the wireless radio interfaces on the AP To monitor Ethernet LAN wired and wireless LAN WLAN settings click the Firmware Version Shows version information about the firmware currently installed on the AP As new versions of the WLAN AP firmware become available you can upgrade the firmware on your AP Identifies the AP hardware version System Uptime Provides information about the system start up time Power Source The power source of monitor system is the power adapter or PoE Connecting to the AP Web Interface Using the IPv6 Address To connect to the AP by using the IPv6 global address or IPv6 Link Local address you must enter the AP address into your browser in a special format NOTE The following instructions and examples work with Microsoft Internet Explorer 7 IE7 and might not work with other browsers To connect to an IPv6 glob
174. or password to confirm that Password you typed it as intended 19 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Device Name Name your AP This name appears only on the Basic Settings page and is used to identify the AP to the administrator A valid name is 1 to 64 alphanumeric characters and can include letters digits hyphens and spaces System Enter the name e mail address or phone number of the Contact person to contact regarding issues related to the AP System Enter the physical location of the AP for example Location Conference Room A Time Settings The Network Time Protocol NTP is an Internet standard protocol that synchronizes computer clock times on your network NTP servers transmit Coordinated Universal Time UTC also known as Greenwich Mean Time to their client systems NTP sends periodic time requests to servers using the returned time stamp to adjust its clock The timestamp is used to indicate the date and time of each event in log messages See http www ntp org for more information about NTP To configure the address of the NTP server that the AP uses or to set the system time manually click the Configuration gt Administration gt Time Settings tab and update the fields as described in Table 16 NOTE The fields available to configure depend on whether you choose to set the system time manually or by using an NTP server Figure 14 shows the
175. ory Note This is a configuration status does not necessarily TSPEC AP Statistics represent Te UME NE session ACTIVI The TSPEC AP Statistics page provides information on the voice and video Active TS Indicates the number of currently active TSPEC Traffic Traffic Streams accepted and rejected by the AP Streams for this radio and Access Category To view TSPEC AP statistics click the System Status gt TSPEC AP Statistics tab TS Clients Indicates the number of Traffic Stream clients associated Figure 10 TSPEC AP Statistics with this radio and Access Category TSPEC AP Statistics Med Time Time allocated for this Access Category over the transmission Admitted medium to carry data This value should be less than or equal to the maximum bandwidth allowed over the medium for this TS Total Voice TS Accepted 0 TSPEC Statistics Summary for Voice ACM Total Voice TS Rejected 0 Med Time Time of unused bandwidth for this Access Category TSPEC Statistics Summary for Video ACM Unallocated 5 Total Video TS Accepted Total Bytes Indicates the total number of TS bytes sent in Transmit table TAE EN or received in Received table by this Radio for the specified Access Category Total Indicates the total number of TS packets sent in Transmit Table 12 TSPEC AP Statistics Packets table or received in Received table by this Radio for the a iti Description specified Access Category Field Description id TSPEC Statistics
176. otection on an otherwise exposed network such as a guest network where the priority is making it easy for clients to get a connection and where no sensitive information is available Enable this feature to encourage dual band wireless clients to connect to the radio operating in the 5 GHz band instead of the radio operating in the 2 4 GHz band The 5 GHz band has more channels available and is generally utilized less than the 2 4 GHz band The Access Point can improve overall network throughput by effectively utilizing the 5 GHz band 44 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Select one of the following Security modes for this VAP None Static WEP IEEE802 1X WPA Personal WPA Enterprise If you select a security mode other than None additional fields appear These fields are explained below Note The security mode you set here is specifically for this VAP MAC You can configure a global list of MAC addresses that Authentication are allowed or denied access to the network The drop Type down menu for this feature allows you to select the type of MAC Authentication to use Disabled Do not use MAC Authentication Local Use the MAC Authentication list that you configure on the MAC Authentication page RADIUS Use the MAC Authentication list on the external RADIUS server For more information about MAC Authentication see MAC Filter on page 53 NOTE
177. ovide access to remote or hard to reach networks A single radio can be configured to forward packets from associated STAs to another access point in the same ESS without using WDS NOTE Workgroup Bridge mode currently supports only IPv4 traffic NOTE Workgroup Bridge mode is not supported across a cluster Use the WorkGroup Bridge page to configure the Work Group Bridge mode on the AP and to configure the settings that allow the AP to serve as a bridge between remote clients and the wireless LAN To configure the Workgroup Bridge settings click the Configuration gt Wireless gt WorkGroup Bridge tab Figure 33 Workgroup Bridge WorkGroup Bridge Global Settings Work Group Bridge Mode Up Down Select Your Radio Radio Rado nesch Infrastructure Client Interface VLAN ID 1 SSID Upstream SSID e Security None z Connection Status Disconnected Access Point Interface Status Up Down VLAN ID 1 SSID Downstream SSID Broadcast i Mi SSID TS Security mone 7 MAC Authentication Disa 58 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Field Description S Broadcast Select this option if you want the downstream SSID to be Workgroup Set the administrative mode of the Workgroup Bridge Security Select the type of security downstream clients will use to authenticate with the access point Choices are e None e WPA Personal e WPA Enterprise MAC
178. own AP List provide Facer Ss a A Saal ta KS eae a NS information The LAPAC1750PRO Access Point does not have Sy Sa ica eno ket oma aera snasaaerao assoc any control over the APs on the list and cannot apply any Fs ict i NST GPCRS CUES SUR RECS IEP ET MER ER security policies to APs detected through the RF scan E 00 06 3b 01 41 03 wian 100 AP Linksys23456 ott ot s 161 6 ail 5 Wed Dec 31 16 00 29 1989 6 9 42 18 24 36 48 54 eet Trusted AP ist The Radio field indicates which radio detected the ei we ie m me a neighboring AP ROUGE AP LIST EXPORT IMPORT e wlan0 Radio 1 petra e wlan1 Radio 2 m mtemarie OReplace Merge Beacon Shows the beacon interval being used by this AP Interval Beacon frames are transmitted by an AP at regular intervals to announce the existence of the wireless network The You must enable AP detection on a radio in order to collect information about default behavior is to send a beacon frame once every 100 other APs within range milliseconds or 10 per second Table 29 Rogue AP Detection eee E O AP Detection To enable Radio 1 to perform neighbor AP detection and for Radio 1 collect information about neighbor APs select Enabled Indicates the type of device e AP indicates the neighboring device is an AP that supports the IEEE 802 11 Wireless Networking Framework in Infrastructure Mode Ad Hoc indicates a neighboring station running in Ad Hoc Mode Stations set to Ad Hoc Mode communicate
179. p sent to the AP in the inbound up direction ACL ACLs are a collection of permit and deny conditions called rules that provide security by blocking unauthorized users and allowing authorized users to access specific resources ACLs can block any unwarranted attempts to reach network resources The access point supports up to 50 IPv4 IPv6 and MAC ACLs IPv4 and IPv6 ACLs IP ACLs classify traffic for Layers 3 and 4 Each ACL is a set of up to 10 rules applied to traffic sent from a wireless client or to be received by a wireless client Each rule specifies whether the contents of a given field should be used to permit or deny access to the network Rules can be based on various criteria and may apply to one or more fields within a packet such as the source or destination IP address the source or destination L4 port or the protocol carried in the packet ACL Configuration Process Configure ACLs and rules on the ACL page steps 1 5 and then apply the rules to a specified VAP on the Global Settings page step 6 Use the following general steps to configure ACLs 1 Specify a name for the ACL 2 Select the type of ACL to add 3 Add the ACL 4 Add new rules to the ACL 5 Configure the match criteria for the rules 6 Apply the ACL to one or more VAPs To configure an ACL click the Configuration gt Qos and Access Control gt ACL tab The following figure shows the page after an IPv4 ACL has been created 68 L
180. persistent logging Caution Enabling persistent logging can wear out the flash non volatile memory and degrade network performance You should only enable persistent logging to debug a problem Make sure you disable persistent logging after you finish debugging the problem Table 17 Logging Options ee eeeeee Persistence Choose Enabled to save system logs to non volatile memory so that the logs are not erased when the AP reboots When persistence is enabled we can store up to 128 messages in non volatile memory Choose Disabled to save system logs to volatile memory Logs in volatile memory are deleted when the system reboots Severity Specify the severity level of the log messages to write to non volatile memory For example if you specify 2 critical alert and emergency logs are written to non volatile memory Error messages with a severity level of 3 7 are written to volatile memory 0 emergency 1 alert 2 critical 3 error 4 warning 5 notice 6 info 7 debug You can store up to 512 messages in non volatile memory Once the number you configure in this field is reached the oldest log event is overwritten by the new log event NOTE To apply your changes click Save Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low C
181. ponding to requests from an 802 1X authenticator The user name can be up to 64 characters ASCII printable characters are allowed which includes upper and lower case alphabetic letters the numeric digits and special symbols such as and Password Enter the MD5 password for the AP to use when responding to requests from an 802 1X authenticator The password can be up1 to 64 characters ASCII printable characters are allowed which includes upper and lower case letters numbers and special symbols such as and Certificate File Status Certificate Indicates if the HTTP SSL Certificate file is present Range is yes File Present or no The default is no Certificate Indicates when the HTTP SSL Certificate file will expire The Expiration range is a valid date If no certificate file exists on the AP the Date field displays Not Present 65 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Certificate File Upload Upload Select the method to use for uploading a certificate file to the Method AP which is either HTTP HTTPS upload by Web browser or TFTP upload by TFTP server Specify the path and filename of the certificate file e For HTTP uploads click Browse to find the location where the certificate file is stored Select the file to upload to the access point Click Upload to initiate the file transfer For TFTP uploads enter the filename including the path
182. ps Virtual Access Point 5 down radio2 vap Virtual Access Point 6 down radio2 vap7 Virtual Access Point 7 down wds0 z down oy z Interface Statistics Table Ea Total Packets Indicates total packets sent or received by this Interface Statistics Table A P cort ee Total Bytes Indicates total bytes sent or received by this AP LAN 1488 4654 1427992 185852 isatap0 o o o radiot vap0 LinksysSMB24G 731 85738 radiot vap1 Virtual Access Point 1 o Dropped Packets Indicates total number of packets sent or received by this AP that were dropped Dropped Bytes Indicates total number of bytes sent or received by this AP that were dropped Indicates total errors related to sending and receiving data on this AP Click Refresh to refresh the information on the page radiot vap2 Virtual Access Point 2 radiot vap3 Virtual Access Point 3 o o o radiot vap4 Virtual Access Point 4 o pS Virtual Access Point 5 0 o 96 Virtual Access Point 6 radiot vap7 Virtual Access Point 7 radio2 vap0 LinksysSMBSG 731 85728 radio2 vap1 Virtual Access Point 1 radio2 vap2 Virtual Access Point 2 radio2 vap3 Virtual Access Point 3 radio2 vap4 Virtual Access Point 4 radio2 vap5 Virtual Access Point 5 o o o o o o o o o o o o 0 radio2 vap7 Virtual Access Point 7 wds0 wast wds2 o o o o o o o o 0 o o o 0 o 0 o 0 o o o o
183. r 00 00 e8 4e 5f 8e 117 LAPAC1750PRO Access Point Software User Manual Section 4 Maintenance of the Access Point In remote capture mode traffic is sent to the PC running Wireshark via one of the network interfaces Depending on where the Wireshark tool is located the traffic can be sent on an Ethernet interface or one of the radios In order to avoid a traffic flood caused by tracing the trace packets the AP automatically installs a capture filter to filter out all packets destined to the Wireshark application For example if the Wireshark IP port is configured to be 58000 then the following capture filter is automatically installed on the AP not portrange 58000 58004 Enabling the packet capture feature impacts performance of the AP and can create a security issue unauthorized clients may be able to connect to the AP and trace user data The AP performance is negatively impacted even if there is no active Wireshark session with the AP The performance is negatively impacted to a greater extent when packet capture is in progress Due to performance and security issues the packet capture mode is not saved in NVRAM on the AP if the AP resets the capture mode is disabled and then you must re enable it in order to resume capturing traffic Packet capture parameters other than mode are saved in NVRAM In order to minimize performance impact on the AP while traffic capture is in progress you should install capture filters to l
184. r Frame Spacing AIFS specifies a wait time for data frames The wait time is measured in slots Valid values for AIFS are 1 through 255 This parameter is used by the algorithm that determines the initial random backoff wait time window for retry of a data transmission during a period of contention for Unified Access Point resources The value specified here in the Minimum Contention Window is the upper limit in milliseconds of a range from which the initial random backoff wait time will be determined The first random number generated will be a number between 0 and the number specified here If the first random backoff wait time expires before the data frame is sent a retry counter is incremented and the random backoff value window is doubled Doubling will continue until the size of the random backoff value reaches the number defined in the Maximum Contention Window 62 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point cwMax Maximum Contention Window TXOP Limit Other QoS Settings No Acknowledgement NOTE The value specified here in the Maximum Contention Window is the upper limit in milliseconds for the doubling of the random backoff value This doubling continues until either the data frame is sent or the Maximum Contention Window size is reached Once the Maximum Contention Window size is reached retries will continue until a maximum number of retries allo
185. r an EtherType value to specify the match criteria Select from List Select Select one of the following protocol types appletalk arp ipv4 ipv6 ipx netbios pppoe Match to Value Enter a custom protocol identifier to which packets are matched The value is a four digit hexadecimal number in the range of 0600 FFFF Select the field and enter a class of service 802 1p user priority value to be matched for the packets The valid range is 0 7 Select this field and enter the source MAC address to compare against an Ethernet frame Source MAC Mask Enter the source MAC address mask specifying which bits in the destination MAC to compare against an Ethernet frame An f indicates that the address bit is significant and a 0 indicates that the address bit is to be ignored A MAC mask of ff ff ff ff ff ff matches a single MAC address Destination MAC Select this field and enter the destination MAC address Address to compare against an Ethernet frame 77 LAPAC1750PRO Access Point Software User Manual Destination MAC Enter the destination MAC address mask specifying Mask which bits in the destination MAC to compare against an Ethernet frame An f indicates that the address bit is significant and a 0 indicates that the address bit is to be ignored A MAC mask of ff ff ff ff ff ff matches a single MAC address VLAN ID Select the field and enter a VLAN ID to be matched for packets The VLAN ID range is 0 4095 IPv4 Cla
186. r file Do not attempt to use bin files or files of other formats for the upgrade these types of files will not work 3 Click Upgrade to apply the new firmware image Upon clicking Upgrade for the firmware upgrade a popup confirmation window is displayed that describes the upgrade process 4 Click OK to confirm the upgrade and start the process NOTE The firmware upgrade process begins once you click Upgrade and then OK in the popup confirmation window The upgrade process may take several minutes during which time the access point will be unavailable Do not power down the access point while the upgrade is in process When the upgrade is complete the access point restarts The AP resumes normal operation with the same configuration settings it had before the upgrade 1 To verify that the firmware upgrade completed successfully check the firmware version shown on the Firmware page or the Status Status gt Status and Statistics gt System Summary tab If the upgrade was successful the updated version name or number is indicated Configuration Backup Restore The access point configuration file is in XML format and contains all of the information about the AP settings You can download the configuration file to a management station to manually edit the content or to save as a back up copy for example config xml The backup file can be used at a later date to restore the access point to the previously save configuration W
187. radio2 vap6 Virtual Access Point 6 0 o o was3 12 LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status Workgroup Bridge The Workgroup Bridge page displays packet and byte counts for traffic between stations on a workgroup bridge The information in the following table is available for each network interface that is configured as a workgroup bridge interface Figure 6 Workgroup Bridge WorkGroup Bridge Refresh Status Table Interface Name SSID Status MAC Address VLAN ID Statistics Table Interface SSID Total Packets Total Bytes a see D recenen Table 8 Workgroup Bridge e es Status Table Name of the Ethernet or VAP interface Wireless network name Also known as the SSID this alphanumeric key uniquely identifies a wireless local area network The SSID is set on the VAP tab See Configuring VAPs Whether the interface is disconnected or is administratively configured as enabled up or disabled down VLAN ID Virtual LAN VLAN ID You can use VLANs to establish multiple internal and guest networks on the same AP The VLAN ID is set on the VAP tab See Configuring VAPs Statistics Table Total Packets The total number of Sent Received packets bridged between the wired clients in the workgroup bridge and the wireless network Total Bytes The total number of Sent Received bytes bridged between the wired clients in the workgroup bridge and th
188. rce port to match ftp ftpdata http smtp snmp telnet tftp WWW Each of these keywords translates into its equivalent port number Match to Port Enter the IANA port number to match to the source port identified in the datagram header The port range is 0 65535 and includes three different types of ports e 0 1023 Well Known Ports e 1024 49151 Registered Ports e 49152 65535 Dynamic and or Private Ports 76 LAPAC1750PRO Access Point Software User Manual Destination Port Select this field to include a destination port in the match condition for the rule The destination port is identified in the datagram header Once you select the field choose the port name or enter the port number Select From List Select the keyword associated with the destination port to match ftp ftpdata http smtp snmp telnet tftp WWW Each of these keywords translates into its equivalent port number Match to Port Enter the IANA port number to match to the destination port identified in the datagram header The port range is O 65535 and includes three different types of ports e 0 1023 Well Known Ports e 1024 49151 Registered Ports e 49152 65535 Dynamic and or Private Ports EtherType Class of Service Source MAC Address Section 3 Configuring the Access Point Select the EtherType field to compare the match criteria against the value in the header of an Ethernet frame Select an EtherType keyword or ente
189. re are the following brtrunk Linux bridge interface in the AP ethO 802 3 traffic on the Ethernet port wlan0 VAPO traffic on radio 1 wlanOwds0O wlanOwds3 Traffic on the specified WDS interface wlanOvap1 wlanOvap7 Traffic on the specified VAP on Radio 1 wlan1 VAPO traffic on radio 2 wlanivap1 wlanlvap7 Traffic on the specified VAP on Radio 2 radio1 802 11 traffic on radio 1 radio2 802 11 traffic on radio 2 Capture Duration Specify the time duration in seconds for the capture range 10 to 3600 Max Capture File Size Specify the maximum allowed size for the capture file in KB range 64 to 4096 Remote Packet Capture Remote Packet Capture allows you to specify a remote port as the destination for packet captures This feature works in conjunction with the Wireshark network analyzer tool for Windows A packet capture server runs on the AP and sends the captured packets via a TCP connection to the Wireshark tool A Windows PC running the Wireshark tool allows you to display log and analyze captured traffic When the remote capture mode is in use the AP doesn t store any captured data locally in its file system You can trace up to five interfaces on the AP at the same time However you must start a separate Wireshark session for each interface You can configure the IP port number used for connecting Wireshark to the AP The default port number is 2002 The system uses 5 consecu
190. red locally on the MAC Filtering page or the external RADIUS server The Allow Block filter setting on the MAC Filtering page determines whether the clients in the station list local or RADIUS can access the network through the AP To enable filtering by MAC address click the Configuration gt Wireless gt MAC Filtering tab Figure 31 MAC Filtering MAC Filtering Filter Allow only stations in list Block all stations in list Stations List 53 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point NOTE Global MAC Authentication settings apply to all VAPs on both radios Table 37 MAC Filtering ca To set the MAC Address Filter select one of the following options e Allow only stations in the list Any station that is not in the stations list is denied access to the network through the AP Block all stations in list Only the stations that appear in the list are denied access to the network through the AP All other stations are permitted access Note The filter you select is applied to the clients in the stations list regardless of whether that station list is local or on the RADIUS server This is the local list of clients that are either permitted or denied access to the network through the AP To add a MAC address to the local stations list enter its 48 bit MAC address into the lower text boxes then click Add To remove a MAC address from the stations
191. rence problems for example with microwave ovens By default fragmentation is off We recommend not using fragmentation unless you suspect radio interference The additional headers applied to each fragment increase the overhead on the network and can greatly reduce throughput RTS Threshold Transmit Power Fixed Multicast Rate Section 3 Configuring the Access Point Specify a Request to Send RTS Threshold value between 0 and 2347 The RTS threshold indicates the number of octets in an MPDU below which an RTS CTS handshake is not performed Changing the RTS threshold can help control traffic flow through the AP especially one with a lot of clients If you specify a low threshold value RTS packets will be sent more frequently This will consume more bandwidth and reduce the throughput of the packet On the other hand sending more RTS packets can help the network recover from interference or collisions which might occur on a busy network or on a network experiencing electromagnetic interference Specify the maximum number of stations allowed to access this AP at any one time You can enter a value between 0 and 200 Enter a percentage value for the transmit power level for this AP The default value which is 100 can be more cost efficient than a lower percentage since it gives the AP a maximum broadcast range and reduces the number of APs needed To increase capacity of the network place APs closer toget
192. ress 1 3 RADIUS Key RADIUS Key 1 3 You can toggle between the address types to configure IPv4 and IPv6 global RADIUS address settings but the AP contacts only the RADIUS server or servers for the address type you select in this field Enter the IPv4 or IPv6 address for the primary RADIUS server for this VAP If the IPv4 RADIUS IP Address Type option is selected in the previous field enter the IP address of the RADIUS server that all VAPs use by default for example 192 168 10 23 If the IPv6 RADIUS IP Address Type option is selected enter the IPv6 address of the primary global RADIUS server for example 2001 0db8 1234 abcd Enter up to three IPv4 and or IPv6 addresses to use as the backup RADIUS servers for this VAP The field label is RADIUS IP Address when the IPv4 RADIUS IP Address Type option is selected and RADIUS IPv6 Address when the IPv6 RADIUS IP Address Type option is selected If authentication fails with the primary server each configured backup server is tried in sequence Enter the RADIUS key in the text box The RADIUS Key is the shared secret key for the global RADIUS server You can use up to 63 standard alphanumeric and special characters The key is case sensitive and you must configure the same key on the AP and on your RADIUS server The text you enter will be displayed as characters to prevent others from seeing the RADIUS key as you type Enter the RADIUS key associated with the configure
193. ribed in the following table and then click Save Table 18 Log Relay Host a ae Relay Log Select Enabled to allow the access point to send log messages to a remote host Select Disabled to keep all log messages on the local system Relay Host Specify the IPv4 address IPv6 address or DNS name of the remote log server Relay Port Specify the Port number for the syslog process on the Relay Host The default port is 514 NOTE To apply your changes click Save Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low NOTE Hostnames are composed of series of labels joined with dots as are all domain names Each label must be between 1 and 63 characters long and the entire hostname including dots has a maximum of 253 characters If you enabled the Log Relay Host clicking Save will activate remote logging The AP will send its kernel messages in real time for display to the remote log server monitor a specified kernel log file or other storage depending on how you configured the Log Relay Host If you disabled the Log Relay Host clicking Save will disable remote logging Email Alert The Email Alert feature allows the AP to automatically send email messages when an event at or above the configured severity level occurs Use the Email Alert page to con
194. rification process Verification The authentication method for CP to use to verify clients Guest The user does not need to be authenticated by a database Local The Access Point uses a local database to authenticated users RADIUS The Access Point uses a database ona remote RADIUS server to authenticate users Specifies that CP should redirect the newly authenticated client to the configured URL If this option is clear the user sees the locale specific welcome page after a successful verification Redirect URL Away Time Session Timeout Max Bandwidth Upstream Max Bandwidth Downstream User Group Name Section 3 Configuring the Access Point Enter the URL including http either IPv4 or an IPv6 address to which the newly authenticated client is redirected if the URL Redirect Mode is enabled The IPv4 address should be in a form similar to http xxx xxx xxx xxx http 192 0 2 10 The IPv6 address should be in a form similar to http XXXX XXXX XXXX XXXX XXXX XXXX XXX x xxxx http 2001 DB8 CAD5 7D91 The range is from 0 to 256 characters The amount of time a user remains in the CP authenticated client list after it disassociates from the AP If the time specified in this field expires before the client attempts to reauthenticate its entry is removed from the authenticated client list The range is from 0 to 1440 minutes The default value is 60 minutes Note An away timeout value is also
195. rnet Explorer 7 E7 and might not work with a Dynamic and Static IP Addressing on the AP When you power on the access point the built in DHCP client searches for a DHCP server on the network in order to obtain an IP address and other network information If the AP does not find a DHCP server on the network the AP continues to use its default Static IP Address 192 168 1 252 until you reassign it a new static IP address and specify a static IP addressing policy or until the AP successfully receives network information from a DHCP server To change the connection type and assign a static IP address by using the Web UI see VLAN and IPv4 Address on page 29 NOTE If you do not have a DHCP server on your internal network and do not plan to use one the first thing you must do after powering on the access point is change the connection type from DHCP to static IP You can either assign a new static IP address to the AP or continue using the default address We recommend assigning a new static IP address so that if you bring up another WLAN AP on the same network the IP address for each AP will be unique Recovering an IP Address If you experience trouble communicating with the access point you can recover a static IP address by resetting the AP configuration to the factory defaults see Restoring Configuration on page 114 and To Restore the Factory Default Configuration on page 114 or you can get a dynamically ass
196. s The default is BFBFBF The default is BFBFBF Locale An abbreviation for the locale from 1 to 32 characters Accept Label The default is en Acceptance Use Locale Label A descriptive label for the locale from 1 to 32 characters Policy The default is English User Label The label for the user name text box The range is from 0 to 32 characters Account Image The image file to display above the login field to depict an authenticated login Password Label The label for the user password text box The range is from 0 to 64 characters Account Label The text that instructs the user to enter a user name The range is from 0 to 32 characters No Accept Text Button Label The label on the button users click to submit their user name password for authentication The range is from 2 to 32 characters The default is Connect The name of the font to use for all text on the CP page Denied Text You can enter multiple font names each separated by acomma If the first font is not available on the client system the next font will be used and so on For font names that have spaces surround the entire name Welcome Title in quotes The range is from 1 to 512 characters The default is arial sans serif MS UI Gothic Work In Progress Text The text that displays in the page header to the right of the logo The range is from 1 to 128 characters The default is Welcome to the Wireless Network The instructive text that
197. s definition A family of view subtrees allows control access to one row in a table in a more efficient manner The OID maskis 47 characters in length The format of the OID mask is xx xx Xx OF XX XX Xx and is 16 octets in length Each octet is 2 hexadecimal characters separated by either a period or a colon Only hex characters are accepted in this field For example OID mask FA 80 is 11111010 10000000 SNMP Views This field shows the MIB views on the access point Use the buttons on the page to perform the following tasks e Add Add the new view to the SNMP Views table e Remove Remove the selected view from the SNMP Views table Save Apply and save the changed SNMP view settings 84 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Groups SNMP groups allow you to combine users into groups of different authorization and access privileges Each group is associated with one of three security levels e noAuthNoPriv e authNoPriv e authPriv Read and or write access to management objects MIBs for each group is controlled by associating a MIB view to a group for read and write access separately By default the access point has two groups e RO A read only group with no authentication and no data encryption No security is provided by this group By default users of this group will have read access to the default all MIB view which can be modifie
198. selected from the Captive Portal Groups menu Click the Configuration gt Captive Portal gt Local Groups tab to access the page which the following figure shows Figure 54 CP Local Groups Local Groups Captive Portal Groups Create v Captive Portal Group Parameters Group Name 1 32 characters The following table describes the fields on the CP Local Groups page that you use to create a CP local group Table 61 Captive Portal Local Group Configuration ee aes Captive Portal The menu includes all CP groups that exist on the Groups switch To create a new group select Create To delete a CP group select the group name Group Name This field is available only if the option selected from the Captive Portal Group menu is Create Specify a name for the local user Delete Group This field is available only if the option selected from the Captive Portal Group menu is a user created CP group To delete the selected group select the check box and click Save 97 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Local Users You can configure a captive portal instance to accommodate both guest users and authorized users Guest users do not have assigned user names and passwords Authorized users provide a valid user name and password that must first be validated against a local database or RADIUS server Authorized users are typically assigned to a CP instance that is associated
199. sk_length formats are supported Individual hosts can be provided for this i e IP address or Hostname For example if you enter a range of 192 168 1 0 24 this specifies a subnetwork with address 192 168 1 0 and a subnet mask of 255 255 255 0 The address range is used to specify the subnet of the designated NMS Only machines with IP addresses in this range are permitted to execute get and set requests on the managed device Given the example above the machines with addresses from 192 168 1 1 through 192 168 1 254 can execute SNMP commands on the device The address identified by suffix 0 in a subnetwork range is always reserved for the subnet address and the address identified by 255 in the range is always reserved for the broadcast address Asanotherexample ifyouenterarangeof10 10 1 128 25 machines with IP addresses from 10 10 1 129 through 10 10 1 254 can execute SNMP requests on managed devices In this example 10 10 1 128 is the network address and 10 10 1 255 is the broadcast address 126 addresses would be designated NMS IPv6 Specify the IPv6 DNS hostname or subnet of the Address Name machines that can execute get and set requests to the managed devices Section 3 Configuring the Access Point Trap Community Enter the global community string associated with SNMP traps The valid range is 1 256 characters Traps sent from the device will provide this string as a community name The community name can be in any alphanum
200. ss Maps Service Type You can specify one type of service to use in matching packets to class criteria IP DSCP To use IP DSCP as a match criterion select the check box and select a DSCP value keyword or enter a DSCP Select from List Select from a list of DSCP types Match to Value Enter a DSCP Value to match 0 63 IP Precedence Select this field to match the packet s IP Precedence value to the class criteria IP Precedence value The IP Precedence range is 0 7 IP TOS Bits Select this field and enter a value to use the packet s Type of Service bits in the IP header as match criteria The TOS bit value ranges between 00 FF The high order three bits represent the IP precedence value The high order six bits represent the IP Differentiated Services Code Point DSCP value Section 3 Configuring the Access Point IP TOS Mask Enter an IP TOS mask value to perform a boolean AND with the TOS field in the header of the packet and compared against the TOS entered for this rule The TOS Mask can be used to compare specific bits Precedence Type of Service from the TOS field in the IP header of a packet against the TOS value entered for this rule 00 FF Delete Class Map Check to delete the class map selected in the Class Map Name menu The class map cannot be deleted if it is already attached to a policy To delete a Class Map select the Delete Class Map option and click Save Policy Map Use the Policy Map page to creat
201. such as system time and amount of data transmitted and received RADIUS IP Specify whether the RADIUS IP addresses are IPv4 or IPv6 Network RADIUS server addresses RADIUS IP The IPv4 or IPv6 address for the primary RADIUS server for this VAP The IPv4 address should be in a form similar tO XXX XXX XXX XXX 192 0 2 10 The IPv6 address should be in a form similar to XXXX XXXX XXXX XXXX XXXX XXXX XXXX Xxxx 2001 DB8 CAD5 7D91 When the first wireless client tries to authenticate with a VAP the access point sends an authentication request to the primary server If the primary server responds to the authentication request the access point continues to use this RADIUS server as the primary server and authentication requests are sent to the address you specify RADIUS Backup Up to three IPv4 or IPv6 backup RADIUS server addresses If authentication fails with the primary server each configured backup server is tried in sequence RADIUS Current Specify which RADIUS server to use to authenticate clients primary Use the RADIUS server with the IP address configured in the RADIUS IP field backupone Use the RADIUS server with the IP address configured in the RADIUS Backup IP 1 field backuptwo Use the RADIUS server with the IP address configured in the RADIUS Backup IP 2 field backupthree Use the RADIUS server with the IP address configured in the RADIUS Backup IP 3 field Section 3 Configuring the Access Point
202. supplicant user name and password by using the Web interface click the Configuration gt Security gt 802 1X Supplicant tab and configure the fields shown in Table 44 Figure 36 802 1X Supplicant 802 1X Supplicant SUPPLICANT CONFIGURATION 802 1X Supplicant Enabled Disabled EAP Method Username Range 1 64 characters Password Range 1 64 characters Certificate File Present no Certificate Expiration Date Not Present Browse to the location where your certificate file is stored and click the Upload button To upload from a TFTP server click the TFTP radio button and enter the TFTP server information Upload Method HTTP HTTPS TFTP Filename Table 44 802 1X Supplicant Authentication ee eee Supplicant Configuration 802 1X Click Enabled to enable the Administrative status of the Supplicant 802 1X Supplicant Click Disabled to disable the Administrative status of the 802 1X Supplicant Select the algorithm to be used for encrypting authentication user names and passwords The options are as follows e MD5 A hash function defined in RFC 3748 that provides basic security PEAP Protected Extensible Authentication Protocol which provides a higher level of security than MD5 by encapsulating it within a TLS tunnel TLS Transport Layer Security as defined in RFC 5216 an open standard that provides a high level of security Enter the MD5 user name for the AP to use when res
203. t Software User Manual Section 3 Configuring the Access Point ACL Type Down Select the type of ACL to apply to traffic in the outbound down direction which can be one of the following IPv4 The ACL examines IPv4 packets for matches to ACL rules IPv6 The ACL examines IPv6 packets for matches to ACL rules MAC The ACL examines layer 2 frames for matches to ACL rules ACL Name Select the name of the ACL applied to traffic in the Down outbound down direction After switching the packet or frame to the outbound interface the ACL s rules are checked for a match The packet or frame is transmitted if it is permitted and discarded if it is denied ACL Type Up Select the type of ACL to apply to traffic in the inbound up direction which can be one of the following IPv4 The ACL examines IPv4 packets for matches to ACL rules IPv6 The ACL examines IPv6 packets for matches to ACL rules MAC The ACL examines Layer 2 frames for matches to ACL rules ACL Name Up Select the name of the ACL applied to traffic entering the AP in the inbound up direction When a packet or frame is received by the AP the ACL s rules are checked for a match The packet or frame is processed if it is permitted and discarded if it is denied DiffServ Policy Select the name of the DiffServ policy applied to traffic Down from the AP in the outbound down direction DiffServ Policy Select the name of the DiffServ policy applied to traffic U
204. ted client To do this the AP sends data packets to clients every few seconds when no other traffic is passing This allows the AP to The number of bytes received from the wireless client detect when a client goes out of range even during periods when no normal traffic is exchanged The client connection drops off the list within 300 seconds Drop Packets The number of packets that were dropped after being if these data packets are not acknowledged even if no disassociation message received is received Drop Bytes The number of bytes that were dropped after being received TS Violate The number of packets sent from a wireless client to the Packets AP in excess of its active TS uplink bandwidth or for an access category requiring admission control to which the wireless client has not been admitted 14 LAPAC1750PRO Access Point Software User Manual Section 2 Viewing Access Point System Status TSPEC Client Associations The TSPEC Client Association Status and Statistics page provides information about the TSPEC client data transmitted and received by this access point Table 10 shows voice and video packets transmitted and received by the association along with status information The page shows a real time display of transmit and receive statistics for the TSPEC clients All transmit and receive statistics shown are totals since the client association started A TSPEC is a traffic specification that is sent from a QoS cap
205. ter then only radio 1 on the dual radio AP is configured with the cluster configuration Radio 2 on the AP remains as it was prior to joining the cluster However if the cluster already has at least one dual radio AP then the second radio of the AP joining the cluster is configured with the cluster settings Viewing and Configuring Cluster Members The Access Points tab allows you to start or stop clustering on an AP view the cluster members and configure the location and cluster name for a cluster member From the Configuration gt Cluster gt Access Points page you can also click the IP address of each cluster member to navigate to configuration settings and data on an access point in the cluster To view information about cluster members and to configure the location and cluster of an individual member click the Configuration gt Cluster gt Access Points tab Figure 58 Cluster Information and Member Configuration Access Points Status Clustering is online Clustered ry Location MAC Address IP Address not set B4 75 0E 1A EB 00 192 168 20 120 Fa Stop Clustering Clustering Options Location Cluster Name default Clustering IP Version pe Ps If clustering is currently disabled on the AP the Start Clustering button is visible If clustering is enabled the Stop Clustering button is visible You can edit the clustering option information when clustering is disabled The following table describes the configura
206. terfaces include the 802 11 header e 802 3 packets received and transmitted on the Ethernet interface e 802 3 packets received and transmitted on the internal logical interfaces such as VAPs and WDS interfaces Click Maintenance gt Diagnostics gt Packet Capture to display the Packet Capture Configuration and Settings page From this page you can e View the current packet capture status e Configure packet capture parameters e Configure packet file capture e Configure a remote capture port e Download a packet capture file Figure 65 Packet Capture Configuration Packet Capture PACKET CAPTURE STATUS Current Capture Status Stopped due to administrative action Packet Capture Time 00 00 00 Packet Capture File Size 0 KB Stop Capture PACKET CAPTURE CONFIGURATION Capture Beacons Enabled Disabled Promiscuous Capture Enabled Disabled Client Filter Enable Client Filter MAC Address 00 00 00 00 00 00 PACKET FILE CAPTURE Capture Interface radio1 Capture Duration 60 Seconds Range 10 to 3600 Max Capture File Size 1024 KB Range 64 to 4096 Sco REMOT m PACKET CAPTURE Remote Capture Port 2002 EEN StartRemote capture Range 1025 65530 Default 2002 PACKET CAPTURE FILE DOWNLOAD HTTP HTTPS TFIP File download using HTTP S may be done by clicking the Download button To use TFTP download check the box that indicates TFTP download TFTP Server File
207. the new certificate is accepted on the browser SSL Certificate File Status Certificate File Indicates ifthe HTTP SSL Certificate file is present Range Present is either Yes or No Certificate Indicates when the HTTP SSL Certificate file will expire Expiration The range is a valid date Date Certificate The Common Name attribute of the server certificate Issuer The range is a valid string For example CN self Common signed OU Linksys LLC Name L Irvine ST California C US To Get the Current HTTP SSL Certificate Download Select either HTTP HTTPS or TFTP option Click Method Download to save the current HTTP SSL Certificate as a backup file to your PC HTTP SSL This field is available when the selected download Certificate File method is TFTP Enter the filename of the certificate The filename is a 256 byte alphanumeric string The default is Mini_httpd pem Note File name should not contain spaces lt gt fi Bit 812 My and successive The IPv4 or IPv6 address of the TFTP server where the file will be downloaded The default is 0 0 0 0 Section 3 Configuring the Access Point Upload SSL Certificate Upload Select the upload method Method e HTTP HTTPS Upload the file by using a Web browser e TFTP Upload the file from a TFTP server HTTP SSL If the selected upload method is HTTP click the Browse Certificate File button to browse to the file to upload to the AP If th
208. the scheduler The range is up or ee eer a down The default is down Set Schedule Daily r sii Weekday Provides additional information about the status The Weeki i E an reason can be one or more of the following stat time gt engtime 0 0 IsActive Operational status is up Action Profile Name Rule 1D Day of the Week Start Time End Time ConfigDown Operational status is down because lobal configuration is disabled 2 TimeNotSet Operational status is down because the AP time has not been set either manually or by specifying an NTP server to use ManagedMode Operational status is down because the AP is in managed mode Scheduler The scheduler profile defines the list of profile names that Profile can be associated to the VAP or Radio configuration Rules are associated with a named scheduler profile You can define up to 16 scheduler profile names By default no profiles are created The profile name can be up to 32 alphanumeric characters Click Add to add the profile name Rule Each scheduler profile may have up to 16 periodic rules Configuration This table includes the settings you use to configure periodic rules Select Profile Select the profile name from the menu Set Schedule The day of the week Range is Daily Weekday Monday to Friday Weekend Saturday and Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sunday The default is Daily LAPAC17
209. the settings Scheduler Association For a scheduler profile to take effect you must associate it with at least one radio or VAP interface To associate the Scheduler profiles select the Scheduler Association tab in the Manage section By default there are no scheduler profiles created so no profile is associated to any radio or VAP The scheduler profile needs to be explicitly associated to a radio or VAP configuration Only one scheduler profile can be associated to any radio or VAP configuration however a single profile can be associated to multiple radios or VAPs If the scheduler profile associated with a VAP or radio is deleted then the associated profile to the VAP or radio is removed implicitly If the radio is operationally disabled then all the VAPs associated to that radio are also operationally disabled irrespective of the VAP configuration Figure 29 Scheduler Association Scheduler Association Interface SSID Scheduler Profile Interface Operational Status Radio 1 down Radio 2 bid up Radio 1 VAPO LinksysSMB24G L up Radio 1 VAP1 Virtual Access Point 1 Radio 1 VAP2 Virtual Access Point 2 Radio 1 VAP3 Virtual Access Point 3 Radio 1 VAP4 Virtual Access Point 4 Radio 1 VAPS Virtual Access Point 5 Radio 1 VAP6 Virtual Access Point 6 J 4 aWallafadlalls e 5 Radio 1 VAP7 Virtual Access Point 7 Radio 2 VAPO LinksysSMBSG E up Radio 2 VAP1 Virtual Access Point 1 Radio 2 VAP2 Virtua
210. thin that policy is found DiffServ is supported for IPv4 and IPv6 packets Use the Class Map page to add a new Diffserv class name or to rename or delete an existing class and define the criteria to associate with the DiffServ class To configure a DiffServ Class Map click the Configuration gt Qos and Access Control gt Class Map tab NOTE The Class Map page displays the Match Criteria Configuration fields only if a class map has been created To create a class map enter a name in the Class Map Name field and click Add Class Map Class Map Class Map Configuration Class Map Name Match Layer 3 Protocol Add Class Map Match Criteria Configuration Class Map Name Match Every Protocol Source IP Address Source Port Source MAC Address Destination IP Address Destination Port Destination MAC Address EtherType Class Of Service VLAN ID Service Type IP DSCP IP Precedence IP TOS Bits Figure 39 QoS DiffServ Class Map 1 31 characters Pav CLMap1 v Delete Class Map Select From List P 7 O00000 Select From List 7 00062001 2000 30 Select From List al Select From List 0 7 0 4095 Select From List M Jo 7 00 FF Match to Value Source IP Mask Match to Port Source MAC Mask 0 255 00100100 0K 0 65535 Destination IP Mask 90012001 200 00 Match to Port 0 65535 Destination
211. tion and status information available on the Cluster Access Points page 101 LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point Table 66 Access Points in the Cluster ae If the status field is visible then the AP is enabled for clustering If clustering is not enabled then the AP is operating in stand alone mode and none of the information in this table is visible To disable clustering on the AP click Stop Clustering Location Description of where the access point is physically located MAC Address Media Access Control MAC address of the access point The address shown here is the MAC address for the bridge br0 This is the address by which the AP is known externally to other networks IP Address Specifies the IP address for the access point Each IP address is a link to the Administration Web pages for that access point You can use the links to navigate to the Administration Web pages for a specific access point This is useful for viewing data on a specific access point to make sure a cluster member is picking up cluster configuration changes to configure advanced settings on a particular access point or to switch a standalone access point to cluster mode The following table describes the cluster information to configure for an individual member The clustering options are read only when clustering is enabled To configure the clustering options you must stop clusterin
212. tive port numbers starting with the configured port for the packet capture sessions If a firewall is installed between the Wireshark PC and the AP these ports must be allowed to pass through the firewall The firewall must also be configured to allow the Wireshark PC to initiate TCP connection to the AP In order to configure Wireshark to use the AP as the source for captured packets you must specify the remote interface in the Capture Options menu For example to capture packets on an AP with IP address 192 168 1 252 on radio 1 using the default IP port specify the following interface rpcap 192 168 1 252 radio1 To capture packets on the Ethernet interface of the AP and VAPO on radio 1 using IP port 58000 start two Wireshark sessions and specify the following interfaces rpcap 192 168 1 252 58000 ethO rpcap 192 168 1 252 58000 wlanO When you are capturing traffic on the radio interface you can disable beacon capture but other 802 11 control frames are still sent to Wireshark You can set up a display filter to show only the following e Data frames in the trace e Traffic on specific BSSIDs e Traffic between two clients Some examples of useful display filters are e Exclude beacons and ACK RTS CTS frames wlan fc type_subtype 8 wlan fc type 1 e Data frames only wlan fc type 2 e Traffic on a specific BSSID wlan bssid 00 02 bc 00 17 d0 All traffic to and from a specific client wlan add
213. type of ACL that is applied to traffic in the inbound client to AP direction which can be one of the following IPv4 The ACL examines IPv4 packets for matches to ACL rules IPv6 The ACL examines IPv6 packets for matches to ACL rules MAC The ACL examines layer 2 frames for matches to ACL rules Shows the name of the ACL applied to traffic entering the AP in the inbound direction When a packet or frame is received by the AP the ACL s rules are checked for a match The packet or frame is processed if it is permitted and discarded if it is denied Shows the type of ACL to apply to traffic in the outbound AP to client direction which can be one of the following IPv4 The ACL examines IPv4 packets for matches to ACL rules IPv6 The ACL examines IPv6 packets for matches to ACL rules MAC The ACL examines layer 2 frames for matches to ACL rules Shows the name of the ACL applied to traffic in the outbound direction After switching the packet or frame to the outbound interface the ACL s rules are checked for a match The packet or frame is transmitted if it is permitted and discarded if it is denied Shows the name of the DiffServ policy applied to traffic sent to the AP in the inbound client to AP direction Shows the name of the DiffServ policy applied to traffic from the AP in the outbound AP to client direction SNMP This section describes how to configure the SNMP settings on the access point and contains th
214. ua aaa 16 TSFECAP Statistics as ae Gwe SG Sew eae Be ee Se 17 Email Alert Status c6syseav aca en ad aan eanv ewes 18 SYtEM LOG esee o ee Eaa ore RR wrk a 18 Section 3 Configuring the Access Point 19 Administrati N ssf 3 4 5 3a6o4 sepete riere treis de 19 LAN erea enen Bee RAA a EO ae NEE aE a 29 Wireless ciatti RHEE eC kine oe oe ma aiei e aes 33 LAPAC1750PRO Access Point Software User Manual Section 1 Getting Started Section 1 Getting Started The LAPAC1750PRO Access Point provides continuous high speed access between wireless devices and Ethernet devices It is an advanced standards based solution for wireless networking in businesses of any size The access point AP enables wireless local area network WLAN deployment while providing state of the art wireless networking features The access point works in Standalone Mode which means it is an individual access point in your network You manage the device through a Web based user interface UI or SNMP Simple Network Management Protocol This document describes how to perform the setup management and maintenance of the access point in Standalone Mode Before you power on a new access point review the following sections to check required hardware and software components client configurations and compatibility issues Make sure you have everything you need for a successful launch and test of your new or extended wireless network This section contains
215. w power mode have data buffered on the AP awaiting pick up The DTIM period you specify indicates how often the clients served by this AP should check for buffered data still on the AP awaiting pickup The measurement is in beacons For example if you set this field to 1 clients will check for buffered data on the AP at every beacon If you set this field to 10 clients will check on every 10th beacon 37 LAPAC1750PRO Access Point Software User Manual Fragmentation Specify a number between 256 and 2 346 to set the Threshold frame size threshold in bytes The fragmentation threshold is a way of limiting the size of packets frames transmitted over the network If a packet exceeds the fragmentation threshold you set the fragmentation function is activated and the packet is sent as multiple 802 11 frames If the packet being transmitted is equal to or less than the threshold fragmentation is not used Setting the threshold to the largest value 2 346 bytes effectively disables fragmentation Fragmentation plays no role when Aggregation is enabled Fragmentation involves more overhead both because of the extra work of dividing up and reassembling of frames it requires and because it increases message traffic on the network However fragmentation can help improve network performance and reliability if properly configured Sending smaller frames by using lower fragmentation threshold might help with some interfe
216. wed is reached The TXOP Limit is a station EDCA parameter and only applies to traffic flowing from the client station to the AP The Transmission Opportunity TXOP is an interval of time in milliseconds when a WME client station has the right to initiate transmissions onto the wireless medium WM towards the Unified Access Point The TXOP Limit maximum value is 65535 Select On to specify that the AP should not acknowledge frames with QosNoAck as the service class value Select On to enable Automatic Power Save Delivery APSD which is a power management method APSD is recommended if VoIP phones access the network through the AP After you configure the QoS settings you must click Save to apply the changes and save the changes to startup configuration file Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low Security You can configure up to four global IPv4 or IPv6 RADIUS servers One of the servers always acts as a primary while the others act as backup servers The network type IPv4 or IPv6 and accounting mode are common across all configured RADIUS servers You can configure each VAP to use the global RADIUS server settings which is the default or you can configure a per VAP RADIUS server set You can also configure separate RADIUS server settings for
217. with a different VAP than guest users Use the Local Users page to configure up to 128 authorized users in the local database Click the Configuration gt Captive Portal gt Local Users tab to access the page which the following figure shows Figure 55 CP Local Users Local Users Captive Portal Users Create v Captive Portal User Parameters User Name 1 32 characters The following table describes the fields on the CP Local Users page that you use to create a CP local user Table 62 Creating Captive Portal Local Users Field Beseription Captive Portal Users To create a new user select Create UserName Specify a name for the local user After you create a user or select an existing user from the Captive Portal Users menu additional fields appear on the screen Local Users Captive Portal Users User v Captive Portal User Parameters User Password 8 64 alphanumeric amp special characters Away Time 0 Min Range 0 1440 Default 0 Group Name Max Bandwidth Upstream 0 Mbps Range 0 300 Default 0 Max Bandwidth Downstream 0 Mbps Range 0 300 Default 0 Delete User The following table describes the fields on the CP Local Users page that you use to configure settings for an existing CP local user Table 63 Creating Captive Portal Local Users w 2 Captive Portal Users Select the name of the user with the settings to configure User Password Enter the user s password fr
218. y admission control ACM for the voice access category The options are e On A station is required to send a TSPEC request for bandwidth to the AP before sending or receiving a voice traffic stream The AP responds with the result of the request which includes the allotted medium time if the TSPEC was admitted Off A station can send and receive voice priority traffic without requiring an admitted TSPEC the AP ignores voice TSPEC requests from client stations Specify an upper limit on the amount of traffic the AP attempts to transmit on the wireless medium using a voice admission control to gain access Regulates mandatory admission control for the video access category The options are e On A station is required to send a TSPEC request for bandwidth to the AP before sending or receiving a video traffic stream The AP responds with the result of the request which includes the allotted medium time if the TSPEC was admitted Off A station can send and receive video priority traffic without requiring an admitted TSPEC the AP ignores video TSPEC requests from client stations LAPAC1750PRO Access Point Software User Manual Section 3 Configuring the Access Point TSPEC Video Specify an upper limit on the amount of traffic the AP ACM Limit attempts to transmit on the wireless medium using a video admission control to gain access TSPEC AP Specify the amount of time for an AP to detect a downlink Inactivity TS as
219. ymbols such as and NOTE After you configure the WDS settings you must click Save to apply the changes and to save the settings Changing some settings might cause the AP to stop and restart system processes If this happens wireless clients will temporarily lose connectivity We recommend that you change AP settings when WLAN traffic is low NOTE Partner WDS AP in the remote network retains its management IP address acquired from a DHCP server connected to the WDS AP in the main network even if the WDS link is broken The IP address is released when the WDS interface is brought administratively down Workgroup Bridges The Workgroup Bridge feature enables the AP to extend the accessibility of a remote network In Workgroup Bridge mode the access point acts as a wireless station STA on the wireless LAN It can bridge traffic between a remote wired network or associated wireless clients and the wireless LAN that is connected using the Workgroup Bridge mode The Workgroup Bridge feature enables support for STA mode and AP mode operation simultaneously The access point can operate in one BSS as an STA device while operating on another BSS as an access point When Workgroup Bridge mode is enabled then the access point supports only one BSS for wireless clients that associate with it and another BSS to which the access point associates as a wireless client It is recommended that Workgroup Bridge mode be used only when the WDS

User Guide PDF

Contents

Download Pdf Manuals

Related Search

Related Contents